From c2f55492bd269a2b128d2972f1613a43e1b87e64 Mon Sep 17 00:00:00 2001 From: Shannon Kularathna Date: Fri, 4 Jun 2021 18:40:39 +0000 Subject: [PATCH 001/104] Add information to API evictions --- .../scheduling-eviction/api-eviction.md | 57 +++++++++++++++++-- 1 file changed, 52 insertions(+), 5 deletions(-) diff --git a/content/en/docs/concepts/scheduling-eviction/api-eviction.md b/content/en/docs/concepts/scheduling-eviction/api-eviction.md index e7f1942df2..d51821557a 100644 --- a/content/en/docs/concepts/scheduling-eviction/api-eviction.md +++ b/content/en/docs/concepts/scheduling-eviction/api-eviction.md @@ -6,14 +6,61 @@ weight: 70 {{< glossary_definition term_id="api-eviction" length="short" >}}
-You can request eviction by directly calling the Eviction API -using a client of the kube-apiserver, like the `kubectl drain` command. -This creates an `Eviction` object, which causes the API server to terminate the Pod. +You can request eviction by calling the Eviction API directly, or programmatically +using a client of the kube-apiserver, like the `kubectl drain` command. This +creates an `Eviction` object, which causes the API server to terminate the Pod. API-initiated evictions respect your configured [`PodDisruptionBudgets`](/docs/tasks/run-application/configure-pdb/) and [`terminationGracePeriodSeconds`](/docs/concepts/workloads/pods/pod-lifecycle#pod-termination). +Using the API to create an Eviction object for a Pod is like performing a +policy-controlled DELETE operation on the Pod. + +## Calling the Eviction API + +You can use a [Kubernetes language client](/docs/tasks/administer-cluster/access-cluster-api/#programmatic-access-to-the-api) +to access the Kubernetes API and create an `Eviction` object. To do this, you +POST the attempted operation. + +Alternatively, you can attempt an eviction operation by accessing the API using +`curl` or `wget`. + +## How API-initiated eviction works + +When you attempt to create an `Eviction` object, the API responds in one of the +following ways: + +* `200 OK`: the eviction is allowed and the Pod is deleted, similar to sending a + `DELETE` request to the Pod URL. +* `429 Too Many Requests`: the eviction is not currently allowed because of the + configured PodDisruptionBudget. You may be able to attempt the eviction again + later. +* `500 Internal Server Error`: the eviction is not allowed because there is a + misconfiguration, like if multiple PodDisruptionBudgets reference the same Pod. + +If the Pod you want to evict doesn't have a PodDisruptionBudget, the server always +returns `200 OK` and allows the eviction. + +[[Need more information about the eviction object. Once it's created, what happens +to cause the Pod to shut down? What control plane components work to get the job done?]] + +## Troubleshooting stuck evictions + +In some cases, your applications may enter a broken state, where the Eviction +API will only return `429` or `500` responses until you intervene. This can +happen if, for example, a ReplicaSet creates pods for your application but new +pods do not enter a `Ready` state. You may also notice this behavior in cases +where the last evicted Pod had a long termination grace period. + +If you notice stuck evictions, try one of the following solutions: + +* Abort or pause the automated operation causing the issue. Investigate the stuck + application before you restart the operation. +* Directly delete the Pod from your cluster control plane instead of using the + Eviction API. + ## {{% heading "whatsnext" %}} -* Learn about [Node-pressure Eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/) -* Learn about [Pod Priority and Preemption](/docs/concepts/scheduling-eviction/pod-priority-preemption/) +* Learn how to protect your applications with a [Pod Disruption Budget](/docs/tasks/run-application/configure-pdb/). +* Learn about [Node-pressure Eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/). +* Learn about [Pod Priority and Preemption](/docs/concepts/scheduling-eviction/pod-priority-preemption/). From d6345808f45b8634d890c8bba2937fac3628b4a5 Mon Sep 17 00:00:00 2001 From: Shannon Kularathna Date: Fri, 4 Jun 2021 18:40:39 +0000 Subject: [PATCH 002/104] Add information to API evictions --- .../scheduling-eviction/api-eviction.md | 88 ++++++++++++++---- .../administer-cluster/safely-drain-node.md | 91 +------------------ 2 files changed, 75 insertions(+), 104 deletions(-) diff --git a/content/en/docs/concepts/scheduling-eviction/api-eviction.md b/content/en/docs/concepts/scheduling-eviction/api-eviction.md index d51821557a..b4e92c40bf 100644 --- a/content/en/docs/concepts/scheduling-eviction/api-eviction.md +++ b/content/en/docs/concepts/scheduling-eviction/api-eviction.md @@ -7,42 +7,98 @@ weight: 70 {{< glossary_definition term_id="api-eviction" length="short" >}}
You can request eviction by calling the Eviction API directly, or programmatically -using a client of the kube-apiserver, like the `kubectl drain` command. This +using a client of the {{}}, like the `kubectl drain` command. This creates an `Eviction` object, which causes the API server to terminate the Pod. API-initiated evictions respect your configured [`PodDisruptionBudgets`](/docs/tasks/run-application/configure-pdb/) and [`terminationGracePeriodSeconds`](/docs/concepts/workloads/pods/pod-lifecycle#pod-termination). Using the API to create an Eviction object for a Pod is like performing a -policy-controlled DELETE operation on the Pod. +policy-controlled [`DELETE` operation](/docs/reference/kubernetes-api/workload-resources/pod-v1/#delete-delete-a-pod) +on the Pod. ## Calling the Eviction API You can use a [Kubernetes language client](/docs/tasks/administer-cluster/access-cluster-api/#programmatic-access-to-the-api) to access the Kubernetes API and create an `Eviction` object. To do this, you -POST the attempted operation. +POST the attempted operation, similar to the following example: + +{{< tabs name="Eviction_example" >}} +{{% tab name="policy/v1" %}} +{{< note >}} +`policy/v1` Eviction is available in v1.22+. Use `policy/v1beta1` with prior releases. +{{< /note >}} + +```json +{ + "apiVersion": "policy/v1", + "kind": "Eviction", + "metadata": { + "name": "quux", + "namespace": "default" + } +} +``` +{{% /tab %}} +{{% tab name="policy/v1beta1" %}} +{{< note >}} +Deprecated in v1.22 in favor of `policy/v1` +{{< /note >}} + +```json +{ + "apiVersion": "policy/v1beta1", + "kind": "Eviction", + "metadata": { + "name": "quux", + "namespace": "default" + } +} +``` +{{% /tab %}} +{{< /tabs >}} Alternatively, you can attempt an eviction operation by accessing the API using -`curl` or `wget`. +`curl` or `wget`, similar to the following example: + +```bash +curl -v -H 'Content-type: application/json' https://your-cluster-api-endpoint.example/api/v1/namespaces/default/pods/quux/eviction -d @eviction.json +``` ## How API-initiated eviction works -When you attempt to create an `Eviction` object, the API responds in one of the -following ways: +When you request an eviction using the API, the API server performs admission +checks and responds in one of the following ways: -* `200 OK`: the eviction is allowed and the Pod is deleted, similar to sending a - `DELETE` request to the Pod URL. +* `200 OK`: the eviction is allowed, the `Eviction` subresource is created, and + the Pod is deleted, similar to sending a `DELETE` request to the Pod URL. * `429 Too Many Requests`: the eviction is not currently allowed because of the - configured PodDisruptionBudget. You may be able to attempt the eviction again - later. + configured {{}}. + You may be able to attempt the eviction again later. You might also see this + response because of API rate limiting. * `500 Internal Server Error`: the eviction is not allowed because there is a misconfiguration, like if multiple PodDisruptionBudgets reference the same Pod. -If the Pod you want to evict doesn't have a PodDisruptionBudget, the server always -returns `200 OK` and allows the eviction. +If the Pod you want to evict isn't part of a workload that has a +PodDisruptionBudget, the API server always returns `200 OK` and allows the +eviction. -[[Need more information about the eviction object. Once it's created, what happens -to cause the Pod to shut down? What control plane components work to get the job done?]] +If the API server allows the eviction, the Pod is deleted as follows: + +1. The `Pod` resource in the API server is updated with a deletion timestamp, + after which the API server considers the `Pod` resource to be terminated. The + `Pod` resource is also marked with the configured grace period. +1. The {{}} on the node where the local Pod is running notices that the `Pod` + resource is marked for termination and starts to gracefully shut down the + local Pod. +1. While the kubelet is shutting the Pod down, the control plane removes the Pod + from {{}} and + {{}} + objects. As a result, controllers no longer consider the Pod as a valid object. +1. After the grace period for the Pod expires, the kubelet forcefully terminates + the local Pod. +1. The kubelet tells the API server to remove the `Pod` resource. +1. The API server deletes the `Pod` resource. ## Troubleshooting stuck evictions @@ -56,8 +112,8 @@ If you notice stuck evictions, try one of the following solutions: * Abort or pause the automated operation causing the issue. Investigate the stuck application before you restart the operation. -* Directly delete the Pod from your cluster control plane instead of using the - Eviction API. +* Wait a while, then directly delete the Pod from your cluster control plane + instead of using the Eviction API. ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/tasks/administer-cluster/safely-drain-node.md b/content/en/docs/tasks/administer-cluster/safely-drain-node.md index 04c908c592..74d1694b08 100644 --- a/content/en/docs/tasks/administer-cluster/safely-drain-node.md +++ b/content/en/docs/tasks/administer-cluster/safely-drain-node.md @@ -23,8 +23,6 @@ This task also assumes that you have met the following prerequisites: and have [configured PodDisruptionBudgets](/docs/tasks/run-application/configure-pdb/) for applications that need them. - - ## (Optional) Configure a disruption budget {#configure-poddisruptionbudget} @@ -100,95 +98,12 @@ replicas to fall below the specified budget are blocked. If you prefer not to use [kubectl drain](/docs/reference/generated/kubectl/kubectl-commands/#drain) (such as to avoid calling to an external command, or to get finer control over the pod -eviction process), you can also programmatically cause evictions using the eviction API. +eviction process), you can also programmatically cause evictions using the +eviction API. -You should first be familiar with using [Kubernetes language clients](/docs/tasks/administer-cluster/access-cluster-api/#programmatic-access-to-the-api) to access the API. - -The eviction subresource of a -Pod can be thought of as a kind of policy-controlled DELETE operation on the Pod -itself. To attempt an eviction (more precisely: to attempt to -*create* an Eviction), you POST an attempted operation. Here's an example: - -{{< tabs name="Eviction_example" >}} -{{% tab name="policy/v1" %}} -{{< note >}} -`policy/v1` Eviction is available in v1.22+. Use `policy/v1beta1` with prior releases. -{{< /note >}} - -```json -{ - "apiVersion": "policy/v1", - "kind": "Eviction", - "metadata": { - "name": "quux", - "namespace": "default" - } -} -``` -{{% /tab %}} -{{% tab name="policy/v1beta1" %}} -{{< note >}} -Deprecated in v1.22 in favor of `policy/v1` -{{< /note >}} - -```json -{ - "apiVersion": "policy/v1beta1", - "kind": "Eviction", - "metadata": { - "name": "quux", - "namespace": "default" - } -} -``` -{{% /tab %}} -{{< /tabs >}} - -You can attempt an eviction using `curl`: - -```bash -curl -v -H 'Content-type: application/json' https://your-cluster-api-endpoint.example/api/v1/namespaces/default/pods/quux/eviction -d @eviction.json -``` - -The API can respond in one of three ways: - -- If the eviction is granted, then the Pod is deleted as if you sent - a `DELETE` request to the Pod's URL and received back `200 OK`. -- If the current state of affairs wouldn't allow an eviction by the rules set - forth in the budget, you get back `429 Too Many Requests`. This is - typically used for generic rate limiting of *any* requests, but here we mean - that this request isn't allowed *right now* but it may be allowed later. -- If there is some kind of misconfiguration; for example multiple PodDisruptionBudgets - that refer the same Pod, you get a `500 Internal Server Error` response. - -For a given eviction request, there are two cases: - -- There is no budget that matches this pod. In this case, the server always - returns `200 OK`. -- There is at least one budget. In this case, any of the three above responses may - apply. - -## Stuck evictions - -In some cases, an application may reach a broken state, one where unless you intervene the -eviction API will never return anything other than 429 or 500. - -For example: this can happen if ReplicaSet is creating Pods for your application but -the replacement Pods do not become `Ready`. You can also see similar symptoms if the -last Pod evicted has a very long termination grace period. - -In this case, there are two potential solutions: - -- Abort or pause the automated operation. Investigate the reason for the stuck application, - and restart the automation. -- After a suitably long wait, `DELETE` the Pod from your cluster's control plane, instead - of using the eviction API. - -Kubernetes does not specify what the behavior should be in this case; it is up to the -application owners and cluster owners to establish an agreement on behavior in these cases. +For more information, see [API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/). ## {{% heading "whatsnext" %}} - * Follow steps to protect your application by [configuring a Pod Disruption Budget](/docs/tasks/run-application/configure-pdb/). From c6f301bd08c66981c1868a7cf87fc66787ab04b1 Mon Sep 17 00:00:00 2001 From: Benedikt Rollik Date: Thu, 21 Oct 2021 18:14:38 +0200 Subject: [PATCH 003/104] [de] Participating in SIG Docs --- .../de/docs/contribute/participate/_index.md | 98 ++++++++ .../contribute/participate/pr-wranglers.md | 81 +++++++ .../participate/roles-and-responsibilities.md | 227 ++++++++++++++++++ 3 files changed, 406 insertions(+) create mode 100644 content/de/docs/contribute/participate/_index.md create mode 100644 content/de/docs/contribute/participate/pr-wranglers.md create mode 100644 content/de/docs/contribute/participate/roles-and-responsibilities.md diff --git a/content/de/docs/contribute/participate/_index.md b/content/de/docs/contribute/participate/_index.md new file mode 100644 index 0000000000..23c801efce --- /dev/null +++ b/content/de/docs/contribute/participate/_index.md @@ -0,0 +1,98 @@ +--- +title: Bei SIG Docs mitmachen +content_type: concept +weight: 60 +card: + name: contribute + weight: 60 +--- + + + +Die SIG Docs ist eine der +[Special Interest Groups (Interessengruppen)](https://github.com/kubernetes/community/blob/master/sig-list.md) innerhalb des Kubernetes-Projekts, die sich auf das Schreiben, Aktualisieren und Pflegen der Dokumentation für Kubernetes als Ganzes konzentriert. Weitere Informationen über die SIG findest du unter SIG Docs im [Github Repository der Community](https://github.com/kubernetes/community/tree/master/sig-docs). + +SIG Docs begrüß,t Inhalte und Bewertungen von allen Mitwirkenden. Jeder kann einen +Pull Request (PR) eröffnen, und jeder ist willkommen, Fragen zum Inhalt zu stellen oder Kommentare +zu laufenden Pull Requests abzugeben. + +Du kannst dich ausserdem als [Member](/docs/contribute/participate/roles-and-responsibilities/#members), +[Reviewer](/docs/contribute/participate/roles-and-responsibilities/#reviewers), oder +[Approver](/docs/contribute/participate/roles-and-responsibilities/#approvers) beteiligen. +Diese Rollen erfordern einen erweiterten Zugriff und bringen bestimmte Verantwortlichkeiten für +Änderungen zu genehmigen und zu bestätigen. +Unter [community-membership](https://github.com/kubernetes/community/blob/master/community-membership.md) findest du weitere Informationen darüber, wie die Mitgliedschaft in der Kubernetes-Community funktioniert. + +Der Rest dieses Dokuments umreiß,t einige spezielle Vorgehensweisen dieser Rollen innerhalb von SIG Docs, die für die Pflege eines der öffentlichsten Aushängeschilder von Kubernetes verantwortlich ist - die Kubernetes-Website und die Dokumentation. + + +## SIG Docs-Vorsitzender + +Jede SIG, auch die SIG Docs, wählt ein oder mehrere SIG-Mitglieder, die als +Vorstand fungieren. Sie sind die Kontaktstellen zwischen der SIG Docs und anderen Teilen der +der Kubernetes-Organisation. Sie benötigen umfassende Kenntnisse über die Struktur +des Kubernetes-Projekts als Ganzes und wie SIG Docs darin arbeitet. Informationen zur [Führung](https://github.com/kubernetes/community/tree/master/sig-docs#leadership) und den aktuellen Vorsitzenden. +## SIG Docs-Teams und Automatisierung + +Die Automatisierung in SIG Docs stützt sich auf zwei verschiedene Mechanismen: +GitHub-Teams und OWNERS-Dateien. + +### GitHub Teams + +Es gibt zwei Kategorien von SIG Docs [Teams] (https://github.com/orgs/kubernetes/teams?query=sig-docs) auf GitHub: + +- `@sig-docs-{language}-owners` sind Genehmiger und Verantwortliche +- `@sig-docs-{language}-reviewers` sind Reviewer + +Jede Gruppe kann in GitHub-Kommentaren mit ihrem `@name` referenziert werden, um mit +mit allen Mitgliedern dieser Gruppe zu kommunizieren. + +Manchmal überschneiden sich Prow- und GitHub-Teams, ohne genau übereinzustimmen. Für +Zuordnung von Issues, Pull-Requests und zur Unterstützung von PR-Genehmigungen verwendet die +Automatisierung die Informationen aus den `OWNERS`-Dateien. + +### OWNERS Dateien und Front-Matter + +Das Kubernetes-Projekt verwendet ein Automatisierungstool namens prow für die Automatisierung im Zusammenhang mit GitHub-Problemen und Pull-Requests. +Das [Kubernetes-Website-Repository](https://github.com/kubernetes/website) verwendet zwei [prow-Plugins](https://github.com/kubernetes/test-infra/tree/master/prow/plugins): + +- blunderbuss +- approve + +Diese beiden Plugins verwenden die +[OWNERS](https://github.com/kubernetes/website/blob/main/OWNERS) und +[OWNERS_ALIASES](https://github.com/kubernetes/website/blob/main/OWNERS_ALIASES) +Dateien auf der obersten Ebene des GitHub-Repositorys `kubernetes/website`, um zu steuern +wie prow innerhalb des Repositorys arbeitet. + +Eine OWNERS-Datei enthält eine Liste von Personen, die SIG Docs-Reviewer und +Genehmiger sind. OWNERS-Dateien können auch in Unterverzeichnissen existieren und bestimmen, wer +Dateien in diesem Unterverzeichnis und seinen Unterverzeichnissen als Rezensent oder +Genemiger bestätigen darf. Weitere Informationen über OWNERS-Dateien im Allgemeinen findest du unter +[OWNERS](https://github.com/kubernetes/community/blob/master/contributors/guide/owners.md). + +Auß,erdem kann eine einzelne Markdown-Datei in ihrem Front-Matter (Vorspann) Reviewer und Genehmiger auflisten. +Entweder durch Auflistung einzelner GitHub-Benutzernamen oder GitHub-Gruppen. + +Die Kombination aus OWNERS-Dateien und Front-Matter in Markdown-Dateien bestimmt, welche Ratschläge PR-Eigentümer von automatisierten Systemen erhalten, und wen sie um eine technische und redaktionelle Überprüfung ihres PRs bitten sollen. +## So funktioniert das Zusammenführen + +Wenn ein Pull Request mit der Branch (Ast) zusammengeführt wird, in dem der Inhalt veröffentlicht werden soll, wird dieser Inhalt auf http://kubernetes.io veröffentlicht. Um sicherzustellen, dass die Qualität der veröffentlichten Inhalte hoch ist, beschränken wir das Zusammenführen von Pull Requests auf +SIG Docs Freigabeberechtigte. So funktioniert es: + +- Wenn eine Pull-Anfrage sowohl das `lgtm`- als auch das `approve`-Label hat, kein `hold`-Label hat, + und alle Tests bestanden sind, wird der Pull Request automatisch zusammengeführt. +- Mitglieder der Kubernetes-Organisation und SIG Docs-Genehmiger können Kommentare hinzufügen, um + Kommentare hinzufügen, um das automatische Zusammenführen eines Pull Requests zu verhindern (durch Hinzufügen eines `/hold`-Kommentars + kann ein vorheriger `/lgtm`-Kommentar zurückgehalten werden). +- Jedes Kubernetes-Mitglied kann das `lgtm`-Label hinzufügen, indem es einen `/lgtm`-Kommentar hinzufügt. +- Nur SIG Docs-Genehmiger können einen Pull Request zusammenführen indem sie einen `/approve` Kommentar hinzufügen. + Einige Genehmiger übernehmen auch weitere spezielle Rollen, wie zum Beispiel [PR Wrangler](/docs/contribute/participate/pr-wranglers/) oder [SIG Docs Vorsitzende](#sig-docs-chairperson). + +## {{% heading "whatsnext" %}} + +Weitere Informationen über die Mitarbeit an der Kubernetes-Dokumentation findest du unter: + +- [Neue Inhalte beisteuern](/docs/contribute/new-content/overview/) +- [Inhalte überprüfen](/docs/contribute/review/reviewing-prs) +- [Styleguide für die Dokumentation](/docs/contribute/style/) diff --git a/content/de/docs/contribute/participate/pr-wranglers.md b/content/de/docs/contribute/participate/pr-wranglers.md new file mode 100644 index 0000000000..f77c11037d --- /dev/null +++ b/content/de/docs/contribute/participate/pr-wranglers.md @@ -0,0 +1,81 @@ +--- +title: PR Wranglers +content_type: concept +weight: 20 +--- + + + +SIG Docs [approvers](/docs/contribute/participate/roles-and-responsibilities/#approvers) übernehmen einwöchige Schichten um die [Pull Requests](https://github.com/kubernetes/website/wiki/PR-Wranglers) des Repositories zu verwalten. + +Dieser Abschnitt behandelt die Aufgaben eines PR-Wranglers. Weitere Informationen über gute Reviews findest du unter [Überprüfen von Änderungen](/docs/contribute/review/). + + +## Aufgaben + +Tägliche Aufgaben in einer einwöchigen Schicht als PR Wrangler: + +- Sortiere und kennzeichne täglich eingehende Probleme. Siehe [Einstufung und Kategorisierung von Problemen](/docs/contribute/review/for-approvers/#triage-and-categorize-issues) für Richtlinien, wie SIG Docs Metadaten verwendet. +- Überprüfe [offene Pull Requests](https://github.com/kubernetes/website/pulls) auf Qualität und Einhaltung der [Style](/docs/contribute/style/style-guide/) und [Content](/docs/contribute/style/content-guide/) Leitfäden. + - Beginne mit den kleinsten PRs (`size/XS`) und ende mit den größten (`size/XXL`). Überprüfe so viele PRs, wie du kannst. +- Achte darauf, dass die PR-Autoren den [CLA](https://github.com/kubernetes/community/blob/master/CLA.md) unterschreiben. + - Verwende [dieses](https://github.com/zparnold/k8s-docs-pr-botherer) Skript, um diejenigen, die den CLA noch nicht unterschrieben haben, daran zu erinnern, dies zu tun. +- Gib Feedback zu den Änderungen und bitte die Mitglieder anderer SIGs um technische Überprüfung. + - Gib inline Vorschläge für die vorgeschlagenen inhaltlichen Änderungen in den PR ein. + - Wenn du den Inhalt überprüfen musst, kommentiere den PR und bitte um weitere Details. + - Vergebe das/die entsprechende(n) `sig/`-Label. + - Falls nötig, weise die Reviever aus dem Block `revievers:` im Vorspann der Datei zu. +- Benutze den Kommentar `/approve`, um einen PR zum Zusammenführen zu genehmigen. Führe den PR zusammen, wenn er inhaltlich und technisch einwandfrei ist. + - PRs sollten einen `/lgtm`-Kommentar von einem anderen Mitglied haben, bevor sie zusammengeführt werden. + - Erwäge, technisch korrekte Inhalte zu akzeptieren, die nicht den [Stilrichtlinien](/docs/contribute/style/style-guide/) entsprechen. Eröffne ein neues Thema mit dem Label `good first issue`, um Stilprobleme anzusprechen. + +### Hilfreiche GitHub-Anfragen für Wranglers + +Die folgenden Anfragen sind beim Wrangling hilfreich. +Wenn du diese Anfragen abgearbeitet hast, ist die verbleibende Liste der zu prüfenden PRs meist klein. +Diese Anfragen schließen Lokalisierungs-PRs aus. Alle Anfragen beziehen sich auf den Hauptast, außer der letzten. + +- [Kein CLA, nicht zusammenfürbar](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+label%3A%22cncf-cla%3A+no%22+-label%3A%22do-not-merge%2Fwork-in-progress%22+-label%3A%22do-not-merge%2Fhold%22+label%3Alanguage%2Fen): + Erinnere den Beitragenden daran, den CLA zu unterschreiben. Wenn sowohl der Bot als auch ein Mensch sie daran erinnert haben, schließe + den PR und erinnere die Autoren daran, dass sie ihn erneut öffnen können, nachdem sie den CLA unterschrieben haben. + **Überprüfe keine PRs, deren Autoren den CLA nicht unterschrieben haben!** +- [Benötigt LGTM](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+-label%3A%22cncf-cla%3A+kein%22+-label%3Ado-not-merge%2Fwork-in-progress+-label%3Ado-not-merge%2Fhold+label%3Alanguage%2Fen+-label%3Algtm): + Listet PRs auf, die ein LGTM von einem Mitglied benötigen. Wenn der PR eine technische Überprüfung benötigt, schalte einen der vom Bot vorgeschlagenen Reviewer ein. Wenn der Inhalt überarbeitet werden muss, füge Vorschläge und Feedback in-line hinzu. +- [Hat LGTM, braucht die Zustimmung von Docs](https://github.com/kubernetes/website/pulls?q=is%3Aopen+is%3Apr+-label%3Ado-not-merge%2Fwork-in-progress+-label%3Ado-not-merge%2Fhold+label%3Alanguage%2Fen+label%3Algtm+): + Listet PRs auf, die einen `/approve`-Kommentar benötigen, um zusammengeführt zu werden. +- [Quick Wins](https://github.com/kubernetes/website/pulls?utf8=%E2%9C%93&q=is%3Apr+is%3Aopen+base%3Amain+-label%3A%22do-not-merge%2Fwork-in-progress%22+-label%3A%22do-not-merge%2Fhold%22+label%3A%22cncf-cla%3A+yes%22+label%3A%22size%2FXS%22+label%3A%22language%2Fen%22): Listet PRs gegen den Hauptzweig auf, die nicht eindeutig blockiert sind. (ändere "XS" in der Größenbezeichnung, wenn du dich durch die PRs arbeitest [XS, S, M, L, XL, XXL]). +- [Nicht gegen den Hauptast](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+label%3Alanguage%2Fen+-base%3Amain): Wenn der PR gegen einen `dev-`Ast gerichtet ist, ist er für eine kommende Veröffentlichung. Weise diesen dem [Docs Release Manager](https://github.com/kubernetes/sig-release/tree/master/release-team#kubernetes-release-team-roles) zu: `/assign @`. Wenn der PR gegen einen alten Ast gerichtet ist, hilf dem Autor herauszufinden, ob er auf den richtigen Ast gerichtet ist. + +### Hilfreiche Prow-Befehle für Wranglers + +``` +# Englisches Label hinzufuegen +/language en + +# füge dem PR ein Squash-Label hinzu, wenn es mehr als einen Commit gibt +/label tide/merge-method-squash + +# einen PR ueber Prow neu betiteln (z.B. als Work-in-Progress [WIP]) +/retitle [WIP] +``` + +### Wann Pull Requests schließen + +Reviews und Genehmigungen sind ein Mittel, um unsere PR-Warteschlange kurz und aktuell zu halten. Ein weiteres Mittel ist das Schließen. + +PRs werden geschlossen, wenn: +- Der Autor den CLA seit zwei Wochen nicht unterschrieben hat. + + Die Autoren können den PR wieder öffnen, nachdem sie den CLA unterschrieben haben. Dies ist ein risikoarmer Weg, um sicherzustellen, dass nichts zusammengeführt wird, ohne dass ein CLA unterzeichnet wurde. + +- Der Autor hat seit Zwei oder mehr Wochen nicht auf Kommentare oder Feedback geantwortet. + +Hab keine Angst, Pull Requests zu schließen. Mitwirkende können sie leicht wieder öffnen und die laufenden Arbeiten fortsetzen. Oft ist es die Nachricht über die Schließung, die einen Autor dazu anspornt, seinen Beitrag wieder aufzunehmen und zu beenden. + +Um eine Pull-Anfrage zu schließen, hinterlasse einen `/close`-Kommentar zu dem PR. + +{{< note >}} + +Der [`fejta-bot`](https://github.com/fejta-bot) Bot markiert Themen nach 90 Tagen Inaktivität als veraltet. Nach weiteren 30 Tagen markiert er Issues als faul und schließt sie. PR-Beauftragte sollten Themen nach 14-30 Tagen Inaktivität schließen. + +{{< /note >}} diff --git a/content/de/docs/contribute/participate/roles-and-responsibilities.md b/content/de/docs/contribute/participate/roles-and-responsibilities.md new file mode 100644 index 0000000000..515e3cf9e4 --- /dev/null +++ b/content/de/docs/contribute/participate/roles-and-responsibilities.md @@ -0,0 +1,227 @@ +--- +title: Rollen und Verantwortlichkeiten +content_type: concept +weight: 10 +--- + +<!-- overview --> + +Jeder kann zu Kubernetes beitragen. Wenn deine Beiträge zu SIG Docs wachsen, kannst du dich für verschiedene Stufen der Mitgliedschaft in der Community bewerben. +Diese Rollen ermöglichen es dir, mehr Verantwortung innerhalb der Gemeinschaft zu übernehmen. +Jede Rolle erfordert mehr Zeit und Engagement. Die Rollen sind: + +- Jeder: trägt regelmäßig zur Kubernetes-Dokumentation bei +- Member: können Probleme zuweisen und einstufen und Pull Requests unverbindlich prüfen +- Reviewer: können die Überprüfung von Dokumentations-Pull-Requests leiten und für die Qualität einer Änderung bürgen +- Approver: können die Überprüfung von Dokumentations- und Merge-Änderungen leiten + +<!-- body --> + +## Jeder + +Jeder mit einem GitHub-Konto kann zu Kubernetes beitragen. SIG Docs heißt alle neuen Mitwirkenden willkommen! + +Jeder kann: + +- Ein Problem in einem beliebigen [Kubernetes](https://github.com/kubernetes/) + Repository, einschließlich + [`kubernetes/website`](https://github.com/kubernetes/website) +- Unverbindliches Feedback zu einem Pull Request geben +- Zu einer Lokalisierung beitragen +- Schlage Verbesserungen auf [Slack](https://slack.k8s.io/) oder der + [SIG docs mailing list](https://groups.google.com/forum/#!forum/kubernetes-sig-docs). + +Nach dem [Signieren des CLA](/docs/contribute/new-content/overview/#sign-the-cla) kann jeder auch: + +- eine Pull-Anfrage öffnen, um bestehende Inhalte zu verbessern, neue Inhalte hinzuzufügen oder einen Blogbeitrag oder eine Fallstudie zu schreiben +- Diagramme, Grafiken und einbettbare Screencasts und Videos erstellen + +Weitere Informationen findest du unter [neue Inhalte beisteuern](/docs/contribute/new-content/). + +## Member + +Ein Member (Mitglied) ist jemand, der bereits mehrere Pull Requests an +`kubernetes/website` eingereicht hat. Mitglieder sind ein Teil der +[Kubernetes GitHub Organisation](https://github.com/kubernetes). + +Member können: + +- Alles tun, was unter [Jeder](#jeder) aufgeführt ist +- Den Kommentar `/lgtm` verwenden, um einem Pull Request das Label LGTM (looks good to me) hinzuzufügen + + {{< note >}} + Die Verwendung von `/lgtm` löst eine Automatisierung aus. Wenn du eine unverbindliche + Zustimmung geben willst, funktioniert der Kommentar "LGTM" auch! + {{< /note >}} + +- Verwende den Kommentar `/hold`, um das Zusammenführen eines Pull Requests zu blockieren. +- Benutze den Kommentar `/assign`, um einem Pull Request einen Reviewer zuzuweisen. +- Unverbindliche Überprüfung von Pull Requests +- Nutze die Automatisierung, um Probleme zu sortieren und zu kategorisieren +- Neue Funktionen dokumentieren + +### Mitglied werden + +Nachdem du mindestens 5 substantielle Pull Requests eingereicht hast und die anderen +[Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#member): + +1. Finde zwei [Reviewer](#reviewers) oder [Approver](#approvers), die deine Mitgliedschaft [sponsern](/docs/contribute/advanced#sponsor-a-new-contributor). + + Bitte um Sponsoring im [#sig-docs channel on Slack](https://kubernetes.slack.com) oder auf der + [SIG Docs Mailingliste](https://groups.google.com/forum/#!forum/kubernetes-sig-docs). + + {{< note >}} + Schicke keine direkte E-Mail oder Slack-Direktnachricht an ein einzelnes + SIG Docs-Mitglied. Du musst das Sponsoring beantragen, bevor du deine Bewerbung einreichst. + {{< /note >}} + +1. Eröffne ein GitHub-Issue im + [`kubernetes/org`](https://github.com/kubernetes/org/) Repository. Verwende dabei das + **Organization Membership Request** issue template. + +1. Informiere deine Sponsoren über das GitHub-Issue. Du kannst entweder: + - Ihren GitHub-Benutzernamen in deinem Issue (`@<GitHub-Benutzername>`) erwähnen + - Ihnen den Issue-Link über Slack oder per E-Mail senden. + + Die Sponsoren werden deine Anfrage mit einer "+1"-Stimme genehmigen. Sobald deine Sponsoren + genehmigen, fügt dich ein Kubernetes-GitHub-Admin als Mitglied hinzu. + Herzlichen Glückwunsch! + + Wenn dein Antrag auf Mitgliedschaft nicht angenommen wird, erhältst du eine Rückmeldung. + Nachdem du dich mit dem Feedback auseinandergesetzt hast, kannst du dich erneut bewerben. + +1. Nimm die Einladung zur Kubernetes GitHub Organisation in deinem E-Mail-Konto an. + + {{< note >}} + GitHub sendet die Einladung an die Standard-E-Mail-Adresse in deinem Konto. + {{< /note >}} + +## Reviewer + +Reviewer (Rezensenten) sind dafür verantwortlich, offene Pull Requests zu überprüfen. Anders als bei den Mitgliedern +musst du auf das Feedback der Prüfer eingehen. Reviewer sind Mitglieder des +[@kubernetes/sig-docs-{language}-reviews](https://github.com/orgs/kubernetes/teams?query=sig-docs) +GitHub-Teams. + +Rezensenten können: + +- Alles tun, was unter [Jeder](#jeder) und [Member](#member) aufgeführt ist +- Pull Requests überprüfen und verbindliches Feedback geben + + {{< note >}} + Um unverbindliches Feedback zu geben, stellst du deinen Kommentaren eine Formulierung wie "Optional:" voran. + {{< /note >}} + +- Bearbeite benutzerseitige Zeichenfolgen im Code +- Verbessere Code-Kommentare + +### Zuweisung von Reviewern zu Pull Requests + +Die Automatisierung weist allen Pull Requests Reviewer zu. Du kannst eine +Review von einer bestimmten Person anfordern, indem du einen Kommentar schreibst: `/assign +[@_github_handle]`. + +Wenn der zugewiesene Prüfer den PR nicht kommentiert hat, kann ein anderer Prüfer +einspringen. Du kannst bei Bedarf auch technische Prüfer zuweisen. + +### Verwendung von `/lgtm` + +LGTM steht für "Looks good to me" und zeigt an, dass ein Pull Request +technisch korrekt und bereit zum Zusammenführen ist. Alle PRs brauchen einen `/lgtm` Kommentar von einem +Reviewer und einen `/approve` Kommentar von einem Approver, um zusammengeführt zu werden. + +Ein `/lgtm`-Kommentar vom Reviewer ist verbindlich und löst eine Automatisierung aus, die das `lgtm`-Label hinzufügt. + +### Reviewer werden + +Wenn du die +[Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#reviewer) erfüllst, +kannst du ein SIG Docs-Reviewer werden. Reviewer in anderen SIGs müssen sich gesondert für den Reviewer-Status in SIG Docs bewerben. + +So bewirbst du dich: + +1. Eröffne einen Pull Request, in dem du deinen GitHub-Benutzernamen in einen Abschnitt der + [OWNERS_ALIASES](https://github.com/kubernetes/website/blob/main/OWNERS) Datei + im `kubernetes/website` Repository hinzufügt. + + {{< note >}} + Wenn du dir nicht sicher bist, wo du dich hinzufügen sollst, füge dich zu `sig-docs-de-reviews` hinzu. + {{< /note >}} + +1. Weise den PR einem oder mehreren SIG-Docs-Genehmigern zu (Benutzernamen, die unter + `sig-docs-{language}-owners` aufgelisted sind). + Wenn der PR genehmigt wurde, fügt dich ein SIG Docs-Lead dem entsprechenden GitHub-Team hinzu. Sobald du hinzugefügt bist, + wird [@k8s-ci-robot](https://github.com/kubernetes/test-infra/tree/master/prow#bots-home) + dich als Reviewer für neue Pull Requests vorschlagen und zuweisen. + + +## Approver + + +Approver (Genehmiger) prüfen und genehmigen Pull Requests zum Zusammenführen. Genehmigende sind Mitglieder des +[@kubernetes/sig-docs-{language}-owners](https://github.com/orgs/kubernetes/teams/?query=sig-docs) +GitHub-Teams. + +Genehmigende können Folgendes tun: + +- Alles, was unter [Jeder](#jeder), [Member](#member) und [Reviewer](#reviewes) aufgeführt ist +- Inhalte von Mitwirkenden veröffentlichen, indem sie Pull Requests mit dem Kommentar `/approve` genehmigen und zusammenführen +- Verbesserungen für den Style Guide vorschlagen +- Verbesserungsvorschläge für Docs-Tests einbringen +- Verbesserungsvorschläge für die Kubernetes-Website oder andere Tools machen + +Wenn der PR bereits einen `/lgtm` hat, oder wenn der Genehmigende ebenfalls mit +`/lgtm` kommentiert, wird der PR automatisch zusammengeführt. Ein SIG Docs-Genehmiger sollte nur ein +`/lgtm` für eine Änderung hinterlassen, die keine weitere technische Überprüfung erfordert. + +### Pull Requests genehmigen + +Genehmiger und SIG Docs-Leads sind die Einzigen, die Pull Requests +in das Website-Repository aufnehmen. Damit sind bestimmte Verantwortlichkeiten verbunden. + +- Genehmigende können den Befehl `/approve` verwenden, der PRs in das Repository einfügt. + + {{< warning >}} + Ein unvorsichtiges Zusammenführen kann die Website lahmlegen, also sei dir sicher, dass du es auch so meinst, wenn du etwas zusammenführst. + {{< /warning >}} + +- Vergewissere dich, dass die vorgeschlagenen Änderungen den + [Beitragsrichtlinien](/docs/contribute/style/content-guide/#contributing-content) entsprechen. + + Wenn du jemals eine Frage hast oder dir bei etwas nicht sicher bist, fordere einfach Hilfe an, um eine zusätzliche Überprüfung zu erhalten. + +- Vergewissere dich, dass die Netlify-Tests erfolgreich sind, bevor du einen PR mittels `/approve` genehmigst. + + <img src="/images/docs/contribute/netlify-pass.png" width="75%" alt="Netlify-Tests müssen vor der Freigabe bestanden werden" /> + +- Besuche die Netlify-Seitenvorschau für den PR, um sicherzustellen, dass alles gut aussieht, bevor du es genehmigst. + +- Nimm am [PR Wrangler Rotationsplan](https://github.com/kubernetes/website/wiki/PR-Wranglers) + für wöchentliche Rotationen teil. SIG Docs erwartet von allen Genehmigern, dass sie an dieser + Rotation teilnehmen. Siehe [PR-Wranglers](/docs/contribute/participate/pr-wranglers/). + für weitere Details. + +### Ein Approver werden + +Wenn du die [Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#approver) erfüllst, +kannst du ein SIG Docs Approver werden. Genehmigende in anderen SIGs müssen sich separat für den Approver-Status in SIG Docs bewerben. + +So bewirbst du dich: + +1. Eröffne eine Pull-Anfrage, in der du dich in einem Abschnitt der + [OWNERS_ALIASES](https://github.com/kubernetes/website/blob/main/OWNERS) + Datei im `kubernetes/website` Repository hinzuzufügen. + + {{< note >}} + Wenn du dir nicht sicher bist, wo du dich hinzufügen sollst, füge dich zu `sig-docs-de-owners` hinzu. + {{< /note >}} + +2. Weise den PR einem oder mehreren aktuellen SIG Docs Genehmigern zu. + +Wenn der PR genehmigt wurde, fügt dich ein SIG Docs-Lead dem entsprechenden GitHub-Team hinzu. Sobald du hinzugefügt bist, +wird [@k8s-ci-robot](https://github.com/kubernetes/test-infra/tree/master/prow#bots-home) +dich als Reviewer für neue Pull Requests vorschlagen und zuweisen. + +## {{% heading "whatsnext" %}} + +- Erfahre mehr über [PR-Wrangling](/docs/contribute/participate/pr-wranglers/), eine Rolle, die alle Genehmiger im Wechsel übernehmen. From 4f1ccf1bc6d2b1c52f647403da9caca08070d8d4 Mon Sep 17 00:00:00 2001 From: Benedikt Rollik <brollik@online.net> Date: Thu, 21 Oct 2021 18:16:38 +0200 Subject: [PATCH 004/104] typo --- content/de/docs/contribute/participate/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/de/docs/contribute/participate/_index.md b/content/de/docs/contribute/participate/_index.md index 23c801efce..9dd3cfec37 100644 --- a/content/de/docs/contribute/participate/_index.md +++ b/content/de/docs/contribute/participate/_index.md @@ -10,7 +10,7 @@ card: <!-- overview --> Die SIG Docs ist eine der -[Special Interest Groups (Interessengruppen)](https://github.com/kubernetes/community/blob/master/sig-list.md) innerhalb des Kubernetes-Projekts, die sich auf das Schreiben, Aktualisieren und Pflegen der Dokumentation für Kubernetes als Ganzes konzentriert. Weitere Informationen über die SIG findest du unter SIG Docs im [Github Repository der Community](https://github.com/kubernetes/community/tree/master/sig-docs). +[Special Interest Groups (Fachspezifischen Interessengruppen)](https://github.com/kubernetes/community/blob/master/sig-list.md) innerhalb des Kubernetes-Projekts, die sich auf das Schreiben, Aktualisieren und Pflegen der Dokumentation für Kubernetes als Ganzes konzentriert. Weitere Informationen über die SIG findest du unter SIG Docs im [Github Repository der Community](https://github.com/kubernetes/community/tree/master/sig-docs). SIG Docs begrüß,t Inhalte und Bewertungen von allen Mitwirkenden. Jeder kann einen Pull Request (PR) eröffnen, und jeder ist willkommen, Fragen zum Inhalt zu stellen oder Kommentare From 74c53d61deb59b347d14ef5b6ee42f8f9adad1b6 Mon Sep 17 00:00:00 2001 From: Benedikt Rollik <brollik@online.net> Date: Thu, 21 Oct 2021 18:29:38 +0200 Subject: [PATCH 005/104] fixed broken links + typos --- .../de/docs/contribute/participate/_index.md | 14 ++++++------- .../participate/roles-and-responsibilities.md | 20 +++++++++---------- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/content/de/docs/contribute/participate/_index.md b/content/de/docs/contribute/participate/_index.md index 9dd3cfec37..4723c5b121 100644 --- a/content/de/docs/contribute/participate/_index.md +++ b/content/de/docs/contribute/participate/_index.md @@ -16,9 +16,9 @@ SIG Docs begrüß,t Inhalte und Bewertungen von allen Mitwirkenden. Jede Pull Request (PR) eröffnen, und jeder ist willkommen, Fragen zum Inhalt zu stellen oder Kommentare zu laufenden Pull Requests abzugeben. -Du kannst dich ausserdem als [Member](/docs/contribute/participate/roles-and-responsibilities/#members), -[Reviewer](/docs/contribute/participate/roles-and-responsibilities/#reviewers), oder -[Approver](/docs/contribute/participate/roles-and-responsibilities/#approvers) beteiligen. +Du kannst dich ausserdem als [Member](/de/docs/contribute/participate/roles-and-responsibilities/#member), +[Reviewer](/de/docs/contribute/participate/roles-and-responsibilities/#reviewer), oder +[Approver](/de/docs/contribute/participate/roles-and-responsibilities/#approver) beteiligen. Diese Rollen erfordern einen erweiterten Zugriff und bringen bestimmte Verantwortlichkeiten für Änderungen zu genehmigen und zu bestätigen. Unter [community-membership](https://github.com/kubernetes/community/blob/master/community-membership.md) findest du weitere Informationen darüber, wie die Mitgliedschaft in der Kubernetes-Community funktioniert. @@ -26,12 +26,12 @@ Unter [community-membership](https://github.com/kubernetes/community/blob/master Der Rest dieses Dokuments umreiß,t einige spezielle Vorgehensweisen dieser Rollen innerhalb von SIG Docs, die für die Pflege eines der öffentlichsten Aushängeschilder von Kubernetes verantwortlich ist - die Kubernetes-Website und die Dokumentation. <!-- body --> -## SIG Docs-Vorsitzender +## SIG Docs Vorstand Jede SIG, auch die SIG Docs, wählt ein oder mehrere SIG-Mitglieder, die als Vorstand fungieren. Sie sind die Kontaktstellen zwischen der SIG Docs und anderen Teilen der der Kubernetes-Organisation. Sie benötigen umfassende Kenntnisse über die Struktur -des Kubernetes-Projekts als Ganzes und wie SIG Docs darin arbeitet. Informationen zur [Führung](https://github.com/kubernetes/community/tree/master/sig-docs#leadership) und den aktuellen Vorsitzenden. +des Kubernetes-Projekts als Ganzes und wie SIG Docs darin arbeitet. Informationen zur [Leitung](https://github.com/kubernetes/community/tree/master/sig-docs#leadership) und den aktuellen Vorsitzenden. ## SIG Docs-Teams und Automatisierung Die Automatisierung in SIG Docs stützt sich auf zwei verschiedene Mechanismen: @@ -39,7 +39,7 @@ GitHub-Teams und OWNERS-Dateien. ### GitHub Teams -Es gibt zwei Kategorien von SIG Docs [Teams] (https://github.com/orgs/kubernetes/teams?query=sig-docs) auf GitHub: +Es gibt zwei Kategorien von SIG Docs [Teams](https://github.com/orgs/kubernetes/teams?query=sig-docs) auf GitHub: - `@sig-docs-{language}-owners` sind Genehmiger und Verantwortliche - `@sig-docs-{language}-reviewers` sind Reviewer @@ -53,7 +53,7 @@ Automatisierung die Informationen aus den `OWNERS`-Dateien. ### OWNERS Dateien und Front-Matter -Das Kubernetes-Projekt verwendet ein Automatisierungstool namens prow für die Automatisierung im Zusammenhang mit GitHub-Problemen und Pull-Requests. +Das Kubernetes-Projekt verwendet ein Automatisierungstool namens prow für die Automatisierung im Zusammenhang mit GitHub-Issues und Pull-Requests. Das [Kubernetes-Website-Repository](https://github.com/kubernetes/website) verwendet zwei [prow-Plugins](https://github.com/kubernetes/test-infra/tree/master/prow/plugins): - blunderbuss diff --git a/content/de/docs/contribute/participate/roles-and-responsibilities.md b/content/de/docs/contribute/participate/roles-and-responsibilities.md index 515e3cf9e4..7322f9a302 100644 --- a/content/de/docs/contribute/participate/roles-and-responsibilities.md +++ b/content/de/docs/contribute/participate/roles-and-responsibilities.md @@ -10,8 +10,8 @@ Jeder kann zu Kubernetes beitragen. Wenn deine Beiträge zu SIG Docs wachsen Diese Rollen ermöglichen es dir, mehr Verantwortung innerhalb der Gemeinschaft zu übernehmen. Jede Rolle erfordert mehr Zeit und Engagement. Die Rollen sind: -- Jeder: trägt regelmäßig zur Kubernetes-Dokumentation bei -- Member: können Probleme zuweisen und einstufen und Pull Requests unverbindlich prüfen +- Jeder: kann regelmäßig zur Kubernetes-Dokumentation beitragen +- Member: können Issues zuweisen und einstufen und Pull Requests unverbindlich prüfen - Reviewer: können die Überprüfung von Dokumentations-Pull-Requests leiten und für die Qualität einer Änderung bürgen - Approver: können die Überprüfung von Dokumentations- und Merge-Änderungen leiten @@ -25,11 +25,11 @@ Jeder kann: - Ein Problem in einem beliebigen [Kubernetes](https://github.com/kubernetes/) Repository, einschließlich - [`kubernetes/website`](https://github.com/kubernetes/website) + [`kubernetes/website`](https://github.com/kubernetes/website) melden - Unverbindliches Feedback zu einem Pull Request geben - Zu einer Lokalisierung beitragen -- Schlage Verbesserungen auf [Slack](https://slack.k8s.io/) oder der - [SIG docs mailing list](https://groups.google.com/forum/#!forum/kubernetes-sig-docs). +- Verbesserungen auf [Slack](https://slack.k8s.io/) oder der + [SIG docs mailing list](https://groups.google.com/forum/#!forum/kubernetes-sig-docs) vorschlagen. Nach dem [Signieren des CLA](/docs/contribute/new-content/overview/#sign-the-cla) kann jeder auch: @@ -57,13 +57,13 @@ Member können: - Verwende den Kommentar `/hold`, um das Zusammenführen eines Pull Requests zu blockieren. - Benutze den Kommentar `/assign`, um einem Pull Request einen Reviewer zuzuweisen. - Unverbindliche Überprüfung von Pull Requests -- Nutze die Automatisierung, um Probleme zu sortieren und zu kategorisieren +- Nutze die Automatisierung, um Issues zu sortieren und zu kategorisieren - Neue Funktionen dokumentieren ### Mitglied werden -Nachdem du mindestens 5 substantielle Pull Requests eingereicht hast und die anderen -[Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#member): +Du kannst ein Mitglied werden, nachdem du mindestens 5 substantielle Pull Requests eingereicht hast und die anderen +[Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#member) erfüst: 1. Finde zwei [Reviewer](#reviewers) oder [Approver](#approvers), die deine Mitgliedschaft [sponsern](/docs/contribute/advanced#sponsor-a-new-contributor). @@ -201,7 +201,7 @@ in das Website-Repository aufnehmen. Damit sind bestimmte Verantwortlichkeiten v Rotation teilnehmen. Siehe [PR-Wranglers](/docs/contribute/participate/pr-wranglers/). für weitere Details. -### Ein Approver werden +### Approver werden Wenn du die [Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#approver) erfüllst, kannst du ein SIG Docs Approver werden. Genehmigende in anderen SIGs müssen sich separat für den Approver-Status in SIG Docs bewerben. @@ -224,4 +224,4 @@ dich als Reviewer für neue Pull Requests vorschlagen und zuweisen. ## {{% heading "whatsnext" %}} -- Erfahre mehr über [PR-Wrangling](/docs/contribute/participate/pr-wranglers/), eine Rolle, die alle Genehmiger im Wechsel übernehmen. +- Erfahre mehr über [PR-Wrangling](/de/docs/contribute/participate/pr-wranglers/), eine Rolle, die alle Genehmiger im Wechsel übernehmen. From 400861724ace18e8f219dba4856a922ec9f6d11a Mon Sep 17 00:00:00 2001 From: Benedikt Rollik <brollik@scaleway.com> Date: Fri, 22 Oct 2021 11:09:06 +0200 Subject: [PATCH 006/104] Update content/de/docs/contribute/participate/_index.md Co-authored-by: Tim Bannister <tim@scalefactory.com> --- content/de/docs/contribute/participate/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/de/docs/contribute/participate/_index.md b/content/de/docs/contribute/participate/_index.md index 4723c5b121..8a7064ddbd 100644 --- a/content/de/docs/contribute/participate/_index.md +++ b/content/de/docs/contribute/participate/_index.md @@ -12,7 +12,7 @@ card: Die SIG Docs ist eine der [Special Interest Groups (Fachspezifischen Interessengruppen)](https://github.com/kubernetes/community/blob/master/sig-list.md) innerhalb des Kubernetes-Projekts, die sich auf das Schreiben, Aktualisieren und Pflegen der Dokumentation für Kubernetes als Ganzes konzentriert. Weitere Informationen über die SIG findest du unter SIG Docs im [Github Repository der Community](https://github.com/kubernetes/community/tree/master/sig-docs). -SIG Docs begrüß,t Inhalte und Bewertungen von allen Mitwirkenden. Jeder kann einen +SIG Docs begrüßt Inhalte und Bewertungen von allen Mitwirkenden. Jeder kann einen Pull Request (PR) eröffnen, und jeder ist willkommen, Fragen zum Inhalt zu stellen oder Kommentare zu laufenden Pull Requests abzugeben. From bbc216bc72f35a0f6d0eeec270760e97814b79fa Mon Sep 17 00:00:00 2001 From: Benedikt Rollik <brollik@scaleway.com> Date: Fri, 22 Oct 2021 11:09:14 +0200 Subject: [PATCH 007/104] Update content/de/docs/contribute/participate/_index.md Co-authored-by: Tim Bannister <tim@scalefactory.com> --- content/de/docs/contribute/participate/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/de/docs/contribute/participate/_index.md b/content/de/docs/contribute/participate/_index.md index 8a7064ddbd..24a4ff7a31 100644 --- a/content/de/docs/contribute/participate/_index.md +++ b/content/de/docs/contribute/participate/_index.md @@ -10,7 +10,7 @@ card: <!-- overview --> Die SIG Docs ist eine der -[Special Interest Groups (Fachspezifischen Interessengruppen)](https://github.com/kubernetes/community/blob/master/sig-list.md) innerhalb des Kubernetes-Projekts, die sich auf das Schreiben, Aktualisieren und Pflegen der Dokumentation für Kubernetes als Ganzes konzentriert. Weitere Informationen über die SIG findest du unter SIG Docs im [Github Repository der Community](https://github.com/kubernetes/community/tree/master/sig-docs). +[Special Interest Groups ](https://github.com/kubernetes/community/blob/master/sig-list.md) (Fachspezifischen Interessengruppen) innerhalb des Kubernetes-Projekts, die sich auf as Schreiben, Aktualisieren und Pflegen der Dokumentation für Kubernetes als Ganzes konzentriert. Weitere Informationen über die SIG findest du unter SIG Docs im [GitHub Repository der Community](https://github.com/kubernetes/community/tree/master/sig-docs). SIG Docs begrüßt Inhalte und Bewertungen von allen Mitwirkenden. Jeder kann einen Pull Request (PR) eröffnen, und jeder ist willkommen, Fragen zum Inhalt zu stellen oder Kommentare From 249248e9467490b438f621d2fdb70370401bcc9c Mon Sep 17 00:00:00 2001 From: Benedikt Rollik <brollik@online.net> Date: Fri, 22 Oct 2021 11:15:54 +0200 Subject: [PATCH 008/104] add unicode characters --- .../de/docs/contribute/participate/_index.md | 59 +++++++++---------- 1 file changed, 29 insertions(+), 30 deletions(-) diff --git a/content/de/docs/contribute/participate/_index.md b/content/de/docs/contribute/participate/_index.md index 24a4ff7a31..6a107c5e54 100644 --- a/content/de/docs/contribute/participate/_index.md +++ b/content/de/docs/contribute/participate/_index.md @@ -9,32 +9,31 @@ card: <!-- overview --> -Die SIG Docs ist eine der -[Special Interest Groups ](https://github.com/kubernetes/community/blob/master/sig-list.md) (Fachspezifischen Interessengruppen) innerhalb des Kubernetes-Projekts, die sich auf as Schreiben, Aktualisieren und Pflegen der Dokumentation für Kubernetes als Ganzes konzentriert. Weitere Informationen über die SIG findest du unter SIG Docs im [GitHub Repository der Community](https://github.com/kubernetes/community/tree/master/sig-docs). +Die SIG Docs ist eine der [Special Interest Groups](https://github.com/kubernetes/community/blob/master/sig-list.md) (Fachspezifischen Interessengruppen) innerhalb des Kubernetes-Projekts, die sich auf das Schreiben, Aktualisieren und Pflegen der Dokumentation für Kubernetes als Ganzes konzentriert. Weitere Informationen über die SIG findest du unter SIG Docs im [GitHub Repository der Community](https://github.com/kubernetes/community/tree/master/sig-docs). -SIG Docs begrüßt Inhalte und Bewertungen von allen Mitwirkenden. Jeder kann einen -Pull Request (PR) eröffnen, und jeder ist willkommen, Fragen zum Inhalt zu stellen oder Kommentare +SIG Docs begrüßt Inhalte und Bewertungen von allen Mitwirkenden. Jeder kann einen +Pull Request (PR) eröffnen, und jeder ist willkommen, Fragen zum Inhalt zu stellen oder Kommentare zu laufenden Pull Requests abzugeben. Du kannst dich ausserdem als [Member](/de/docs/contribute/participate/roles-and-responsibilities/#member), [Reviewer](/de/docs/contribute/participate/roles-and-responsibilities/#reviewer), oder [Approver](/de/docs/contribute/participate/roles-and-responsibilities/#approver) beteiligen. -Diese Rollen erfordern einen erweiterten Zugriff und bringen bestimmte Verantwortlichkeiten für -Änderungen zu genehmigen und zu bestätigen. -Unter [community-membership](https://github.com/kubernetes/community/blob/master/community-membership.md) findest du weitere Informationen darüber, wie die Mitgliedschaft in der Kubernetes-Community funktioniert. +Diese Rollen erfordern einen erweiterten Zugriff und bringen bestimmte Verantwortlichkeiten für +Änderungen zu genehmigen und zu bestätigen. +Unter [community-membership](https://github.com/kubernetes/community/blob/master/community-membership.md) findest du weitere Informationen darüber, wie die Mitgliedschaft in der Kubernetes-Community funktioniert. -Der Rest dieses Dokuments umreiß,t einige spezielle Vorgehensweisen dieser Rollen innerhalb von SIG Docs, die für die Pflege eines der öffentlichsten Aushängeschilder von Kubernetes verantwortlich ist - die Kubernetes-Website und die Dokumentation. +Der Rest dieses Dokuments umreiß,t einige spezielle Vorgehensweisen dieser Rollen innerhalb von SIG Docs, die für die Pflege eines der öffentlichsten Aushängeschilder von Kubernetes verantwortlich ist - die Kubernetes-Website und die Dokumentation. <!-- body --> ## SIG Docs Vorstand -Jede SIG, auch die SIG Docs, wählt ein oder mehrere SIG-Mitglieder, die als +Jede SIG, auch die SIG Docs, wählt ein oder mehrere SIG-Mitglieder, die als Vorstand fungieren. Sie sind die Kontaktstellen zwischen der SIG Docs und anderen Teilen der -der Kubernetes-Organisation. Sie benötigen umfassende Kenntnisse über die Struktur +der Kubernetes-Organisation. Sie benötigen umfassende Kenntnisse über die Struktur des Kubernetes-Projekts als Ganzes und wie SIG Docs darin arbeitet. Informationen zur [Leitung](https://github.com/kubernetes/community/tree/master/sig-docs#leadership) und den aktuellen Vorsitzenden. ## SIG Docs-Teams und Automatisierung -Die Automatisierung in SIG Docs stützt sich auf zwei verschiedene Mechanismen: +Die Automatisierung in SIG Docs stützt sich auf zwei verschiedene Mechanismen: GitHub-Teams und OWNERS-Dateien. ### GitHub Teams @@ -47,13 +46,13 @@ Es gibt zwei Kategorien von SIG Docs [Teams](https://github.com/orgs/kubernetes/ Jede Gruppe kann in GitHub-Kommentaren mit ihrem `@name` referenziert werden, um mit mit allen Mitgliedern dieser Gruppe zu kommunizieren. -Manchmal überschneiden sich Prow- und GitHub-Teams, ohne genau übereinzustimmen. Für -Zuordnung von Issues, Pull-Requests und zur Unterstützung von PR-Genehmigungen verwendet die +Manchmal überschneiden sich Prow- und GitHub-Teams, ohne genau übereinzustimmen. Für +Zuordnung von Issues, Pull-Requests und zur Unterstützung von PR-Genehmigungen verwendet die Automatisierung die Informationen aus den `OWNERS`-Dateien. ### OWNERS Dateien und Front-Matter -Das Kubernetes-Projekt verwendet ein Automatisierungstool namens prow für die Automatisierung im Zusammenhang mit GitHub-Issues und Pull-Requests. +Das Kubernetes-Projekt verwendet ein Automatisierungstool namens prow für die Automatisierung im Zusammenhang mit GitHub-Issues und Pull-Requests. Das [Kubernetes-Website-Repository](https://github.com/kubernetes/website) verwendet zwei [prow-Plugins](https://github.com/kubernetes/test-infra/tree/master/prow/plugins): - blunderbuss @@ -65,34 +64,34 @@ Diese beiden Plugins verwenden die Dateien auf der obersten Ebene des GitHub-Repositorys `kubernetes/website`, um zu steuern wie prow innerhalb des Repositorys arbeitet. -Eine OWNERS-Datei enthält eine Liste von Personen, die SIG Docs-Reviewer und -Genehmiger sind. OWNERS-Dateien können auch in Unterverzeichnissen existieren und bestimmen, wer +Eine OWNERS-Datei enthält eine Liste von Personen, die SIG Docs-Reviewer und +Genehmiger sind. OWNERS-Dateien können auch in Unterverzeichnissen existieren und bestimmen, wer Dateien in diesem Unterverzeichnis und seinen Unterverzeichnissen als Rezensent oder -Genemiger bestätigen darf. Weitere Informationen über OWNERS-Dateien im Allgemeinen findest du unter +Genemiger bestätigen darf. Weitere Informationen über OWNERS-Dateien im Allgemeinen findest du unter [OWNERS](https://github.com/kubernetes/community/blob/master/contributors/guide/owners.md). Auß,erdem kann eine einzelne Markdown-Datei in ihrem Front-Matter (Vorspann) Reviewer und Genehmiger auflisten. Entweder durch Auflistung einzelner GitHub-Benutzernamen oder GitHub-Gruppen. -Die Kombination aus OWNERS-Dateien und Front-Matter in Markdown-Dateien bestimmt, welche Ratschläge PR-Eigentümer von automatisierten Systemen erhalten, und wen sie um eine technische und redaktionelle Überprüfung ihres PRs bitten sollen. -## So funktioniert das Zusammenführen +Die Kombination aus OWNERS-Dateien und Front-Matter in Markdown-Dateien bestimmt, welche Ratschläge PR-Eigentümer von automatisierten Systemen erhalten, und wen sie um eine technische und redaktionelle Überprüfung ihres PRs bitten sollen. +## So funktioniert das Zusammenführen -Wenn ein Pull Request mit der Branch (Ast) zusammengeführt wird, in dem der Inhalt veröffentlicht werden soll, wird dieser Inhalt auf http://kubernetes.io veröffentlicht. Um sicherzustellen, dass die Qualität der veröffentlichten Inhalte hoch ist, beschränken wir das Zusammenführen von Pull Requests auf +Wenn ein Pull Request mit der Branch (Ast) zusammengeführt wird, in dem der Inhalt veröffentlicht werden soll, wird dieser Inhalt auf http://kubernetes.io veröffentlicht. Um sicherzustellen, dass die Qualität der veröffentlichten Inhalte hoch ist, beschränken wir das Zusammenführen von Pull Requests auf SIG Docs Freigabeberechtigte. So funktioniert es: - Wenn eine Pull-Anfrage sowohl das `lgtm`- als auch das `approve`-Label hat, kein `hold`-Label hat, - und alle Tests bestanden sind, wird der Pull Request automatisch zusammengeführt. -- Mitglieder der Kubernetes-Organisation und SIG Docs-Genehmiger können Kommentare hinzufügen, um - Kommentare hinzufügen, um das automatische Zusammenführen eines Pull Requests zu verhindern (durch Hinzufügen eines `/hold`-Kommentars - kann ein vorheriger `/lgtm`-Kommentar zurückgehalten werden). -- Jedes Kubernetes-Mitglied kann das `lgtm`-Label hinzufügen, indem es einen `/lgtm`-Kommentar hinzufügt. -- Nur SIG Docs-Genehmiger können einen Pull Request zusammenführen indem sie einen `/approve` Kommentar hinzufügen. - Einige Genehmiger übernehmen auch weitere spezielle Rollen, wie zum Beispiel [PR Wrangler](/docs/contribute/participate/pr-wranglers/) oder [SIG Docs Vorsitzende](#sig-docs-chairperson). + und alle Tests bestanden sind, wird der Pull Request automatisch zusammengeführt. +- Mitglieder der Kubernetes-Organisation und SIG Docs-Genehmiger können Kommentare hinzufügen, um + Kommentare hinzufügen, um das automatische Zusammenführen eines Pull Requests zu verhindern (durch Hinzufügen eines `/hold`-Kommentars + kann ein vorheriger `/lgtm`-Kommentar zurückgehalten werden). +- Jedes Kubernetes-Mitglied kann das `lgtm`-Label hinzufügen, indem es einen `/lgtm`-Kommentar hinzufügt. +- Nur SIG Docs-Genehmiger können einen Pull Request zusammenführen indem sie einen `/approve` Kommentar hinzufügen. + Einige Genehmiger übernehmen auch weitere spezielle Rollen, wie zum Beispiel [PR Wrangler](/docs/contribute/participate/pr-wranglers/) oder [SIG Docs Vorsitzende](#sig-docs-chairperson). ## {{% heading "whatsnext" %}} -Weitere Informationen über die Mitarbeit an der Kubernetes-Dokumentation findest du unter: +Weitere Informationen über die Mitarbeit an der Kubernetes-Dokumentation findest du unter: - [Neue Inhalte beisteuern](/docs/contribute/new-content/overview/) -- [Inhalte überprüfen](/docs/contribute/review/reviewing-prs) -- [Styleguide für die Dokumentation](/docs/contribute/style/) +- [Inhalte überprüfen](/docs/contribute/review/reviewing-prs) +- [Styleguide für die Dokumentation](/docs/contribute/style/) From 62e8810b4a86a80c7ac825cd9e122588305ea0fc Mon Sep 17 00:00:00 2001 From: Benedikt Rollik <brollik@online.net> Date: Fri, 22 Oct 2021 11:16:03 +0200 Subject: [PATCH 009/104] add unicode characters --- .../contribute/participate/pr-wranglers.md | 66 ++++----- .../participate/roles-and-responsibilities.md | 128 +++++++++--------- 2 files changed, 97 insertions(+), 97 deletions(-) diff --git a/content/de/docs/contribute/participate/pr-wranglers.md b/content/de/docs/contribute/participate/pr-wranglers.md index f77c11037d..7705bbc377 100644 --- a/content/de/docs/contribute/participate/pr-wranglers.md +++ b/content/de/docs/contribute/participate/pr-wranglers.md @@ -6,76 +6,76 @@ weight: 20 <!-- overview --> -SIG Docs [approvers](/docs/contribute/participate/roles-and-responsibilities/#approvers) übernehmen einwöchige Schichten um die [Pull Requests](https://github.com/kubernetes/website/wiki/PR-Wranglers) des Repositories zu verwalten. +SIG Docs [approvers](/docs/contribute/participate/roles-and-responsibilities/#approvers) übernehmen einwöchige Schichten um die [Pull Requests](https://github.com/kubernetes/website/wiki/PR-Wranglers) des Repositories zu verwalten. -Dieser Abschnitt behandelt die Aufgaben eines PR-Wranglers. Weitere Informationen über gute Reviews findest du unter [Überprüfen von Änderungen](/docs/contribute/review/). +Dieser Abschnitt behandelt die Aufgaben eines PR-Wranglers. Weitere Informationen über gute Reviews findest du unter [Überprüfen von Änderungen](/docs/contribute/review/). <!-- body --> ## Aufgaben -Tägliche Aufgaben in einer einwöchigen Schicht als PR Wrangler: +Tägliche Aufgaben in einer einwöchigen Schicht als PR Wrangler: -- Sortiere und kennzeichne täglich eingehende Probleme. Siehe [Einstufung und Kategorisierung von Problemen](/docs/contribute/review/for-approvers/#triage-and-categorize-issues) für Richtlinien, wie SIG Docs Metadaten verwendet. -- Überprüfe [offene Pull Requests](https://github.com/kubernetes/website/pulls) auf Qualität und Einhaltung der [Style](/docs/contribute/style/style-guide/) und [Content](/docs/contribute/style/content-guide/) Leitfäden. - - Beginne mit den kleinsten PRs (`size/XS`) und ende mit den größten (`size/XXL`). Überprüfe so viele PRs, wie du kannst. +- Sortiere und kennzeichne täglich eingehende Probleme. Siehe [Einstufung und Kategorisierung von Problemen](/docs/contribute/review/for-approvers/#triage-and-categorize-issues) für Richtlinien, wie SIG Docs Metadaten verwendet. +- Überprüfe [offene Pull Requests](https://github.com/kubernetes/website/pulls) auf Qualität und Einhaltung der [Style](/docs/contribute/style/style-guide/) und [Content](/docs/contribute/style/content-guide/) Leitfäden. + - Beginne mit den kleinsten PRs (`size/XS`) und ende mit den größten (`size/XXL`). Überprüfe so viele PRs, wie du kannst. - Achte darauf, dass die PR-Autoren den [CLA](https://github.com/kubernetes/community/blob/master/CLA.md) unterschreiben. - Verwende [dieses](https://github.com/zparnold/k8s-docs-pr-botherer) Skript, um diejenigen, die den CLA noch nicht unterschrieben haben, daran zu erinnern, dies zu tun. -- Gib Feedback zu den Änderungen und bitte die Mitglieder anderer SIGs um technische Überprüfung. - - Gib inline Vorschläge für die vorgeschlagenen inhaltlichen Änderungen in den PR ein. - - Wenn du den Inhalt überprüfen musst, kommentiere den PR und bitte um weitere Details. +- Gib Feedback zu den Änderungen und bitte die Mitglieder anderer SIGs um technische Überprüfung. + - Gib inline Vorschläge für die vorgeschlagenen inhaltlichen Änderungen in den PR ein. + - Wenn du den Inhalt überprüfen musst, kommentiere den PR und bitte um weitere Details. - Vergebe das/die entsprechende(n) `sig/`-Label. - - Falls nötig, weise die Reviever aus dem Block `revievers:` im Vorspann der Datei zu. -- Benutze den Kommentar `/approve`, um einen PR zum Zusammenführen zu genehmigen. Führe den PR zusammen, wenn er inhaltlich und technisch einwandfrei ist. - - PRs sollten einen `/lgtm`-Kommentar von einem anderen Mitglied haben, bevor sie zusammengeführt werden. - - Erwäge, technisch korrekte Inhalte zu akzeptieren, die nicht den [Stilrichtlinien](/docs/contribute/style/style-guide/) entsprechen. Eröffne ein neues Thema mit dem Label `good first issue`, um Stilprobleme anzusprechen. + - Falls nötig, weise die Reviever aus dem Block `revievers:` im Vorspann der Datei zu. +- Benutze den Kommentar `/approve`, um einen PR zum Zusammenführen zu genehmigen. Führe den PR zusammen, wenn er inhaltlich und technisch einwandfrei ist. + - PRs sollten einen `/lgtm`-Kommentar von einem anderen Mitglied haben, bevor sie zusammengeführt werden. + - Erwäge, technisch korrekte Inhalte zu akzeptieren, die nicht den [Stilrichtlinien](/docs/contribute/style/style-guide/) entsprechen. Eröffne ein neues Thema mit dem Label `good first issue`, um Stilprobleme anzusprechen. -### Hilfreiche GitHub-Anfragen für Wranglers +### Hilfreiche GitHub-Anfragen für Wranglers Die folgenden Anfragen sind beim Wrangling hilfreich. -Wenn du diese Anfragen abgearbeitet hast, ist die verbleibende Liste der zu prüfenden PRs meist klein. -Diese Anfragen schließen Lokalisierungs-PRs aus. Alle Anfragen beziehen sich auf den Hauptast, außer der letzten. +Wenn du diese Anfragen abgearbeitet hast, ist die verbleibende Liste der zu prüfenden PRs meist klein. +Diese Anfragen schließen Lokalisierungs-PRs aus. Alle Anfragen beziehen sich auf den Hauptast, außer der letzten. -- [Kein CLA, nicht zusammenfürbar](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+label%3A%22cncf-cla%3A+no%22+-label%3A%22do-not-merge%2Fwork-in-progress%22+-label%3A%22do-not-merge%2Fhold%22+label%3Alanguage%2Fen): - Erinnere den Beitragenden daran, den CLA zu unterschreiben. Wenn sowohl der Bot als auch ein Mensch sie daran erinnert haben, schließe - den PR und erinnere die Autoren daran, dass sie ihn erneut öffnen können, nachdem sie den CLA unterschrieben haben. - **Überprüfe keine PRs, deren Autoren den CLA nicht unterschrieben haben!** -- [Benötigt LGTM](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+-label%3A%22cncf-cla%3A+kein%22+-label%3Ado-not-merge%2Fwork-in-progress+-label%3Ado-not-merge%2Fhold+label%3Alanguage%2Fen+-label%3Algtm): - Listet PRs auf, die ein LGTM von einem Mitglied benötigen. Wenn der PR eine technische Überprüfung benötigt, schalte einen der vom Bot vorgeschlagenen Reviewer ein. Wenn der Inhalt überarbeitet werden muss, füge Vorschläge und Feedback in-line hinzu. +- [Kein CLA, nicht zusammenfürbar](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+label%3A%22cncf-cla%3A+no%22+-label%3A%22do-not-merge%2Fwork-in-progress%22+-label%3A%22do-not-merge%2Fhold%22+label%3Alanguage%2Fen): + Erinnere den Beitragenden daran, den CLA zu unterschreiben. Wenn sowohl der Bot als auch ein Mensch sie daran erinnert haben, schließe + den PR und erinnere die Autoren daran, dass sie ihn erneut öffnen können, nachdem sie den CLA unterschrieben haben. + **Überprüfe keine PRs, deren Autoren den CLA nicht unterschrieben haben!** +- [Benötigt LGTM](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+-label%3A%22cncf-cla%3A+kein%22+-label%3Ado-not-merge%2Fwork-in-progress+-label%3Ado-not-merge%2Fhold+label%3Alanguage%2Fen+-label%3Algtm): + Listet PRs auf, die ein LGTM von einem Mitglied benötigen. Wenn der PR eine technische Überprüfung benötigt, schalte einen der vom Bot vorgeschlagenen Reviewer ein. Wenn der Inhalt überarbeitet werden muss, füge Vorschläge und Feedback in-line hinzu. - [Hat LGTM, braucht die Zustimmung von Docs](https://github.com/kubernetes/website/pulls?q=is%3Aopen+is%3Apr+-label%3Ado-not-merge%2Fwork-in-progress+-label%3Ado-not-merge%2Fhold+label%3Alanguage%2Fen+label%3Algtm+): - Listet PRs auf, die einen `/approve`-Kommentar benötigen, um zusammengeführt zu werden. -- [Quick Wins](https://github.com/kubernetes/website/pulls?utf8=%E2%9C%93&q=is%3Apr+is%3Aopen+base%3Amain+-label%3A%22do-not-merge%2Fwork-in-progress%22+-label%3A%22do-not-merge%2Fhold%22+label%3A%22cncf-cla%3A+yes%22+label%3A%22size%2FXS%22+label%3A%22language%2Fen%22): Listet PRs gegen den Hauptzweig auf, die nicht eindeutig blockiert sind. (ändere "XS" in der Größenbezeichnung, wenn du dich durch die PRs arbeitest [XS, S, M, L, XL, XXL]). -- [Nicht gegen den Hauptast](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+label%3Alanguage%2Fen+-base%3Amain): Wenn der PR gegen einen `dev-`Ast gerichtet ist, ist er für eine kommende Veröffentlichung. Weise diesen dem [Docs Release Manager](https://github.com/kubernetes/sig-release/tree/master/release-team#kubernetes-release-team-roles) zu: `/assign @<manager's_github-username>`. Wenn der PR gegen einen alten Ast gerichtet ist, hilf dem Autor herauszufinden, ob er auf den richtigen Ast gerichtet ist. + Listet PRs auf, die einen `/approve`-Kommentar benötigen, um zusammengeführt zu werden. +- [Quick Wins](https://github.com/kubernetes/website/pulls?utf8=%E2%9C%93&q=is%3Apr+is%3Aopen+base%3Amain+-label%3A%22do-not-merge%2Fwork-in-progress%22+-label%3A%22do-not-merge%2Fhold%22+label%3A%22cncf-cla%3A+yes%22+label%3A%22size%2FXS%22+label%3A%22language%2Fen%22): Listet PRs gegen den Hauptzweig auf, die nicht eindeutig blockiert sind. (ändere "XS" in der Größenbezeichnung, wenn du dich durch die PRs arbeitest [XS, S, M, L, XL, XXL]). +- [Nicht gegen den Hauptast](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+label%3Alanguage%2Fen+-base%3Amain): Wenn der PR gegen einen `dev-`Ast gerichtet ist, ist er für eine kommende Veröffentlichung. Weise diesen dem [Docs Release Manager](https://github.com/kubernetes/sig-release/tree/master/release-team#kubernetes-release-team-roles) zu: `/assign @<manager's_github-username>`. Wenn der PR gegen einen alten Ast gerichtet ist, hilf dem Autor herauszufinden, ob er auf den richtigen Ast gerichtet ist. -### Hilfreiche Prow-Befehle für Wranglers +### Hilfreiche Prow-Befehle für Wranglers ``` # Englisches Label hinzufuegen /language en -# füge dem PR ein Squash-Label hinzu, wenn es mehr als einen Commit gibt +# füge dem PR ein Squash-Label hinzu, wenn es mehr als einen Commit gibt /label tide/merge-method-squash # einen PR ueber Prow neu betiteln (z.B. als Work-in-Progress [WIP]) /retitle [WIP] <TITLE> ``` -### Wann Pull Requests schließen +### Wann Pull Requests schließen -Reviews und Genehmigungen sind ein Mittel, um unsere PR-Warteschlange kurz und aktuell zu halten. Ein weiteres Mittel ist das Schließen. +Reviews und Genehmigungen sind ein Mittel, um unsere PR-Warteschlange kurz und aktuell zu halten. Ein weiteres Mittel ist das Schließen. PRs werden geschlossen, wenn: - Der Autor den CLA seit zwei Wochen nicht unterschrieben hat. - Die Autoren können den PR wieder öffnen, nachdem sie den CLA unterschrieben haben. Dies ist ein risikoarmer Weg, um sicherzustellen, dass nichts zusammengeführt wird, ohne dass ein CLA unterzeichnet wurde. + Die Autoren können den PR wieder öffnen, nachdem sie den CLA unterschrieben haben. Dies ist ein risikoarmer Weg, um sicherzustellen, dass nichts zusammengeführt wird, ohne dass ein CLA unterzeichnet wurde. - Der Autor hat seit Zwei oder mehr Wochen nicht auf Kommentare oder Feedback geantwortet. -Hab keine Angst, Pull Requests zu schließen. Mitwirkende können sie leicht wieder öffnen und die laufenden Arbeiten fortsetzen. Oft ist es die Nachricht über die Schließung, die einen Autor dazu anspornt, seinen Beitrag wieder aufzunehmen und zu beenden. +Hab keine Angst, Pull Requests zu schließen. Mitwirkende können sie leicht wieder öffnen und die laufenden Arbeiten fortsetzen. Oft ist es die Nachricht über die Schließung, die einen Autor dazu anspornt, seinen Beitrag wieder aufzunehmen und zu beenden. -Um eine Pull-Anfrage zu schließen, hinterlasse einen `/close`-Kommentar zu dem PR. +Um eine Pull-Anfrage zu schließen, hinterlasse einen `/close`-Kommentar zu dem PR. {{< note >}} -Der [`fejta-bot`](https://github.com/fejta-bot) Bot markiert Themen nach 90 Tagen Inaktivität als veraltet. Nach weiteren 30 Tagen markiert er Issues als faul und schließt sie. PR-Beauftragte sollten Themen nach 14-30 Tagen Inaktivität schließen. +Der [`fejta-bot`](https://github.com/fejta-bot) Bot markiert Themen nach 90 Tagen Inaktivität als veraltet. Nach weiteren 30 Tagen markiert er Issues als faul und schließt sie. PR-Beauftragte sollten Themen nach 14-30 Tagen Inaktivität schließen. {{< /note >}} diff --git a/content/de/docs/contribute/participate/roles-and-responsibilities.md b/content/de/docs/contribute/participate/roles-and-responsibilities.md index 7322f9a302..44c7b60028 100644 --- a/content/de/docs/contribute/participate/roles-and-responsibilities.md +++ b/content/de/docs/contribute/participate/roles-and-responsibilities.md @@ -6,14 +6,14 @@ weight: 10 <!-- overview --> -Jeder kann zu Kubernetes beitragen. Wenn deine Beiträge zu SIG Docs wachsen, kannst du dich für verschiedene Stufen der Mitgliedschaft in der Community bewerben. -Diese Rollen ermöglichen es dir, mehr Verantwortung innerhalb der Gemeinschaft zu übernehmen. +Jeder kann zu Kubernetes beitragen. Wenn deine Beiträge zu SIG Docs wachsen, kannst du dich für verschiedene Stufen der Mitgliedschaft in der Community bewerben. +Diese Rollen ermöglichen es dir, mehr Verantwortung innerhalb der Gemeinschaft zu übernehmen. Jede Rolle erfordert mehr Zeit und Engagement. Die Rollen sind: -- Jeder: kann regelmäßig zur Kubernetes-Dokumentation beitragen -- Member: können Issues zuweisen und einstufen und Pull Requests unverbindlich prüfen -- Reviewer: können die Überprüfung von Dokumentations-Pull-Requests leiten und für die Qualität einer Änderung bürgen -- Approver: können die Überprüfung von Dokumentations- und Merge-Änderungen leiten +- Jeder: kann regelmäßig zur Kubernetes-Dokumentation beitragen +- Member: können Issues zuweisen und einstufen und Pull Requests unverbindlich prüfen +- Reviewer: können die Überprüfung von Dokumentations-Pull-Requests leiten und für die Qualität einer Änderung bürgen +- Approver: können die Überprüfung von Dokumentations- und Merge-Änderungen leiten <!-- body --> @@ -33,7 +33,7 @@ Jeder kann: Nach dem [Signieren des CLA](/docs/contribute/new-content/overview/#sign-the-cla) kann jeder auch: -- eine Pull-Anfrage öffnen, um bestehende Inhalte zu verbessern, neue Inhalte hinzuzufügen oder einen Blogbeitrag oder eine Fallstudie zu schreiben +- eine Pull-Anfrage öffnen, um bestehende Inhalte zu verbessern, neue Inhalte hinzuzufügen oder einen Blogbeitrag oder eine Fallstudie zu schreiben - Diagramme, Grafiken und einbettbare Screencasts und Videos erstellen Weitere Informationen findest du unter [neue Inhalte beisteuern](/docs/contribute/new-content/). @@ -44,26 +44,26 @@ Ein Member (Mitglied) ist jemand, der bereits mehrere Pull Requests an `kubernetes/website` eingereicht hat. Mitglieder sind ein Teil der [Kubernetes GitHub Organisation](https://github.com/kubernetes). -Member können: +Member können: -- Alles tun, was unter [Jeder](#jeder) aufgeführt ist -- Den Kommentar `/lgtm` verwenden, um einem Pull Request das Label LGTM (looks good to me) hinzuzufügen +- Alles tun, was unter [Jeder](#jeder) aufgeführt ist +- Den Kommentar `/lgtm` verwenden, um einem Pull Request das Label LGTM (looks good to me) hinzuzufügen {{< note >}} - Die Verwendung von `/lgtm` löst eine Automatisierung aus. Wenn du eine unverbindliche + Die Verwendung von `/lgtm` löst eine Automatisierung aus. Wenn du eine unverbindliche Zustimmung geben willst, funktioniert der Kommentar "LGTM" auch! {{< /note >}} -- Verwende den Kommentar `/hold`, um das Zusammenführen eines Pull Requests zu blockieren. +- Verwende den Kommentar `/hold`, um das Zusammenführen eines Pull Requests zu blockieren. - Benutze den Kommentar `/assign`, um einem Pull Request einen Reviewer zuzuweisen. -- Unverbindliche Überprüfung von Pull Requests +- Unverbindliche Überprüfung von Pull Requests - Nutze die Automatisierung, um Issues zu sortieren und zu kategorisieren - Neue Funktionen dokumentieren ### Mitglied werden Du kannst ein Mitglied werden, nachdem du mindestens 5 substantielle Pull Requests eingereicht hast und die anderen -[Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#member) erfüst: +[Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#member) erfüst: 1. Finde zwei [Reviewer](#reviewers) oder [Approver](#approvers), die deine Mitgliedschaft [sponsern](/docs/contribute/advanced#sponsor-a-new-contributor). @@ -75,19 +75,19 @@ Du kannst ein Mitglied werden, nachdem du mindestens 5 substantielle Pull Reques SIG Docs-Mitglied. Du musst das Sponsoring beantragen, bevor du deine Bewerbung einreichst. {{< /note >}} -1. Eröffne ein GitHub-Issue im +1. Eröffne ein GitHub-Issue im [`kubernetes/org`](https://github.com/kubernetes/org/) Repository. Verwende dabei das **Organization Membership Request** issue template. -1. Informiere deine Sponsoren über das GitHub-Issue. Du kannst entweder: - - Ihren GitHub-Benutzernamen in deinem Issue (`@<GitHub-Benutzername>`) erwähnen - - Ihnen den Issue-Link über Slack oder per E-Mail senden. +1. Informiere deine Sponsoren über das GitHub-Issue. Du kannst entweder: + - Ihren GitHub-Benutzernamen in deinem Issue (`@<GitHub-Benutzername>`) erwähnen + - Ihnen den Issue-Link über Slack oder per E-Mail senden. Die Sponsoren werden deine Anfrage mit einer "+1"-Stimme genehmigen. Sobald deine Sponsoren - genehmigen, fügt dich ein Kubernetes-GitHub-Admin als Mitglied hinzu. - Herzlichen Glückwunsch! + genehmigen, fügt dich ein Kubernetes-GitHub-Admin als Mitglied hinzu. + Herzlichen Glückwunsch! - Wenn dein Antrag auf Mitgliedschaft nicht angenommen wird, erhältst du eine Rückmeldung. + Wenn dein Antrag auf Mitgliedschaft nicht angenommen wird, erhältst du eine Rückmeldung. Nachdem du dich mit dem Feedback auseinandergesetzt hast, kannst du dich erneut bewerben. 1. Nimm die Einladung zur Kubernetes GitHub Organisation in deinem E-Mail-Konto an. @@ -98,15 +98,15 @@ Du kannst ein Mitglied werden, nachdem du mindestens 5 substantielle Pull Reques ## Reviewer -Reviewer (Rezensenten) sind dafür verantwortlich, offene Pull Requests zu überprüfen. Anders als bei den Mitgliedern -musst du auf das Feedback der Prüfer eingehen. Reviewer sind Mitglieder des +Reviewer (Rezensenten) sind dafür verantwortlich, offene Pull Requests zu überprüfen. Anders als bei den Mitgliedern +musst du auf das Feedback der Prüfer eingehen. Reviewer sind Mitglieder des [@kubernetes/sig-docs-{language}-reviews](https://github.com/orgs/kubernetes/teams?query=sig-docs) GitHub-Teams. -Rezensenten können: +Rezensenten können: -- Alles tun, was unter [Jeder](#jeder) und [Member](#member) aufgeführt ist -- Pull Requests überprüfen und verbindliches Feedback geben +- Alles tun, was unter [Jeder](#jeder) und [Member](#member) aufgeführt ist +- Pull Requests überprüfen und verbindliches Feedback geben {{< note >}} Um unverbindliches Feedback zu geben, stellst du deinen Kommentaren eine Formulierung wie "Optional:" voran. @@ -121,107 +121,107 @@ Die Automatisierung weist allen Pull Requests Reviewer zu. Du kannst eine Review von einer bestimmten Person anfordern, indem du einen Kommentar schreibst: `/assign [@_github_handle]`. -Wenn der zugewiesene Prüfer den PR nicht kommentiert hat, kann ein anderer Prüfer -einspringen. Du kannst bei Bedarf auch technische Prüfer zuweisen. +Wenn der zugewiesene Prüfer den PR nicht kommentiert hat, kann ein anderer Prüfer +einspringen. Du kannst bei Bedarf auch technische Prüfer zuweisen. ### Verwendung von `/lgtm` -LGTM steht für "Looks good to me" und zeigt an, dass ein Pull Request -technisch korrekt und bereit zum Zusammenführen ist. Alle PRs brauchen einen `/lgtm` Kommentar von einem -Reviewer und einen `/approve` Kommentar von einem Approver, um zusammengeführt zu werden. +LGTM steht für "Looks good to me" und zeigt an, dass ein Pull Request +technisch korrekt und bereit zum Zusammenführen ist. Alle PRs brauchen einen `/lgtm` Kommentar von einem +Reviewer und einen `/approve` Kommentar von einem Approver, um zusammengeführt zu werden. -Ein `/lgtm`-Kommentar vom Reviewer ist verbindlich und löst eine Automatisierung aus, die das `lgtm`-Label hinzufügt. +Ein `/lgtm`-Kommentar vom Reviewer ist verbindlich und löst eine Automatisierung aus, die das `lgtm`-Label hinzufügt. ### Reviewer werden Wenn du die -[Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#reviewer) erfüllst, -kannst du ein SIG Docs-Reviewer werden. Reviewer in anderen SIGs müssen sich gesondert für den Reviewer-Status in SIG Docs bewerben. +[Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#reviewer) erfüllst, +kannst du ein SIG Docs-Reviewer werden. Reviewer in anderen SIGs müssen sich gesondert für den Reviewer-Status in SIG Docs bewerben. So bewirbst du dich: -1. Eröffne einen Pull Request, in dem du deinen GitHub-Benutzernamen in einen Abschnitt der +1. Eröffne einen Pull Request, in dem du deinen GitHub-Benutzernamen in einen Abschnitt der [OWNERS_ALIASES](https://github.com/kubernetes/website/blob/main/OWNERS) Datei - im `kubernetes/website` Repository hinzufügt. + im `kubernetes/website` Repository hinzufügt. {{< note >}} - Wenn du dir nicht sicher bist, wo du dich hinzufügen sollst, füge dich zu `sig-docs-de-reviews` hinzu. + Wenn du dir nicht sicher bist, wo du dich hinzufügen sollst, füge dich zu `sig-docs-de-reviews` hinzu. {{< /note >}} 1. Weise den PR einem oder mehreren SIG-Docs-Genehmigern zu (Benutzernamen, die unter `sig-docs-{language}-owners` aufgelisted sind). - Wenn der PR genehmigt wurde, fügt dich ein SIG Docs-Lead dem entsprechenden GitHub-Team hinzu. Sobald du hinzugefügt bist, + Wenn der PR genehmigt wurde, fügt dich ein SIG Docs-Lead dem entsprechenden GitHub-Team hinzu. Sobald du hinzugefügt bist, wird [@k8s-ci-robot](https://github.com/kubernetes/test-infra/tree/master/prow#bots-home) - dich als Reviewer für neue Pull Requests vorschlagen und zuweisen. + dich als Reviewer für neue Pull Requests vorschlagen und zuweisen. ## Approver -Approver (Genehmiger) prüfen und genehmigen Pull Requests zum Zusammenführen. Genehmigende sind Mitglieder des +Approver (Genehmiger) prüfen und genehmigen Pull Requests zum Zusammenführen. Genehmigende sind Mitglieder des [@kubernetes/sig-docs-{language}-owners](https://github.com/orgs/kubernetes/teams/?query=sig-docs) GitHub-Teams. -Genehmigende können Folgendes tun: +Genehmigende können Folgendes tun: -- Alles, was unter [Jeder](#jeder), [Member](#member) und [Reviewer](#reviewes) aufgeführt ist -- Inhalte von Mitwirkenden veröffentlichen, indem sie Pull Requests mit dem Kommentar `/approve` genehmigen und zusammenführen -- Verbesserungen für den Style Guide vorschlagen -- Verbesserungsvorschläge für Docs-Tests einbringen -- Verbesserungsvorschläge für die Kubernetes-Website oder andere Tools machen +- Alles, was unter [Jeder](#jeder), [Member](#member) und [Reviewer](#reviewes) aufgeführt ist +- Inhalte von Mitwirkenden veröffentlichen, indem sie Pull Requests mit dem Kommentar `/approve` genehmigen und zusammenführen +- Verbesserungen für den Style Guide vorschlagen +- Verbesserungsvorschläge für Docs-Tests einbringen +- Verbesserungsvorschläge für die Kubernetes-Website oder andere Tools machen Wenn der PR bereits einen `/lgtm` hat, oder wenn der Genehmigende ebenfalls mit -`/lgtm` kommentiert, wird der PR automatisch zusammengeführt. Ein SIG Docs-Genehmiger sollte nur ein -`/lgtm` für eine Änderung hinterlassen, die keine weitere technische Überprüfung erfordert. +`/lgtm` kommentiert, wird der PR automatisch zusammengeführt. Ein SIG Docs-Genehmiger sollte nur ein +`/lgtm` für eine Änderung hinterlassen, die keine weitere technische Überprüfung erfordert. ### Pull Requests genehmigen Genehmiger und SIG Docs-Leads sind die Einzigen, die Pull Requests in das Website-Repository aufnehmen. Damit sind bestimmte Verantwortlichkeiten verbunden. -- Genehmigende können den Befehl `/approve` verwenden, der PRs in das Repository einfügt. +- Genehmigende können den Befehl `/approve` verwenden, der PRs in das Repository einfügt. {{< warning >}} - Ein unvorsichtiges Zusammenführen kann die Website lahmlegen, also sei dir sicher, dass du es auch so meinst, wenn du etwas zusammenführst. + Ein unvorsichtiges Zusammenführen kann die Website lahmlegen, also sei dir sicher, dass du es auch so meinst, wenn du etwas zusammenführst. {{< /warning >}} -- Vergewissere dich, dass die vorgeschlagenen Änderungen den +- Vergewissere dich, dass die vorgeschlagenen Änderungen den [Beitragsrichtlinien](/docs/contribute/style/content-guide/#contributing-content) entsprechen. - Wenn du jemals eine Frage hast oder dir bei etwas nicht sicher bist, fordere einfach Hilfe an, um eine zusätzliche Überprüfung zu erhalten. + Wenn du jemals eine Frage hast oder dir bei etwas nicht sicher bist, fordere einfach Hilfe an, um eine zusätzliche Überprüfung zu erhalten. - Vergewissere dich, dass die Netlify-Tests erfolgreich sind, bevor du einen PR mittels `/approve` genehmigst. - <img src="/images/docs/contribute/netlify-pass.png" width="75%" alt="Netlify-Tests müssen vor der Freigabe bestanden werden" /> + <img src="/images/docs/contribute/netlify-pass.png" width="75%" alt="Netlify-Tests müssen vor der Freigabe bestanden werden" /> -- Besuche die Netlify-Seitenvorschau für den PR, um sicherzustellen, dass alles gut aussieht, bevor du es genehmigst. +- Besuche die Netlify-Seitenvorschau für den PR, um sicherzustellen, dass alles gut aussieht, bevor du es genehmigst. - Nimm am [PR Wrangler Rotationsplan](https://github.com/kubernetes/website/wiki/PR-Wranglers) - für wöchentliche Rotationen teil. SIG Docs erwartet von allen Genehmigern, dass sie an dieser + für wöchentliche Rotationen teil. SIG Docs erwartet von allen Genehmigern, dass sie an dieser Rotation teilnehmen. Siehe [PR-Wranglers](/docs/contribute/participate/pr-wranglers/). - für weitere Details. + für weitere Details. ### Approver werden -Wenn du die [Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#approver) erfüllst, -kannst du ein SIG Docs Approver werden. Genehmigende in anderen SIGs müssen sich separat für den Approver-Status in SIG Docs bewerben. +Wenn du die [Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#approver) erfüllst, +kannst du ein SIG Docs Approver werden. Genehmigende in anderen SIGs müssen sich separat für den Approver-Status in SIG Docs bewerben. So bewirbst du dich: -1. Eröffne eine Pull-Anfrage, in der du dich in einem Abschnitt der +1. Eröffne eine Pull-Anfrage, in der du dich in einem Abschnitt der [OWNERS_ALIASES](https://github.com/kubernetes/website/blob/main/OWNERS) - Datei im `kubernetes/website` Repository hinzuzufügen. + Datei im `kubernetes/website` Repository hinzuzufügen. {{< note >}} - Wenn du dir nicht sicher bist, wo du dich hinzufügen sollst, füge dich zu `sig-docs-de-owners` hinzu. + Wenn du dir nicht sicher bist, wo du dich hinzufügen sollst, füge dich zu `sig-docs-de-owners` hinzu. {{< /note >}} 2. Weise den PR einem oder mehreren aktuellen SIG Docs Genehmigern zu. -Wenn der PR genehmigt wurde, fügt dich ein SIG Docs-Lead dem entsprechenden GitHub-Team hinzu. Sobald du hinzugefügt bist, +Wenn der PR genehmigt wurde, fügt dich ein SIG Docs-Lead dem entsprechenden GitHub-Team hinzu. Sobald du hinzugefügt bist, wird [@k8s-ci-robot](https://github.com/kubernetes/test-infra/tree/master/prow#bots-home) -dich als Reviewer für neue Pull Requests vorschlagen und zuweisen. +dich als Reviewer für neue Pull Requests vorschlagen und zuweisen. ## {{% heading "whatsnext" %}} -- Erfahre mehr über [PR-Wrangling](/de/docs/contribute/participate/pr-wranglers/), eine Rolle, die alle Genehmiger im Wechsel übernehmen. +- Erfahre mehr über [PR-Wrangling](/de/docs/contribute/participate/pr-wranglers/), eine Rolle, die alle Genehmiger im Wechsel übernehmen. From 4dc14931e83a07ac56a38b34ce04283bed1ffc31 Mon Sep 17 00:00:00 2001 From: Benedikt Rollik <brollik@online.net> Date: Fri, 22 Oct 2021 11:17:26 +0200 Subject: [PATCH 010/104] fix typo --- .../docs/contribute/participate/roles-and-responsibilities.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/de/docs/contribute/participate/roles-and-responsibilities.md b/content/de/docs/contribute/participate/roles-and-responsibilities.md index 44c7b60028..a031d192e0 100644 --- a/content/de/docs/contribute/participate/roles-and-responsibilities.md +++ b/content/de/docs/contribute/participate/roles-and-responsibilities.md @@ -63,7 +63,7 @@ Member können: ### Mitglied werden Du kannst ein Mitglied werden, nachdem du mindestens 5 substantielle Pull Requests eingereicht hast und die anderen -[Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#member) erfüst: +[Anforderungen](https://github.com/kubernetes/community/blob/master/community-membership.md#member) erforderst: 1. Finde zwei [Reviewer](#reviewers) oder [Approver](#approvers), die deine Mitgliedschaft [sponsern](/docs/contribute/advanced#sponsor-a-new-contributor). From 2261af19a72387ea95040f23945835f49b7a321f Mon Sep 17 00:00:00 2001 From: Benedikt Rollik <brollik@online.net> Date: Wed, 27 Oct 2021 15:55:30 +0200 Subject: [PATCH 011/104] fix typos and wording review --- .../de/docs/contribute/participate/_index.md | 30 ++++++++----------- .../contribute/participate/pr-wranglers.md | 8 ++--- .../participate/roles-and-responsibilities.md | 4 +-- 3 files changed, 19 insertions(+), 23 deletions(-) diff --git a/content/de/docs/contribute/participate/_index.md b/content/de/docs/contribute/participate/_index.md index 6a107c5e54..2db9bd9af1 100644 --- a/content/de/docs/contribute/participate/_index.md +++ b/content/de/docs/contribute/participate/_index.md @@ -18,11 +18,10 @@ zu laufenden Pull Requests abzugeben. Du kannst dich ausserdem als [Member](/de/docs/contribute/participate/roles-and-responsibilities/#member), [Reviewer](/de/docs/contribute/participate/roles-and-responsibilities/#reviewer), oder [Approver](/de/docs/contribute/participate/roles-and-responsibilities/#approver) beteiligen. -Diese Rollen erfordern einen erweiterten Zugriff und bringen bestimmte Verantwortlichkeiten für -Änderungen zu genehmigen und zu bestätigen. +Diese Rollen erfordern einen erweiterten Zugriff und bringen bestimmte Verantwortlichkeiten zur Genehmigung und Bestätigung von Änderungen mit sich. Unter [community-membership](https://github.com/kubernetes/community/blob/master/community-membership.md) findest du weitere Informationen darüber, wie die Mitgliedschaft in der Kubernetes-Community funktioniert. -Der Rest dieses Dokuments umreiß,t einige spezielle Vorgehensweisen dieser Rollen innerhalb von SIG Docs, die für die Pflege eines der öffentlichsten Aushängeschilder von Kubernetes verantwortlich ist - die Kubernetes-Website und die Dokumentation. +Der Rest dieses Dokuments umreißt einige spezielle Vorgehensweisen dieser Rollen innerhalb von SIG Docs, die für die Pflege eines der öffentlichsten Aushängeschilder von Kubernetes verantwortlich ist - die Kubernetes-Website und die Dokumentation. <!-- body --> ## SIG Docs Vorstand @@ -30,7 +29,7 @@ Der Rest dieses Dokuments umreiß,t einige spezielle Vorgehensweisen dieser Jede SIG, auch die SIG Docs, wählt ein oder mehrere SIG-Mitglieder, die als Vorstand fungieren. Sie sind die Kontaktstellen zwischen der SIG Docs und anderen Teilen der der Kubernetes-Organisation. Sie benötigen umfassende Kenntnisse über die Struktur -des Kubernetes-Projekts als Ganzes und wie SIG Docs darin arbeitet. Informationen zur [Leitung](https://github.com/kubernetes/community/tree/master/sig-docs#leadership) und den aktuellen Vorsitzenden. +des Kubernetes-Projekts als Ganzes und wie SIG Docs darin arbeitet. Hier findest zu alle weiteren Informationen zu den aktuellen Vorsitzenden und der [Leitung](https://github.com/kubernetes/community/tree/master/sig-docs#leadership). ## SIG Docs-Teams und Automatisierung Die Automatisierung in SIG Docs stützt sich auf zwei verschiedene Mechanismen: @@ -43,11 +42,9 @@ Es gibt zwei Kategorien von SIG Docs [Teams](https://github.com/orgs/kubernetes/ - `@sig-docs-{language}-owners` sind Genehmiger und Verantwortliche - `@sig-docs-{language}-reviewers` sind Reviewer -Jede Gruppe kann in GitHub-Kommentaren mit ihrem `@name` referenziert werden, um mit -mit allen Mitgliedern dieser Gruppe zu kommunizieren. +Jede Gruppe kann in GitHub-Kommentaren mit ihrem `@name` referenziert werden, um mit allen Mitgliedern dieser Gruppe zu kommunizieren. -Manchmal überschneiden sich Prow- und GitHub-Teams, ohne genau übereinzustimmen. Für -Zuordnung von Issues, Pull-Requests und zur Unterstützung von PR-Genehmigungen verwendet die +Manchmal überschneiden sich Prow- und GitHub-Teams, ohne eine genaue Übereinstimmung. Für die Zuordnung von Issues, Pull-Requests und zur Unterstützung von PR-Genehmigungen verwendet die Automatisierung die Informationen aus den `OWNERS`-Dateien. ### OWNERS Dateien und Front-Matter @@ -58,7 +55,7 @@ Das [Kubernetes-Website-Repository](https://github.com/kubernetes/website) verwe - blunderbuss - approve -Diese beiden Plugins verwenden die +Diese beiden Plugins nutzen die [OWNERS](https://github.com/kubernetes/website/blob/main/OWNERS) und [OWNERS_ALIASES](https://github.com/kubernetes/website/blob/main/OWNERS_ALIASES) Dateien auf der obersten Ebene des GitHub-Repositorys `kubernetes/website`, um zu steuern @@ -66,25 +63,24 @@ wie prow innerhalb des Repositorys arbeitet. Eine OWNERS-Datei enthält eine Liste von Personen, die SIG Docs-Reviewer und Genehmiger sind. OWNERS-Dateien können auch in Unterverzeichnissen existieren und bestimmen, wer -Dateien in diesem Unterverzeichnis und seinen Unterverzeichnissen als Rezensent oder -Genemiger bestätigen darf. Weitere Informationen über OWNERS-Dateien im Allgemeinen findest du unter +Dateien in diesem Unterverzeichnis und seinen Unterverzeichnissen als Gutachter oder +Genehmiger bestätigen darf. Weitere Informationen über OWNERS-Dateien im Allgemeinen findest du unter [OWNERS](https://github.com/kubernetes/community/blob/master/contributors/guide/owners.md). -Auß,erdem kann eine einzelne Markdown-Datei in ihrem Front-Matter (Vorspann) Reviewer und Genehmiger auflisten. +Außerdem kann eine einzelne Markdown-Datei in ihrem Front-Matter (Vorspann) Reviewer und Genehmiger auflisten. Entweder durch Auflistung einzelner GitHub-Benutzernamen oder GitHub-Gruppen. -Die Kombination aus OWNERS-Dateien und Front-Matter in Markdown-Dateien bestimmt, welche Ratschläge PR-Eigentümer von automatisierten Systemen erhalten, und wen sie um eine technische und redaktionelle Überprüfung ihres PRs bitten sollen. +Die Kombination aus OWNERS-Dateien und Front-Matter in Markdown-Dateien bestimmt, welche Empfehlungen PR-Eigentümer von automatisierten Systemen erhalten, und wen sie um eine technische und redaktionelle Überprüfung ihres PRs bitten sollen. ## So funktioniert das Zusammenführen -Wenn ein Pull Request mit der Branch (Ast) zusammengeführt wird, in dem der Inhalt veröffentlicht werden soll, wird dieser Inhalt auf http://kubernetes.io veröffentlicht. Um sicherzustellen, dass die Qualität der veröffentlichten Inhalte hoch ist, beschränken wir das Zusammenführen von Pull Requests auf +Wenn ein Pull Request mit der Branch (Ast) zusammengeführt wird, in dem der Inhalt bereitgestellt werden soll, wird dieser Inhalt auf http://kubernetes.io veröffentlicht. Um sicherzustellen, dass die Qualität der veröffentlichten Inhalte hoch ist, beschränken wir das Zusammenführen von Pull Requests auf SIG Docs Freigabeberechtigte. So funktioniert es: - Wenn eine Pull-Anfrage sowohl das `lgtm`- als auch das `approve`-Label hat, kein `hold`-Label hat, und alle Tests bestanden sind, wird der Pull Request automatisch zusammengeführt. -- Mitglieder der Kubernetes-Organisation und SIG Docs-Genehmiger können Kommentare hinzufügen, um - Kommentare hinzufügen, um das automatische Zusammenführen eines Pull Requests zu verhindern (durch Hinzufügen eines `/hold`-Kommentars - kann ein vorheriger `/lgtm`-Kommentar zurückgehalten werden). - Jedes Kubernetes-Mitglied kann das `lgtm`-Label hinzufügen, indem es einen `/lgtm`-Kommentar hinzufügt. +- Mitglieder der Kubernetes-Organisation und SIG Docs-Genehmiger können kommentieren, um das automatische Zusammenführen eines Pull Requests zu verhindern (durch Hinzufügen eines `/hold`-Kommentars + kann ein vorheriger `/lgtm`-Kommentar zurückgehalten werden). - Nur SIG Docs-Genehmiger können einen Pull Request zusammenführen indem sie einen `/approve` Kommentar hinzufügen. Einige Genehmiger übernehmen auch weitere spezielle Rollen, wie zum Beispiel [PR Wrangler](/docs/contribute/participate/pr-wranglers/) oder [SIG Docs Vorsitzende](#sig-docs-chairperson). diff --git a/content/de/docs/contribute/participate/pr-wranglers.md b/content/de/docs/contribute/participate/pr-wranglers.md index 7705bbc377..9b8dab89c3 100644 --- a/content/de/docs/contribute/participate/pr-wranglers.md +++ b/content/de/docs/contribute/participate/pr-wranglers.md @@ -33,7 +33,7 @@ Tägliche Aufgaben in einer einwöchigen Schicht als PR Wrangler: Die folgenden Anfragen sind beim Wrangling hilfreich. Wenn du diese Anfragen abgearbeitet hast, ist die verbleibende Liste der zu prüfenden PRs meist klein. -Diese Anfragen schließen Lokalisierungs-PRs aus. Alle Anfragen beziehen sich auf den Hauptast, außer der letzten. +Diese Anfragen schließen Lokalisierungs-PRs aus. Alle Anfragen beziehen sich auf den `main`-Branch, außer der letzten. - [Kein CLA, nicht zusammenfürbar](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+label%3A%22cncf-cla%3A+no%22+-label%3A%22do-not-merge%2Fwork-in-progress%22+-label%3A%22do-not-merge%2Fhold%22+label%3Alanguage%2Fen): Erinnere den Beitragenden daran, den CLA zu unterschreiben. Wenn sowohl der Bot als auch ein Mensch sie daran erinnert haben, schließe @@ -44,12 +44,12 @@ Diese Anfragen schließen Lokalisierungs-PRs aus. Alle Anfragen beziehen sich au - [Hat LGTM, braucht die Zustimmung von Docs](https://github.com/kubernetes/website/pulls?q=is%3Aopen+is%3Apr+-label%3Ado-not-merge%2Fwork-in-progress+-label%3Ado-not-merge%2Fhold+label%3Alanguage%2Fen+label%3Algtm+): Listet PRs auf, die einen `/approve`-Kommentar benötigen, um zusammengeführt zu werden. - [Quick Wins](https://github.com/kubernetes/website/pulls?utf8=%E2%9C%93&q=is%3Apr+is%3Aopen+base%3Amain+-label%3A%22do-not-merge%2Fwork-in-progress%22+-label%3A%22do-not-merge%2Fhold%22+label%3A%22cncf-cla%3A+yes%22+label%3A%22size%2FXS%22+label%3A%22language%2Fen%22): Listet PRs gegen den Hauptzweig auf, die nicht eindeutig blockiert sind. (ändere "XS" in der Größenbezeichnung, wenn du dich durch die PRs arbeitest [XS, S, M, L, XL, XXL]). -- [Nicht gegen den Hauptast](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+label%3Alanguage%2Fen+-base%3Amain): Wenn der PR gegen einen `dev-`Ast gerichtet ist, ist er für eine kommende Veröffentlichung. Weise diesen dem [Docs Release Manager](https://github.com/kubernetes/sig-release/tree/master/release-team#kubernetes-release-team-roles) zu: `/assign @<manager's_github-username>`. Wenn der PR gegen einen alten Ast gerichtet ist, hilf dem Autor herauszufinden, ob er auf den richtigen Ast gerichtet ist. +- [Nicht gegen den `main`-Branch](https://github.com/kubernetes/website/pulls?q=is%3Aopen+ist%3Apr+label%3Alanguage%2Fen+-base%3Amain): Wenn der PR gegen einen `dev-`Ast gerichtet ist, ist er für eine kommende Veröffentlichung. Weise diesen dem [Docs Release Manager](https://github.com/kubernetes/sig-release/tree/master/release-team#kubernetes-release-team-roles) zu: `/assign @<manager's_github-username>`. Wenn der PR gegen einen alten Ast gerichtet ist, hilf dem Autor herauszufinden, ob er auf den richtigen Ast gerichtet ist. ### Hilfreiche Prow-Befehle für Wranglers ``` -# Englisches Label hinzufuegen +# Englisches Label hinzufügen /language en # füge dem PR ein Squash-Label hinzu, wenn es mehr als einen Commit gibt @@ -59,7 +59,7 @@ Diese Anfragen schließen Lokalisierungs-PRs aus. Alle Anfragen beziehen sich au /retitle [WIP] <TITLE> ``` -### Wann Pull Requests schließen +### Wann sind Pull Requests zu schließen Reviews und Genehmigungen sind ein Mittel, um unsere PR-Warteschlange kurz und aktuell zu halten. Ein weiteres Mittel ist das Schließen. diff --git a/content/de/docs/contribute/participate/roles-and-responsibilities.md b/content/de/docs/contribute/participate/roles-and-responsibilities.md index a031d192e0..66bf0c7891 100644 --- a/content/de/docs/contribute/participate/roles-and-responsibilities.md +++ b/content/de/docs/contribute/participate/roles-and-responsibilities.md @@ -98,12 +98,12 @@ Du kannst ein Mitglied werden, nachdem du mindestens 5 substantielle Pull Reques ## Reviewer -Reviewer (Rezensenten) sind dafür verantwortlich, offene Pull Requests zu überprüfen. Anders als bei den Mitgliedern +Reviewer (Gutachteren) sind dafür verantwortlich, offene Pull Requests zu überprüfen. Anders als bei den Mitgliedern musst du auf das Feedback der Prüfer eingehen. Reviewer sind Mitglieder des [@kubernetes/sig-docs-{language}-reviews](https://github.com/orgs/kubernetes/teams?query=sig-docs) GitHub-Teams. -Rezensenten können: +Gutachteren können: - Alles tun, was unter [Jeder](#jeder) und [Member](#member) aufgeführt ist - Pull Requests überprüfen und verbindliches Feedback geben From e97b170c509c6a5ed6792a4432b856a30de01260 Mon Sep 17 00:00:00 2001 From: Benedikt Rollik <brollik@online.net> Date: Wed, 27 Oct 2021 16:04:40 +0200 Subject: [PATCH 012/104] typo --- content/de/docs/contribute/participate/_index.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/de/docs/contribute/participate/_index.md b/content/de/docs/contribute/participate/_index.md index 2db9bd9af1..5b39657764 100644 --- a/content/de/docs/contribute/participate/_index.md +++ b/content/de/docs/contribute/participate/_index.md @@ -29,7 +29,8 @@ Der Rest dieses Dokuments umreißt einige spezielle Vorgehensweisen dieser Rolle Jede SIG, auch die SIG Docs, wählt ein oder mehrere SIG-Mitglieder, die als Vorstand fungieren. Sie sind die Kontaktstellen zwischen der SIG Docs und anderen Teilen der der Kubernetes-Organisation. Sie benötigen umfassende Kenntnisse über die Struktur -des Kubernetes-Projekts als Ganzes und wie SIG Docs darin arbeitet. Hier findest zu alle weiteren Informationen zu den aktuellen Vorsitzenden und der [Leitung](https://github.com/kubernetes/community/tree/master/sig-docs#leadership). +des Kubernetes-Projekts als Ganzes und wie SIG Docs darin arbeitet. Hier findest alle weiteren Informationen zu den aktuellen Vorsitzenden und der [Leitung](https://github.com/kubernetes/community/tree/master/sig-docs#leadership). + ## SIG Docs-Teams und Automatisierung Die Automatisierung in SIG Docs stützt sich auf zwei verschiedene Mechanismen: From 734aa6b6735ca20a72814c0c10176c4c29765013 Mon Sep 17 00:00:00 2001 From: Jari Moellenbernd <jari.moellenbernd@assecosol.com> Date: Thu, 4 Nov 2021 20:32:11 +0100 Subject: [PATCH 013/104] Fix typo in hello-minikube.md --- content/de/docs/tutorials/hello-minikube.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/de/docs/tutorials/hello-minikube.md b/content/de/docs/tutorials/hello-minikube.md index a1bf6dd493..2137c5fdd9 100644 --- a/content/de/docs/tutorials/hello-minikube.md +++ b/content/de/docs/tutorials/hello-minikube.md @@ -105,7 +105,7 @@ Der Pod führt einen Container basierend auf dem bereitgestellten Docker-Image a hello-node-5f76cf6ccf-br9b5 1/1 Running 0 1m ``` -4. Cluster Events anzigen: +4. Cluster Events anzeigen: ```shell kubectl get events From 7a7fa15a4833737cd775c8c3bf9d7692294e9954 Mon Sep 17 00:00:00 2001 From: Andreas Deininger <andreas@deininger.net> Date: Tue, 30 Nov 2021 18:30:55 +0100 Subject: [PATCH 014/104] Minor improvements --- content/de/docs/contribute/localization.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/content/de/docs/contribute/localization.md b/content/de/docs/contribute/localization.md index d40f941776..ea83b3e7eb 100644 --- a/content/de/docs/contribute/localization.md +++ b/content/de/docs/contribute/localization.md @@ -22,30 +22,30 @@ Da Mitwirkende nicht ihren eigenen Pull Request freigeben können, brauchst du m Alle Lokalisierungsteams müssen sich mit ihren eigenen Ressourcen selbst tragen. Die Kubernetes-Website ist gerne bereit, deine Arbeit zu beherbergen, aber es liegt an dir, sie zu übersetzen. -### Finden deinen Zwei-Buchstaben-Sprachcode +### Ermittlung deines Zwei-Buchstaben-Sprachcodes Rufe den [ISO 639-1 Standard](https://www.loc.gov/standards/iso639-2/php/code_list.php) auf und finde deinen Zwei-Buchstaben-Ländercode zur Lokalisierung. Zum Beispiel ist der Zwei-Buchstaben-Code für Korea `ko`. -### Duplizieren und klonen des Repositories +### Duplizieren und Klonen des Repositories -Als erstes [erstells du dir deine eigenes Duplikat](/docs/contribute/new-content/new-content/#fork-the-repo) vom [kubernetes/website] Repository. +Als erstes [erstellst du dir deine eigenes Duplikat](/docs/contribute/new-content/new-content/#fork-the-repo) vom [kubernetes/website] Repository. -Dann klonst du das Duplikat und `cd` hinein: +Dann klonst du das Duplikat und wechselst in das neu erstellte Verzeichnis: ```shell git clone https://github.com/<username>/website cd website ``` -### Eröffne ein Pull Request +### Eröffnen eines Pull Requests Als nächstes [eröffnest du einen Pull Request](/docs/contribute/new-content/open-a-pr/#open-a-pr) (PR) um eine Lokalisierung zum `kubernetes/website` Repository hinzuzufügen. -Der PR muss die [minimalen Inhaltsanforderungen](#mindestanforderungen) erfüllen bevor dieser genehmigt werden kann. +Der PR muss die [minimalen Inhaltsanforderungen](#mindestanforderungen) erfüllen, bevor dieser genehmigt werden kann. -Wie der PR für eine neue Lokalisierung aussieht kannst du dir an dem PR für die [Französische Dokumentation](https://github.com/kubernetes/website/pull/12548) ansehen. +Wie der PR für eine neue Lokalisierung aussieht, kannst du dir an dem PR für die [Französische Dokumentation](https://github.com/kubernetes/website/pull/12548) ansehen. -### Trete der Kubernetes GitHub Organisation bei +### Tritt der Kubernetes GitHub Organisation bei Sobald du eine Lokalisierungs-PR eröffnet hast, kannst du Mitglied der Kubernetes GitHub Organisation werden. Jede Person im Team muss einen eigenen [Antrag auf Mitgliedschaft in der Organisation](https://github.com/kubernetes/org/issues/new/choose) im `kubernetes/org`-Repository erstellen. @@ -94,9 +94,9 @@ contentDir = "content/de" weight = 3 ``` -Wenn du deinem Block einen Parameter `weight` zuweist, suche den Sprachblock mit dem höchsten Gewicht und addiere 1 zu diesem Wert. +Wenn du deinem Block einen Parameter `weight` zuweist, suche den Sprachblock mit dem höchsten Gewicht und addiere 1 zu diesem Wert. -Weitere Informationen zu Hugos Multilingualen Support findest du unter "[Multilingual Mode](https://gohugo.io/content-management/multilingual/)" auf in der Hugo Dokumentation. +Weitere Informationen zu Hugos multilingualem Support findest du unter "[Multilingual Mode](https://gohugo.io/content-management/multilingual/)" auf in der Hugo Dokumentation. ### Neuen Lokalisierungsordner erstellen From e05a28c402485d3659a145cd58d36bb88ad77727 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Mon, 20 Dec 2021 08:33:58 +0800 Subject: [PATCH 015/104] [zh] Translate kubeadm config ref v1beta2 --- .../config-api/kubeadm-config.v1beta2.md | 1830 +++++++++++++++++ 1 file changed, 1830 insertions(+) create mode 100644 content/zh/docs/reference/config-api/kubeadm-config.v1beta2.md diff --git a/content/zh/docs/reference/config-api/kubeadm-config.v1beta2.md b/content/zh/docs/reference/config-api/kubeadm-config.v1beta2.md new file mode 100644 index 0000000000..a1a8bee01c --- /dev/null +++ b/content/zh/docs/reference/config-api/kubeadm-config.v1beta2.md @@ -0,0 +1,1830 @@ +--- +title: kubeadm 配置 (v1beta2) +content_type: tool-reference +package: kubeadm.k8s.io/v1beta2 +auto_generated: true +--- + +<!-- +title: kubeadm Configuration (v1beta2) +content_type: tool-reference +package: kubeadm.k8s.io/v1beta2 +auto_generated: true +--> +<!-- +<h2>Overview</h2> +<p>Package v1beta2 defines the v1beta2 version of the kubeadm configuration file format. +This version improves on the v1beta1 format by fixing some minor issues and adding a few new fields.</p> +<p>A list of changes since v1beta1:</p> +--> +<h2>概述</h2> + +<p>包 v1beta2 定义 kubeadm 配置文件格式的 v1beta2 版本。 +此版本改进了 v1beta1 的格式，修复了一些小问题并添加了一些新的字段。</p> + +<p>从 v1beta1 版本以来的变更列表：</p> + +<ul> +<!-- +<li>"certificateKey" field is added to InitConfiguration and JoinConfiguration.</li> +<li>"ignorePreflightErrors" field is added to the NodeRegistrationOptions.</li> +<li>The JSON "omitempty" tag is used in a more places where appropriate.</li> +<li>The JSON "omitempty" tag of the "taints" field (inside NodeRegistrationOptions) is removed.</li> +--> +<li>"certificateKey" 字段被添加到 InitConfiguration 和 JoinConfiguration 中。</li> +<li>"ignorePreflightErrors" 字段被添加到 NodeRegistrationOptions 中。</li> +<li>JSON 标签 "omitempty" 在合适的情况下被用到更多的位置。</li> +<li>"taints" 字段（在 NodeRegistrationOptions）的 JSON 标签 "omitempty" 被去除。</li> +</ul> + +<!-- +<p>See the Kubernetes 1.15 changelog for further details.</p> +--> +<p>参阅 Kubernetes 1.15 的变更记录以了解详细信息。</p> + +<!-- +<p>Migration from old kubeadm config versions</p> +<p>Please convert your v1beta1 configuration files to v1beta2 using the "kubeadm config migrate" command of kubeadm v1.15.x +(conversion from older releases of kubeadm config files requires older release of kubeadm as well e.g.</p> +<ul> +<li>kubeadm v1.11 should be used to migrate v1alpha1 to v1alpha2; kubeadm v1.12 should be used to translate v1alpha2 to v1alpha3;</li> +<li>kubeadm v1.13 or v1.14 should be used to translate v1alpha3 to v1beta1)</li> +</ul> +--> +<p>从老的 kubeadm 配置版本迁移：</p> +<p>请使用 kubeadm v1.15.x 的 "kubeadm config migrate" 命令将 v1beta1 +版本的配置文件转换为 v1beta2。 +（从更老版本的 kubeadm 配置文件迁移需要使用更老版本的 kubeadm。例如：</p> +<ul> +<li>kubeadm v1.11 版本可以用来从 v1alpha1 迁移到 v1alpha2 版本；kubeadm v1.12 +可用来将 v1alpha2 翻译为 v1alpha3。</li> +<li>kubeadm v1.13 或 v1.14 可以用来将 v1alpha3 迁移到 v1beta1。</li> +</ul> +） + +<!-- +<p>Nevertheless, kubeadm v1.15.x will support reading from v1beta1 version of the kubeadm config file format.</p> +--> +<p>尽管如此，kubeadm v1.15.x 会支持读取 v1beta1 版本的 kubeadm 配置文件格式。</p> + +<!-- +<h2>Basics</h2> +<p>The preferred way to configure kubeadm is to pass an YAML configuration file with the <code>--config</code> option. Some of the +configuration options defined in the kubeadm config file are also available as command line flags, but only +the most common/simple use case are supported with this approach.</p> +<p>A kubeadm config file could contain multiple configuration types separated using three dashes (<code>---</code>).</p> +<p>kubeadm supports the following configuration types:</p> +--> +<h2>基础知识</h2> + +<p>配置 kubeadm 的推荐方式是使用 <code>--config</code> 选项向其传递一个 YAML 配置文件。 +kubeadm 配置文件中定义的某些配置选项也可以作为命令行标志来使用， +不过这种方法所支持的都是一些最常见的、最简单的使用场景。</p> + +<p>一个 kubeadm 配置文件中可以包含多个配置类型，使用三根横线（<code>---</code>）作为分隔符。</p> + +<p>kubeadm 支持以下配置类型：</p> + +<pre style="background-color:#fff"><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeadm.k8s.io/v1beta2<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>InitConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeadm.k8s.io/v1beta2<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>ClusterConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubelet.config.k8s.io/v1beta1<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>KubeletConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeproxy.config.k8s.io/v1alpha1<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>KubeProxyConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeadm.k8s.io/v1beta2<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>JoinConfiguration<span style="color:#bbb"> +</span></pre> + +<!-- +<p>To print the defaults for "init" and "join" actions use the following commands:</p> +--> +<p>要输出 "init" 和 "join" 动作的默认值，可以使用下面的命令：</p> + +<pre style="background-color:#fff">kubeadm config print init-defaults +kubeadm config print join-defaults +</pre> + +<!-- +<p>The list of configuration types that must be included in a configuration file depends by the action you are +performing (<code>init</code> or <code>join</code>) and by the configuration options you are going to use (defaults or advanced customization).</p> +<p>If some configuration types are not provided, or provided only partially, kubeadm will use default values; defaults +provided by kubeadm includes also enforcing consistency of values across components when required (e.g. +<code>--cluster-cidr</code> flag on controller manager and <code>clusterCIDR</code> on kube-proxy).</p> +--> +<p>配置文件中必须包含的配置类型列表取决于你在执行的动作（<code>init</code> 或 <code>join</code>）， +也取决于你要使用的配置选项（默认值或者高级定制）。</p> + +<p>如果某些配置类型没有提供，或者仅部分提供，kubeadm 将使用默认值； +kubeadm 所提供的默认值在必要时也会保证其在多个组件之间是一致的 +（例如控制器管理器上的 <code>--cluster-cidr</code> 参数和 kube-proxy 上的 +<code>clusterCIDR</code>）。</p> + +<!-- +<p>Users are always allowed to override default values, with the only exception of a small subset of setting with +relevance for security (e.g. enforce authorization-mode Node and RBAC on API server)</p> +<p>If the user provides a configuration types that is not expected for the action you are performing, kubeadm will +ignore those types and print a warning.</p> +--> +<p>用户总是可以重载默认配置值，唯一的例外是一小部分与安全性相关联的配置 +（例如在 API 服务器上强制实施 Node 和 RBAC 鉴权模式）。</p> + +<p>如果用户所提供的配置类型并非你所执行的操作需要的， +kubeadm 会忽略这些配置类型并打印警告信息。</p> + +<!-- +<h2>Kubeadm init configuration types</h2> +<p>When executing kubeadm init with the <code>--config</code> option, the following configuration types could be used: +InitConfiguration, ClusterConfiguration, KubeProxyConfiguration, KubeletConfiguration, but only one +between InitConfiguration and ClusterConfiguration is mandatory.</p> +--> +<h2>kubeadm init 配置类型</h2> + +<p>当带有 <code>--config</code> 选项来执行 kubeadm init 命令时，可以使用下面的配置类型： +<code>InitConfiguration</code>、<code>ClusterConfiguration</code>、<code>KubeProxyConfiguration</code>、 +<code>KubeletConfiguration</code>，但 <code>InitConfiguration</code> 和 <code>ClusterConfiguration</code> +之间只有一个是必须提供的。</p> + +<pre style="background-color:#fff"><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeadm.k8s.io/v1beta2<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>InitConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">bootstrapTokens</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>...<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">nodeRegistration</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>...<span style="color:#bbb"> +</span></pre> + +<!-- +<p>The InitConfiguration type should be used to configure runtime settings, that in case of <code>kubeadm init</code> +are the configuration of the bootstrap token and all the setting which are specific to the node where kubeadm +is executed, including:</p> +<ul> +<li> +<p><code>nodeRegistration</code>, that holds fields that relate to registering the new node to the cluster; +use it to customize the node name, the CRI socket to use or any other settings that should apply to this +node only (e.g. the node ip).</p> +</li> +<li> +<p><code>apiServer</code>, that represents the endpoint of the instance of the API server to be deployed on this node; +use it e.g. to customize the API server advertise address.</p> +</li> +</ul> +--> +<p>类型 InitConfiguration 用来配置运行时设置，就 kubeadm init 命令而言， +包括启动引导令牌以及所有与 kubeadm 所在节点相关的设置，包括：</p> + +<ul> +<li><code>nodeRegistration</code>：其中包含与向集群注册新节点相关的字段； +使用这个类型来定制节点名称、要使用的 CRI 套接字或者其他仅对当前节点起作用的设置 +（例如节点 IP 地址）。</li> +<li><code>apiServer</code>：代表的是要部署到此节点上的 API 服务器示例的端点； +使用这个类型可以完成定制 API 服务器公告地址这类操作。</li> +</ul> + +<pre style="background-color:#fff"><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeadm.k8s.io/v1beta2<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>ClusterConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">networking</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>...<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">etcd</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>...<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">apiServer</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">extraArgs</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>...<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">extraVolumes</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>...<span style="color:#bbb"> +</span><span style="color:#bbb"></span>...<span style="color:#bbb"> +</span></pre> + +<!-- +<p>The ClusterConfiguration type should be used to configure cluster-wide settings, +including settings for:</p> +<ul> +<li> +<p>Networking, that holds configuration for the networking topology of the cluster; use it e.g. to customize +pod subnet or services subnet.</p> +</li> +--> +<p>类型 <code>ClusterConfiguration</code> 用来定制集群范围的设置，具体包括以下设置：</p> + +<ul> +<li><code>networking</code>：其中包含集群的网络拓扑配置。使用这一部分可以定制 Pod +的子网或者 Service 的子网。</li> + +<!-- +<li> +<p>Etcd configurations; use it e.g. to customize the local etcd or to configure the API server +for using an external etcd cluster.</p> +</li> +<li> +<p>kube-apiserver, kube-scheduler, kube-controller-manager configurations; use it to customize control-plane +components by adding customized setting or overriding kubeadm default settings.</p> +</li> +--> +<li><code>etcd</code>：etcd 数据库的配置。例如使用这个部分可以定制本地 etcd 或者配置 +API 服务器使用一个外部的 etcd 集群。</li> +<li><code>kube-apiserver</code>、<code>kube-scheduler</code>、<code>kube-controller-manager</code> +配置：这些部分可以通过添加定制的设置或者重载 kubeadm 的默认设置来定制控制面组件。</li> +</ul> + +<pre style="background-color:#fff"><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeproxy.config.k8s.io/v1alpha1<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>KubeProxyConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>...<span style="color:#bbb"> +</span></pre> + +<!-- +<p>The KubeProxyConfiguration type should be used to change the configuration passed to kube-proxy instances deployed +in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults.</p> +<p>See https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/ or +https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration +for kube proxy official documentation.</p> +--> +<p>KubeProxyConfiguration 类型用来更改传递给在集群中部署的 kube-proxy 实例的配置。 +如果此对象没有提供，或者仅部分提供，kubeadm 使用默认值。</p> + +<p>关于 kube-proxy 的官方文档，可参阅 +https://kubernetes.io/zh/docs/reference/command-line-tools-reference/kube-proxy/ +或者 https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration。 +</p> + +<pre style="background-color:#fff"><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubelet.config.k8s.io/v1beta1<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>KubeletConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>...<span style="color:#bbb"> +</span></pre> +<!-- +<p>The KubeletConfiguration type should be used to change the configurations that will be passed to all kubelet instances +deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults.</p> +<p>See https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ or +https://godoc.org/k8s.io/kubelet/config/v1beta1#KubeletConfiguration +for kubelet official documentation.</p> +<p>Here is a fully populated example of a single YAML file containing multiple +configuration types to be used during a <code>kubeadm init</code> run.</p> +--> +<p>KubeletConfiguration 类型用来更改传递给在集群中部署的 kubelet 实例的配置。 +如果此对象没有提供，或者仅部分提供，kubeadm 使用默认值。</p> + +<p>关于 kubelet 的官方文档，可参阅 +https://kubernetes.io/zh/docs/reference/command-line-tools-reference/kubelet/ +或者 +https://godoc.org/k8s.io/kubelet/config/v1beta1#KubeletConfiguration。</p> + +<p>下面是一个为执行 <code>kubeadm init</code> 而提供的、包含多个配置类型的单一 YAML 文件， +其中填充了很多部分。</p> + +<pre style="background-color:#fff"><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeadm.k8s.io/v1beta2<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>InitConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">bootstrapTokens</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- <span style="color:#000;font-weight:bold">token</span>:<span style="color:#bbb"> </span><span style="color:#d14">"9a08jv.c0izixklcxtmnze7"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">description</span>:<span style="color:#bbb"> </span><span style="color:#d14">"kubeadm bootstrap token"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">ttl</span>:<span style="color:#bbb"> </span><span style="color:#d14">"24h"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- <span style="color:#000;font-weight:bold">token</span>:<span style="color:#bbb"> </span><span style="color:#d14">"783bde.3f89s0fje9f38fhf"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">description</span>:<span style="color:#bbb"> </span><span style="color:#d14">"another bootstrap token"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">usages</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- authentication<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- signing<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">groups</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- system:bootstrappers:kubeadm:default-node-token<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">nodeRegistration</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">name</span>:<span style="color:#bbb"> </span><span style="color:#d14">"ec2-10-100-0-1"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">criSocket</span>:<span style="color:#bbb"> </span><span style="color:#d14">"/var/run/dockershim.sock"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">taints</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- <span style="color:#000;font-weight:bold">key</span>:<span style="color:#bbb"> </span><span style="color:#d14">"kubeadmNode"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">value</span>:<span style="color:#bbb"> </span><span style="color:#d14">"master"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">effect</span>:<span style="color:#bbb"> </span><span style="color:#d14">"NoSchedule"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">kubeletExtraArgs</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">v</span>:<span style="color:#bbb"> </span><span style="color:#099">4</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">ignorePreflightErrors</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- IsPrivilegedUser<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">localAPIEndpoint</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">advertiseAddress</span>:<span style="color:#bbb"> </span><span style="color:#d14">"10.100.0.1"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">bindPort</span>:<span style="color:#bbb"> </span><span style="color:#099">6443</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">certificateKey</span>:<span style="color:#bbb"> </span><span style="color:#d14">"e6a2eb8581237ab72a4f494f30285ec12a9694d750b9785706a83bfcbbbd2204"</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span>---<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeadm.k8s.io/v1beta2<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>ClusterConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">etcd</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#998;font-style:italic"># one of local or external</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">local</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">imageRepository</span>:<span style="color:#bbb"> </span><span style="color:#d14">"k8s.gcr.io"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">imageTag</span>:<span style="color:#bbb"> </span><span style="color:#d14">"3.2.24"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">dataDir</span>:<span style="color:#bbb"> </span><span style="color:#d14">"/var/lib/etcd"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">extraArgs</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">listen-client-urls</span>:<span style="color:#bbb"> </span><span style="color:#d14">"http://10.100.0.1:2379"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">serverCertSANs</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- <span style="color:#bbb"> </span><span style="color:#d14">"ec2-10-100-0-1.compute-1.amazonaws.com"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">peerCertSANs</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- <span style="color:#d14">"10.100.0.1"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#998;font-style:italic"># external:</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#998;font-style:italic"># endpoints:</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#998;font-style:italic"># - "10.100.0.1:2379"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#998;font-style:italic"># - "10.100.0.2:2379"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#998;font-style:italic"># caFile: "/etcd/kubernetes/pki/etcd/etcd-ca.crt"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#998;font-style:italic"># certFile: "/etcd/kubernetes/pki/etcd/etcd.crt"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#998;font-style:italic"># keyFile: "/etcd/kubernetes/pki/etcd/etcd.key"</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">networking</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">serviceSubnet</span>:<span style="color:#bbb"> </span><span style="color:#d14">"10.96.0.0/16"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">podSubnet</span>:<span style="color:#bbb"> </span><span style="color:#d14">"10.244.0.0/24"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">dnsDomain</span>:<span style="color:#bbb"> </span><span style="color:#d14">"cluster.local"</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kubernetesVersion</span>:<span style="color:#bbb"> </span><span style="color:#d14">"v1.12.0"</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">controlPlaneEndpoint</span>:<span style="color:#bbb"> </span><span style="color:#d14">"10.100.0.1:6443"</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">apiServer</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">extraArgs</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">authorization-mode</span>:<span style="color:#bbb"> </span><span style="color:#d14">"Node,RBAC"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">extraVolumes</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- <span style="color:#000;font-weight:bold">name</span>:<span style="color:#bbb"> </span><span style="color:#d14">"some-volume"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">hostPath</span>:<span style="color:#bbb"> </span><span style="color:#d14">"/etc/some-path"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">mountPath</span>:<span style="color:#bbb"> </span><span style="color:#d14">"/etc/some-pod-path"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">readOnly</span>:<span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">false</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">pathType</span>:<span style="color:#bbb"> </span>File<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">certSANs</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- <span style="color:#d14">"10.100.1.1"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- <span style="color:#d14">"ec2-10-100-0-1.compute-1.amazonaws.com"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">timeoutForControlPlane</span>:<span style="color:#bbb"> </span>4m0s<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">controllerManager</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">extraArgs</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">"node-cidr-mask-size": </span><span style="color:#d14">"20"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">extraVolumes</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- <span style="color:#000;font-weight:bold">name</span>:<span style="color:#bbb"> </span><span style="color:#d14">"some-volume"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">hostPath</span>:<span style="color:#bbb"> </span><span style="color:#d14">"/etc/some-path"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">mountPath</span>:<span style="color:#bbb"> </span><span style="color:#d14">"/etc/some-pod-path"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">readOnly</span>:<span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">false</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">pathType</span>:<span style="color:#bbb"> </span>File<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">scheduler</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">extraArgs</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">address</span>:<span style="color:#bbb"> </span><span style="color:#d14">"10.100.0.1"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">extraVolumes</span>:<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>- <span style="color:#000;font-weight:bold">name</span>:<span style="color:#bbb"> </span><span style="color:#d14">"some-volume"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">hostPath</span>:<span style="color:#bbb"> </span><span style="color:#d14">"/etc/some-path"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">mountPath</span>:<span style="color:#bbb"> </span><span style="color:#d14">"/etc/some-pod-path"</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">readOnly</span>:<span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">false</span><span style="color:#bbb"> +</span><span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">pathType</span>:<span style="color:#bbb"> </span>File<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">certificatesDir</span>:<span style="color:#bbb"> </span><span style="color:#d14">"/etc/kubernetes/pki"</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">imageRepository</span>:<span style="color:#bbb"> </span><span style="color:#d14">"k8s.gcr.io"</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">useHyperKubeImage</span>:<span style="color:#bbb"> </span><span style="color:#000;font-weight:bold">false</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">clusterName</span>:<span style="color:#bbb"> </span><span style="color:#d14">"example-cluster"</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span>---<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubelet.config.k8s.io/v1beta1<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>KubeletConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#998;font-style:italic"># kubelet specific options here</span><span style="color:#bbb"> +</span><span style="color:#bbb"></span>---<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeproxy.config.k8s.io/v1alpha1<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>KubeProxyConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#998;font-style:italic"># kube-proxy specific options here</span><span style="color:#bbb"> +</span></pre> + +<!-- +<h2>Kubeadm join configuration types</h2> +<p>When executing kubeadm join with the <code>--config</code> option, the JoinConfiguration type should be provided.</p> +--> +<h2> kubeadm join 配置类型</h2> + +<p>当带有 <code>--config</code> 选项来执行 <code>kubeadm join</code> 操作时， +需要提供 JoinConfiguration 类型。</p> + +<pre style="background-color:#fff"><span style="color:#000;font-weight:bold">apiVersion</span>:<span style="color:#bbb"> </span>kubeadm.k8s.io/v1beta2<span style="color:#bbb"> +</span><span style="color:#bbb"></span><span style="color:#000;font-weight:bold">kind</span>:<span style="color:#bbb"> </span>JoinConfiguration<span style="color:#bbb"> +</span><span style="color:#bbb"> </span>...<span style="color:#bbb"> +</span></pre> + +<!-- +<p>The JoinConfiguration type should be used to configure runtime settings, that in case of <code>kubeadm join</code> +are the discovery method used for accessing the cluster info and all the setting which are specific +to the node where kubeadm is executed, including:</p> +<ul> +<li> +<p><code>NodeRegistration</code>, that holds fields that relate to registering the new node to the cluster; +use it to customize the node name, the CRI socket to use or any other settings that should apply to this +node only (e.g. the node IP).</p> +</li> +<li> +<p><code>APIEndpoint</code>, that represents the endpoint of the instance of the API server to be eventually deployed on this node.</p> +</li> +</ul> +--> +<p>JoinConfiguration 类型用来配置运行时设置，就 <code>kubeadm join</code> +而言包括用来访问集群信息的发现方法，以及所有特定于 kubeadm 执行所在节点的设置， +包括：</p> + +<ul> +<li><code>nodeRegistration</code>：其中包含向集群注册新节点相关的配置字段； +使用这个类型可以定制节点名称、用使用的 CRI 套接字和所有其他仅适用于当前节点的设置 +（例如节点 IP 地址）。</li> +<li><code>apiEndpoint</code>：用来代表最终要部署到此节点上的 API +服务器实例的端点。</li> +</ul> + +<!-- +## Resource Types +--> +## 资源类型 {#resource-types} + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) +- [ClusterStatus](#kubeadm-k8s-io-v1beta2-ClusterStatus) +- [InitConfiguration](#kubeadm-k8s-io-v1beta2-InitConfiguration) +- [JoinConfiguration](#kubeadm-k8s-io-v1beta2-JoinConfiguration) + +## `ClusterConfiguration` {#kubeadm-k8s-io-v1beta2-ClusterConfiguration} + +<!-- +<p>ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster</p> +--> +<p>ClusterConfiguration 包含一个 kubadm 集群的集群范围配置信息。</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubeadm.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>ClusterConfiguration</code></td></tr> + +<tr><td><code>etcd</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-Etcd"><code>Etcd</code></a> +</td> +<td> + <!-- + <p><code>etcd</code> holds the configuration for etcd.</p> + --> + <p><code>etcd</code> 中包含 etcd 服务的配置。</p> +</td> +</tr> +<tr><td><code>networking</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-Networking"><code>Networking</code></a> +</td> +<td> + <!-- + <p><code>networking</code> holds configuration for the networking topology of the cluster.</p> + --> + <code>networking</code> 字段包含集群的网络拓扑配置。 +</td> +</tr> +<tr><td><code>kubernetesVersion</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>kubernetesVersion</code> is the target version of the control plane.</p> + --> + <p><code>kubernetesVersion</code> 设置控制面的目标版本。</p> +</td> +</tr> +<tr><td><code>controlPlaneEndpoint</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>controlPlaneEndpoint</code> sets a stable IP address or DNS name for the control plane; it +can be a valid IP address or a RFC-1123 DNS subdomain, both with optional TCP port. +In case the <code>controlPlaneEndpoint</code> is not specified, the <code>advertiseAddress</code> + <code>bindPort</code> +are used; in case the <code>controlPlaneEndpoint</code> is specified but without a TCP port, +the <code>bindPort</code> is used. +Possible usages are:</p> + --> + <p><code>controlPlaneEndpoint</code> 为控制面设置一个稳定的 IP 地址或 DNS 名称。 +取值可以是一个合法的 IP 地址或者 RFC-1123 形式的 DNS 子域名，二者均可以带一个可选的 +TCP 端口号。 +如果 <code>controlPlaneEndpoint</code> 未设置，则使用 <code>advertiseAddress<code> ++ <code>bindPort</code>。 +如果设置了 <code>controlPlaneEndpoint</code>，但未指定 TCP 端口号，则使用 +<code>bindPort</code>。</p> +<p>可能的用法有：</p> +<!-- +<ul> +<li>In a cluster with more than one control plane instances, this field should be +assigned the address of the external load balancer in front of the +control plane instances.</li> +<li>In environments with enforced node recycling, the <code>controlPlaneEndpoint</code> could +be used for assigning a stable DNS to the control plane.</li> +</ul> +--> +<ul> + <li>在一个包含不止一个控制面实例的集群中， +该字段应该设置为放置在控制面实例之前的外部负载均衡器的地址。</li> + <li>在带有强制性节点回收的环境中，<code>controlPlaneEndpoint</code> +可以用来为控制面设置一个稳定的 DNS。</li> +</ul> +</td> +</tr> +<tr><td><code>apiServer</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-APIServer"><code>APIServer</code></a> +</td> +<td> + <!-- + <p><code>apiServer</code> contains extra settings for the API server.</p> + --> + <p><code>apiServer</code> 包含 API 服务器的一些额外配置。</p> +</td> +</tr> +<tr><td><code>controllerManager</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-ControlPlaneComponent"><code>ControlPlaneComponent</code></a> +</td> +<td> + <!-- + <p><code>controllerManager</code> contains extra settings for the controller manager.</p> + --> + <p><code>controllerManager</code> 中包含控制器管理器的额外配置。</p> +</td> +</tr> +<tr><td><code>scheduler</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-ControlPlaneComponent"><code>ControlPlaneComponent</code></a> +</td> +<td> + <!-- + <p><code>scheduler</code> contains extra settings for the scheduler.</p> + --> + <p><code>scheduler</code> 包含调度器的额外配置。</p> +</td> +</tr> +<tr><td><code>dns</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-DNS"><code>DNS</code></a> +</td> +<td> + <!-- + <p><code>dns</code> defines the options for the DNS add-on installed in the cluster.</p> + --> + <p><code>dns</code> 定义在集群中安装的 DNS 插件的选项。</p> +</td> +</tr> +<tr><td><code>certificatesDir</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>certificatesDir</code> specifies where to store or look for all required certificates.</p> + --> + <p><code>certificatesDir</code> 设置在何处存放或者查找所需证书。</p> +</td> +</tr> +<tr><td><code>imageRepository</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>imageRepository</code> sets the container registry to pull images from. +If empty, <code>k8s.gcr.io</code> will be used by default; in case of kubernetes version is +a CI build (kubernetes version starts with <code>ci/</code>) <code>gcr.io/k8s-staging-ci-images</code> +is used as a default for control plane components and for kube-proxy, while +<code>k8s.gcr.io</code> will be used for all the other images.</p> + --> + <p><code>imageRepository</code> 设置用来拉取镜像的容器仓库。 +如果此字段为空，默认使用 <code>k8s.gcr.io</code>； +当 Kubernetes 用来执行 CI 构造时（Kubernetes 版本以 <code>ci/</code> 开头）， +将默认使用 <code>gcr.io/k8s-staging-ci-images</code> 来拉取控制面组件镜像， +而使用 <code>k8s.gcr.io</code> 来拉取所有其他镜像。</p> +</td> +</tr> +<tr><td><code>useHyperKubeImage</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + <p><code>useHyperKubeImage</code> controls if hyperkube should be used for Kubernetes components +instead of their respective separate images. +DEPRECATED: As <code>hyperkube</code> is itself deprecated, this fields is too. It will be +removed in future kubeadm config versions, kubeadm will print multiple warnings +when this set to true, and at some point it may become ignored.</p> + --> + <p><code>useHyperKubeImage</code> 控制是否使用 hyperkube 来作为Kubernetes +组件，而不是一个个独立的镜像。 +已启用：由于 <code>hyperkube</code> 自身已被弃用，此字段也被启用。 +将被从将来的 kubeadm 配置版本中移除，kubeadm 在此字段设置为 true +时会打印多个警告信息，并且在一些其他位置忽略此字段设置。</p> +</td> +</tr> +<tr><td><code>featureGates</code> <B><!--[Required]-->[必需]</B><br/> +<code>map[string]bool</code> +</td> +<td> + <!-- + <p><code>featureGates</code> contains the feature gates enabled by the user.</p> + --> + <p><code>featureGates</code> 包含用户所启用的特性门控。</p> +</td> +</tr> +<tr><td><code>clusterName</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p>The cluster name.</p> + --> + <p>集群名称。</p> +</td> +</tr> +</tbody> +</table> + +## `ClusterStatus` {#kubeadm-k8s-io-v1beta2-ClusterStatus} + +<!-- +<p>ClusterStatus contains the cluster status. The ClusterStatus will be stored in +the kubeadm-config ConfigMap in the cluster, and then updated by kubeadm when +additional control plane instance joins or leaves the cluster.</p> +--> +<p>ClusterStatus 包含集群信息。ClusterStatus 会被保存在集群中 kubeadm-config +ConfigMap 中，之后在新的控制面实例添加到集群或者现有控制面实例离开集群时被更新。</p> +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubeadm.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>ClusterStatus</code></td></tr> + +<tr><td><code>apiEndpoints</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-APIEndpoint"><code>map[string]APIEndpoint</code></a> +</td> +<td> + <!-- + <p><code>apiEndpoints</code> currently available in the cluster, one for each control +plane/API server instance. +The key of the map is the IP of the host's default interface.</p> + --> + <p><code>apiEndpoints</code> 为当前集群中可用的 API 端点，每个控制面实例 +（API 服务器）对应一个表项。 +映射的键名为主机默认接口的 IP 地址。</p> +</td> +</tr> +</tbody> +</table> + +## `InitConfiguration` {#kubeadm-k8s-io-v1beta2-InitConfiguration} + +<!-- +<p>InitConfiguration contains a list of elements that is specific "kubeadm init"-only runtime +information.</p> +--> +<p>InitConfiguration 包含一组特定于 "kubeadm init" 的运行时元素。</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubeadm.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>InitConfiguration</code></td></tr> + +<tr><td><code>bootstrapTokens</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-BootstrapToken"><code>[]BootstrapToken</code></a> +</td> +<td> + <!-- + <p><code>bootstrapTokens</code> is respected at <code>kubeadm init</code> time and describes a set of bootstrap tokens to create. +This information IS NOT uploaded to the kubeadm cluster ConfigMap, partly because of its sensitive nature.</p> + --> + <p><code>bootstrapTokens</code> 在 <code>kubeadm init</code> 执行时会被用到， +其中描述了一组要创建的启动引导令牌（Bootstrap Tokens）。 +这里的信息不会被上传到 kubeadm 在集群中保存的 ConfigMap 中，部分原因是由于信息本身比较敏感。</p> +</td> +</tr> +<tr><td><code>nodeRegistration</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-NodeRegistrationOptions"><code>NodeRegistrationOptions</code></a> +</td> +<td> + <!-- + <p><code>nodeRegistration</code> holds fields that relate to registering the new control-plane node to the cluster.</p> + --> + <p><code>nodeRegistration</code> 中包含与向集群中注册新的控制面节点相关的字段。</p> +</td> +</tr> +<tr><td><code>localAPIEndpoint</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-APIEndpoint"><code>APIEndpoint</code></a> +</td> +<td> + <!-- + <p><code>localAPIEndpoint</code> represents the endpoint of the API server instance that's deployed on this control plane node. +In HA setups, this differs from <code>ClusterConfiguration.controlPlaneEndpoint</code> in the sense that <code>controlPlaneEndpoint</code> +is the global endpoint for the cluster, which then load-balances the requests to each individual API server. This +configuration object lets you customize what IP/DNS name and port the local API server advertises it's accessible +on. By default, kubeadm tries to auto-detect the IP of the default interface and use that, but in case that process +fails you may set the desired value here.</p> + --> + <p><code>localAPIEndpoint</code> 所代表的的是在此控制面节点上要部署的 API 服务器的端点。 +在高可用（HA）配置中，此字段与 <code>ClusterConfiguration.controlPlaneEndpoint</code> +的取值不同：后者代表的是整个集群的全局端点，该端点上的请求会被负载均衡到每个 API 服务器。 +此配置对象允许你定制本地 API 服务器所公布的、可访问的 IP/DNS 名称和端口。 +默认情况下，kubeadm 会尝试自动检测默认接口上的 IP 并使用该地址。 +不过，如果这种检测失败，你可以在此字段中直接设置所期望的值。</p> +</td> +</tr> +<tr><td><code>certificateKey</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>certificateKey</code> sets the key with which certificates and keys are encrypted prior to being uploaded in +a secret in the cluster during the <code>uploadcerts init</code> phase.</p> + --> + <p><code>certificateKey</code> 用来设置一个秘钥，该秘钥将对 <code>uploadcerts init</code> +阶段上传到集群中某 Secret 内的秘钥和证书加密。</p> +</td> +</tr> +</tbody> +</table> + +## `JoinConfiguration` {#kubeadm-k8s-io-v1beta2-JoinConfiguration} + +<p> +<!-- +JoinConfiguration contains elements describing a particular node. +--> +JoinConfiguration 包含描述特定节点的元素。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubeadm.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>JoinConfiguration</code></td></tr> + +<tr><td><code>nodeRegistration</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-NodeRegistrationOptions"><code>NodeRegistrationOptions</code></a> +</td> +<td> + <!-- + <p><code>nodeRegistration</code> holds fields that relate to registering the new +control-plane node to the cluster</p> + --> + <code>nodeRegistration</code> 包含与向集群注册控制面节点相关的字段。 +</td> +</tr> +<tr><td><code>caCertPath</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>caCertPath</code> is the path to the SSL certificate authority used to +secure comunications between a node and the control-plane. +Defaults to "/etc/kubernetes/pki/ca.crt".</p> + --> + <p><code>caCertPath</code> 是指向 SSL 证书机构的路径， +该证书包用来加密节点与控制面之间的通信。默认值为 +"/etc/kubernetes/pki/ca.crt"。</p> +</td> +</tr> +<tr><td><code>discovery</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-Discovery"><code>Discovery</code></a> +</td> +<td> + <!-- + <p><code>discovery</code> specifies the options for the kubelet to use during the TLS +bootstrap process.</p> + --> + <p><code>discovery</code> 设置 TLS 引导过程中 kubelet 要使用的选项。</p> +</td> +</tr> +<tr><td><code>controlPlane</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-JoinControlPlane"><code>JoinControlPlane</code></a> +</td> +<td> + <!-- + <p><code>controlPlane</code> defines the additional control plane instance to be deployed +on the joining node. If nil, no additional control plane instance will be deployed.</p> + --> + <p><code>controlPlane</code> 定义要在正被加入到集群中的节点上部署的额外控制面实例。 +此字段为 null 时，不会再上面部署额外的控制面实例。</p> +</td> +</tr> +</tbody> +</table> + +## `APIEndpoint` {#kubeadm-k8s-io-v1beta2-APIEndpoint} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ClusterStatus](#kubeadm-k8s-io-v1beta2-ClusterStatus) + +- [InitConfiguration](#kubeadm-k8s-io-v1beta2-InitConfiguration) + +- [JoinControlPlane](#kubeadm-k8s-io-v1beta2-JoinControlPlane) + +<p> +<!-- +APIEndpoint struct contains elements of API server instance deployed on a node. +--> +APIEndpoint 结构包含某节点上部署的 API 服务器的配置元素。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>advertiseAddress</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>advertiseAddress</code> sets the IP address for the API server to advertise.</p> + --> + <p><code>advertiseAddress</code> 设置 API 服务器要公布的 IP 地址。</p> +</td> +</tr> +<tr><td><code>bindPort</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + <p><code>bindPort</code> sets the secure port for the API Server to bind to. +Defaults to 6443.</p> + --> + <code>bindPort</code> 设置 API 服务器要绑定到的安全端口。默认值为 6443。 +</td> +</tr> +</tbody> +</table> + +## `APIServer` {#kubeadm-k8s-io-v1beta2-APIServer} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) + +<p> +<!-- +APIServer holds settings necessary for API server deployments in the cluster +--> +APIServer 包含集群中 API 服务器部署所必需的设置。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>ControlPlaneComponent</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-ControlPlaneComponent"><code>ControlPlaneComponent</code></a> +</td> +<td>（<code>ControlPlaneComponent</code> 结构的字段被嵌入到此类型中） + <span class="text-muted">无描述</span> +</tr> +<tr><td><code>certSANs</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!-- + <p><code>certSANs</code> sets extra Subject Alternative Names (SANs) for the API Server +signing certificate.</p> + --> + <code>certSANs</code> 设置 API 服务器签署证书所用的额外主题替代名（Subject Alternative Name，SAN）。 +</td> +</tr> +<tr><td><code>timeoutForControlPlane</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <!-- + <p><code>timeoutForControlPlane</code> controls the timeout that we wait for the API server +to appear.</p> + --> + <p><code>timeoutForControlPlane</code> 用来控制我们等待 API 服务器开始运行的超时时间。</p> +</td> +</tr> +</tbody> +</table> + +## `BootstrapToken` {#kubeadm-k8s-io-v1beta2-BootstrapToken} + +<!-- +**Appears in:** +--> +**出现在：** + +- [InitConfiguration](#kubeadm-k8s-io-v1beta2-InitConfiguration) + + +<!--p>BootstrapToken describes one bootstrap token, stored as a Secret in the cluster</p--> +<p>BootstrapToken 描述的是一个启动引导令牌，以 Secret 形式存储在集群中。</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>token</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-BootstrapTokenString"><code>BootstrapTokenString</code></a> +</td> +<td> + <!--p><code>token</code> is used for establishing bidirectional trust between nodes and control-planes. +Used for joining nodes in the cluster.</p--> + <p><code>token</code> 用来在节点与控制面之间建立双向的信任关系。 +在向集群中添加节点时使用。</p> +</td> +</tr> +<tr><td><code>description</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!--p><code>description</code> sets a human-friendly message why this token exists and what it's used +for, so other administrators can know its purpose.</p--> + <p><code>description</code> 设置一个对人友好的消息， +说明为什么此令牌会存在以及其目标用途，这样其他管理员能够知道其目的。</p> +</td> +</tr> +<tr><td><code>ttl</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <!--p><code>ttl</code> defines the time to live for this token. Defaults to <code>24h</code>. +<code>expires</code> and <code>ttl</code> are mutually exclusive.</p--> + <p><code>ttl</code> 定义此令牌的声明周期。默认为 <code>24h</code>。 +<code>expires</code> 和 <code>ttl</code> 是互斥的。</p> +</td> +</tr> +<tr><td><code>expires</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#time-v1-meta"><code>meta/v1.Time</code></a> +</td> +<td> + <!--p><code>expires</code> specifies the timestamp when this token expires. Defaults to being set +dynamically at runtime based on the <code>ttl</code>. <code>expires</code> and <code>ttl</code> are mutually exclusive.</p--> + <p><code>expires</code> 设置此令牌过期的时间戳。 +默认为在运行时基于<code>ttl</code>来决定。 +<code>expires</code>和<code>ttl</code>是互斥的。</p> +</td> +</tr> +<tr><td><code>usages</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!--p><code>usages</code> describes the ways in which this token can be used. Can by default be used +for establishing bidirectional trust, but that can be changed here.</p--> + <p><code>usages</code> 描述此令牌的可能使用方式。默认情况下， +令牌可用于建立双向的信任关系；不过这里可以改变默认用途。</p> +</td> +</tr> +<tr><td><code>groups</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!--p><code>groups</code> specifies the extra groups that this token will authenticate as when/if +used for authentication</p--> + <p><code>groups</code> 设定此令牌被用于身份认证时对应的附加用户组。</p> +</td> +</tr> +</tbody> +</table> + +## `BootstrapTokenDiscovery` {#kubeadm-k8s-io-v1beta2-BootstrapTokenDiscovery} + +<!-- +**Appears in:** +--> +**出现在：** + +- [Discovery](#kubeadm-k8s-io-v1beta2-Discovery) + +<p> +<!-- +BootstrapTokenDiscovery is used to set the options for bootstrap token based discovery +--> +BootstrapTokenDiscovery 用来设置基于引导令牌的服务发现选项。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>token</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> +<p> + <!-- + <code>token</code> is a token used to validate cluster information fetched from the control-plane. + --> + <code>token</code> 用来验证从控制面获得的集群信息。 +</p> +</td> +</tr> +<tr><td><code>apiServerEndpoint</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> +<p> + <!-- + <code>apiServerEndpoint</p> is an IP or domain name to the API server from which +information will be fetched. + --> + <code>apiServerEndpoint</p> 为 API 服务器的 IP 地址或者域名，从该端点可以获得集群信息。 +</p> +</td> +</tr> +<tr><td><code>caCertHashes</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> +<p> + <!-- + <code>caCertHashes</code> specifies a set of public key pins to verify when token-based discovery +is used. The root CA found during discovery must match one of these values. +Specifying an empty set disables root CA pinning, which can be unsafe. +Each hash is specified as "<type>:<value>", where the only currently supported type is +"sha256". This is a hex-encoded SHA-256 hash of the Subject Public Key Info (SPKI) +object in DER-encoded ASN.1. These hashes can be calculated using, for example, OpenSSL. + --> + <code>caCertHashes</code> 设置一组在基于令牌来发现服务时要验证的公钥指纹。 +发现过程中获得的根 CA 必须与这里的数值之一匹配。 +设置为空集合意味着禁用根 CA 指纹，因而可能是不安全的。 +每个哈希值的形式为 "<type>:<value>"，当前唯一支持的 type 为 +"sha256"。 +哈希值为主体公钥信息（Subject Public Key Info，SPKI）对象的 SHA-256 +哈希值（十六进制编码），形式为 DER 编码的 ASN.1。 +例如，这些哈希值可以使用 OpenSSL 来计算。 +</p> +</td> +</tr> +<tr><td><code>unsafeSkipCAVerification</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + <p><code>unsafeSkipCAVerification</code> allows token-based discovery without CA verification via +<code>caCertHashes</code>. This can weaken the security of kubeadm since other nodes can +impersonate the control-plane.</p> + --> + <code>unsafeSkipCAVerification</code> 允许在使用基于令牌的服务发现时不使用 +<code>caCertHashes</code> 来执行 CA 验证。这会弱化 kubeadm 的安全性， +因为其他节点可以伪装成控制面。 +</td> +</tr> +</tbody> +</table> + +## `BootstrapTokenString` {#kubeadm-k8s-io-v1beta2-BootstrapTokenString} + +<!-- +**Appears in:** +--> +**出现在：** + +- [BootstrapToken](#kubeadm-k8s-io-v1beta2-BootstrapToken) + +<!--p>BootstrapTokenString is a token of the format <code>abcdef.abcdef0123456789</code> that is used +for both validation of the practically of the API server from a joining node's point +of view and as an authentication method for the node in the bootstrap phase of +"kubeadm join". This token is and should be short-lived.</p--> +<p>BootstrapTokenString 形式为 <code>abcdef.abcdef0123456789</code> 的一个令牌， +用来从加入集群的节点角度验证 API 服务器的身份，或者 "kubeadm join" +在节点启动引导是作为一种身份认证方法。 +此令牌的生命期是短暂的，并且应该如此。</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>id</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!--span class="text-muted">No description provided.</span--> + <span class="text-muted">无描述</span> +</tr> +<tr><td><code>secret</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!--span class="text-muted">No description provided.</span--> + <span class="text-muted">无描述</span> +</tr> +</tbody> +</table> + +## `ControlPlaneComponent` {#kubeadm-k8s-io-v1beta2-ControlPlaneComponent} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) +- [APIServer](#kubeadm-k8s-io-v1beta2-APIServer) + +<p> +<!-- +ControlPlaneComponent holds settings common to control plane component of the cluster +--> +ControlPlaneComponent 中包含对集群中所有控制面组件都适用的设置。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>extraArgs</code> <B><!--[Required]-->[必需]</B><br/> +<code>map[string]string</code> +</td> +<td> +<p> + <!-- + <code>extraArgs</code> is an extra set of flags to pass to the control plane component. +A key in this map is the flag name as it appears on the command line except +without leading dash(es). + --> + <code>extraArgs</code> 是要传递给控制面组件的一组额外的参数标志。 +此映射中的每个键对应命令行上使用的标志名称，只是没有其引导连字符。 +</p> +</td> +</tr> +<tr><td><code>extraVolumes</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-HostPathMount"><code>[]HostPathMount</code></a> +</td> +<td> +<p> + <!-- + <code>extraVolumes</code> is an extra set of host volumes, mounted to the control plane component. + --> + <code>extraVolumes</code> 是一组额外的主机卷，需要挂载到控制面组件中。 +</p> +</td> +</tr> +</tbody> +</table> + +## `DNS` {#kubeadm-k8s-io-v1beta2-DNS} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) + + +<p> +<!-- +DNS defines the DNS addon that should be used in the cluster +--> +DNS 结构定义要在集群中使用的 DNS 插件。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>type</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-DNSAddOnType"><code>DNSAddOnType</code></a> +</td> +<td> + <!-- + <p><code>type</code> defines the DNS add-on to be used.</p> + --> + <p><code>type</code> 定义要使用的 DNS 插件类型。</p> +</td> +</tr> +<tr><td><code>ImageMeta</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-ImageMeta"><code>ImageMeta</code></a> +</td> +<td>（<code>ImageMeta</code> 的成员被内嵌到此类型中）。 +<p> + <!-- + <code>imageMeta</code> allows to customize the image used for the DNS component. + --> + <code>imageMeta</code> 允许对 DNS 组件所使用的的镜像作定制。 +</p> +</td> +</tr> +</tbody> +</table> + +## `DNSAddOnType` {#kubeadm-k8s-io-v1beta2-DNSAddOnType} + +<!-- +(Alias of `string`) + +**Appears in:** +--> +（`string` 数据类型的别名） + +**出现在：** + +- [DNS](#kubeadm-k8s-io-v1beta2-DNS) + +<!-- +<p>DNSAddOnType defines string identifying DNS add-on types.</p> +--> +<p>DNSAddOnType 定义的是用来辨识 DNS 插件类型的字符串。</p> + +## `Discovery` {#kubeadm-k8s-io-v1beta2-Discovery} + +<!-- +**Appears in:** +--> +**出现在：** + +- [JoinConfiguration](#kubeadm-k8s-io-v1beta2-JoinConfiguration) + +<p> +<!-- +Discovery specifies the options for the kubelet to use during the TLS Bootstrap process. +--> +Discovery 设置 TLS 启动引导过程中 kubelet 要使用的配置选项。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>bootstrapToken</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-BootstrapTokenDiscovery"><code>BootstrapTokenDiscovery</code></a> +</td> +<td> +<p> + <!-- + <code>bootstrapToken</code> is used to set the options for bootstrap token based discovery. +<code>bootstrapToken</code> and <code>file</code> are mutually exclusive. + --> + <code>bootstrapToken</code> 设置基于启动引导令牌的服务发现选项。 +<code>bootstrapToken</code> 与 <code>file</code> 是互斥的。 +</p> +</td> +</tr> +<tr><td><code>file</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-FileDiscovery"><code>FileDiscovery</code></a> +</td> +<td> + <!-- + <code>file</code> is used to specify a file or URL to a kubeconfig file from which to load +cluster information. +<code>bootstrapToken</code> and <code>file</code> are mutually exclusive. + --> + <code> 用来设置一个文件或者 URL 路径，指向一个 kubeconfig 文件； +该配置文件中包含集群信息。 +<code>bootstrapToken</code> 与 <code>file</code> 是互斥的。 +</td> +</tr> +<tr><td><code>tlsBootstrapToken</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> +<p> + <!-- + <code>tlsBootstrapToken</code> is a token used for TLS bootstrapping. +If <code>bootstrapToken</code> is set, this field is defaulted to <code>.bootstrapToken.token</code>, but +can be overridden. If <code>file<code> is set, this field ∗∗must be set∗∗ in case the KubeConfigFile +does not contain any other authentication information + --> + <code>tlsBootstrapToken</code> 是 TLS 启动引导过程中使用的令牌。 +如果设置了 <code>bootstrapToken</code>，则此字段默认值为 <code>.bootstrapToken.token</code>， +不过可以被重载。 +如果设置了 <code>file</code>，此字段<B>必须被设置</B>，以防 kubeconfig +文件中不包含其他身份认证信息。 +</p> +</td> +</tr> +<tr><td><code>timeout</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> +<p> + <!-- + <code>timeout</code> modifies the discovery timeout. + --> + <code>timeout</code> 用来修改发现过程的超时时长。 +</p> +</td> +</tr> +</tbody> +</table> + +## `Etcd` {#kubeadm-k8s-io-v1beta2-Etcd} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) + +<p> +<!-- +Etcd contains elements describing Etcd configuration. +--> +Etcd 包含用来描述 etcd 配置的元素。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>local</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-LocalEtcd"><code>LocalEtcd</code></a> +</td> +<td> +<p> + <!-- + <code>local</code> provides configuration knobs for configuring the local etcd instance. +<code>local</code> and <code>external</code> are mutually exclusive. + --> + <code>local</code> 提供配置本地 etcd 实例的选项。<code>local</code> 和 +<code>external</code> 是互斥的。 +</p> +</td> +</tr> +<tr><td><code>external</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-ExternalEtcd"><code>ExternalEtcd</code></a> +</td> +<td> +<p> + <!-- + <code>external</code> describes how to connect to an external etcd cluster. +<code>local</code> and <code>external</code> are mutually exclusive. + --> + <code>external</code>描述如何连接到外部的 etcd 集群。 +<code>local</code>和<code>external</code>是互斥的。 +</p> +</td> +</tr> +</tbody> +</table> + +## `ExternalEtcd` {#kubeadm-k8s-io-v1beta2-ExternalEtcd} + +<!-- +**Appears in:** +--> +**出现在：** + +- [Etcd](#kubeadm-k8s-io-v1beta2-Etcd) + +<p> +<!-- +ExternalEtcd describes an external etcd cluster. +Kubeadm has no knowledge of where certificate files live and they must be supplied. +--> +ExternalEtcd 描述外部 etcd 集群。 +kubeadm 不清楚证书文件的存放位置，因此必须单独提供证书信息。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>endpoints</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!-- + <p><code>endpoints</code> contains the list of etcd members.</p> + --> + <p><code>endpoints</code> 包含一组 etcd 成员的列表。</p> +</td> +</tr> +<tr><td><code>caFile</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>caFile</code> is an SSL Certificate Authority (CA) file used to secure etcd communication. +Required if using a TLS connection.</p> + --> + <p><code>caFile</code> 是一个 SSL 证书机构（CA）文件，用来加密 etcd 通信。 +如果使用 TLS 连接，此字段为必需字段。</p> +</td> +</tr> +<tr><td><code>certFile</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>certFile</code> is an SSL certification file used to secure etcd communication. +Required if using a TLS connection.</p> + --> + <p><code>certFile</code> 是一个 SSL 证书文件，用来加密 etcd 通信。 +如果使用 TLS 连接，此字段为必需字段。</p> +</td> +</tr> +<tr><td><code>keyFile</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>keyFile</code> is an SSL key file used to secure etcd communication. +Required if using a TLS connection.</p> + --> + <p><code>keyFile</code> 是一个用来加密 etcd 通信的 SSL 秘钥文件。 +此字段在使用 TLS 连接时为必填字段。</p> + +</td> +</tr> +</tbody> +</table> + +## `FileDiscovery` {#kubeadm-k8s-io-v1beta2-FileDiscovery} + +<!-- +**Appears in:** +--> +**出现在：** + +- [Discovery](#kubeadm-k8s-io-v1beta2-Discovery) + +<!-- +<p>FileDiscovery is used to specify a file or URL to a kubeconfig file from which to load +cluster information.</p> +--> +<p>FileDiscovery 用来指定一个文件或者 URL 路径，指向一个 kubeconfig 文件； +该配置文件可用来加载集群信息。</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>kubeConfigPath</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>kubeConfigPath</code> is used to specify the actual file path or URL to the kubeconfig +file from which to load cluster information.</p> + --> + <p><code>kubeConfigPath</code> 用来指定一个文件或者 URL 路径，指向一个 kubeconfig 文件； +该配置文件可用来加载集群信息。</p> +</td> +</tr> +</tbody> +</table> + +## `HostPathMount` {#kubeadm-k8s-io-v1beta2-HostPathMount} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ControlPlaneComponent](#kubeadm-k8s-io-v1beta2-ControlPlaneComponent) + +<!--p>HostPathMount contains elements describing volumes that are mounted from the host.</p--> +<p>HostPathMount 包含从宿主节点挂载的卷的信息。</p--> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + + +<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!--p><code>name</code> is the name of the volume inside the Pod template.</p--> + <p><code>name</code> 为卷在 Pod 模板中的名称。</p> +</td> +</tr> +<tr><td><code>hostPath</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!--p><code>hostPath</code> is the path in the host that will be mounted inside the Pod.</p--> + <p><code>hostPath</code> 是要在 Pod 中挂载的卷在宿主系统上的路径。</p> +</td> +</tr> +<tr><td><code>mountPath</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!--p><code>mountPath</code> is the path inside the Pod where <code>hostPath</code> will be mounted.</p--> + <p><code>mountPath</code> 是 <code>hostPath</code> 在 Pod 内挂载的路径。</p> +</td> +</tr> +<tr><td><code>readOnly</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!--p><code>readOnly</code> controls write access to the volume.</p--> + <p><code>readOnly</code> 控制卷的读写访问模式。</p> +</td> +</tr> +<tr><td><code>pathType</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#hostpathtype-v1-core"><code>core/v1.HostPathType</code></a> +</td> +<td> + <!--p><code>pathType</code> is the type of the <code>hostPath</code>.</p--> + <p><code>pathType</code> 是 <code>hostPath</code> 的类型。</p> +</td> +</tr> +</tbody> +</table> + +## `ImageMeta` {#kubeadm-k8s-io-v1beta2-ImageMeta} + +<!-- +**Appears in:** +--> +**出现在：** + +- [DNS](#kubeadm-k8s-io-v1beta2-DNS) + +- [LocalEtcd](#kubeadm-k8s-io-v1beta2-LocalEtcd) + +<!--p>ImageMeta allows to customize the image used for components that are not +originated from the Kubernetes/Kubernetes release process</p--> +<p>ImageMeta 用来配置来源不是 Kubernetes/kubernetes +发布过程的组件所使用的镜像。</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>imageRepository</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!--p><code>imageRepository</code> sets the container registry to pull images from. +If not set, the <code>imageRepository</code> defined in ClusterConfiguration will be used instead.</p--> + <p><code>imageRepository</code> 设置镜像拉取所用的容器仓库。 +若未设置，则使用 ClusterConfiguration 中的 <code>imageRepository</code>。</p> +</td> +</tr> +<tr><td><code>imageTag</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!--p><code>imageTag</code> allows to specify a tag for the image. +In case this value is set, kubeadm does not change automatically the version of +the above components during upgrades.</p--> + <p><code>imageTag</code> 允许用户设置镜像的标签。 +如果设置了此字段，则 kubeadm 不再在集群升级时自动更改组件的版本。</p> +</td> +</tr> +</tbody> +</table> + +## `JoinControlPlane` {#kubeadm-k8s-io-v1beta2-JoinControlPlane} + +<!-- +**Appears in:** +--> +**出现在：** + +- [JoinConfiguration](#kubeadm-k8s-io-v1beta2-JoinConfiguration) + +<!--p>JoinControlPlane contains elements describing an additional control plane instance +to be deployed on the joining node.</p--> +<p>JoinControlPlane 包含在正在加入集群的节点上要部署的额外的控制面组件的设置。</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>localAPIEndpoint</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-APIEndpoint"><code>APIEndpoint</code></a> +</td> +<td> + <!-- + <p><code>localAPIEndpoint</code> represents the endpoint of the API server instance to be +deployed on this node.</p> + --> + <p><code>localAPIEndpoint</code> 代表的是将在此节点上部署的 API 服务器实例的端点。</p> +</td> +</tr> +<tr><td><code>certificateKey</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>certificateKey</code> is the key that is used for decryption of certificates after +they are downloaded from the secret upon joining a new control plane node. +The corresponding encryption key is in the InitConfiguration.</p> + --> + <p><code>certificateKey</code> 是在添加新的控制面节点时用来解密所下载的 +Secret 中的证书的秘钥。对应的加密秘钥在 InitConfiguration 结构中。</p> +</td> +</tr> +</tbody> +</table> + +## `LocalEtcd` {#kubeadm-k8s-io-v1beta2-LocalEtcd} + +<!-- +**Appears in:** +--> +**出现在：** + +- [Etcd](#kubeadm-k8s-io-v1beta2-Etcd) + +<!-- +<p>LocalEtcd describes that kubeadm should run an etcd cluster locally</p> +--> +<p>LocalEtcd 描述的是 kubeadm 要使用的本地 etcd 集群。</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>ImageMeta</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubeadm-k8s-io-v1beta2-ImageMeta"><code>ImageMeta</code></a> +</td> +<td>（<code>ImageMeta</code> 结构的字段被嵌入到此类型中。） + <!-- + <p>ImageMeta allows to customize the container used for etcd.</p> + --> + <p>ImageMeta 允许用户为 etcd 定制要使用的容器。</p> +</td> +</tr> +<tr><td><code>dataDir</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>dataDir</code> is the directory etcd will place its data. +Defaults to "/var/lib/etcd".</p> + --> + <p><code>dataDir</code> 是 etcd 用来存放数据的目录。 +默认值为 "/var/lib/etcd"。</p> +</td> +</tr> +<tr><td><code>extraArgs</code> <B><!--[Required]-->[必需]</B><br/> +<code>map[string]string</code> +</td> +<td> + <!-- + <p><code>extraArgs</code> are extra arguments provided to the etcd binary when run +inside a static Pod. A key in this map is the flag name as it appears on the +command line except without leading dash(es).</p> + --> + <p><code>extraArgs</code> 是为 etcd 可执行文件提供的额外参数，用于在静态 +Pod 中运行 etcd。映射中的每一个键对应命令行上的一个标志参数，只是去掉了前置的连字符。</p> +</td> +</tr> +<tr><td><code>serverCertSANs</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!-- + <p><code>serverCertSANs</code> sets extra Subject Alternative Names (SANs) for the etcd +server signing certificate.</p> + --> + <p><code>serverCertSANs</code> 为 etcd 服务器的签名证书设置额外的主体替代名 +（Subject Alternative Names，SAN）。</p> +</td> +</tr> +<tr><td><code>peerCertSANs</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!-- + <p><code>peerCertSANs</code> sets extra Subject Alternative Names (SANs) for the etcd peer +signing certificate.</p> + --> + <p><code>peerCertSANs</code> 为 etcd 的对等端签名证书设置额外的主体替代名 +（Subject Alternative Names，SAN）。</p> +</td> +</tr> +</tbody> +</table> + +## `Networking` {#kubeadm-k8s-io-v1beta2-Networking} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) + +<!-- +<p>Networking contains elements describing cluster's networking configuration</p> +--> +<p>Networking 中包含描述集群网络配置的元素。</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>serviceSubnet</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>serviceSubnet</code> is the subnet used by Kubernetes Services. Defaults to "10.96.0.0/12".</p> + --> + <p><code>serviceSubnet</code> 是 Kubernetes 服务所使用的的子网。 +默认值为 "10.96.0.0/12"。</p> +</td> +</tr> +<tr><td><code>podSubnet</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!--p><code>podSubnet</code> is the subnet used by Pods.</p--> + <p><code>podSubnet</code> 为 Pod 所使用的子网。</p> +</td> +</tr> +<tr><td><code>dnsDomain</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!--p><code>dnsDomain</code> is the DNS domain used by Kubernetes Services. Defaults to "cluster.local".</p--> + <p><code>dnsDomain</code> 是 Kubernetes 服务所使用的的 DNS 域名。 +默认值为 "cluster.local"。</p> +</td> +</tr> +</tbody> +</table> + +## `NodeRegistrationOptions` {#kubeadm-k8s-io-v1beta2-NodeRegistrationOptions} + +<!-- +**Appears in:** +--> +**出现在：** + +- [InitConfiguration](#kubeadm-k8s-io-v1beta2-InitConfiguration) +- [JoinConfiguration](#kubeadm-k8s-io-v1beta2-JoinConfiguration) + +<!-- +<p>NodeRegistrationOptions holds fields that relate to registering a new control-plane or +node to the cluster, either via "kubeadm init" or "kubeadm join"</p> +--> +<p>NodeRegistrationOptions 包含向集群中注册新的控制面或节点所需要的信息； +节点注册可能通过 "kubeadm init" 或 "kubeadm join" 完成。</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>name</code> is the <code>.metadata.name</code> field of the Node API object that will be created in this +<code>kubeadm init</code> or <code>kubeadm join</code> operation. +This field is also used in the <code>CommonName</code> field of the kubelet's client certificate to +the API server. +Defaults to the hostname of the node if not provided.</p> + --> + <p><code>name</code> 是 Node API 对象的 <code>.metadata.name</code> 字段值； +该 API 对象会在此 <code>kubeadm init</code> 或 <code>kubeadm join</code> 操作期间创建。 +在提交给 API 服务器的 kubelet 客户端证书中，此字段也用作其 <code>CommonName</code>。 +如果未指定则默认为节点的主机名。</p> +</td> +</tr> +<tr><td><code>criSocket</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + <p><code>criSocket</code> is used to retrieve container runtime info. +This information will be annotated to the Node API object, for later re-use</p> + --> + <p><code>criSocket</code> 用来读取容器运行时的信息。 +此信息会被以注解的方式添加到 Node API 对象至上，用于后续用途。</p> +</td> +</tr> +<tr><td><code>taints</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#taint-v1-core"><code>[]core/v1.Taint</code></a> +</td> +<td> + <!-- + <p><code>tains</code> specifies the taints the Node API object should be registered with. +If this field is unset, i.e. nil, in the <code>kubeadm init</code> process it will be defaulted to +<code>taints: ["node-role.kubernetes.io/master:""]</code>. +If you don't want to taint your control-plane node, set this field to an empty slice, +i.e. <code>taints: []</code> in the YAML file. This field is solely used for Node registration.</p> + --> + <p><code>tains</code> 设定 Node API 对象被注册时要附带的污点。 +若未设置此字段（即字段值为 null）, 在 <code>kubeadm init</code> 期间，节点与控制面之间的通信。 +默认值为污点默认设置为 <code>taints: ["node-role.kubernetes.io/master:""]</code>。 +如果你不希望为控制面节点设置污点，可以在 YAML 中将此字段设置为空的列表，即 +<code>taints: []</code>。 此字段仅用在 Node 注册期间。</p> +</td> +</tr> +<tr><td><code>kubeletExtraArgs</code> <B><!--[Required]-->[必需]</B><br/> +<code>map[string]string</code> +</td> +<td> + <!-- + <p><code>kubeletExtraArgs</code> passes through extra arguments to the kubelet. +The arguments here are passed to the kubelet command line via the environment file +kubeadm writes at runtime for the kubelet to source. +This overrides the generic base-level configuration in the 'kubelet-config-1.X' ConfigMap. +Flags have higher priority when parsing. These values are local and specific to the node +kubeadm is executing on. A key in this map is the flag name as it appears on the +command line except without leading dash(es).</p> + --> + <p><code>kubeletExtraArgs</code> 用来向 kubelet 传递额外参数。 +这里的参数会通过 kubeadm 在运行时写入的、由 kubelet 来读取的环境文件来传递给 kubelet 命令行。 +这里的设置会覆盖掉 'kubelet-config-1.X' ConfigMap 中包含的一般性的配置。 +命令行标志在解析时优先级更高。 +这里的设置值仅作用于 kubeadm 运行所在的节点。 +映射中的每个键对应命令行中的一个标志参数，只是去掉了前置的连字符。</p> +</td> +</tr> +<tr><td><code>ignorePreflightErrors</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!-- + <p><code>ignorePreflightErrors</code> provides a list of pre-flight errors to be ignored when +the current node is registered.</p> + --> + <p><code>ignorePreflightErrors</code> 提供一组在当前节点被注册时可以忽略掉的预检错误。</p> +</td> +</tr> +</tbody> +</table> + From 3d96a08179eb7f6000b7149143f474e50d10f9c8 Mon Sep 17 00:00:00 2001 From: Kobayashi Daisuke <kobayashi.da-06@fujitsu.com> Date: Thu, 27 Jan 2022 16:38:58 +0900 Subject: [PATCH 016/104] translate concepts/storage/volume.md into japanese --- content/ja/docs/concepts/storage/volumes.md | 1130 +++++++++++++++++++ 1 file changed, 1130 insertions(+) create mode 100644 content/ja/docs/concepts/storage/volumes.md diff --git a/content/ja/docs/concepts/storage/volumes.md b/content/ja/docs/concepts/storage/volumes.md new file mode 100644 index 0000000000..29d014e5ed --- /dev/null +++ b/content/ja/docs/concepts/storage/volumes.md @@ -0,0 +1,1130 @@ +--- +title: ボリューム +content_type: concept +weight: 10 +--- + +<!-- overview --> + +コンテナ内のディスク上のファイルは一時的なものであり、コンテナ内で実行する場合、重要なアプリケーションでいくつかの問題が発生します。1つの問題は、コンテナがクラッシュしたときにファイルが失われることです。kubeletはコンテナを再起動しますが、クリーンな状態です。 +2番目の問題は、`Pod`で一緒に実行されているコンテナ間でファイルを共有するときに発生します。 +Kubernetes{{< glossary_tooltip text="ボリューム" term_id="volume" >}}の抽象化は、これらの問題の両方を解決します。 +[Pod](/ja/docs/concepts/workloads/pods/)に精通していることをお勧めします。 + +<!-- body --> + +## 背景 + +Dockerには[ボリューム](https://docs.docker.com/storage/)の概念がありますが、多少緩く、管理も不十分です。Dockerボリュームは、ディスク上または別のコンテナ内のディレクトリです。Dockerはボリュームドライバーを提供しますが、機能は多少制限されています。 + +Kubernetesは多くの種類のボリュームをサポートしています。 +{{< glossary_tooltip term_id="pod" text="Pod" >}}は任意の数のボリュームタイプを同時に使用できます。 +エフェメラルボリュームタイプにはPodの存続期間がありますが、永続ボリュームはPodの存続期間を超えて存在します。 +Podが存在しなくなると、Kubernetesはエフェメラルボリュームを破棄します。ただしKubernetesは永続ボリュームを破棄しません。 +特定のPod内のあらゆる種類のボリュームについて、データはコンテナの再起動後も保持されます。 + +コアとなるボリュームはディレクトリであり、Pod内のコンテナからアクセスできるデータが含まれている可能性があります。 +ディレクトリがどのように作成されるか、それをバックアップするメディア、およびそのコンテンツは、使用する特定のボリュームタイプによって決まります。 + +ボリュームを使用するには、`.spec.volumes`でPodに提供するボリュームを指定し、`.spec.containers[*].volumeMounts`でそれらのボリュームをコンテナにマウントする場所を宣言します。 +コンテナ内のプロセスは{{< glossary_tooltip text="コンテナイメージ" term_id="image" >}}の初期コンテンツと、コンテナ内にマウントされたボリューム(定義されている場合)で構成されるファイルシステムビューを確認します。 +プロセスは、コンテナイメージのコンテンツと最初に一致するルートファイルシステムを確認します。 +そのファイルシステム階層内への書き込みは、もし許可されている場合、後続のファイルシステムアクセスを実行するときにそのプロセスが表示する内容に影響します。 +ボリュームはイメージ内の[指定されたパス](#using-subpath)へマウントされます。 +Pod内で定義されたコンテナごとに、コンテナが使用する各ボリュームをマウントする場所を個別に指定する必要があります。 + + +ボリュームは他のボリューム内にマウントできません(ただし、関連するメカニズムについては、[subPathの使用](#using-subpath)を参照してください)。 +またボリュームには、別のボリューム内の何かへのハードリンクを含めることはできません。 + +## ボリュームの種類 {#volume-types} + +Kubernetesはいくつかのタイプのボリュームをサポートしています。 + +### awsElasticBlockStore {#awselasticblockstore} + +`awsElasticBlockStore`ボリュームは、Amazon Web Services(AWS)[EBSボリューム](https://aws.amazon.com/ebs/)をPodにマウントします。 +Podを削除すると消去される`emptyDir`とは異なり、EBSボリュームのコンテンツは保持されたままボリュームはアンマウントされます。 +これは、EBSボリュームにデータを事前入力でき、データをPod間で共有できることを意味します。 + +{{< note >}} +使用する前に、`aws ec2 create-volume`またはAWSAPIを使用してEBSボリュームを作成する必要があります。 +{{< /note >}} + +`awsElasticBlockStore`ボリュームを使用する場合、いくつかの制限があります。 + +* Podが実行されているノードはAWS EC2インスタンスである必要があります +* これらのインスタンスは、EBSボリュームと同じリージョンおよびアベイラビリティーゾーンにある必要があります +* EBSは、ボリュームをマウントする単一のEC2インスタンスのみをサポートします + +#### AWS EBSボリュームの作成 + +PodでEBSボリュームを使用する前に作成する必要があります。 + +```shell +aws ec2 create-volume --availability-zone=eu-west-1a --size=10 --volume-type=gp2 +``` + +ゾーンがクラスターを立ち上げたゾーンと一致していることを確認してください。サイズとEBSボリュームタイプが使用に適していることを確認してください。 + +#### AWS EBS設定例 + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-ebs +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /test-ebs + name: test-volume + volumes: + - name: test-volume + # This AWS EBS volume must already exist. + awsElasticBlockStore: + volumeID: "<volume id>" + fsType: ext4 +``` + +EBSボリュームがパーティション化されている場合は、オプションのフィールド`partition: "<partition number>"`を指定して、マウントするパーティションを指定できます。 + +#### AWS EBS CSIの移行 + +{{< feature-state for_k8s_version="v1.17" state="beta" >}} + +`awsElasticBlockStore`の`CSIMigration`機能を有効にすると、すべてのプラグイン操作が既存のツリー内プラグインから`ebs.csi.aws.com`Container Storage Interface(CSI)ドライバーにリダイレクトされます。 +この機能を使用するには、[AWS EBS CSIドライバー](https://github.com/kubernetes-sigs/aws-ebs-csi-driver)がクラスターにインストールされ、`CSIMigration`と`CSIMigrationAWS`のbeta機能が有効になっている必要があります。 + +#### AWS EBS CSIの移行の完了 + +{{< feature-state for_k8s_version="v1.17" state="alpha" >}} + +`awsElasticBlockStore`ストレージプラグインがコントローラーマネージャーとkubeletによってロードされないようにするには、`InTreePluginAWSUnregister`フラグを`true`に設定します。 + +### azureDisk {#azuredisk} + +`azureDisk`ボリュームタイプは、MicrosoftAzure[データディスク](https://docs.microsoft.com/en-us/azure/aks/csi-storage-drivers)をPodにマウントします。 + +詳細については、[`azureDisk`ボリュームプラグイン](https://github.com/kubernetes/examples/tree/master/staging/volumes/azure_disk/README.md)を参照してください。 + +#### azureDisk CSIの移行 + +{{< feature-state for_k8s_version="v1.19" state="beta" >}} + +`azureDisk`の`CSIMigration`機能を有効にすると、すべてのプラグイン操作が既存のツリー内プラグインから`disk.csi.azure.com`Container Storage Interface(CSI)ドライバーにリダイレクトされます。 +この機能を利用するには、クラスタに[Azure Disk CSI Driver](https://github.com/kubernetes-sigs/azuredisk-csi-driver)をインストールし、`CSIMigration`および`CSIMigrationAzureDisk`機能を有効化する必要があります。 + +### azureFile {#azurefile} + +`azureFile`ボリュームタイプは、Microsoft Azureファイルボリューム(SMB 2.1および3.0)をPodにマウントします。 + +詳細については[`azureFile` volume plugin](https://github.com/kubernetes/examples/tree/master/staging/volumes/azure_file/README.md)を参照してください。 + +#### azureFile CSIの移行 + +{{< feature-state for_k8s_version="v1.21" state="beta" >}} + +`zureFile`の`CSIMigration`機能を有効にすると、既存のin-treeプラグインから`file.csi.azure.com`Container Storage Interface(CSI)Driverへすべてのプラグイン操作がリダイレクトされます。 +この機能を利用するには、クラスタに[Azure File CSI Driver](https://github.com/kubernetes-sigs/azurefile-csi-driver)をインストールし、`CSIMigration`および`CSIMigrationAzureFile`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)を有効化する必要があります。 + +Azure File CSIドライバーは、異なるfsgroupで同じボリュームを使用することをサポートしていません。AzurefileCSIの移行が有効になっている場合、異なるfsgroupで同じボリュームを使用することはまったくサポートされません。 + +### cephfs + +`cephfs`ボリュームを使用すると、既存のCephFSボリュームをPodにマウントすることができます。 +Podを取り外すと消去される`emptyDir`とは異なり、`cephfs`ボリュームは内容を保持したまま単にアンマウントされるだけです。 +つまり`cephfs`ボリュームにあらかじめデータを入れておき、そのデータをPod間で共有することができます。 +`cephfs`ボリュームは複数のライターによって同時にマウントすることができます。 + +{{< note >}} +事前に共有をエクスポートした状態で、自分のCephサーバーを起動しておく必要があります。 +{{< /note >}} + +詳細については[CephFSの例](https://github.com/kubernetes/examples/tree/master/volumes/cephfs/)を参照してください。 + +### cinder + +{{< note >}} +KubernetesはOpenStackクラウドプロバイダーで構成する必要があります。 +{{< /note >}} + +`cinder`ボリュームタイプは、PodにOpenStackのCinderのボリュームをマウントするために使用されます。 + +#### Cinderボリュームの設定例 + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-cinder +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-cinder-container + volumeMounts: + - mountPath: /test-cinder + name: test-volume + volumes: + - name: test-volume + # This OpenStack volume must already exist. + cinder: + volumeID: "<volume id>" + fsType: ext4 +``` + +#### OpenStack CSIの移行 + +{{< feature-state for_k8s_version="v1.21" state="beta" >}} + +Cinderの`CSIMigration`機能は、Kubernetes1.21ではデフォルトで有効になっています。 +既存のin-treeプラグインからのすべてのプラグイン操作を`cinder.csi.openstack.org`Container Storage Interface(CSI) Driverへリダイレクトします。 +[OpenStack Cinder CSIドライバー](https://github.com/kubernetes/cloud-provider-openstack/blob/master/docs/cinder-csi-plugin/using-cinder-csi-plugin.md)をクラスターにインストールする必要があります。 +`CSIMigrationOpenStack`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)を`false`に設定すると、クラスタのCinder CSIマイグレーションを無効化することができます。 +`CSIMigrationOpenStack`機能を無効にすると、in-treeのCinderボリュームプラグインがCinderボリュームのストレージ管理のすべての側面に責任を持つようになります。 + +### configMap + +[ConfigMap](/ja/docs/tasks/configure-pod-container/configure-pod-configmap/)は構成データをPodに挿入する方法を提供します。 +ConfigMapに格納されたデータは、タイプ`configMap`のボリュームで参照され、Podで実行されているコンテナ化されたアプリケーションによって使用されます。 + +ConfigMapを参照するときは、ボリューム内のConfigMapの名前を指定します。 +ConfigMapの特定のエントリに使用するパスをカスタマイズできます。 +次の設定は、`log-config`ConfigMapを`configmap-pod`というPodにマウントする方法を示しています。 + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: configmap-pod +spec: + containers: + - name: test + image: busybox + volumeMounts: + - name: config-vol + mountPath: /etc/config + volumes: + - name: config-vol + configMap: + name: log-config + items: + - key: log_level + path: log_level +``` + +`log-config`ConfigMapはボリュームとしてマウントされ、その`log_level`エントリに格納されているすべてのコンテンツは、パス`/etc/config/log_level`のPodにマウントされます。 +このパスはボリュームの`mountPath`と`log_level`をキーとする`path`から派生することに注意してください。 + + +{{< note >}} +* 使用する前に[ConfigMap](/ja/docs/tasks/configure-pod-container/configure-pod-configmap/)を作成する必要があります。 + +* [`subPath`](#using-subpath)ボリュームマウントとしてConfigMapを使用するコンテナはConfigMapの更新を受信しません。 + +* テキストデータはUTF-8文字エンコードを使用してファイルとして公開されます。その他の文字エンコードには`binaryData`を使用します。 +{{< /note >}} + +### downwardAPI {#downwardapi} + +`downwardAPI`ボリュームは、アプリケーションへのdownward APIデータを利用できるようになります。ディレクトリをマウントし、要求されたデータをプレーンテキストファイルに書き込みます。 + +{{< note >}} +[`subPath`](#using-subpath)ボリュームマウントとしてdownward APIを使用するコンテナは、downward APIの更新を受け取りません。 +{{< /note >}} + +詳細については[downward API example](/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/)を参照してください。 + +### emptyDir {#emptydir} + +`emptyDir`ボリュームはPodがノードに割り当てられたときに最初に作成され、そのPodがそのノードで実行されている限り存在します。 +名前が示すように`emptyDir`ボリュームは最初は空です。 +Pod内のすべてのコンテナは`emptyDir`ボリューム内の同じファイルを読み書きできますが、そのボリュームは各コンテナで同じパスまたは異なるパスにマウントされることがあります。 +何らかの理由でPodがノードから削除されると、`emptyDir`内のデータは永久に削除されます。 + +{{< note >}} +コンテナがクラッシュしても、ノードからPodが削除されることは*ありません*。`emptyDir`ボリューム内のデータは、コンテナのクラッシュしても安全です。 + +{{< /note >}} + +`emptyDir`のいくつかの用途は次の通りです。 + +* ディスクベースのマージソートなどのスクラッチスペース +* クラッシュからの回復のための長い計算のチェックポイント +* Webサーバーコンテナがデータを提供している間にコンテンツマネージャコンテナがフェッチするファイルを保持する + +環境に応じて、`emptyDir`ボリュームは、ディスクやSSD、ネットワークストレージなど、ノードをバックアップするあらゆる媒体に保存されます。 +ただし、`emptyDir.medium`フィールドを`"Memory"`に設定すると、Kubernetesは代わりにtmpfs(RAMベースのファイルシステム)をマウントします。 +tmpfsは非常に高速ですが、ディスクと違ってノードのリブート時にクリアされ、書き込んだファイルはコンテナのメモリ制限にカウントされることに注意してください。 + +{{< note >}} +`SizeMemoryBackedVolumes`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)が有効な場合、メモリバックアップボリュームにサイズを指定することができます。 +サイズが指定されていない場合、メモリでバックアップされたボリュームは、Linuxホストのメモリの50％のサイズになります。 +{{< /note>}} + +#### emptyDirの設定例 + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-pd +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /cache + name: cache-volume + volumes: + - name: cache-volume + emptyDir: {} +``` + +### fc (fibre channel) {#fc} + +`fc`ボリュームタイプを使用すると、既存のファイバーチャネルブロックストレージボリュームをPodにマウントできます。 +`targetWWNs`ボリューム構成のパラメーターを使用して、単一または複数のターゲットWorld Wide Name(WWN)を指定できます。 +複数のWWNが指定されている場合、targetWWNは、それらのWWNがマルチパス接続からのものであると想定します。 + +{{< note >}} +Kubernetesホストがアクセスできるように、事前にこれらのLUN(ボリューム)をターゲットWWNに割り当ててマスクするようにFCSANゾーニングを構成する必要があります。 +{{< /note >}} + +詳細については[fibre channelの例](https://github.com/kubernetes/examples/tree/master/staging/volumes/fibre_channel)を参照してください。 + +### flocker (非推奨) {#flocker} + +[Flocker](https://github.com/ClusterHQ/flocker)はオープンソースのクラスター化されたコンテナデータボリュームマネージャーです。 +Flockerは、さまざまなストレージバックエンドに支えられたデータボリュームの管理とオーケストレーションを提供します。 + +`flocker`ボリュームを使用すると、FlockerデータセットをPodにマウントできます。 +もしデータセットがまだFlockerに存在しない場合は、まずFlocker CLIかFlocker APIを使ってデータセットを作成する必要があります。 +データセットがすでに存在する場合は、FlockerによってPodがスケジュールされているノードに再アタッチされます。 +これは、必要に応じてPod間でデータを共有できることを意味します。 + +{{< note >}} +使用する前に、独自のFlockerインストールを実行する必要があります。 +{{< /note >}} + +詳細については[Flocker example](https://github.com/kubernetes/examples/tree/master/staging/volumes/flocker)を参照してください。 + +### gcePersistentDisk + +`gcePersistentDisk`ボリュームは、Google Compute Engine (GCE)の[永続ディスク](https://cloud.google.com/compute/docs/disks)(PD)をPodにマウントします。 +Podを取り外すと消去される`emptyDir`とは異なり、PDの内容は保持されボリュームは単にアンマウントされるだけです。これはPDにあらかじめデータを入れておくことができ、そのデータをPod間で共有できることを意味します。 + +{{< note >}} +`gcloud`を使用する前に、またはGCE APIまたはUIを使用してPDを作成する必要があります。 +{{< /note >}} + +`gcePersistentDisk`を使用する場合、いくつかの制限があります。 + +* Podが実行されているノードはGCE VMである必要があります +* これらのVMは、永続ディスクと同じGCEプロジェクトおよびゾーンに存在する必要があります + +GCE永続ディスクの機能の1つは、永続ディスクへの同時読み取り専用アクセスです。`gcePersistentDisk`ボリュームを使用すると、複数のコンシューマーが永続ディスクを読み取り専用として同時にマウントできます。 +これはPDにデータセットを事前入力してから、必要な数のPodから並行して提供できることを意味します。 +残念ながらPDは読み取り/書き込みモードで1人のコンシューマーのみがマウントできます。同時書き込みは許可されていません。 + +PDが読み取り専用であるか、レプリカ数が0または1でない限り、ReplicaSetによって制御されるPodでGCE永続ディスクを使用すると失敗します。 + +#### GCE永続ディスクの作成 {#gce-create-persistent-disk} + +PodでGCE永続ディスクを使用する前に、それを作成する必要があります。 + +```shell +gcloud compute disks create --size=500GB --zone=us-central1-a my-data-disk +``` + +#### GCE永続ディスクの設定例 + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-pd +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /test-pd + name: test-volume + volumes: + - name: test-volume + # This GCE PD must already exist. + gcePersistentDisk: + pdName: my-data-disk + fsType: ext4 +``` + +#### リージョン永続ディスク + + [リージョン永続ディスク](https://cloud.google.com/compute/docs/disks/#repds)機能を使用すると、同じリージョン内の2つのゾーンで使用できる永続ディスクを作成できます。 + この機能を使用するには、ボリュームをPersistentVolumeとしてプロビジョニングする必要があります。Podから直接ボリュームを参照することはサポートされていません。 + +#### リージョンPD PersistentVolumeを手動でプロビジョニングする + +[GCE PDのStorageClass](/docs/concepts/storage/storage-classes/#gce)を使用して動的プロビジョニングが可能です。 +SPDPersistentVolumeを作成する前に、永続ディスクを作成する必要があります。 + +```shell +gcloud compute disks create --size=500GB my-data-disk + --region us-central1 + --replica-zones us-central1-a,us-central1-b +``` + +#### リージョン永続ディスクの設定例 + +```yaml +apiVersion: v1 +kind: PersistentVolume +metadata: + name: test-volume +spec: + capacity: + storage: 400Gi + accessModes: + - ReadWriteOnce + gcePersistentDisk: + pdName: my-data-disk + fsType: ext4 + nodeAffinity: + required: + nodeSelectorTerms: + - matchExpressions: + # failure-domain.beta.kubernetes.io/zone should be used prior to 1.21 + - key: topology.kubernetes.io/zone + operator: In + values: + - us-central1-a + - us-central1-b +``` + +#### GCE CSIの移行 + +{{< feature-state for_k8s_version="v1.17" state="beta" >}} + +GCE PDの`CSIMigration`機能を有効にすると、すべてのプラグイン操作が既存のin-treeプラグインから`pd.csi.storage.gke.io`Container Storage Interface (CSI) Driverにリダイレクトされるようになります。 +この機能を使用するには、クラスタに[GCE PD CSI Driver](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver)がインストールされ、`CSIMigration`と`CSIMigrationGCE`のbeta機能が有効になっている必要があります。 + +#### GCE CSIの移行の完了 + +{{< feature-state for_k8s_version="v1.21" state="alpha" >}} + +`gcePersistentDisk`ストレージプラグインがコントローラーマネージャーとkubeletによってロードされないようにするには、`InTreePluginGCEUnregister`フラグを`true`に設定します。 + +### gitRepo(非推奨) {#gitrepo} + +{{< warning >}} +`gitRepo`ボリュームタイプは非推奨です。gitレポジトリを使用してコンテナをプロビジョニングするには、Gitを使用してレポジトリのクローンを作成するInitContainerに[EmptyDir](#emptydir)をマウントしてから、Podのコンテナに[EmptyDir](#emptydir)をマウントします。 +{{< /warning >}} + +`gitRepo`ボリュームは、ボリュームプラグインの一例です。このプラグインは空のディレクトリをマウントし、そのディレクトリにgitリポジトリをクローンしてPodで使えるようにします。 + +`gitRepo`ボリュームの例を次に示します。 + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: server +spec: + containers: + - image: nginx + name: nginx + volumeMounts: + - mountPath: /mypath + name: git-volume + volumes: + - name: git-volume + gitRepo: + repository: "git@somewhere:me/my-git-repository.git" + revision: "22f1d8406d464b0c0874075539c1f2e96c253775" +``` + +### glusterfs + +`glusterfs`ボリュームは[Glusterfs](https://www.gluster.org)(オープンソースのネットワークファイルシステム)ボリュームをPodにマウントできるようにするものです。 +Podを取り外すと消去される`emptyDir`とは異なり、`glusterfs`ボリュームの内容は保持され、単にアンマウントされるだけです。 +これは、glusterfsボリュームにデータを事前に入力でき、データをPod間で共有できることを意味します。 +GlusterFSは複数のライターが同時にマウントすることができます。 + +{{< note >}} +GlusterFSを使用するためには、事前にGlusterFSのインストールを実行しておく必要があります。 +{{< /note >}} + +詳細については[GlusterFSの例](https://github.com/kubernetes/examples/tree/master/volumes/glusterfs)を参照してください。 + +### hostPath {#hostpath} + +{{< warning >}} +HostPathボリュームには多くのセキュリティリスクがあり、可能な場合はHostPathの使用を避けることがベストプラクティスです。HostPathボリュームを使用する必要がある場合は、必要なファイルまたはディレクトリのみにスコープを設定し、読み取り専用としてマウントする必要があります。 + +AdmissionPolicyによって特定のディレクトリへのHostPathアクセスを制限する場合、ポリシーを有効にするために`volumeMounts`は`readOnly`マウントを使用するように要求されなければなりません。 +{{< /warning >}} + +`hostPath`ボリュームは、ファイルまたはディレクトリをホストノードのファイルシステムからPodにマウントします。 +これはほとんどのPodに必要なものではありませんが、一部のアプリケーションには強力なエスケープハッチを提供します。 + +たとえば`hostPath`のいくつかの使用法は次のとおりです。 + +* Dockerの内部にアクセスする必要があるコンテナを実行する場合:`hostPath`に`/var/lib/docker`を使用します。 +* コンテナ内でcAdvisorを実行する場合:`hostPath`に`/sys`を指定します。 +* Podが実行される前に、与えられた`hostPath`が存在すべきかどうか、作成すべきかどうか、そして何として存在すべきかを指定できるようにします。 + +必須の`path`プロパティに加えて、オプションで`hostPath`ボリュームに`type`を指定することができます。 + +フィールド`type`でサポートされている値は次のとおりです。 + +| 値 | ふるまい | +|:------|:---------| +| | 空の文字列(デフォルト)は下位互換性のためです。つまり、hostPathボリュームをマウントする前にチェックは実行されません。 | +| `DirectoryOrCreate` | 指定されたパスに何も存在しない場合、必要に応じて、権限を0755に設定し、Kubeletと同じグループと所有権を持つ空のディレクトリが作成されます。 | +| `Directory` | 指定されたパスにディレクトリが存在する必要があります。 | +| `FileOrCreate` | 指定されたパスに何も存在しない場合、必要に応じて、権限を0644に設定し、Kubeletと同じグループと所有権を持つ空のファイルが作成されます。 | +| `File` | 指定されたパスにファイルが存在する必要があります。 | +| `Socket` | UNIXソケットは、指定されたパスに存在する必要があります。 | +| `CharDevice` | キャラクターデバイスは、指定されたパスに存在する必要があります。 | +| `BlockDevice` | ブロックデバイスは、指定されたパスに存在する必要があります。 | + +このタイプのボリュームを使用するときは、以下の理由のため注意してください。 + +* HostPath は、特権的なシステム認証情報(Kubeletなど)や特権的なAPI(コンテナランタイムソケットなど)を公開する可能性があり、コンテナのエスケープやクラスタの他の部分への攻撃に利用される可能性があります。 +* 同一構成のPod(PodTemplateから作成されたものなど)は、ノード上のファイルが異なるため、ノードごとに動作が異なる場合があります。 +* ホスト上に作成されたファイルやディレクトリは、rootでしか書き込みができません。[特権コンテナ](/docs/tasks/configure-pod-container/security-context/)内でrootとしてプロセスを実行するか、ホスト上のファイルのパーミッションを変更して`hostPath`ボリュームに書き込みができるようにする必要があります。 + +#### hostPathの設定例 + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-pd +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /test-pd + name: test-volume + volumes: + - name: test-volume + hostPath: + # directory location on host + path: /data + # this field is optional + type: Directory +``` + +{{< caution >}} +`FileOrCreate`モードでは、ファイルの親ディレクトリは作成されません。マウントされたファイルの親ディレクトリが存在しない場合、Podは起動に失敗します。 +このモードが確実に機能するようにするには、[`FileOrCreate`構成](＃hostpath-fileorcreate-example)に示すように、ディレクトリとファイルを別々にマウントしてみてください。 +{{< /caution >}} + +#### hostPath FileOrCreateの設定例 {#hostpath-fileorcreate-example} + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-webserver +spec: + containers: + - name: test-webserver + image: k8s.gcr.io/test-webserver:latest + volumeMounts: + - mountPath: /var/local/aaa + name: mydir + - mountPath: /var/local/aaa/1.txt + name: myfile + volumes: + - name: mydir + hostPath: + # Ensure the file directory is created. + path: /var/local/aaa + type: DirectoryOrCreate + - name: myfile + hostPath: + path: /var/local/aaa/1.txt + type: FileOrCreate +``` + +### iscsi + +`iscsi`ボリュームは、既存のiSCSI(SCSI over IP)ボリュームをPodにマウントすることができます。 +Podを取り外すと消去される`emptyDir`とは異なり、`iscsi`ボリュームの内容は保持され、単にアンマウントされるだけです。 +つまり、iscsiボリュームにはあらかじめデータを入れておくことができ、そのデータをPod間で共有することができるのです。 + + +{{< note >}} +使用する前に、ボリュームを作成したiSCSIサーバーを起動する必要があります。 + +{{< /note >}} + +iSCSIの特徴として、複数のコンシューマーから同時に読み取り専用としてマウントできることが挙げられます。 +つまり、ボリュームにあらかじめデータセットを入れておき、必要な数のPodから並行してデータを提供することができます。 +残念ながら、iSCSIボリュームは1つのコンシューマによってのみ読み書きモードでマウントすることができます。 +同時に書き込みを行うことはできません。 + +詳細については[iSCSIの例](https://github.com/kubernetes/examples/tree/master/volumes/iscsi)を参照してください。 + +### local + +`local`ボリュームは、ディスク、パーティション、ディレクトリなど、マウントされたローカルストレージデバイスを表します。 + +ローカルボリュームは静的に作成されたPersistentVolumeとしてのみ使用できます。動的プロビジョニングはサポートされていません。 + +`hostPath`ボリュームと比較して、`local`ボリュームは手動でノードにPodをスケジューリングすることなく、耐久性と移植性に優れた方法で使用することができます。 +システムはPersistentVolume上のノードアフィニティーを見ることで、ボリュームのノード制約を認識します。 + +ただし、`loval`ボリュームは、基盤となるノードの可用性に左右されるため、すべてのアプリケーションに適しているわけではありません。 +ノードが異常になると、Podは`local`ボリュームにアクセスできなくなります。 +このボリュームを使用しているPodは実行できません。`local`ボリュームを使用するアプリケーションは、基盤となるディスクの耐久性の特性に応じて、この可用性の低下と潜在的なデータ損失に耐えられる必要があります。 + +次の例では、`local`ボリュームと`nodeAffinity`を使用したPersistentVolumeを示しています。 + +```yaml +apiVersion: v1 +kind: PersistentVolume +metadata: + name: example-pv +spec: + capacity: + storage: 100Gi + volumeMode: Filesystem + accessModes: + - ReadWriteOnce + persistentVolumeReclaimPolicy: Delete + storageClassName: local-storage + local: + path: /mnt/disks/ssd1 + nodeAffinity: + required: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/hostname + operator: In + values: + - example-node +``` + +ローカルボリュームを使用する場合は、PersistentVolume`nodeAffinity`を設定する必要があります。 +KubernetesのスケジューラはPersistentVolume`nodeAffinity`を使用して、これらのPodを正しいノードにスケジューリングします。 + +PersistentVolume`volumeMode`を(デフォルト値の「Filesystem」ではなく)「Block」に設定して、ローカルボリュームをrawブロックデバイスとして公開できます。 + +ローカルボリュームを使用する場合、`volumeBindingMode`を`WaitForFirstConsumer`に設定したStorageClassを作成することをお勧めします。 +詳細については、local [StorageClass](/docs/concepts/storage/storage-classes/#local)の例を参照してください。 +ボリュームバインディングを遅延させると、PersistentVolumeClaimバインディングの決定が、ノードリソース要件、ノードセレクタ、Podアフィニティ、Podアンチアフィニティなど、Podが持つ可能性のある他のノード制約も含めて評価されるようになります。 + +ローカルボリュームのライフサイクルの管理を改善するために、外部の静的プロビジョナーを個別に実行できます。 +このプロビジョナーはまだ動的プロビジョニングをサポートしていないことに注意してください。 +外部ローカルプロビジョナーの実行方法の例については、[ローカルボリュームプロビジョナーユーザーガイド](https://github.com/kubernetes-sigs/sig-storage-local-static-provisioner)を参照してください。 + +{{< note >}} +ボリュームのライフサイクルを管理するために外部の静的プロビジョナーが使用されていない場合、ローカルのPersistentVolumeは、ユーザーによる手動のクリーンアップと削除を必要とします。 +{{< /note >}} + +### nfs + +`nfs`ボリュームは、既存のNFS(Network File System)共有をPodにマウントすることを可能にします。Podを取り外すと消去される`emptyDir`とは異なり、`nfs`ボリュームのコンテンツは保存され、単にアンマウントされるだけです。 +つまり、NFSボリュームにはあらかじめデータを入れておくことができ、そのデータをPod間で共有することができます。 +NFSは複数のライターによって同時にマウントすることができます。 + +{{< note >}} +使用する前に、共有をエクスポートしてNFSサーバーを実行する必要があります。 +{{< /note >}} + +詳細については[NFSの例](https://github.com/kubernetes/examples/tree/master/staging/volumes/nfs)を参照してください。 + +### persistentVolumeClaim {#persistentvolumeclaim} + +`PersistentVolumeClaim`ボリュームは[PersistentVolume](/ja/docs/concepts/storage/persistent-volumes/)をPodにマウントするために使用されます。 +PersistentVolumeClaimは、ユーザが特定のクラウド環境の詳細を知らなくても、耐久性のあるストレージ(GCE永続ディスクやiSCSIボリュームなど)を「要求」するための方法です。 + +詳細については[PersistentVolume](/ja/docs/concepts/storage/persistent-volumes/)を参照してください。 + +### portworxVolume {#portworxvolume} + +`portworxVolume`は、Kubernetesとハイパーコンバージドで動作するエラスティックブロックストレージレイヤーです。 +[Portworx](https://portworx.com/use-case/kubernetes-storage/)は、サーバー内のストレージをフィンガープリントを作成し、機能に応じて階層化し、複数のサーバーにまたがって容量を集約します。 +Portworxは、仮想マシンまたはベアメタルLinuxノードでゲスト内で動作します。 + +`portworxVolume`はKubernetesを通して動的に作成することができますが、事前にプロビジョニングしてPodの中で参照することもできます。 +以下は、事前にプロビジョニングされたPortworxボリュームを参照するPodの例です。 + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-portworx-volume-pod +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /mnt + name: pxvol + volumes: + - name: pxvol + # This Portworx volume must already exist. + portworxVolume: + volumeID: "pxvol" + fsType: "<fs-type>" +``` + +{{< note >}} +Podで使用する前に、`pxvol`という名前の既存のPortworxVolumeがあることを確認してください。 +{{< /note >}} + +詳細については[Portworxボリューム](https://github.com/kubernetes/examples/tree/master/staging/volumes/portworx/README.md)の例を参照してください。 + +### 投影 + +投影ボリュームは、複数の既存のボリュームソースを同じディレクトリにマッピングします。 +詳細については[投影ボリューム](/docs/concepts/storage/projected-volumes/)を参照してください。 + +### quobyte(非推奨) {#quobyte} + +`quobyte`ボリュームは、既存の[Quobyte](https://www.quobyte.com)ボリュームをPodにマウントすることができます。 + + +{{< note >}} +使用する前にQuobyteをセットアップして、ボリュームを作成した状態で動作させる必要があります。 +{{< /note >}} + +CSIは、Kubernetes内部でQuobyteボリュームを使用するための推奨プラグインです。 +QuobyteのGitHubプロジェクトには、CSIを使用してQuobyteをデプロイするための[手順](https://github.com/quobyte/quobyte-csi#quobyte-csi)と例があります + +### rbd + +`rbd`ボリュームは[Rados Block Device](https://docs.ceph.com/en/latest/rbd/)(RBD)ボリュームをPodにマウントすることを可能にします。 +Podを取り外すと消去される`emptyDir`とは異なり、`rbd`ボリュームの内容は保存され、ボリュームはアンマウントされます。つまり、RBDボリュームにはあらかじめデータを入れておくことができ、そのデータをPod間で共有することができるのです。 + +{{< note >}} +RBDを使用する前に、Cephのインストールが実行されている必要があります。 +{{< /note >}} + +RBDの特徴として、複数のコンシューマーから同時に読み取り専用としてマウントできることが挙げられます。 +つまり、ボリュームにあらかじめデータセットを入れておき、必要な数のPodから並行して提供することができるのです。 +残念ながら、RBDボリュームは1つのコンシューマーによってのみ読み書きモードでマウントすることができます。 +同時に書き込みを行うことはできません。 + +詳細については[RBDの例](https://github.com/kubernetes/examples/tree/master/volumes/rbd)を参照してください。 + +#### RBD CSIの移行 {#rbd-csi-migration} + +{{< feature-state for_k8s_version="v1.23" state="alpha" >}} + +`RBD`の`CSIMigration`機能を有効にすると、既存のin-treeプラグインから`rbd.csi.ceph.com`{{< glossary_tooltip text="CSI" term_id="csi" >}}ドライバーにすべてのプラグイン操作がリダイレクトされます。 +この機能を使用するには、クラスタに[Ceph CSIドライバー](https://github.com/ceph/ceph-csi)をインストールし、`CSIMigration`および`csiMigrationRBD`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)を有効にしておく必要があります。 + + +{{< note >}} + +ストレージを管理するKubernetesクラスターオペレーターとして、RBD CSIドライバーへの移行を試みる前に完了する必要のある前提条件は次のとおりです。 + +* Ceph CSIドライバー(`rbd.csi.ceph.com`)v3.5.0以降をKubernetesクラスターにインストールする必要があります。 +* CSIドライバーの動作に必要なパラメーターとして`clusterID`フィールドがありますが、in-tree StorageClassには`monitors`フィールドがあるため、Kubernetesストレージ管理者はCSI config mapでモニターハッシュ(例：`#echo -n '<monitors_string>' | md5sum`)に基づいたclusterIDを作成し、モニターをこのclusterID設定の下に保持しなければなりません。 +* また、in-tree Storageclassの`adminId`の値が`admin`と異なる場合、in-tree Storageclassに記載されている`adminSecretName`に`adminId`パラメーター値のbase64値をパッチしなければなりませんが、それ以外はスキップすることが可能です。 +{{< /note >}} + +### secret + +`secret`ボリュームは、パスワードなどの機密情報をPodに渡すために使用します。 +Kubernetes APIにsecretを格納し、Kubernetesに直接結合することなくPodが使用するファイルとしてマウントすることができます。 +`secret`ボリュームはtmpfs(RAM-backed filesystem)によってバックアップされるため、不揮発性ストレージに書き込まれることはありません。 + +{{< note >}} +使用する前にKubernetes APIでSecretを作成する必要があります。 +{{< /note >}} + +{{< note >}} +[`SubPath`](#using-subpath)ボリュームマウントとしてSecretを使用しているコンテナは、Secretの更新を受け取りません。 +{{< /note >}} + +詳細については[Secretの設定](/ja/docs/concepts/configuration/secret/)を参照してください。 + +### storageOS(非推奨) {#storageos} + +`storageos`ボリュームを使用すると、既存の[StorageOS](https://www.storageos.com)ボリュームをPodにマウントできます。 + +StorageOSは、Kubernetes環境内でコンテナとして実行され、Kubernetesクラスター内の任意のノードからローカルストレージまたは接続されたストレージにアクセスできるようにします。 +データを複製してノードの障害から保護することができます。シンプロビジョニングと圧縮により使用率を向上させ、コストを削減できます。 + +根本的にStorageOSは、コンテナにブロックストレージを提供しファイルシステムからアクセスできるようにします。 + +StorageOS Containerは64ビットLinuxを必要とし、追加の依存関係はありません。 +無償の開発者ライセンスが利用可能です。 + + +{{< caution >}} +StorageOSボリュームにアクセスする、またはプールにストレージ容量を提供する各ノードでStorageOSコンテナを実行する必要があります。 +インストール手順については、[StorageOSドキュメント](https://docs.storageos.com)を参照してください。 +{{< /caution >}} + +次の例は、StorageOSを使用したPodの設定です。 + +```yaml +apiVersion: v1 +kind: Pod +metadata: + labels: + name: redis + role: master + name: test-storageos-redis +spec: + containers: + - name: master + image: kubernetes/redis:v1 + env: + - name: MASTER + value: "true" + ports: + - containerPort: 6379 + volumeMounts: + - mountPath: /redis-master-data + name: redis-data + volumes: + - name: redis-data + storageos: + # The `redis-vol01` volume must already exist within StorageOS in the `default` namespace. + volumeName: redis-vol01 + fsType: ext4 +``` + +StorageOS、動的プロビジョニング、およびPersistentVolumeClaimの詳細については、[StorageOSの例](https://github.com/kubernetes/examples/blob/master/volumes/storageos)を参照してください。 + + +### vsphereVolume {#vspherevolume} + +{{< note >}} +KubernetesvSphereクラウドプロバイダーを設定する必要があります。cloudproviderの設定については、[vSphere入門ガイド](https://vmware.github.io/vsphere-storage-for-kubernetes/documentation/)を参照してください。 +{{< /note >}} + +`vsphereVolume`は、vSphereVMDKボリュームをPodにマウントするために使用されます。 +ボリュームの内容は、マウント解除されたときに保持されます。VMFSとVSANの両方のデータストアをサポートします。 + +{{< note >}} +Podで使用する前に、次のいずれかの方法を使用してvSphereVMDKボリュームを作成する必要があります。 +{{< /note >}} + +#### Creating a VMDK volume {#creating-vmdk-volume} + +次のいずれかの方法を選択して、VMDKを作成します。 + +{{< tabs name="tabs_volumes" >}} +{{% tab name="vmkfstoolsを使用して作成する" %}} +最初にESXにSSHで接続し、次に以下のコマンドを使用してVMDKを作成します。 + +```shell +vmkfstools -c 2G /vmfs/volumes/DatastoreName/volumes/myDisk.vmdk +``` + +{{% /tab %}} +{{% tab name="vmware-vdiskmanagerを使用して作成する" %}} +次のコマンドを使用してVMDKを作成します。 + +```shell +vmware-vdiskmanager -c -t 0 -s 40GB -a lsilogic myDisk.vmdk +``` + +{{% /tab %}} + +{{< /tabs >}} + +#### vSphere VMDKの設定例 {#vsphere-vmdk-configuration} + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-vmdk +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /test-vmdk + name: test-volume + volumes: + - name: test-volume + # This VMDK volume must already exist. + vsphereVolume: + volumePath: "[DatastoreName] volumes/myDisk" + fsType: ext4 +``` + +詳細については[vSphereボリューム](https://github.com/kubernetes/examples/tree/master/staging/volumes/vsphere)の例を参照してください。 + +#### vSphere CSIの移行 {#vsphere-csi-migration} + +{{< feature-state for_k8s_version="v1.19" state="beta" >}} + +`vsphereVolume`の`CSIMigration`機能を有効にすると、既存のインツリープラグインから`csi.vsphere.vmware.com`{{< glossary_tooltip text="CSI" term_id="csi" >}}ドライバーにすべてのプラグイン操作がリダイレクトされます。 +この機能を使用するには、クラスタに[vSphere CSIドライバー](https://github.com/kubernetes-sigs/vsphere-csi-driver)がインストールされ、`CSIMigration`および`CSIMigrationvSphere`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)が有効になっていなければなりません。 + +また、vSphere vCenter/ESXiのバージョンが7.0u1以上、HWのバージョンがVM version 15以上であることが条件となります。 + + +{{< note >}} +組み込みの`vsphereVolume`プラグインの次のStorageClassパラメーターは、vSphere CSIドライバーでサポートされていません。 + +* `diskformat` +* `hostfailurestotolerate` +* `forceprovisioning` +* `cachereservation` +* `diskstripes` +* `objectspacereservation` +* `iopslimit` + +これらのパラメーターを使用して作成された既存のボリュームはvSphere CSIドライバーに移行されますが、vSphere CSIドライバーで作成された新しいボリュームはこれらのパラメーターに従わないことに注意してください。 + +{{< /note >}} + +#### vSphere CSIの移行の完了 {#vsphere-csi-migration-complete} + +{{< feature-state for_k8s_version="v1.19" state="beta" >}} + +`vsphereVolume`プラグインがコントローラーマネージャーとkubeletによってロードされないようにするには、`InTreePluginvSphereUnregister`機能フラグを`true`に設定する必要があります。すべてのワーカーノードに`csi.vsphere.vmware.com`{{< glossary_tooltip text="CSI" term_id="csi" >}}ドライバーをインストールする必要があります。 + +#### Portworx CSIの移行 +{{< feature-state for_k8s_version="v1.23" state="alpha" >}} + +Portworxの`CSIMigration`機能が追加されましたが、Kubernetes 1.23ではAlpha状態であるため、デフォルトで無効になっています。 +すべてのプラグイン操作を既存のツリー内プラグインから`pxd.portworx.com`Container Storage Interface(CSI)ドライバーにリダイレクトします。 +[Portworx CSIドライバー](https://docs.portworx.com/portworx-install-with-kubernetes/storage-operations/csi/)をクラスターにインストールする必要があります。 +この機能を有効にするには、kube-controller-managerとkubeletで`CSIMigrationPortworx=true`を設定します。 + +## subPathの使用 {#using-subpath} + +1つのPodで複数の用途に使用するために1つのボリュームを共有すると便利な場合があります。 +`volumeMounts.subPath`プロパティは、ルートではなく、参照されるボリューム内のサブパスを指定します。 + +次の例は、単一の共有ボリュームを使用してLAMPスタック(Linux Apache MySQL PHP)でPodを構成する方法を示しています。 +このサンプルの`subPath`構成は、プロダクションでの使用にはお勧めしません。 + +PHPアプリケーションのコードとアセットはボリュームの`html`フォルダーにマップされ、MySQLデータベースはボリュームの`mysql`フォルダーに保存されます。例えば: + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: my-lamp-site +spec: + containers: + - name: mysql + image: mysql + env: + - name: MYSQL_ROOT_PASSWORD + value: "rootpasswd" + volumeMounts: + - mountPath: /var/lib/mysql + name: site-data + subPath: mysql + - name: php + image: php:7.0-apache + volumeMounts: + - mountPath: /var/www/html + name: site-data + subPath: html + volumes: + - name: site-data + persistentVolumeClaim: + claimName: my-lamp-site-data +``` + +### 拡張された環境変数でのsubPathの使用{#using-subpath-expanded-environment} + +{{< feature-state for_k8s_version="v1.17" state="stable" >}} + +`subPathExpr`フィールドを使用して、downwart API環境変数から`subPath`ディレクトリ名を作成します。 +`subPath`プロパティと`subPathExpr`プロパティは相互に排他的です。 + +この例では、`Pod`が`subPathExpr`を使用して、`hostPath`ボリューム`/var/log/pods`内に`pod1`というディレクトリを作成します。 +`hostPath`ボリュームは`downwardAPI`から`Pod`名を受け取ります。 +ホストディレクトリ`/var/log/pods/pod1`は、コンテナ内の`/logs`にマウントされます。 + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: pod1 +spec: + containers: + - name: container1 + env: + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + image: busybox + command: [ "sh", "-c", "while [ true ]; do echo 'Hello'; sleep 10; done | tee -a /logs/hello.txt" ] + volumeMounts: + - name: workdir1 + mountPath: /logs + # The variable expansion uses round brackets (not curly brackets). + subPathExpr: $(POD_NAME) + restartPolicy: Never + volumes: + - name: workdir1 + hostPath: + path: /var/log/pods +``` + +## リソース + +`emptyDir`ボリュームの記憶媒体(DiskやSSDなど)は、kubeletのルートディレクトリ(通常は`/var/lib/kubelet`)を保持するファイルシステムの媒体によって決定されます。 +`emptyDir`または`hostPath`ボリュームが消費する容量に制限はなく、コンテナ間またはPod間で隔離されることもありません。 + +リソース仕様を使用したスペースの要求については、[リソースの管理方法](/ja/docs/concepts/configuration/manage-resources-containers/)を参照してください。 + +## ツリー外のボリュームプラグイン + +ツリー外ボリュームプラグインには{{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}}(CSI)、およびFlexVolume(非推奨)があります。 +これらのプラグインによりストレージベンダーは、プラグインのソースコードをKubernetesリポジトリに追加することなく、カスタムストレージプラグインを作成することができます。 + +以前は、すべてのボリュームプラグインが「ツリー内」にありました。 +「ツリー内」のプラグインは、Kubernetesのコアバイナリとともにビルド、リンク、コンパイルされ、出荷されていました。 +つまり、Kubernetesに新しいストレージシステム(ボリュームプラグイン)を追加するには、Kubernetesのコアコードリポジトリにコードをチェックインする必要があったのです。 + +CSIとFlexVolumeはどちらも、ボリュームプラグインをKubernetesコードベースとは独立して開発し、拡張機能としてKubernetesクラスターにデプロイ(インストール)することを可能にします。 + +ツリー外のボリュームプラグインの作成を検討しているストレージベンダーについては、[ボリュームプラグインのFAQ](https://github.com/kubernetes/community/blob/master/sig-storage/volume-plugin-faq.md)を参照してください。 + +### csi + +[Container Storage Interface](https://github.com/container-storage-interface/spec/blob/master/spec.md)(CSI)は、コンテナオーケストレーションシステム(Kubernetesなど)の標準インターフェイスを定義して、任意のストレージシステムをコンテナワークロードに公開します。 + +詳細については[CSI design proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/container-storage-interface.md)を参照してください。 + +{{< note >}} +CSI仕様バージョン0.2および0.3のサポートは、Kubernetes v1.13で非推奨になり、将来のリリースで削除される予定です。 +{{< /note >}} + +{{< note >}} +CSIドライバーは、すべてのKubernetesリリース間で互換性があるとは限りません。各Kubernetesリリースでサポートされているデプロイ手順と互換性マトリックスについては、特定のCSIドライバーのドキュメントを確認してください。 +{{< /note >}} + +CSI互換のボリュームドライバーがKubernetesクラスタ上に展開されると、ユーザーは`csi`ボリュームタイプを使用して、CSIドライバーによって公開されたボリュームをアタッチまたはマウントすることができます。 + +`csi`ボリュームはPodで3つの異なる方法によって使用することができます。 + +* [PersistentVolumeClaim](#persistentvolumeclaim)の参照を通して +* [一般的なエフェメラルボリューム](/docs/concepts/storage/ephemeral-volumes/#generic-ephemeral-volume)(alpha機能)で +* ドライバーがそれをサポートしている場合は、[CSIエフェメラルボリューム](/docs/concepts/storage/ephemeral-volumes/#csi-ephemeral-volume)(beta機能)を使って + +ストレージ管理者は、CSI永続ボリュームを構成するために次のフィールドを使用できます。 + +* `driver`: 使用するボリュームドライバーの名前を指定する文字列。 + この値は[CSI spec](https://github.com/container-storage-interface/spec/blob/master/spec.md#getplugininfo)で定義されたCSIドライバーが`GetPluginInfoResponse`で返す値に対応していなければなりません。 + これはKubernetesが呼び出すCSIドライバーを識別するために使用され、CSIドライバーコンポーネントがCSIドライバーに属するPVオブジェクトを識別するために使用されます。 +* `volumeHandle`: ボリュームを一意に識別する文字列。この値は、[CSI spec](https://github.com/container-storage-interface/spec/blob/master/spec.md#createvolume)で定義されたCSIドライバーが`CreateVolumeResponse`の`volume.id`フィールドに返す値に対応していなければなりません。この値はCSIボリュームドライバーのすべての呼び出しで、ボリュームを参照する際に`volume_id`として渡されます。 +* `readOnly`: ボリュームを読み取り専用として「ControllerPublished」(添付)するかどうかを示すオプションのブール値。デフォルトはfalseです。この値は、`ControllerPublishVolumeRequest`の`readonly`フィールドを介してCSIドライバーに渡されます。 +* `fsType`: PVの`VolumeMode`が`Filesystem`の場合、このフィールドを使用して、ボリュームのマウントに使用する必要のあるファイルシステムを指定できます。ボリュームがフォーマットされておらず、フォーマットがサポートされている場合、この値はボリュームのフォーマットに使用されます。この値は、`ControllerPublishVolumeRequest`、`NodeStageVolumeRequest`、および`NodePublishVolumeRequest`の`VolumeCapability`フィールドを介してCSIドライバーに渡されます。 +* `volumeAttributes`: ボリュームの静的プロパティを指定する、文字列から文字列へのマップ。このマップは、[CSI spec](https://github.com/container-storage-interface/spec/blob/master/spec.md#createvolume)で定義されているように、CSIドライバーが`CreateVolumeResponse`の`volume.attributes`フィールドで返すマップと一致しなければなりません。このマップは`ControllerPublishVolumeRequest`,`NodeStageVolumeRequest`,`NodePublishVolumeRequest`の`volume_context`フィールドを介してCSIドライバーに渡されます。 +* `controllerPublishSecretRef`: CSI`ControllerPublishVolume`および`ControllerUnpublishVolume`呼び出しを完了するためにCSIドライバーに渡す機密情報を含むsecretオブジェクトへの参照。このフィールドはオプションで、secretが必要ない場合は空にすることができます。secretに複数のsecretが含まれている場合は、すべてのsecretが渡されます。 +* `nodeStageSecretRef`: CSI`NodeStageVolume`呼び出しを完了するために、CSIドライバーに渡す機密情報を含むsecretオブジェクトへの参照。このフィールドはオプションで、secretが必要ない場合は空にすることができます。secretに複数のsecretが含まれている場合、すべてのsecretが渡されます。 +* `nodePublishSecretRef`: CSI`NodePublishVolume`呼び出しを完了するために、CSIドライバーに渡す機密情報を含むsecretオブジェクトへの参照。このフィールドはオプションで、secretが必要ない場合は空にすることができます。secretオブジェクトが複数のsecretを含んでいる場合、すべてのsecretが渡されます。 + +#### CSI rawブロックボリュームのサポート + +{{< feature-state for_k8s_version="v1.18" state="stable" >}} + +外部のCSIドライバーを使用するベンダーは、Kubernetesワークロードでrawブロックボリュームサポートを実装できます。 + +CSI固有の変更を行うことなく、通常どおり、[rawブロックボリュームをサポートするPersistentVolume/PersistentVolumeClaim](/docs/concepts/storage/persistent-volumes/#raw-block-volume-support)を設定できます。 + +#### CSIエフェメラルボリューム + +{{< feature-state for_k8s_version="v1.16" state="beta" >}} + +Pod仕様内でCSIボリュームを直接構成できます。この方法で指定されたボリュームは一時的なものであり、Podを再起動しても持続しません。詳細については[エフェメラルボリューム](/docs/concepts/storage/ephemeral-volumes/#csi-ephemeral-volume)を参照してください。 + +CSIドライバーの開発方法の詳細については[kubernetes-csiドキュメント](https://kubernetes-csi.github.io/docs/)を参照してください。 + +#### ツリー内プラグインからCSIドライバーへの移行 + +{{< feature-state for_k8s_version="v1.17" state="beta" >}} + +`CSIMigration`機能を有効にすると、既存のツリー内プラグインに対する操作が、対応するCSIプラグイン(インストールおよび構成されていることが期待されます)に転送されます。 +その結果、オペレーターは、ツリー内プラグインに取って代わるCSIドライバーに移行するときに、既存のストレージクラス、PersistentVolume、またはPersistentVolumeClaim(ツリー内プラグインを参照)の構成を変更する必要がありません。 + +サポートされている操作と機能には、プロビジョニング/削除、アタッチ/デタッチ、マウント/アンマウント、およびボリュームのサイズ変更が含まれます。 + +`CSIMigration`をサポートし、対応するCSIドライバーが実装されているツリー内プラグインは、[ボリュームのタイプ](＃volume-types)にリストされています。 + +### flexVolume + +{{< feature-state for_k8s_version="v1.23" state="deprecated" >}} + +FlexVolumeは、ストレージドライバーとのインターフェースにexecベースのモデルを使用するアウトオブツリープラグインインターフェースです。FlexVolumeドライバーのバイナリは、各ノード、場合によってはコントロールプレーンノードにも、あらかじめ定義されたボリュームプラグインパスにインストールする必要があります。 + +Podは`flexVolume`インツリーボリュームプラグインを通してFlexVolumeドライバーと対話します。 + +詳細については[FlexVolumeのREADME](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-storage/flexvolume.md#readme)を参照してください。 + +{{< note >}} +FlexVolumeは非推奨です。ツリー外のCSIドライバーを使用することは、外部ストレージをKubernetesと統合するための推奨される方法です。 + +FlexVolumeドライバーのメンテナーは、CSIドライバーを実装し、FlexVolumeドライバーのユーザーをCSIに移行するのを支援する必要があります。FlexVolumeのユーザーは、同等のCSIドライバーを使用するようにワークロードを移動する必要があります。 +{{< /note >}} + +## マウントの伝播 + +マウントの伝播により、コンテナによってマウントされたボリュームを、同じPod内の他のコンテナ、または同じノード上の他のPodに共有できます。 + +ボリュームのマウント伝播は、`Container.volumeMounts`の`mountPropagation`フィールドによって制御されます。その値は次のとおりです。 + +* `None` - このボリュームマウントは、ホストによってこのボリュームまたはそのサブディレクトリにマウントされる後続のマウントを受け取りません。同様に、コンテナによって作成されたマウントはホストに表示されません。これがデフォルトのモードです。 + + このモードは[Linuxカーネルドキュメント](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt)で説明されている`private`マウント伝播と同じです。 + +* `HostToContainer` - このボリュームマウントは、このボリュームまたはそのサブディレクトリのいずれかにマウントされる後続のすべてのマウントを受け取ります。 + + つまりホストがボリュームマウント内に何かをマウントすると、コンテナはそこにマウントされていることを確認します。 + + 同様に同じボリュームに対して`Bidirectional`マウント伝搬を持つPodが何かをマウントすると、`HostToContainer`マウント伝搬を持つコンテナはそれを見ることができます。 + + このモードは[Linuxカーネルドキュメント](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt)で説明されている`rslave`マウント伝播と同じです。 + +* `Bidirectional` - このボリュームマウントは、`HostToContainer`マウントと同じように動作します。さらに、コンテナによって作成されたすべてのボリュームマウントは、ホストと、同じボリュームを使用するすべてのPodのすべてのコンテナに伝播されます。 + + このモードの一般的な使用例は、FlexVolumeまたはCSIドライバーを備えたPod、または`hostPath`ボリュームを使用してホストに何かをマウントする必要があるPodです。 + + このモードは[Linuxカーネルドキュメント](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt)で説明されている`rshared`マウント伝播と同じです。 + + {{< warning >}} + `Bidirectional`マウント伝搬は危険です。ホストオペレーティングシステムにダメージを与える可能性があるため、特権的なコンテナでのみ許可されています。 + Linuxカーネルの動作に精通していることが強く推奨されます。 + また、Pod内のコンテナによって作成されたボリュームマウントは、終了時にコンテナによって破棄(アンマウント)される必要があります。 + {{< /warning >}} + +### 構成 + +一部のデプロイメント(CoreOS、RedHat/Centos、Ubuntu)でマウント伝播が正しく機能する前に、以下に示すように、Dockerでマウント共有を正しく構成する必要があります。 + +Dockerの`systemd`サービスファイルを編集します。以下のように`MountFlags`を設定します。 + + +```shell +MountFlags=shared +``` + +または、`MountFlags=slave`があれば削除してください。その後、Dockerデーモンを再起動します。 + + +```shell +sudo systemctl daemon-reload +sudo systemctl restart docker +``` + +## {{% heading "whatsnext" %}} + +[永続ボリュームを使用してWordPressとMySQLをデプロイする例](/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume/)に従ってください。 + From 021f8be65b9f6aceec1cde512676aeee861222c6 Mon Sep 17 00:00:00 2001 From: Cesar Talledo <ctalledo@nestybox.com> Date: Tue, 11 Jan 2022 22:20:30 +0000 Subject: [PATCH 017/104] Add Sysbox as an option to run kubernetes inside unprivileged containers or pods. Sysbox is an open-source container runtime (similar to "runc") that supports running VM-workloads such as Docker and Kubernetes inside unprivileged containers or pods. Sysbox containers always use the Linux user-namespace for isolation, plus specially crafted proc and sys filesystems, some syscall interception, filesystem ID-mapping, and more. It's possible to run Kubernetes, K3s, K0s, inside containers or pods deployed with Sysbox. This commit aims to make the Kubernetes community aware of this option. Signed-off-by: Cesar Talledo <ctalledo@nestybox.com> --- .../administer-cluster/kubelet-in-userns.md | 21 +++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/kubelet-in-userns.md b/content/en/docs/tasks/administer-cluster/kubelet-in-userns.md index b28859ca29..2b088b7a5d 100644 --- a/content/en/docs/tasks/administer-cluster/kubelet-in-userns.md +++ b/content/en/docs/tasks/administer-cluster/kubelet-in-userns.md @@ -49,6 +49,24 @@ Rootless Podman is not supported. <!-- Supporting rootless podman is discussed in https://github.com/kubernetes/minikube/issues/8719 --> +## Running Kubernetes inside Unprivileged Containers + +{{% thirdparty-content %}} + +### sysbox + +[Sysbox](https://github.com/nestybox/sysbox) is an open-source container runtime +(similar to "runc") that supports running system-level workloads such as Docker +and Kubernetes inside unprivileged containers isolated with the Linux user +namespace. + +See [Sysbox Quick Start Guide: Kubernetes-in-Docker](https://github.com/nestybox/sysbox/blob/master/docs/quickstart/kind.md) for more info. + +Sysbox supports running Kubernetes inside unprivileged containers without +requiring Cgroup v2 and without the `KubeletInUserNamespace` feature gate. It +does this by exposing specially crafted `/proc` and `/sys` filesystems inside +the container plus several other advanced OS virtualization techniques. + ## Running Rootless Kubernetes directly on a host {{% thirdparty-content %}} @@ -235,7 +253,7 @@ This feature gate also allows kube-proxy to ignore an error during setting `RLIM The `KubeletInUserNamespace` feature gate was introduced in Kubernetes v1.22 with "alpha" status. Running kubelet in a user namespace without using this feature gate is also possible -by mounting a specially crafted proc filesystem, but not officially supported. +by mounting a specially crafted proc filesystem (as done by [Sysbox](https://github.com/nestybox/sysbox)), but not officially supported. ### Configuring kube-proxy @@ -272,4 +290,3 @@ on the rootlesscontaine.rs website. - [Usernetes](https://github.com/rootless-containers/usernetes) - [Running K3s with rootless mode](https://rancher.com/docs/k3s/latest/en/advanced/#running-k3s-with-rootless-mode-experimental) - [KEP-2033: Kubelet-in-UserNS (aka Rootless mode)](https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless) - From 167ddd36b95dbfed008904178abed9517964d5f8 Mon Sep 17 00:00:00 2001 From: mtardy <mahe5397@hotmail.fr> Date: Wed, 2 Feb 2022 20:21:21 +0100 Subject: [PATCH 018/104] Add documentation on pod-security.kubernetes.io annotations --- .../reference/labels-annotations-taints.md | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/content/en/docs/reference/labels-annotations-taints.md b/content/en/docs/reference/labels-annotations-taints.md index 9e8d49950a..25eb9f5e68 100644 --- a/content/en/docs/reference/labels-annotations-taints.md +++ b/content/en/docs/reference/labels-annotations-taints.md @@ -450,6 +450,49 @@ or updating objects that contain Pod templates, such as Deployments, Jobs, State See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. +## pod-security.kubernetes.io/exempt + +Example: `pod-security.kubernetes.io/exempt: namespace` + +Used on: Event + +Value **must** be one of `user`, `namespace`, or `runtimeClass` which correspond to +[Pod Security Exemption](/docs/concepts/security/pod-security-admission/#exemptions) +dimensions. This annotation indicates on which dimension was based the exemption +from the PodSecurity enforcement. + +## pod-security.kubernetes.io/enforce-policy + +Example: `pod-security.kubernetes.io/enforce-policy: restricted:latest` + +Used on: Event + +Value **must** be `privileged:<version>`, `baseline:<version>`, +`restricted:<version>` which correspond to [Pod Security +Standard](/docs/concepts/security/pod-security-standards) levels accompanied by +a version which **must** be `latest` or a valid Kubernetes version in the format +`v<MAJOR>.<MINOR>`. This annotations informs about the enforcement level that +allowed or denied the pod during PodSecurity admission. + +See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) +for more information. + +## pod-security.kubernetes.io/audit-violations + +Example: `pod-security.kubernetes.io/audit-violations: would violate +PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container +"example" must set securityContext.allowPrivilegeEscalation=false), ...` + +Used on: Event + +Value details an audit policy violation, it contains the +[Pod Security Standard](/docs/concepts/security/pod-security-standards/) level +that was transgressed as well as the specific policies on the fields that were +violated from the PodSecurity enforcement. + +See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) +for more information. + ## seccomp.security.alpha.kubernetes.io/pod (deprecated) {#seccomp-security-alpha-kubernetes-io-pod} This annotation has been deprecated since Kubernetes v1.19 and will become non-functional in v1.25. From e756335619f974ab9e29882332a1189dc0a8b777 Mon Sep 17 00:00:00 2001 From: Kobayashi Daisuke <kobayashi.da-06@fujitsu.com> Date: Thu, 3 Feb 2022 11:22:41 +0900 Subject: [PATCH 019/104] Update content/ja/docs/concepts/storage/volumes.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> --- content/ja/docs/concepts/storage/volumes.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/ja/docs/concepts/storage/volumes.md b/content/ja/docs/concepts/storage/volumes.md index 29d014e5ed..389893d27c 100644 --- a/content/ja/docs/concepts/storage/volumes.md +++ b/content/ja/docs/concepts/storage/volumes.md @@ -137,7 +137,8 @@ Azure File CSIドライバーは、異なるfsgroupで同じボリュームを `cephfs`ボリュームを使用すると、既存のCephFSボリュームをPodにマウントすることができます。 Podを取り外すと消去される`emptyDir`とは異なり、`cephfs`ボリュームは内容を保持したまま単にアンマウントされるだけです。 つまり`cephfs`ボリュームにあらかじめデータを入れておき、そのデータをPod間で共有することができます。 -`cephfs`ボリュームは複数のライターによって同時にマウントすることができます。 +`cephfs`ボリュームは複数の書き込み元によって同時にマウントすることができます。 + {{< note >}} 事前に共有をエクスポートした状態で、自分のCephサーバーを起動しておく必要があります。 From 369d512ee698bdc7be2ad70a8ce0fb5ed3810d55 Mon Sep 17 00:00:00 2001 From: Kobayashi Daisuke <kobayashi.da-06@fujitsu.com> Date: Thu, 3 Feb 2022 11:24:56 +0900 Subject: [PATCH 020/104] Update content/ja/docs/concepts/storage/volumes.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> --- content/ja/docs/concepts/storage/volumes.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/ja/docs/concepts/storage/volumes.md b/content/ja/docs/concepts/storage/volumes.md index 389893d27c..d293af824b 100644 --- a/content/ja/docs/concepts/storage/volumes.md +++ b/content/ja/docs/concepts/storage/volumes.md @@ -653,7 +653,8 @@ PersistentVolumeClaimは、ユーザが特定のクラウド環境の詳細を `portworxVolume`は、Kubernetesとハイパーコンバージドで動作するエラスティックブロックストレージレイヤーです。 [Portworx](https://portworx.com/use-case/kubernetes-storage/)は、サーバー内のストレージをフィンガープリントを作成し、機能に応じて階層化し、複数のサーバーにまたがって容量を集約します。 -Portworxは、仮想マシンまたはベアメタルLinuxノードでゲスト内で動作します。 +Portworxは、仮想マシンまたはベアメタルのLinuxノードでゲスト内動作します。 + `portworxVolume`はKubernetesを通して動的に作成することができますが、事前にプロビジョニングしてPodの中で参照することもできます。 以下は、事前にプロビジョニングされたPortworxボリュームを参照するPodの例です。 From 070853a03d066d1c046be4fe1839d65c929e4428 Mon Sep 17 00:00:00 2001 From: Kobayashi Daisuke <kobayashi.da-06@fujitsu.com> Date: Thu, 3 Feb 2022 11:36:26 +0900 Subject: [PATCH 021/104] fix word mistakes --- content/ja/docs/concepts/storage/volumes.md | 72 ++++++++++----------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/content/ja/docs/concepts/storage/volumes.md b/content/ja/docs/concepts/storage/volumes.md index d293af824b..50acb26968 100644 --- a/content/ja/docs/concepts/storage/volumes.md +++ b/content/ja/docs/concepts/storage/volumes.md @@ -102,7 +102,7 @@ EBSボリュームがパーティション化されている場合は、オプ {{< feature-state for_k8s_version="v1.17" state="alpha" >}} -`awsElasticBlockStore`ストレージプラグインがコントローラーマネージャーとkubeletによってロードされないようにするには、`InTreePluginAWSUnregister`フラグを`true`に設定します。 +`awsElasticBlockStore`ストレージプラグインがコントローラーマネージャーとkubeletによって読み込まれないようにするには、`InTreePluginAWSUnregister`フラグを`true`に設定します。 ### azureDisk {#azuredisk} @@ -115,7 +115,7 @@ EBSボリュームがパーティション化されている場合は、オプ {{< feature-state for_k8s_version="v1.19" state="beta" >}} `azureDisk`の`CSIMigration`機能を有効にすると、すべてのプラグイン操作が既存のツリー内プラグインから`disk.csi.azure.com`Container Storage Interface(CSI)ドライバーにリダイレクトされます。 -この機能を利用するには、クラスタに[Azure Disk CSI Driver](https://github.com/kubernetes-sigs/azuredisk-csi-driver)をインストールし、`CSIMigration`および`CSIMigrationAzureDisk`機能を有効化する必要があります。 +この機能を利用するには、クラスターに[Azure Disk CSI Driver](https://github.com/kubernetes-sigs/azuredisk-csi-driver)をインストールし、`CSIMigration`および`CSIMigrationAzureDisk`機能を有効化する必要があります。 ### azureFile {#azurefile} @@ -127,8 +127,8 @@ EBSボリュームがパーティション化されている場合は、オプ {{< feature-state for_k8s_version="v1.21" state="beta" >}} -`zureFile`の`CSIMigration`機能を有効にすると、既存のin-treeプラグインから`file.csi.azure.com`Container Storage Interface(CSI)Driverへすべてのプラグイン操作がリダイレクトされます。 -この機能を利用するには、クラスタに[Azure File CSI Driver](https://github.com/kubernetes-sigs/azurefile-csi-driver)をインストールし、`CSIMigration`および`CSIMigrationAzureFile`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)を有効化する必要があります。 +`zureFile`の`CSIMigration`機能を有効にすると、既存のツリー内プラグインから`file.csi.azure.com`Container Storage Interface(CSI)Driverへすべてのプラグイン操作がリダイレクトされます。 +この機能を利用するには、クラスターに[Azure File CSI Driver](https://github.com/kubernetes-sigs/azurefile-csi-driver)をインストールし、`CSIMigration`および`CSIMigrationAzureFile`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)を有効化する必要があります。 Azure File CSIドライバーは、異なるfsgroupで同じボリュームを使用することをサポートしていません。AzurefileCSIの移行が有効になっている場合、異なるfsgroupで同じボリュームを使用することはまったくサポートされません。 @@ -181,10 +181,10 @@ spec: {{< feature-state for_k8s_version="v1.21" state="beta" >}} Cinderの`CSIMigration`機能は、Kubernetes1.21ではデフォルトで有効になっています。 -既存のin-treeプラグインからのすべてのプラグイン操作を`cinder.csi.openstack.org`Container Storage Interface(CSI) Driverへリダイレクトします。 +既存のツリー内プラグインからのすべてのプラグイン操作を`cinder.csi.openstack.org`Container Storage Interface(CSI) Driverへリダイレクトします。 [OpenStack Cinder CSIドライバー](https://github.com/kubernetes/cloud-provider-openstack/blob/master/docs/cinder-csi-plugin/using-cinder-csi-plugin.md)をクラスターにインストールする必要があります。 -`CSIMigrationOpenStack`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)を`false`に設定すると、クラスタのCinder CSIマイグレーションを無効化することができます。 -`CSIMigrationOpenStack`機能を無効にすると、in-treeのCinderボリュームプラグインがCinderボリュームのストレージ管理のすべての側面に責任を持つようになります。 +`CSIMigrationOpenStack`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)を`false`に設定すると、クラスターのCinder CSIマイグレーションを無効化することができます。 +`CSIMigrationOpenStack`機能を無効にすると、ツリー内のCinderボリュームプラグインがCinderボリュームのストレージ管理のすべての側面に責任を持つようになります。 ### configMap @@ -193,7 +193,7 @@ ConfigMapに格納されたデータは、タイプ`configMap`のボリューム ConfigMapを参照するときは、ボリューム内のConfigMapの名前を指定します。 ConfigMapの特定のエントリに使用するパスをカスタマイズできます。 -次の設定は、`log-config`ConfigMapを`configmap-pod`というPodにマウントする方法を示しています。 +次の設定は、`log-config` ConfigMapを`configmap-pod`というPodにマウントする方法を示しています。 ```yaml apiVersion: v1 @@ -258,11 +258,11 @@ Pod内のすべてのコンテナは`emptyDir`ボリューム内の同じファ 環境に応じて、`emptyDir`ボリュームは、ディスクやSSD、ネットワークストレージなど、ノードをバックアップするあらゆる媒体に保存されます。 ただし、`emptyDir.medium`フィールドを`"Memory"`に設定すると、Kubernetesは代わりにtmpfs(RAMベースのファイルシステム)をマウントします。 -tmpfsは非常に高速ですが、ディスクと違ってノードのリブート時にクリアされ、書き込んだファイルはコンテナのメモリ制限にカウントされることに注意してください。 +tmpfsは非常に高速ですが、ディスクと違ってノードのリブート時にクリアされ、書き込んだファイルはコンテナのメモリー制限にカウントされることに注意してください。 {{< note >}} -`SizeMemoryBackedVolumes`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)が有効な場合、メモリバックアップボリュームにサイズを指定することができます。 -サイズが指定されていない場合、メモリでバックアップされたボリュームは、Linuxホストのメモリの50％のサイズになります。 +`SizeMemoryBackedVolumes`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)が有効な場合、メモリーバックアップボリュームにサイズを指定することができます。 +サイズが指定されていない場合、メモリーでバックアップされたボリュームは、Linuxホストのメモリーの50％のサイズになります。 {{< /note>}} #### emptyDirの設定例 @@ -328,7 +328,7 @@ Podを取り外すと消去される`emptyDir`とは異なり、PDの内容は GCE永続ディスクの機能の1つは、永続ディスクへの同時読み取り専用アクセスです。`gcePersistentDisk`ボリュームを使用すると、複数のコンシューマーが永続ディスクを読み取り専用として同時にマウントできます。 これはPDにデータセットを事前入力してから、必要な数のPodから並行して提供できることを意味します。 -残念ながらPDは読み取り/書き込みモードで1人のコンシューマーのみがマウントできます。同時書き込みは許可されていません。 +残念ながらPDは読み取り/書き込みモードで1つのコンシューマーのみがマウントできます。同時書き込みは許可されていません。 PDが読み取り専用であるか、レプリカ数が0または1でない限り、ReplicaSetによって制御されるPodでGCE永続ディスクを使用すると失敗します。 @@ -364,8 +364,8 @@ spec: #### リージョン永続ディスク - [リージョン永続ディスク](https://cloud.google.com/compute/docs/disks/#repds)機能を使用すると、同じリージョン内の2つのゾーンで使用できる永続ディスクを作成できます。 - この機能を使用するには、ボリュームをPersistentVolumeとしてプロビジョニングする必要があります。Podから直接ボリュームを参照することはサポートされていません。 +[リージョン永続ディスク](https://cloud.google.com/compute/docs/disks/#repds)機能を使用すると、同じリージョン内の2つのゾーンで使用できる永続ディスクを作成できます。 +この機能を使用するには、ボリュームをPersistentVolumeとしてプロビジョニングする必要があります。Podから直接ボリュームを参照することはサポートされていません。 #### リージョンPD PersistentVolumeを手動でプロビジョニングする @@ -409,19 +409,19 @@ spec: {{< feature-state for_k8s_version="v1.17" state="beta" >}} -GCE PDの`CSIMigration`機能を有効にすると、すべてのプラグイン操作が既存のin-treeプラグインから`pd.csi.storage.gke.io`Container Storage Interface (CSI) Driverにリダイレクトされるようになります。 -この機能を使用するには、クラスタに[GCE PD CSI Driver](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver)がインストールされ、`CSIMigration`と`CSIMigrationGCE`のbeta機能が有効になっている必要があります。 +GCE PDの`CSIMigration`機能を有効にすると、すべてのプラグイン操作が既存のツリー内プラグインから`pd.csi.storage.gke.io`Container Storage Interface (CSI) Driverにリダイレクトされるようになります。 +この機能を使用するには、クラスターに[GCE PD CSI Driver](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver)がインストールされ、`CSIMigration`と`CSIMigrationGCE`のbeta機能が有効になっている必要があります。 #### GCE CSIの移行の完了 {{< feature-state for_k8s_version="v1.21" state="alpha" >}} -`gcePersistentDisk`ストレージプラグインがコントローラーマネージャーとkubeletによってロードされないようにするには、`InTreePluginGCEUnregister`フラグを`true`に設定します。 +`gcePersistentDisk`ストレージプラグインがコントローラーマネージャーとkubeletによって読み込まれないようにするには、`InTreePluginGCEUnregister`フラグを`true`に設定します。 ### gitRepo(非推奨) {#gitrepo} {{< warning >}} -`gitRepo`ボリュームタイプは非推奨です。gitレポジトリを使用してコンテナをプロビジョニングするには、Gitを使用してレポジトリのクローンを作成するInitContainerに[EmptyDir](#emptydir)をマウントしてから、Podのコンテナに[EmptyDir](#emptydir)をマウントします。 +`gitRepo`ボリュームタイプは非推奨です。gitリポジトリを使用してコンテナをプロビジョニングするには、Gitを使用してリポジトリのクローンを作成するInitContainerに[EmptyDir](#emptydir)をマウントしてから、Podのコンテナに[EmptyDir](#emptydir)をマウントします。 {{< /warning >}} `gitRepo`ボリュームは、ボリュームプラグインの一例です。このプラグインは空のディレクトリをマウントし、そのディレクトリにgitリポジトリをクローンしてPodで使えるようにします。 @@ -494,7 +494,7 @@ AdmissionPolicyによって特定のディレクトリへのHostPathアクセス このタイプのボリュームを使用するときは、以下の理由のため注意してください。 -* HostPath は、特権的なシステム認証情報(Kubeletなど)や特権的なAPI(コンテナランタイムソケットなど)を公開する可能性があり、コンテナのエスケープやクラスタの他の部分への攻撃に利用される可能性があります。 +* HostPath は、特権的なシステム認証情報(Kubeletなど)や特権的なAPI(コンテナランタイムソケットなど)を公開する可能性があり、コンテナのエスケープやクラスターの他の部分への攻撃に利用される可能性があります。 * 同一構成のPod(PodTemplateから作成されたものなど)は、ノード上のファイルが異なるため、ノードごとに動作が異なる場合があります。 * ホスト上に作成されたファイルやディレクトリは、rootでしか書き込みができません。[特権コンテナ](/docs/tasks/configure-pod-container/security-context/)内でrootとしてプロセスを実行するか、ホスト上のファイルのパーミッションを変更して`hostPath`ボリュームに書き込みができるようにする必要があります。 @@ -582,7 +582,7 @@ iSCSIの特徴として、複数のコンシューマーから同時に読み取 `hostPath`ボリュームと比較して、`local`ボリュームは手動でノードにPodをスケジューリングすることなく、耐久性と移植性に優れた方法で使用することができます。 システムはPersistentVolume上のノードアフィニティーを見ることで、ボリュームのノード制約を認識します。 -ただし、`loval`ボリュームは、基盤となるノードの可用性に左右されるため、すべてのアプリケーションに適しているわけではありません。 +ただし、`local`ボリュームは、基盤となるノードの可用性に左右されるため、すべてのアプリケーションに適しているわけではありません。 ノードが異常になると、Podは`local`ボリュームにアクセスできなくなります。 このボリュームを使用しているPodは実行できません。`local`ボリュームを使用するアプリケーションは、基盤となるディスクの耐久性の特性に応じて、この可用性の低下と潜在的なデータ損失に耐えられる必要があります。 @@ -613,14 +613,14 @@ spec: - example-node ``` -ローカルボリュームを使用する場合は、PersistentVolume`nodeAffinity`を設定する必要があります。 -KubernetesのスケジューラはPersistentVolume`nodeAffinity`を使用して、これらのPodを正しいノードにスケジューリングします。 +ローカルボリュームを使用する場合は、PersistentVolume `nodeAffinity`を設定する必要があります。 +KubernetesのスケジューラはPersistentVolume `nodeAffinity`を使用して、これらのPodを正しいノードにスケジューリングします。 -PersistentVolume`volumeMode`を(デフォルト値の「Filesystem」ではなく)「Block」に設定して、ローカルボリュームをrawブロックデバイスとして公開できます。 +PersistentVolume `volumeMode`を(デフォルト値の「Filesystem」ではなく)「Block」に設定して、ローカルボリュームをrawブロックデバイスとして公開できます。 ローカルボリュームを使用する場合、`volumeBindingMode`を`WaitForFirstConsumer`に設定したStorageClassを作成することをお勧めします。 詳細については、local [StorageClass](/docs/concepts/storage/storage-classes/#local)の例を参照してください。 -ボリュームバインディングを遅延させると、PersistentVolumeClaimバインディングの決定が、ノードリソース要件、ノードセレクタ、Podアフィニティ、Podアンチアフィニティなど、Podが持つ可能性のある他のノード制約も含めて評価されるようになります。 +ボリュームバインディングを遅延させると、PersistentVolumeClaimバインディングの決定が、ノードリソース要件、ノードセレクター、Podアフィニティ、Podアンチアフィニティなど、Podが持つ可能性のある他のノード制約も含めて評価されるようになります。 ローカルボリュームのライフサイクルの管理を改善するために、外部の静的プロビジョナーを個別に実行できます。 このプロビジョナーはまだ動的プロビジョニングをサポートしていないことに注意してください。 @@ -722,8 +722,8 @@ RBDの特徴として、複数のコンシューマーから同時に読み取 {{< feature-state for_k8s_version="v1.23" state="alpha" >}} -`RBD`の`CSIMigration`機能を有効にすると、既存のin-treeプラグインから`rbd.csi.ceph.com`{{< glossary_tooltip text="CSI" term_id="csi" >}}ドライバーにすべてのプラグイン操作がリダイレクトされます。 -この機能を使用するには、クラスタに[Ceph CSIドライバー](https://github.com/ceph/ceph-csi)をインストールし、`CSIMigration`および`csiMigrationRBD`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)を有効にしておく必要があります。 +`RBD`の`CSIMigration`機能を有効にすると、既存のツリー内プラグインから`rbd.csi.ceph.com`{{< glossary_tooltip text="CSI" term_id="csi" >}}ドライバーにすべてのプラグイン操作がリダイレクトされます。 +この機能を使用するには、クラスターに[Ceph CSIドライバー](https://github.com/ceph/ceph-csi)をインストールし、`CSIMigration`および`csiMigrationRBD`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)を有効にしておく必要があります。 {{< note >}} @@ -731,8 +731,8 @@ RBDの特徴として、複数のコンシューマーから同時に読み取 ストレージを管理するKubernetesクラスターオペレーターとして、RBD CSIドライバーへの移行を試みる前に完了する必要のある前提条件は次のとおりです。 * Ceph CSIドライバー(`rbd.csi.ceph.com`)v3.5.0以降をKubernetesクラスターにインストールする必要があります。 -* CSIドライバーの動作に必要なパラメーターとして`clusterID`フィールドがありますが、in-tree StorageClassには`monitors`フィールドがあるため、Kubernetesストレージ管理者はCSI config mapでモニターハッシュ(例：`#echo -n '<monitors_string>' | md5sum`)に基づいたclusterIDを作成し、モニターをこのclusterID設定の下に保持しなければなりません。 -* また、in-tree Storageclassの`adminId`の値が`admin`と異なる場合、in-tree Storageclassに記載されている`adminSecretName`に`adminId`パラメーター値のbase64値をパッチしなければなりませんが、それ以外はスキップすることが可能です。 +* CSIドライバーの動作に必要なパラメーターとして`clusterID`フィールドがありますが、ツリー内StorageClassには`monitors`フィールドがあるため、Kubernetesストレージ管理者はCSI config mapでモニターハッシュ(例：`#echo -n '<monitors_string>' | md5sum`)に基づいたclusterIDを作成し、モニターをこのclusterID設定の下に保持しなければなりません。 +* また、ツリー内Storageclassの`adminId`の値が`admin`と異なる場合、ツリー内Storageclassに記載されている`adminSecretName`に`adminId`パラメーター値のbase64値をパッチしなければなりませんが、それ以外はスキップすることが可能です。 {{< /note >}} ### secret @@ -805,7 +805,7 @@ StorageOS、動的プロビジョニング、およびPersistentVolumeClaimの ### vsphereVolume {#vspherevolume} {{< note >}} -KubernetesvSphereクラウドプロバイダーを設定する必要があります。cloudproviderの設定については、[vSphere入門ガイド](https://vmware.github.io/vsphere-storage-for-kubernetes/documentation/)を参照してください。 +KubernetesvSphereクラウドプロバイダーを設定する必要があります。クラウドプロバイダーの設定については、[vSphere入門ガイド](https://vmware.github.io/vsphere-storage-for-kubernetes/documentation/)を参照してください。 {{< /note >}} `vsphereVolume`は、vSphereVMDKボリュームをPodにマウントするために使用されます。 @@ -867,10 +867,10 @@ spec: {{< feature-state for_k8s_version="v1.19" state="beta" >}} -`vsphereVolume`の`CSIMigration`機能を有効にすると、既存のインツリープラグインから`csi.vsphere.vmware.com`{{< glossary_tooltip text="CSI" term_id="csi" >}}ドライバーにすべてのプラグイン操作がリダイレクトされます。 -この機能を使用するには、クラスタに[vSphere CSIドライバー](https://github.com/kubernetes-sigs/vsphere-csi-driver)がインストールされ、`CSIMigration`および`CSIMigrationvSphere`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)が有効になっていなければなりません。 +`vsphereVolume`の`CSIMigration`機能を有効にすると、既存のツリー内プラグインから`csi.vsphere.vmware.com`{{< glossary_tooltip text="CSI" term_id="csi" >}}ドライバーにすべてのプラグイン操作がリダイレクトされます。 +この機能を使用するには、クラスターに[vSphere CSIドライバー](https://github.com/kubernetes-sigs/vsphere-csi-driver)がインストールされ、`CSIMigration`および`CSIMigrationvSphere`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)が有効になっていなければなりません。 -また、vSphere vCenter/ESXiのバージョンが7.0u1以上、HWのバージョンがVM version 15以上であることが条件となります。 +また、vSphere vCenter/ESXiのバージョンが7.0u1以上、HWのバージョンがVM version 15以上であることが条件です。 {{< note >}} @@ -892,7 +892,7 @@ spec: {{< feature-state for_k8s_version="v1.19" state="beta" >}} -`vsphereVolume`プラグインがコントローラーマネージャーとkubeletによってロードされないようにするには、`InTreePluginvSphereUnregister`機能フラグを`true`に設定する必要があります。すべてのワーカーノードに`csi.vsphere.vmware.com`{{< glossary_tooltip text="CSI" term_id="csi" >}}ドライバーをインストールする必要があります。 +`vsphereVolume`プラグインがコントローラーマネージャーとkubeletによって読み込まれないようにするには、`InTreePluginvSphereUnregister`機能フラグを`true`に設定する必要があります。すべてのワーカーノードに`csi.vsphere.vmware.com`{{< glossary_tooltip text="CSI" term_id="csi" >}}ドライバーをインストールする必要があります。 #### Portworx CSIの移行 {{< feature-state for_k8s_version="v1.23" state="alpha" >}} @@ -1013,7 +1013,7 @@ CSI仕様バージョン0.2および0.3のサポートは、Kubernetes v1.13で CSIドライバーは、すべてのKubernetesリリース間で互換性があるとは限りません。各Kubernetesリリースでサポートされているデプロイ手順と互換性マトリックスについては、特定のCSIドライバーのドキュメントを確認してください。 {{< /note >}} -CSI互換のボリュームドライバーがKubernetesクラスタ上に展開されると、ユーザーは`csi`ボリュームタイプを使用して、CSIドライバーによって公開されたボリュームをアタッチまたはマウントすることができます。 +CSI互換のボリュームドライバーがKubernetesクラスター上に展開されると、ユーザーは`csi`ボリュームタイプを使用して、CSIドライバーによって公開されたボリュームをアタッチまたはマウントすることができます。 `csi`ボリュームはPodで3つの異なる方法によって使用することができます。 @@ -1065,9 +1065,9 @@ CSIドライバーの開発方法の詳細については[kubernetes-csiドキ {{< feature-state for_k8s_version="v1.23" state="deprecated" >}} -FlexVolumeは、ストレージドライバーとのインターフェースにexecベースのモデルを使用するアウトオブツリープラグインインターフェースです。FlexVolumeドライバーのバイナリは、各ノード、場合によってはコントロールプレーンノードにも、あらかじめ定義されたボリュームプラグインパスにインストールする必要があります。 +FlexVolumeは、ストレージドライバーとのインターフェースにexecベースのモデルを使用するツリー外プラグインインターフェースです。FlexVolumeドライバーのバイナリは、各ノード、場合によってはコントロールプレーンノードにも、あらかじめ定義されたボリュームプラグインパスにインストールする必要があります。 -Podは`flexVolume`インツリーボリュームプラグインを通してFlexVolumeドライバーと対話します。 +Podは`flexVolume`ツリー内ボリュームプラグインを通してFlexVolumeドライバーと対話します。 詳細については[FlexVolumeのREADME](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-storage/flexvolume.md#readme)を参照してください。 From 3cc1b1b0475f00f6a8fd5f63b837e7b1bdebad7f Mon Sep 17 00:00:00 2001 From: mtardy <mahe5397@hotmail.fr> Date: Fri, 4 Feb 2022 18:53:37 +0100 Subject: [PATCH 022/104] Add disclaimers before reorganizing this reference page between API groups --- .../reference/labels-annotations-taints.md | 34 +++++++++++++++++-- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/content/en/docs/reference/labels-annotations-taints.md b/content/en/docs/reference/labels-annotations-taints.md index 25eb9f5e68..d2d4b4dc16 100644 --- a/content/en/docs/reference/labels-annotations-taints.md +++ b/content/en/docs/reference/labels-annotations-taints.md @@ -452,20 +452,30 @@ for more information. ## pod-security.kubernetes.io/exempt + Example: `pod-security.kubernetes.io/exempt: namespace` -Used on: Event +Used on: `audit.k8s.io/Event` Value **must** be one of `user`, `namespace`, or `runtimeClass` which correspond to [Pod Security Exemption](/docs/concepts/security/pod-security-admission/#exemptions) dimensions. This annotation indicates on which dimension was based the exemption from the PodSecurity enforcement. +{{< caution >}} +This annotation is not used within the Kubernetes API. When you +[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, +audit event data is written using `Event` from API group `audit.k8s.io`. +The annotation applies to audit events. Audit events are different from objects in the +[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group +`events.k8s.io`). +{{< /caution >}} + ## pod-security.kubernetes.io/enforce-policy Example: `pod-security.kubernetes.io/enforce-policy: restricted:latest` -Used on: Event +Used on: `audit.k8s.io/Event` Value **must** be `privileged:<version>`, `baseline:<version>`, `restricted:<version>` which correspond to [Pod Security @@ -477,13 +487,22 @@ allowed or denied the pod during PodSecurity admission. See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) for more information. +{{< caution >}} +This annotation is not used within the Kubernetes API. When you +[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, +audit event data is written using `Event` from API group `audit.k8s.io`. +The annotation applies to audit events. Audit events are different from objects in the +[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group +`events.k8s.io`). +{{< /caution >}} + ## pod-security.kubernetes.io/audit-violations Example: `pod-security.kubernetes.io/audit-violations: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "example" must set securityContext.allowPrivilegeEscalation=false), ...` -Used on: Event +Used on: `audit.k8s.io/Event` Value details an audit policy violation, it contains the [Pod Security Standard](/docs/concepts/security/pod-security-standards/) level @@ -493,6 +512,15 @@ violated from the PodSecurity enforcement. See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) for more information. +{{< caution >}} +This annotation is not used within the Kubernetes API. When you +[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, +audit event data is written using `Event` from API group `audit.k8s.io`. +The annotation applies to audit events. Audit events are different from objects in the +[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group +`events.k8s.io`). +{{< /caution >}} + ## seccomp.security.alpha.kubernetes.io/pod (deprecated) {#seccomp-security-alpha-kubernetes-io-pod} This annotation has been deprecated since Kubernetes v1.19 and will become non-functional in v1.25. From e00fe1d2cbc7b29ed25021ce6cd446ab42538626 Mon Sep 17 00:00:00 2001 From: mtardy <mahe5397@hotmail.fr> Date: Fri, 4 Feb 2022 19:07:28 +0100 Subject: [PATCH 023/104] Remove the Used on information and replace caution tag with note --- .../reference/labels-annotations-taints.md | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/content/en/docs/reference/labels-annotations-taints.md b/content/en/docs/reference/labels-annotations-taints.md index d2d4b4dc16..80dfba8162 100644 --- a/content/en/docs/reference/labels-annotations-taints.md +++ b/content/en/docs/reference/labels-annotations-taints.md @@ -455,28 +455,24 @@ for more information. Example: `pod-security.kubernetes.io/exempt: namespace` -Used on: `audit.k8s.io/Event` - Value **must** be one of `user`, `namespace`, or `runtimeClass` which correspond to [Pod Security Exemption](/docs/concepts/security/pod-security-admission/#exemptions) dimensions. This annotation indicates on which dimension was based the exemption from the PodSecurity enforcement. -{{< caution >}} +{{< note >}} This annotation is not used within the Kubernetes API. When you [enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, audit event data is written using `Event` from API group `audit.k8s.io`. The annotation applies to audit events. Audit events are different from objects in the [Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group `events.k8s.io`). -{{< /caution >}} +{{< /note >}} ## pod-security.kubernetes.io/enforce-policy Example: `pod-security.kubernetes.io/enforce-policy: restricted:latest` -Used on: `audit.k8s.io/Event` - Value **must** be `privileged:<version>`, `baseline:<version>`, `restricted:<version>` which correspond to [Pod Security Standard](/docs/concepts/security/pod-security-standards) levels accompanied by @@ -487,14 +483,14 @@ allowed or denied the pod during PodSecurity admission. See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) for more information. -{{< caution >}} +{{< note >}} This annotation is not used within the Kubernetes API. When you [enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, audit event data is written using `Event` from API group `audit.k8s.io`. The annotation applies to audit events. Audit events are different from objects in the [Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group `events.k8s.io`). -{{< /caution >}} +{{< /note >}} ## pod-security.kubernetes.io/audit-violations @@ -502,8 +498,6 @@ Example: `pod-security.kubernetes.io/audit-violations: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "example" must set securityContext.allowPrivilegeEscalation=false), ...` -Used on: `audit.k8s.io/Event` - Value details an audit policy violation, it contains the [Pod Security Standard](/docs/concepts/security/pod-security-standards/) level that was transgressed as well as the specific policies on the fields that were @@ -512,14 +506,14 @@ violated from the PodSecurity enforcement. See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) for more information. -{{< caution >}} +{{< note >}} This annotation is not used within the Kubernetes API. When you [enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, audit event data is written using `Event` from API group `audit.k8s.io`. The annotation applies to audit events. Audit events are different from objects in the [Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group `events.k8s.io`). -{{< /caution >}} +{{< /note >}} ## seccomp.security.alpha.kubernetes.io/pod (deprecated) {#seccomp-security-alpha-kubernetes-io-pod} From 459a3f96acef329f955016ca49c5301e091c98a9 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Sat, 5 Feb 2022 15:19:21 +0800 Subject: [PATCH 024/104] Fix links and markdown format for some pages --- .../concepts/policy/pod-security-policy.md | 211 ++++++++++-------- .../reference/using-api/deprecation-policy.md | 2 +- .../docs/tutorials/security/ns-level-pss.md | 153 +++++++------ 3 files changed, 208 insertions(+), 158 deletions(-) diff --git a/content/en/docs/concepts/policy/pod-security-policy.md b/content/en/docs/concepts/policy/pod-security-policy.md index 34ea1ecf3f..363ec9b49e 100644 --- a/content/en/docs/concepts/policy/pod-security-policy.md +++ b/content/en/docs/concepts/policy/pod-security-policy.md @@ -23,7 +23,8 @@ updates. ## What is a Pod Security Policy? A _Pod Security Policy_ is a cluster-level resource that controls security -sensitive aspects of the pod specification. The [PodSecurityPolicy](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy) objects +sensitive aspects of the pod specification. The +[PodSecurityPolicy](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy) objects define a set of conditions that a pod must run with in order to be accepted into the system, as well as defaults for the related fields. They allow an administrator to control the following: @@ -50,10 +51,10 @@ administrator to control the following: ## Enabling Pod Security Policies -Pod security policy control is implemented as an optional [admission -controller](/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy). -PodSecurityPolicies are enforced by [enabling the admission -controller](/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-on-an-admission-control-plug-in), +Pod security policy control is implemented as an optional +[admission controller](/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy). +PodSecurityPolicies are enforced by +[enabling the admission controller](/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-on-an-admission-control-plug-in), but doing so without authorizing any policies **will prevent any pods from being created** in the cluster. @@ -65,9 +66,9 @@ controller. ## Authorizing Policies When a PodSecurityPolicy resource is created, it does nothing. In order to use -it, the requesting user or target pod's [service -account](/docs/tasks/configure-pod-container/configure-service-account/) must be -authorized to use the policy, by allowing the `use` verb on the policy. +it, the requesting user or target pod's +[service account](/docs/tasks/configure-pod-container/configure-service-account/) +must be authorized to use the policy, by allowing the `use` verb on the policy. Most Kubernetes pods are not created directly by users. Instead, they are typically created indirectly as part of a @@ -128,6 +129,7 @@ subjects: If a `RoleBinding` (not a `ClusterRoleBinding`) is used, it will only grant usage for pods being run in the same namespace as the binding. This can be paired with system groups to grant access to all pods run in the namespace: + ```yaml # Authorize all service accounts in a namespace: - kind: Group @@ -139,45 +141,47 @@ paired with system groups to grant access to all pods run in the namespace: name: system:authenticated ``` -For more examples of RBAC bindings, see [Role Binding -Examples](/docs/reference/access-authn-authz/rbac#role-binding-examples). -For a complete example of authorizing a PodSecurityPolicy, see -[below](#example). +For more examples of RBAC bindings, see +[RoleBinding examples](/docs/reference/access-authn-authz/rbac#role-binding-examples). +For a complete example of authorizing a PodSecurityPolicy, see [below](#example). ### Recommended Practice -PodSecurityPolicy is being replaced by a new, simplified `PodSecurity` {{< glossary_tooltip -text="admission controller" term_id="admission-controller" >}}. For more details on this change, see -[PodSecurityPolicy Deprecation: Past, Present, and -Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/). Follow these -guidelines to simplify migration from PodSecurityPolicy to the new admission controller: +PodSecurityPolicy is being replaced by a new, simplified `PodSecurity` +{{< glossary_tooltip text="admission controller" term_id="admission-controller" >}}. +For more details on this change, see +[PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/). +Follow these guidelines to simplify migration from PodSecurityPolicy to the +new admission controller: -1. Limit your PodSecurityPolicies to the policies defined by the [Pod Security Standards](/docs/concepts/security/pod-security-standards): - - {{< example file="policy/privileged-psp.yaml" >}}Privileged{{< /example >}} - - {{< example file="policy/baseline-psp.yaml" >}}Baseline{{< /example >}} - - {{< example file="policy/restricted-psp.yaml" >}}Restricted{{< /example >}} +1. Limit your PodSecurityPolicies to the policies defined by the + [Pod Security Standards](/docs/concepts/security/pod-security-standards): -2. Only bind PSPs to entire namespaces, by using the `system:serviceaccounts:<namespace>` group + - {{< example file="policy/privileged-psp.yaml" >}}Privileged{{< /example >}} + - {{< example file="policy/baseline-psp.yaml" >}}Baseline{{< /example >}} + - {{< example file="policy/restricted-psp.yaml" >}}Restricted{{< /example >}} + +1. Only bind PSPs to entire namespaces, by using the `system:serviceaccounts:<namespace>` group (where `<namespace>` is the target namespace). For example: - ```yaml - apiVersion: rbac.authorization.k8s.io/v1 - # This cluster role binding allows all pods in the "development" namespace to use the baseline PSP. - kind: ClusterRoleBinding - metadata: - name: psp-baseline-namespaces - roleRef: - kind: ClusterRole - name: psp-baseline - apiGroup: rbac.authorization.k8s.io - subjects: - - kind: Group - name: system:serviceaccounts:development - apiGroup: rbac.authorization.k8s.io - - kind: Group - name: system:serviceaccounts:canary - apiGroup: rbac.authorization.k8s.io - ``` + ```yaml + apiVersion: rbac.authorization.k8s.io/v1 + # This cluster role binding allows all pods in the "development" namespace to use the baseline PSP. + kind: ClusterRoleBinding + metadata: + name: psp-baseline-namespaces + roleRef: + kind: ClusterRole + name: psp-baseline + apiGroup: rbac.authorization.k8s.io + subjects: + - kind: Group + name: system:serviceaccounts:development + apiGroup: rbac.authorization.k8s.io + - kind: Group + name: system:serviceaccounts:canary + apiGroup: rbac.authorization.k8s.io + ``` ### Troubleshooting @@ -213,8 +217,8 @@ only non-mutating PodSecurityPolicies are used to validate the pod. ## Example -_This example assumes you have a running cluster with the PodSecurityPolicy -admission controller enabled and you have cluster admin privileges._ +This example assumes you have a running cluster with the PodSecurityPolicy +admission controller enabled and you have cluster admin privileges. ### Set up @@ -360,12 +364,24 @@ Let's try that again, slightly differently: ```shell kubectl-user create deployment pause --image=k8s.gcr.io/pause +``` + +```none deployment "pause" created - +``` +```shell kubectl-user get pods -No resources found. +``` +``` +No resources found. +``` + +```shell kubectl-user get events | head -n 2 +``` + +``` LASTSEEN FIRSTSEEN COUNT NAME KIND SUBOBJECT TYPE REASON SOURCE MESSAGE 1m 2m 15 pause-7774d79b5 ReplicaSet Warning FailedCreate replicaset-controller Error creating: pods "pause-7774d79b5-" is forbidden: no providers available to validate pod request ``` @@ -386,6 +402,9 @@ is `default`: kubectl-admin create rolebinding default:psp:unprivileged \ --role=psp:unprivileged \ --serviceaccount=psp-example:default +``` + +```none rolebinding "default:psp:unprivileged" created ``` @@ -394,6 +413,9 @@ eventually succeed in creating the pod: ```shell kubectl-user get pods --watch +``` + +```none NAME READY STATUS RESTARTS AGE pause-7774d79b5-qrgcb 0/1 Pending 0 1s pause-7774d79b5-qrgcb 0/1 Pending 0 1s @@ -407,6 +429,9 @@ Delete the namespace to clean up most of the example resources: ```shell kubectl-admin delete ns psp-example +``` + +``` namespace "psp-example" deleted ``` @@ -415,6 +440,9 @@ up separately: ```shell kubectl-admin delete psp example +``` + +``` podsecuritypolicy "example" deleted ``` @@ -431,7 +459,8 @@ several security mechanisms. {{< codenew file="policy/restricted-psp.yaml" >}} -See [Pod Security Standards](/docs/concepts/security/pod-security-standards/#policy-instantiation) for more examples. +See [Pod Security Standards](/docs/concepts/security/pod-security-standards/#policy-instantiation) +for more examples. ## Policy Reference @@ -467,17 +496,17 @@ and `max`(inclusive). Defaults to no allowed host ports. **Volumes** - Provides a list of allowed volume types. The allowable values correspond to the volume sources that are defined when creating a volume. For the complete list of volume types, see [Types of -Volumes](/docs/concepts/storage/volumes/#types-of-volumes). Additionally, `*` -may be used to allow all volume types. +Volumes](/docs/concepts/storage/volumes/#types-of-volumes). Additionally, +`*` may be used to allow all volume types. The **recommended minimum set** of allowed volumes for new PSPs are: -- configMap -- downwardAPI -- emptyDir -- persistentVolumeClaim -- secret -- projected +- `configMap` +- `downwardAPI` +- `emptyDir` +- `persistentVolumeClaim` +- `secret` +- `projected` {{< warning >}} PodSecurityPolicy does not limit the types of `PersistentVolume` objects that @@ -489,10 +518,10 @@ should be granted permission to create `PersistentVolume` objects. **FSGroup** - Controls the supplemental group applied to some volumes. - *MustRunAs* - Requires at least one `range` to be specified. Uses the -minimum value of the first range as the default. Validates against all ranges. + minimum value of the first range as the default. Validates against all ranges. - *MayRunAs* - Requires at least one `range` to be specified. Allows -`FSGroups` to be left unset without providing a default. Validates against -all ranges if `FSGroups` is set. + `FSGroups` to be left unset without providing a default. Validates against + all ranges if `FSGroups` is set. - *RunAsAny* - No default provided. Allows any `fsGroup` ID to be specified. **AllowedHostPaths** - This specifies a list of host paths that are allowed @@ -511,7 +540,8 @@ For example: readOnly: true # only allow read-only mounts ``` -{{< warning >}}There are many ways a container with unrestricted access to the host +{{< warning >}} +There are many ways a container with unrestricted access to the host filesystem can escalate privileges, including reading data from other containers, and abusing the credentials of system services, such as Kubelet. @@ -552,33 +582,33 @@ spec: **RunAsUser** - Controls which user ID the containers are run with. - *MustRunAs* - Requires at least one `range` to be specified. Uses the -minimum value of the first range as the default. Validates against all ranges. + minimum value of the first range as the default. Validates against all ranges. - *MustRunAsNonRoot* - Requires that the pod be submitted with a non-zero -`runAsUser` or have the `USER` directive defined (using a numeric UID) in the -image. Pods which have specified neither `runAsNonRoot` nor `runAsUser` settings -will be mutated to set `runAsNonRoot=true`, thus requiring a defined non-zero -numeric `USER` directive in the container. No default provided. Setting -`allowPrivilegeEscalation=false` is strongly recommended with this strategy. + `runAsUser` or have the `USER` directive defined (using a numeric UID) in the + image. Pods which have specified neither `runAsNonRoot` nor `runAsUser` settings + will be mutated to set `runAsNonRoot=true`, thus requiring a defined non-zero + numeric `USER` directive in the container. No default provided. Setting + `allowPrivilegeEscalation=false` is strongly recommended with this strategy. - *RunAsAny* - No default provided. Allows any `runAsUser` to be specified. **RunAsGroup** - Controls which primary group ID the containers are run with. - *MustRunAs* - Requires at least one `range` to be specified. Uses the -minimum value of the first range as the default. Validates against all ranges. + minimum value of the first range as the default. Validates against all ranges. - *MayRunAs* - Does not require that RunAsGroup be specified. However, when RunAsGroup -is specified, they have to fall in the defined range. + is specified, they have to fall in the defined range. - *RunAsAny* - No default provided. Allows any `runAsGroup` to be specified. **SupplementalGroups** - Controls which group IDs containers add. - *MustRunAs* - Requires at least one `range` to be specified. Uses the -minimum value of the first range as the default. Validates against all ranges. + minimum value of the first range as the default. Validates against all ranges. - *MayRunAs* - Requires at least one `range` to be specified. Allows -`supplementalGroups` to be left unset without providing a default. -Validates against all ranges if `supplementalGroups` is set. + `supplementalGroups` to be left unset without providing a default. + Validates against all ranges if `supplementalGroups` is set. - *RunAsAny* - No default provided. Allows any `supplementalGroups` to be -specified. + specified. ### Privilege Escalation @@ -623,8 +653,8 @@ added. Capabilities listed in `RequiredDropCapabilities` must not be included in `AllowedCapabilities` or `DefaultAddCapabilities`. **DefaultAddCapabilities** - The capabilities which are added to containers by -default, in addition to the runtime defaults. See the [Docker -documentation](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities) +default, in addition to the runtime defaults. See the +[Docker documentation](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities) for the default list of capabilities when using the Docker runtime. ### SELinux @@ -651,16 +681,17 @@ denoted as the string `Unmasked`. ### AppArmor -Controlled via annotations on the PodSecurityPolicy. Refer to the [AppArmor -documentation](/docs/tutorials/clusters/apparmor/#podsecuritypolicy-annotations). +Controlled via annotations on the PodSecurityPolicy. Refer to the +[AppArmor documentation](/docs/tutorials/security/apparmor/#podsecuritypolicy-annotations). ### Seccomp As of Kubernetes v1.19, you can use the `seccompProfile` field in the -`securityContext` of Pods or containers to [control use of seccomp -profiles](/docs/tutorials/clusters/seccomp). In prior versions, seccomp was -controlled by adding annotations to a Pod. The same PodSecurityPolicies can be -used with either version to enforce how these fields or annotations are applied. +`securityContext` of Pods or containers to +[control use of seccomp profiles](/docs/tutorials/security/seccomp/). +In prior versions, seccomp was controlled by adding annotations to a Pod. The +same PodSecurityPolicies can be used with either version to enforce how these +fields or annotations are applied. **seccomp.security.alpha.kubernetes.io/defaultProfileName** - Annotation that specifies the default seccomp profile to apply to containers. Possible values @@ -677,10 +708,10 @@ are: flag is not defined, the default path will be used, which is `<root-dir>/seccomp` where `<root-dir>` is specified by the `--root-dir` flag. -{{< note >}} + {{< note >}} The `--seccomp-profile-root` flag is deprecated since Kubernetes v1.19. Users are encouraged to use the default path. -{{< /note >}} + {{< /note >}} **seccomp.security.alpha.kubernetes.io/allowedProfileNames** - Annotation that specifies which values are allowed for the pod seccomp annotations. Specified as @@ -692,18 +723,22 @@ default cannot be changed. By default, all safe sysctls are allowed. -- `forbiddenSysctls` - excludes specific sysctls. You can forbid a combination of safe and unsafe sysctls in the list. To forbid setting any sysctls, use `*` on its own. -- `allowedUnsafeSysctls` - allows specific sysctls that had been disallowed by the default list, so long as these are not listed in `forbiddenSysctls`. +- `forbiddenSysctls` - excludes specific sysctls. You can forbid a combination + of safe and unsafe sysctls in the list. To forbid setting any sysctls, use + `*` on its own. +- `allowedUnsafeSysctls` - allows specific sysctls that had been disallowed by + the default list, so long as these are not listed in `forbiddenSysctls`. -Refer to the [Sysctl documentation]( -/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy). +Refer to the [Sysctl documentation](/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy). ## {{% heading "whatsnext" %}} -- See [PodSecurityPolicy Deprecation: Past, Present, and - Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/) to learn about - the future of pod security policy. +- See [PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/) + to learn about the future of pod security policy. -- See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) for policy recommendations. +- See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) + for policy recommendations. + +- Refer to [PodSecurityPolicy reference](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy) + for the API details. -- Refer to [Pod Security Policy Reference](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy) for the api details. diff --git a/content/en/docs/reference/using-api/deprecation-policy.md b/content/en/docs/reference/using-api/deprecation-policy.md index e1c378c4ac..49136e6773 100644 --- a/content/en/docs/reference/using-api/deprecation-policy.md +++ b/content/en/docs/reference/using-api/deprecation-policy.md @@ -85,7 +85,7 @@ might have to add an equivalent field or represent it as an annotation. * **Beta API versions must be supported for 9 months or 3 releases (whichever is longer) after deprecation** * **Alpha API versions may be removed in any release without prior deprecation notice** -This ensures beta API support covers the [maximum supported version skew of 2 releases](/docs/setup/release/version-skew-policy/). +This ensures beta API support covers the [maximum supported version skew of 2 releases](/releases/version-skew-policy/). {{< note >}} There are no current plans for a major version revision of Kubernetes that removes GA APIs. diff --git a/content/en/docs/tutorials/security/ns-level-pss.md b/content/en/docs/tutorials/security/ns-level-pss.md index 119c1411e7..4a20895df7 100644 --- a/content/en/docs/tutorials/security/ns-level-pss.md +++ b/content/en/docs/tutorials/security/ns-level-pss.md @@ -8,57 +8,63 @@ weight: 10 This tutorial applies only for new clusters. {{% /alert %}} -Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated -to beta](/blog/2021/12/09/pod-security-admission-beta/). Pod Security Admission +Pod Security admission (PSA) is enabled by default in v1.23 and later, as it +[graduated to beta](/blog/2021/12/09/pod-security-admission-beta/). Pod Security Admission is an admission controller that applies -[Pod Security Standards](docs/concepts/security/pod-security-standards/) +[Pod Security Standards](/docs/concepts/security/pod-security-standards/) when pods are created. In this tutorial, you will enforce the `baseline` Pod Security Standard, one namespace at a time. You can also apply Pod Security Standards to multiple namespaces at once at the cluster -level. For instructions, refer to [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss). +level. For instructions, refer to +[Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss). + ## {{% heading "prerequisites" %}} Install the following on your workstation: - [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) -- [kubectl](https://kubernetes.io/docs/tasks/tools/) +- [kubectl](/docs/tasks/tools/) ## Create cluster 1. Create a `KinD` cluster as follows: - ```shell - kind create cluster --name psa-ns-level --image kindest/node:v1.23.0 - ``` + ```shell + kind create cluster --name psa-ns-level --image kindest/node:v1.23.0 + ``` + The output is similar to this: - ``` - Creating cluster "psa-ns-level" ... - ✓ Ensuring node image (kindest/node:v1.23.0) 🖼 - ✓ Preparing nodes 📦 - ✓ Writing configuration 📜 - ✓ Starting control-plane 🕹️ - ✓ Installing CNI 🔌 - ✓ Installing StorageClass 💾 - Set kubectl context to "kind-psa-ns-level" - You can now use your cluster with: + + ``` + Creating cluster "psa-ns-level" ... + ✓ Ensuring node image (kindest/node:v1.23.0) 🖼 + ✓ Preparing nodes 📦 + ✓ Writing configuration 📜 + ✓ Starting control-plane 🕹️ + ✓ Installing CNI 🔌 + ✓ Installing StorageClass 💾 + Set kubectl context to "kind-psa-ns-level" + You can now use your cluster with: - kubectl cluster-info --context kind-psa-ns-level + kubectl cluster-info --context kind-psa-ns-level - Not sure what to do next? 😅 Check out https://kind.sigs.k8s.io/docs/user/quick-start/ - ``` + Not sure what to do next? 😅 Check out https://kind.sigs.k8s.io/docs/user/quick-start/ + ``` 1. Set the kubectl context to the new cluster: - ```shell - kubectl cluster-info --context kind-psa-ns-level - ``` + + ```shell + kubectl cluster-info --context kind-psa-ns-level + ``` The output is similar to this: - ``` - Kubernetes control plane is running at https://127.0.0.1:50996 - CoreDNS is running at https://127.0.0.1:50996/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy + + ``` + Kubernetes control plane is running at https://127.0.0.1:50996 + CoreDNS is running at https://127.0.0.1:50996/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy - To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. - ``` + To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. + ``` ## Create a namespace @@ -67,7 +73,9 @@ Create a new namespace called `example`: ```shell kubectl create ns example ``` + The output is similar to this: + ``` namespace/example created ``` @@ -78,63 +86,68 @@ namespace/example created built-in Pod Security Admission. In this step we will warn on baseline pod security standard as per the latest version (default value) - ```shell - kubectl label --overwrite ns example \ + ```shell + kubectl label --overwrite ns example \ pod-security.kubernetes.io/warn=baseline \ pod-security.kubernetes.io/warn-version=latest - ``` + ``` 2. Multiple pod security standards can be enabled on any namespace, using labels. Following command will `enforce` the `baseline` Pod Security Standard, but `warn` and `audit` for `restricted` Pod Security Standards as per the latest version (default value) - ``` - kubectl label --overwrite ns example \ - pod-security.kubernetes.io/enforce=baseline \ - pod-security.kubernetes.io/enforce-version=latest \ - pod-security.kubernetes.io/warn=restricted \ - pod-security.kubernetes.io/warn-version=latest \ - pod-security.kubernetes.io/audit=restricted \ - pod-security.kubernetes.io/audit-version=latest - ``` + ```shell + kubectl label --overwrite ns example \ + pod-security.kubernetes.io/enforce=baseline \ + pod-security.kubernetes.io/enforce-version=latest \ + pod-security.kubernetes.io/warn=restricted \ + pod-security.kubernetes.io/warn-version=latest \ + pod-security.kubernetes.io/audit=restricted \ + pod-security.kubernetes.io/audit-version=latest + ``` ## Verify the Pod Security Standards 1. Create a minimal pod in `example` namespace: - ```shell - cat <<EOF > /tmp/pss/nginx-pod.yaml - apiVersion: v1 - kind: Pod - metadata: - name: nginx - spec: - containers: - - image: nginx - name: nginx - ports: - - containerPort: 80 - EOF - ``` + ```shell + cat <<EOF > /tmp/pss/nginx-pod.yaml + apiVersion: v1 + kind: Pod + metadata: + name: nginx + spec: + containers: + - image: nginx + name: nginx + ports: + - containerPort: 80 + EOF + ``` + 1. Apply the pod spec to the cluster in `example` namespace: - ```shell - kubectl apply -n example -f /tmp/pss/nginx-pod.yaml - ``` + + ```shell + kubectl apply -n example -f /tmp/pss/nginx-pod.yaml + ``` The output is similar to this: - ``` - Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") - pod/nginx created - ``` + + ``` + Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") + pod/nginx created + ``` 1. Apply the pod spec to the cluster in `default` namespace: - ```shell - kubectl apply -n default -f /tmp/pss/nginx-pod.yaml - ``` + + ```shell + kubectl apply -n default -f /tmp/pss/nginx-pod.yaml + ``` Output is similar to this: - ``` - pod/nginx created - ``` + + ``` + pod/nginx created + ``` The Pod Security Standards were applied only to the `example` namespace. You could create the same Pod in the `default` namespace @@ -149,11 +162,13 @@ Run `kind delete cluster -name psa-ns-level` to delete the cluster created. - Run a [shell script](/examples/security/kind-with-namespace-level-baseline-pod-security.sh) to perform all the preceding steps all at once. + 1. Create KinD cluster 2. Create new namespace 3. Apply `baseline` Pod Security Standard in `enforce` mode while applying `restricted` Pod Security Standard also in `warn` and `audit` mode. 4. Create a new pod with the following pod security standards applied + - [Pod Security Admission](/docs/concepts/security/pod-security-admission/) - [Pod Security Standards](/docs/concepts/security/pod-security-standards/) -- [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/) \ No newline at end of file +- [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/) From d5c500bda35c02dcc806e93043fa132dfccf988c Mon Sep 17 00:00:00 2001 From: Matthew Wong <mattwon@amazon.com> Date: Tue, 8 Feb 2022 17:31:06 -0800 Subject: [PATCH 025/104] Add that CSIMigration* fallback does not work for provision operations --- .../feature-gates.md | 45 ++++++++++++------- 1 file changed, 30 insertions(+), 15 deletions(-) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 3235361574..37c00f2a1a 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -618,8 +618,10 @@ Each feature gate is designed for enabling/disabling a specific feature: operations from in-tree plugins to corresponding pre-installed CSI plugins - `CSIMigrationAWS`: Enables shims and translation logic to route volume operations from the AWS-EBS in-tree plugin to EBS CSI plugin. Supports - falling back to in-tree EBS plugin if a node does not have EBS CSI plugin - installed and configured. Requires CSIMigration feature flag enabled. + falling back to in-tree EBS plugin for mount operations to nodes that have + the feature disabled or that do not have EBS CSI plugin installed and + configured. Does not support falling back for provision operations, for those + the CSI plugin must be installed and configured. - `CSIMigrationAWSComplete`: Stops registering the EBS in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the AWS-EBS in-tree plugin to EBS CSI plugin. @@ -629,9 +631,11 @@ Each feature gate is designed for enabling/disabling a specific feature: which prevents the registration of in-tree EBS plugin. - `CSIMigrationAzureDisk`: Enables shims and translation logic to route volume operations from the Azure-Disk in-tree plugin to AzureDisk CSI plugin. - Supports falling back to in-tree AzureDisk plugin if a node does not have - AzureDisk CSI plugin installed and configured. Requires CSIMigration feature - flag enabled. + Supports falling back to in-tree AzureDisk plugin for mount operations to + nodes that have the feature disabled or that do not have AzureDisk CSI plugin + installed and configured. Does not support falling back for provision + operations, for those the CSI plugin must be installed and configured. + Requires CSIMigration feature flag enabled. - `CSIMigrationAzureDiskComplete`: Stops registering the Azure-Disk in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the Azure-Disk in-tree plugin to @@ -641,9 +645,11 @@ Each feature gate is designed for enabling/disabling a specific feature: `InTreePluginAzureDiskUnregister` feature flag which prevents the registration of in-tree AzureDisk plugin. - `CSIMigrationAzureFile`: Enables shims and translation logic to route volume operations from the Azure-File in-tree plugin to AzureFile CSI plugin. - Supports falling back to in-tree AzureFile plugin if a node does not have - AzureFile CSI plugin installed and configured. Requires CSIMigration feature - flag enabled. + Supports falling back to in-tree AzureFile plugin for mount operations to + nodes that have the feature disabled or that do not have AzureFile CSI plugin + installed and configured. Does not support falling back for provision + operations, for those the CSI plugin must be installed and configured. + Requires CSIMigration feature flag enabled. - `CSIMigrationAzureFileComplete`: Stops registering the Azure-File in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the Azure-File in-tree plugin to @@ -654,8 +660,11 @@ Each feature gate is designed for enabling/disabling a specific feature: of in-tree AzureFile plugin. - `CSIMigrationGCE`: Enables shims and translation logic to route volume operations from the GCE-PD in-tree plugin to PD CSI plugin. Supports falling - back to in-tree GCE plugin if a node does not have PD CSI plugin installed and - configured. Requires CSIMigration feature flag enabled. + back to in-tree GCE plugin for mount operations to nodes that have the + feature disabled or that do not have PD CSI plugin installed and configured. + Does not support falling back for provision operations, for those the CSI + plugin must be installed and configured. Requires CSIMigration feature flag + enabled. - `csiMigrationRBD`: Enables shims and translation logic to route volume operations from the RBD in-tree plugin to Ceph RBD CSI plugin. Requires CSIMigration and csiMigrationRBD feature flags enabled and Ceph CSI plugin @@ -671,8 +680,11 @@ Each feature gate is designed for enabling/disabling a specific feature: been deprecated in favor of the `InTreePluginGCEUnregister` feature flag which prevents the registration of in-tree GCE PD plugin. - `CSIMigrationOpenStack`: Enables shims and translation logic to route volume operations from the Cinder in-tree plugin to Cinder CSI plugin. Supports - falling back to in-tree Cinder plugin if a node does not have Cinder CSI - plugin installed and configured. Requires CSIMigration feature flag enabled. + falling back to in-tree Cinder plugin for mount operations to nodes that have + the feature disabled or that do not have Cinder CSI plugin installed and + configured. Does not support falling back for provision operations, for those + the CSI plugin must be installed and configured. Requires CSIMigration + feature flag enabled. - `CSIMigrationOpenStackComplete`: Stops registering the Cinder in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the Cinder in-tree plugin to Cinder CSI plugin. @@ -680,9 +692,12 @@ Each feature gate is designed for enabling/disabling a specific feature: CSI plugin installed and configured on all nodes in the cluster. This flag has been deprecated in favor of the `InTreePluginOpenStackUnregister` feature flag which prevents the registration of in-tree openstack cinder plugin. - `CSIMigrationvSphere`: Enables shims and translation logic to route volume operations - from the vSphere in-tree plugin to vSphere CSI plugin. - Supports falling back to in-tree vSphere plugin if a node does not have vSphere - CSI plugin installed and configured. Requires CSIMigration feature flag enabled. + from the vSphere in-tree plugin to vSphere CSI plugin. Supports falling back + to in-tree vSphere plugin for mount operations to nodes that have the feature + disabled or that do not have vSphere CSI plugin installed and configured. + Does not support falling back for provision operations, for those the CSI + plugin must be installed and configured. Requires CSIMigration feature flag + enabled. - `CSIMigrationvSphereComplete`: Stops registering the vSphere in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the vSphere in-tree plugin to vSphere CSI plugin. Requires CSIMigration and From 3d1ca8c1647cd339367928788cfd1ad1d64882dc Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Sat, 18 Dec 2021 16:00:15 +0800 Subject: [PATCH 026/104] [zh] Translate kube-scheduler config API v1beta2 --- .../kube-scheduler-config.v1beta2.md | 1734 +++++++++++++++++ 1 file changed, 1734 insertions(+) create mode 100644 content/zh/docs/reference/config-api/kube-scheduler-config.v1beta2.md diff --git a/content/zh/docs/reference/config-api/kube-scheduler-config.v1beta2.md b/content/zh/docs/reference/config-api/kube-scheduler-config.v1beta2.md new file mode 100644 index 0000000000..6a2ab78655 --- /dev/null +++ b/content/zh/docs/reference/config-api/kube-scheduler-config.v1beta2.md @@ -0,0 +1,1734 @@ +--- +title: kube-scheduler 配置 (v1beta2) +content_type: tool-reference +package: kubescheduler.config.k8s.io/v1beta2 +auto_generated: true +--- + +<!-- +title: kube-scheduler Configuration (v1beta2) +content_type: tool-reference +package: kubescheduler.config.k8s.io/v1beta2 +auto_generated: true +--> + +<!-- +## Resource Types +--> +## 资源类型 + +- [DefaultPreemptionArgs](#kubescheduler-config-k8s-io-v1beta2-DefaultPreemptionArgs) +- [InterPodAffinityArgs](#kubescheduler-config-k8s-io-v1beta2-InterPodAffinityArgs) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) +- [NodeAffinityArgs](#kubescheduler-config-k8s-io-v1beta2-NodeAffinityArgs) +- [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesBalancedAllocationArgs) +- [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesFitArgs) +- [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadArgs) +- [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta2-VolumeBindingArgs) + +## `DefaultPreemptionArgs` {#kubescheduler-config-k8s-io-v1beta2-DefaultPreemptionArgs} + +<!-- +DefaultPreemptionArgs holds arguments used to configure the +DefaultPreemption plugin. +--> +DefaultPreemptionArgs 包含用来配置 DefaultPreemption 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>DefaultPreemptionArgs</code></td></tr> + + +<tr><td><code>minCandidateNodesPercentage</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + MinCandidateNodesPercentage is the minimum number of candidates to +shortlist when dry running preemption as a percentage of number of nodes. +Must be in the range [0, 100]. Defaults to 10% of the cluster size if +unspecified. + --> + 此字段为试运行抢占时 shortlist 中候选节点数的下限，数值为节点数的百分比。 +字段值必须介于 [0, 100] 之间。未指定时默认值为整个集群规模的 10%。 +</td> +</tr> +<tr><td><code>minCandidateNodesAbsolute</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + MinCandidateNodesAbsolute is the absolute minimum number of candidates to +shortlist. The likely number of candidates enumerated for dry running +preemption is given by the formula: +numCandidates = max(numNodes ∗ minCandidateNodesPercentage, minCandidateNodesAbsolute) +We say "likely" because there are other factors such as PDB violations +that play a role in the number of candidates shortlisted. Must be at least +0 nodes. Defaults to 100 nodes if unspecified. + --> + <p>此字段设置 shortlist 中候选节点的绝对下限。用于试运行抢占而列举的 +候选节点个数近似于通过下面的公式计算的：</p> +<p>候选节点数 = max(节点数 * minCandidateNodesPercentage, minCandidateNodesAbsolute)</p> +<p>之所以说是“近似于”是因为存在一些类似于 PDB 违例这种因素，会影响到进入 shortlist +中候选节点的个数。取值至少为 0 节点。若未设置默认为 100 节点。</p> +</td> +</tr> +</tbody> +</table> + +## `InterPodAffinityArgs` {#kubescheduler-config-k8s-io-v1beta2-InterPodAffinityArgs} + +<!-- +InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plugin. +--> +InterPodAffinityArgs 包含用来配置 InterPodAffinity 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>InterPodAffinityArgs</code></td></tr> + +<tr><td><code>hardPodAffinityWeight</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + HardPodAffinityWeight is the scoring weight for existing pods with a +matching hard affinity to the incoming pod. + --> + 此字段是一个计分权重值。针对新增的 Pod，要对现存的、带有与新 Pod 匹配的 +硬性亲和性设置的 Pod 计算亲和性得分。 +</td> +</tr> +</tbody> +</table> + +## `KubeSchedulerConfiguration` {#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration} + +<!-- +KubeSchedulerConfiguration configures a scheduler +--> +KubeSchedulerConfiguration 用来配置调度器。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>KubeSchedulerConfiguration</code></td></tr> + +<tr><td><code>parallelism</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16 + --> + 此字段设置为调度 Pod 而执行算法时的并发度。此值必须大于 0。 +默认值为 16。 +</td> +</tr> +<tr><td><code>leaderElection</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#LeaderElectionConfiguration"><code>LeaderElectionConfiguration</code></a> +</td> +<td> + <!-- + LeaderElection defines the configuration of leader election client. + --> + 此字段用来定义领导者选举客户端的配置。 +</td> +</tr> +<tr><td><code>clientConnection</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#ClientConnectionConfiguration"><code>ClientConnectionConfiguration</code></a> +</td> +<td> + <!-- + ClientConnection specifies the kubeconfig file and client connection +settings for the proxy server to use when communicating with the apiserver. + --> + 此字段为与 API 服务器通信时使用的代理服务器设置 kubeconfig 文件和客户端 +连接配置。 +</td> +</tr> +<tr><td><code>healthzBindAddress</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Note: Both HealthzBindAddress and MetricsBindAddress fields are deprecated. +Only empty address or port 0 is allowed. Anything else will fail validation. +HealthzBindAddress is the IP address and port for the health check server to serve on. + --> + <code>healthzBindAddress</code> 是健康检查服务器提供服务所用的 IP 地址和端口。 + 注意：<code>healthzBindAddress</code> 和 <code>metricsBindAddress</code> +这两个字段都已被弃用。 +只可以设置空地址或者端口 0。其他设置值都无法通过合法性检查。 +</td> +</tr> +<tr><td><code>metricsBindAddress</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + MetricsBindAddress is the IP address and port for the metrics server to serve on. + --> + <code>metricsBindAddress</code> 是度量值服务器提供服务所用的 IP 地址和端口。 +</td> +</tr> +<tr><td><code>DebuggingConfiguration</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#DebuggingConfiguration"><code>DebuggingConfiguration</code></a> +</td> +<td>（<code>DebuggingConfiguration</code> 的成员被内嵌到此类型中） + <!-- + DebuggingConfiguration holds configuration for Debugging related features + --> + 此字段设置与调试相关功能特性的配置。 +</td> +</tr> +<tr><td><code>percentageOfNodesToScore</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + PercentageOfNodesToScore is the percentage of all nodes that once found feasible +for running a pod, the scheduler stops its search for more feasible nodes in +the cluster. This helps improve scheduler's performance. Scheduler always tries to find +at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. +Example: if the cluster size is 500 nodes and the value of this flag is 30, +then scheduler stops finding further feasible nodes once it finds 150 feasible ones. +When the value is 0, default percentage (5%--50% based on the size of the cluster) of the +nodes will be scored. + --> + 此字段为所有节点的百分比，一旦调度器找到所设置比例的、能够运行 Pod 的节点， +则停止在集群中继续寻找更合适的节点。这一配置有助于提高调度器的性能。调度器 +总会尝试寻找至少 "minFeasibleNodesToFind" 个可行节点，无论此字段的取值如何。 +例如：当集群规模为 500 个节点，而此字段的取值为 30，则调度器在找到 150 个合适 +的节点后会停止继续寻找合适的节点。当此值为 0 时，调度器会使用默认节点数百分比（基于集群规模 +确定的值，在 5% 到 50% 之间）来执行打分操作。 +</td> +</tr> +<tr><td><code>podInitialBackoffSeconds</code> <B><!--[Required]-->[必需]</B><br/> +<code>int64</code> +</td> +<td> + <!-- + PodInitialBackoffSeconds is the initial backoff for unschedulable pods. +If specified, it must be greater than 0. If this value is null, the default value (1s) +will be used. + --> + 此字段设置不可调度 Pod 的初始回退秒数。如果设置了此字段，其取值必须大于零。 +若此值为 null，则使用默认值（1s）。 +</td> +</tr> +<tr><td><code>podMaxBackoffSeconds</code> <B><!--[Required]-->[必需]</B><br/> +<code>int64</code> +</td> +<td> + <!-- + PodMaxBackoffSeconds is the max backoff for unschedulable pods. +If specified, it must be greater than podInitialBackoffSeconds. If this value is null, +the default value (10s) will be used. + --> + 此字段设置不可调度的 Pod 的最大回退秒数。如果设置了此字段，则其值必须大于 +podInitialBackoffSeconds 字段值。如果此值设置为 null，则使用默认值（10s）。 +</td> +</tr> +<tr><td><code>profiles</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile"><code>[]KubeSchedulerProfile</code></a> +</td> +<td> + <!-- + Profiles are scheduling profiles that kube-scheduler supports. Pods can +choose to be scheduled under a particular profile by setting its associated +scheduler name. Pods that don't specify any scheduler name are scheduled +with the "default-scheduler" profile, if present here. + --> + 此字段为 kube-scheduler 所支持的方案（profiles）。Pod 可以通过设置其对应 +的调度器名称来选择使用特定的方案。未指定调度器名称的 Pod 会使用 +“default-scheduler”方案来调度，如果存在的话。 +</td> +</tr> +<tr><td><code>extenders</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-Extender"><code>[]Extender</code></a> +</td> +<td> + <!-- + Extenders are the list of scheduler extenders, each holding the values of how to communicate +with the extender. These extenders are shared by all scheduler profiles. + --> + 此字段为调度器扩展模块（Extender）的列表，每个元素包含如何与某扩展模块 +通信的配置信息。所有调度器模仿会共享此扩展模块列表。 +</td> +</tr> +</tbody> +</table> + +## `NodeAffinityArgs` {#kubescheduler-config-k8s-io-v1beta2-NodeAffinityArgs} + +<!-- +NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. +--> +NodeAffinityArgs 中包含配置 NodeAffinity 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>NodeAffinityArgs</code></td></tr> + +<tr><td><code>addedAffinity</code><br/> +<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#nodeaffinity-v1-core"><code>core/v1.NodeAffinity</code></a> +</td> +<td> + <!-- + AddedAffinity is applied to all Pods additionally to the NodeAffinity +specified in the PodSpec. That is, Nodes need to satisfy AddedAffinity +AND .spec.NodeAffinity. AddedAffinity is empty by default (all Nodes +match). +When AddedAffinity is used, some Pods with affinity requirements that match +a specific Node (such as Daemonset Pods) might remain unschedulable. + --> + <code>addedAffinity</code> 会作为附加的亲和性属性添加到所有 Pod 的 +规约中指定的 NodeAffinity 中。换言之，节点需要同时满足 addedAffinity +和 .spec.nodeAffinity。默认情况下，addedAffinity 为空（与所有节点匹配）。 +使用了 addedAffinity 时，某些带有已经能够与某特定节点匹配的亲和性需求 +的 Pod （例如 DaemonSet Pod）可能会继续呈现不可调度状态。 +</td> +</tr> +</tbody> +</table> + +## `NodeResourcesBalancedAllocationArgs` {#kubescheduler-config-k8s-io-v1beta2-NodeResourcesBalancedAllocationArgs} + +<!-- +NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResourcesBalancedAllocation plugin. +--> +NodeResourcesBalancedAllocationArgs 包含用来配置 NodeResourcesBalancedAllocation 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>NodeResourcesBalancedAllocationArgs</code></td></tr> + +<tr><td><code>resources</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-ResourceSpec"><code>[]ResourceSpec</code></a> +</td> +<td> + <!-- + Resources to be managed, the default is "cpu" and "memory" if not specified. + --> + 要管理的资源；如果未设置，则默认值为 "cpu" 和 "memory"。 +</td> +</tr> +</tbody> +</table> + +## `NodeResourcesFitArgs` {#kubescheduler-config-k8s-io-v1beta2-NodeResourcesFitArgs} + +<!-- +NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plugin. +--> +NodeResourcesFitArgs 包含用来配置 NodeResourcesFit 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>NodeResourcesFitArgs</code></td></tr> + +<tr><td><code>ignoredResources</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!-- + IgnoredResources is the list of resources that NodeResources fit filter +should ignore. This doesn't apply to scoring. + --> + 此字段为 NodeResources 匹配过滤器要忽略的资源列表。此列表不影响节点打分。 +</td> +</tr> +<tr><td><code>ignoredResourceGroups</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!-- + IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. +e.g. if group is ["example.com"], it will ignore all resource names that begin +with "example.com", such as "example.com/aaa" and "example.com/bbb". +A resource group name can't contain '/'. This doesn't apply to scoring. + --> + 此字段定义 NodeResources 匹配过滤器要忽略的资源组列表。 +例如，如果配置值为 ["example.com"]，则以 "example.com" 开头的资源名（如 +"example.com/aaa" 和 "example.com/bbb"）都会被忽略。 +资源组名称中不可以包含 '/'。此设置不影响节点的打分。 +</td> +</tr> +<tr><td><code>scoringStrategy</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy"><code>ScoringStrategy</code></a> +</td> +<td> + <!-- + ScoringStrategy selects the node resource scoring strategy. +The default strategy is LeastAllocated with an equal "cpu" and "memory" weight. + --> + 此字段用来选择节点资源打分策略。默认的策略为 LeastAllocated，且 "cpu" 和 +"memory" 的权重相同。 +</td> +</tr> +</tbody> +</table> + +## `PodTopologySpreadArgs` {#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadArgs} + +<!-- +PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread plugin. +--> +PodTopologySpreadArgs 包含用来配置 PodTopologySpread 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>PodTopologySpreadArgs</code></td></tr> + +<tr><td><code>defaultConstraints</code><br/> +<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#topologyspreadconstraint-v1-core"><code>[]core/v1.TopologySpreadConstraint</code></a> +</td> +<td> + <!-- + DefaultConstraints defines topology spread constraints to be applied to +Pods that don't define any in `pod.spec.topologySpreadConstraints`. +`.defaultConstraints[∗].labelSelectors` must be empty, as they are +deduced from the Pod's membership to Services, ReplicationControllers, +ReplicaSets or StatefulSets. +When not empty, .defaultingType must be "List". + --> + 此字段针对未定义 <code>.spec.topologySpreadConstraints</code> 的 Pod， +为其提供拓扑分布约束。<code>.defaultConstraints[∗].labelSelectors</code> +必须为空，因为这一信息要从 Pod 所属的 Service、ReplicationController、 +ReplicaSet 或 StatefulSet 来推导。 +此字段不为空时，<code>.defaultingType</code> 必须为 "List"。 +</td> +</tr> +<tr><td><code>defaultingType</code><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadConstraintsDefaulting"><code>PodTopologySpreadConstraintsDefaulting</code></a> +</td> +<td> + <!-- + DefaultingType determines how .defaultConstraints are deduced. Can be one + of "System" or "List". + - "System": Use kubernetes defined constraints that spread Pods among + Nodes and Zones. + - "List": Use constraints defined in .defaultConstraints. + Defaults to "List" if feature gate DefaultPodTopologySpread is disabled + and to "System" if enabled.--> + <p> + <code>defaultingType</code> 决定如何推导 <code>.defaultConstraints</code>。 +可选值为 "System" 或 "List"。 + </p> + <ul> + <li>"System"：使用 Kubernetes 定义的约束，将 Pod 分布到不同节点和可用区；</li> + <li>"List"：使用 <code>.defaultConstraints</code> 中定义的约束。</li> + </ul> + <p>当特性门控 DefaultPodTopologySpread 被禁用时，默认值为 "list"；反之，默认值为 "System"。</p> +</td> +</tr> +</tbody> +</table> + +## `VolumeBindingArgs` {#kubescheduler-config-k8s-io-v1beta2-VolumeBindingArgs} + +<!-- +VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin. +--> +VolumeBindingArgs 包含用来配置 VolumeBinding 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta2</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>VolumeBindingArgs</code></td></tr> + +<tr><td><code>bindTimeoutSeconds</code> <B><!--[Required]-->[必需]</B><br/> +<code>int64</code> +</td> +<td> + <!-- + BindTimeoutSeconds is the timeout in seconds in volume binding operation. +Value must be non-negative integer. The value zero indicates no waiting. +If this value is nil, the default value (600) will be used. + --> + 此字段设置卷绑定操作的超时秒数。字段值必须是非负数。 +取值为 0 意味着不等待。如果此值为 null，则使用默认值（600）。 +</td> +</tr> +<tr><td><code>shape</code><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-UtilizationShapePoint"><code>[]UtilizationShapePoint</code></a> +</td> +<td> + <!-- + Shape specifies the points defining the score function shape, which is +used to score nodes based on the utilization of statically provisioned +PVs. The utilization is calculated by dividing the total requested +storage of the pod by the total capacity of feasible PVs on each node. +Each point contains utilization (ranges from 0 to 100) and its +associated score (ranges from 0 to 10). You can turn the priority by +specifying different scores for different utilization numbers. +The default shape points are: +1) 0 for 0 utilization +2) 10 for 100 utilization +All points must be sorted in increasing order by utilization. + --> + <p><code>shape</code> 用来设置打分函数曲线所使用的计分点，这些计分点 +用来基于静态制备的 PV 卷的利用率为节点打分。 +卷的利用率是计算得来的，将 Pod 所请求的总的存储空间大小除以每个节点 +上可用的总的卷容量。每个计分点包含利用率（范围从 0 到 100）和其对应 +的得分（范围从 0 到 10）。你可以通过为不同的使用率值设置不同的得分来 +反转优先级：</p> + <p>默认的曲线计分点为：</p> + <ul> + <li>利用率为 0 时得分为 0；</li> + <li>利用率为 100 时得分为 10。</li> + </ul> + <p>所有计分点必须按利用率值的升序来排序。</p> +</td> +</tr> +</tbody> +</table> + +## `Extender` {#kubescheduler-config-k8s-io-v1beta2-Extender} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +<!-- +Extender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, +it is assumed that the extender chose not to provide that extension. +--> +Extender 包含与扩展模块（Extender）通信所用的参数。 +如果未指定 verb 或者 verb 为空，则假定对应的扩展模块选择不提供该扩展功能。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>urlPrefix</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + URLPrefix at which the extender is available + --> + 用来访问扩展模块的 URL 前缀。 +</td> +</tr> +<tr><td><code>filterVerb</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender. + --> + filter 调用所使用的动词，如果不支持过滤操作则为空。 +此动词会在向扩展模块发送 filter 调用时追加到 urlPrefix 后面。 +</td> +</tr> +<tr><td><code>preemptVerb</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender. + --> + preempt 调用所使用的动词，如果不支持抢占操作则为空。 +此动词会在向扩展模块发送 preempt 调用时追加到 urlPrefix 后面。 +</td> +</tr> +<tr><td><code>prioritizeVerb</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender. + --> + prioritize 调用所使用的动词，如果不支持 prioritize 操作则为空。 +此动词会在向扩展模块发送 prioritize 调用时追加到 urlPrefix 后面。 +</td> +</tr> +<tr><td><code>weight</code> <B><!--[Required]-->[必需]</B><br/> +<code>int64</code> +</td> +<td> + <!-- + The numeric multiplier for the node scores that the prioritize call generates. +The weight should be a positive integer + --> + 针对 prioritize 调用所生成的节点分数要使用的数值系数。 +weight 值必须是正整数。 +</td> +</tr> +<tr><td><code>bindVerb</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. +If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender +can implement this function. + --> + bind 调用所使用的动词，如果不支持 bind 操作则为空。 +此动词会在向扩展模块发送 bind 调用时追加到 urlPrefix 后面。 +如果扩展模块实现了此方法，扩展模块要负责将 Pod 绑定到 API 服务器。 +只有一个扩展模块可以实现此函数。 +</td> +</tr> +<tr><td><code>enableHTTPS</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + EnableHTTPS specifies whether https should be used to communicate with the extender + --> + 此字段设置是否需要使用 HTTPS 来与扩展模块通信。 +</td> +</tr> +<tr><td><code>tlsConfig</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-ExtenderTLSConfig"><code>ExtenderTLSConfig</code></a> +</td> +<td> + <!-- + TLSConfig specifies the transport layer security config + --> + 此字段设置传输层安全性（TLS）配置。 +</td> +</tr> +<tr><td><code>httpTimeout</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <!-- + HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize +timeout is ignored, k8s/other extenders priorities are used to select the node. + --> + 此字段给出扩展模块功能调用的超时值。filter 操作超时会导致 Pod 无法被调度。 +prioritize 操作超时会被忽略，Kubernetes 或者其他扩展模块所给出的优先级值 +会被用来选择节点。 +</td> +</tr> +<tr><td><code>nodeCacheCapable</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + NodeCacheCapable specifies that the extender is capable of caching node information, +so the scheduler should only send minimal information about the eligible nodes +assuming that the extender already cached full details of all nodes in the cluster + --> + 此字段指示扩展模块可以缓存节点信息，从而调度器应该发送关于可选节点的最少信息， +假定扩展模块已经缓存了集群中所有节点的全部详细信息。 +</td> +</tr> +<tr><td><code>managedResources</code><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-ExtenderManagedResource"><code>[]ExtenderManagedResource</code></a> +</td> +<td> + <!-- + ManagedResources is a list of extended resources that are managed by +this extender. +- A pod will be sent to the extender on the Filter, Prioritize and Bind + (if the extender is the binder) phases iff the pod requests at least + one of the extended resources in this list. If empty or unspecified, + all pods will be sent to this extender. +- If IgnoredByScheduler is set to true for a resource, kube-scheduler + will skip checking the resource in predicates. + --> + <p><code>managedResources</code> 是一个由此扩展模块所管理的扩展资源的列表。</p> + <ul> + <li>如果某 Pod 请求了此列表中的至少一个扩展资源，则 Pod 会在 filter、 +prioritize 和 bind （如果扩展模块可以执行绑定操作）阶段被发送到该扩展模块。 +若此字段为空或未设置，则所有 Pod 都会发送到此扩展模块。</li> + <li>如果某资源上设置了 <code>ignoredByScheduler</code> 为 true，则 kube-scheduler +会在断言阶段略过对该资源的检查。</li> + </ul> +</td> +</tr> +<tr><td><code>ignorable</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + Ignorable specifies if the extender is ignorable, i.e. scheduling should not +fail when the extender returns an error or is not reachable. + --> + 此字段用来设置扩展模块是否是可忽略的。换言之，当扩展模块返回错误或者 +完全不可达时，调度操作不应失败。 +</td> +</tr> +</tbody> +</table> + +## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1beta2-ExtenderManagedResource} + +<!-- +**Appears in:** +--> +**出现在：** + +- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) + +<!-- +ExtenderManagedResource describes the arguments of extended resources +managed by an extender. +--> +ExtenderManagedResource 描述某扩展模块所管理的扩展资源的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Name is the extended resource name. + --> + 扩展资源的名称。 +</td> +</tr> +<tr><td><code>ignoredByScheduler</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + IgnoredByScheduler indicates whether kube-scheduler should ignore this +resource when applying predicates. + --> + 此字段标明 kube-scheduler 是否应在应用断言时忽略此资源。 +</td> +</tr> +</tbody> +</table> + +## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1beta2-ExtenderTLSConfig} + +<!-- +**Appears in:** +--> +**出现在：** + +- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) + +<!-- +ExtenderTLSConfig contains settings to enable TLS with extender +--> +ExtenderTLSConfig 包含启用与扩展模块间 TLS 传输所需的配置参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>insecure</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + Server should be accessed without verifying the TLS certificate. For testing only. + --> + 访问服务器时不需要检查 TLS 证书。此配置仅针对测试用途。 +</td> +</tr> +<tr><td><code>serverName</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + ServerName is passed to the server for SNI and is used in the client to check server +certificates against. If ServerName is empty, the hostname used to contact the +server is used. + --> + <code>serverName</code> 会被发送到服务器端，作为 SNI 标志；客户端会使用 +此设置来检查服务器证书。如果 <code>serverName</code> 为空，则会使用联系 +服务器时所用的主机名。 +</td> +</tr> +<tr><td><code>certFile</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Server requires TLS client certificate authentication + --> + 服务器端所要求的 TLS 客户端证书认证。 +</td> +</tr> +<tr><td><code>keyFile</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Server requires TLS client certificate authentication + --> + 服务器端所要求的 TLS 客户端秘钥认证。 +</td> +</tr> +<tr><td><code>caFile</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Trusted root certificates for server + --> + 服务器端可信任的根证书。 +</td> +</tr> +<tr><td><code>certData</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]byte</code> +</td> +<td> + <!-- + CertData holds PEM-encoded bytes (typically read from a client certificate file). +CertData takes precedence over CertFile + --> + <code>certData</code> 包含 PEM 编码的字节流（通常从某客户端证书文件读入）。 +此字段优先级高于 certFile 字段。 +</td> +</tr> +<tr><td><code>keyData</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]byte</code> +</td> +<td> + <!-- + KeyData holds PEM-encoded bytes (typically read from a client certificate key file). +KeyData takes precedence over KeyFile + --> + <code>keyData</code> 包含 PEM 编码的字节流（通常从某客户端证书秘钥文件读入）。 +此字段优先级高于 keyFile 字段。 +</td> +</tr> +<tr><td><code>caData</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]byte</code> +</td> +<td> + <!-- + CAData holds PEM-encoded bytes (typically read from a root certificates bundle). +CAData takes precedence over CAFile + --> + <code>caData</code> 包含 PEM 编码的字节流（通常从某根证书包文件读入）。 +此字段优先级高于 caFile 字段。 +</td> +</tr> +</tbody> +</table> + +## `KubeSchedulerProfile` {#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +<!-- +KubeSchedulerProfile is a scheduling profile. +--> +KubeSchedulerProfile 是一个调度方案。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>schedulerName</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + schedulername is the name of the scheduler associated to this profile. +if schedulername matches with the pod's "spec.schedulername", then the pod +is scheduled with this profile. + --> + <code>schedulerName</code> 是与此调度方案相关联的调度器的名称。 +如果 <code>schedulerName</code> 与 Pod 的 <code>spec.schedulerName</code> +匹配，则该 Pod 会使用此方案来调度。 +</td> +</tr> +<tr><td><code>plugins</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-Plugins"><code>Plugins</code></a> +</td> +<td> + <!-- + Plugins specify the set of plugins that should be enabled or disabled. +Enabled plugins are the ones that should be enabled in addition to the +default plugins. Disabled plugins are any of the default plugins that +should be disabled. +When no enabled or disabled plugin is specified for an extension point, +default plugins for that extension point will be used if there is any. +If a QueueSort plugin is specified, the same QueueSort Plugin and +PluginConfig must be specified for all profiles. + --> + <p><code>plugins</code> 设置一组应该被启用或禁止的插件。 +被启用的插件是指除了默认插件之外需要被启用的插件。被禁止的插件 +是指需要被禁用的默认插件。</p> + <p>如果针对某个扩展点没有设置被启用或被禁止的插件，则使用该扩展点 +的默认插件（如果有的话）。如果设置了 QueueSort 插件，则同一个 QueueSort +插件和 <code>pluginConfig</code> 要被设置到所有调度方案之上。</p> +</td> +</tr> +<tr><td><code>pluginConfig</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginConfig"><code>[]PluginConfig</code></a> +</td> +<td> + <!-- + PluginConfig is an optional set of custom plugin arguments for each plugin. +Omitting config args for a plugin is equivalent to using the default config +for that plugin. + --> + <code>pluginConfig</code> 是为每个插件提供的一组可选的定制插件参数。 +如果忽略了插件的配置参数，则意味着使用该插件的默认配置。 +</td> +</td> +</tr> +</tbody> +</table> + +## `Plugin` {#kubescheduler-config-k8s-io-v1beta2-Plugin} + +<!-- +**Appears in:** +--> +**出现在：** + +- [PluginSet](#kubescheduler-config-k8s-io-v1beta2-PluginSet) + +<!-- +Plugin specifies a plugin name and its weight when applicable. Weight is used only for Score plugins. +--> +Plugin 指定插件的名称及其权重（如果适用的话）。权重仅用于评分（Score）插件。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Name defines the name of plugin + --> + 插件的名称。 +</td> +</tr> +<tr><td><code>weight</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + Weight defines the weight of plugin, only used for Score plugins. + --> + 插件的权重；仅适用于评分（Score）插件。 +</td> +</tr> +</tbody> +</table> + +## `PluginConfig` {#kubescheduler-config-k8s-io-v1beta2-PluginConfig} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile) + +<!-- +PluginConfig specifies arguments that should be passed to a plugin at the time of initialization. +A plugin that is invoked at multiple extension points is initialized once. Args can have arbitrary structure. +It is up to the plugin to process these Args. +--> +PluginConfig 给出初始化阶段要传递给插件的参数。 +在多个扩展点被调用的插件仅会被初始化一次。 +参数可以是任意结构。插件负责处理这里所传的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Name defines the name of plugin being configured + --> + <code>name</code> 是所配置的插件的名称。 +</td> +</tr> +<tr><td><code>args</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/runtime/#RawExtension"><code>k8s.io/apimachinery/pkg/runtime.RawExtension</code></a> +</td> +<td> + <!-- + Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure. + --> + <code>args</code> 定义在初始化阶段要传递给插件的参数。参数可以为任意结构。 +</td> +</tr> +</tbody> +</table> + +## `PluginSet` {#kubescheduler-config-k8s-io-v1beta2-PluginSet} + +<!-- +**Appears in:** +--> +**出现在：** + +- [Plugins](#kubescheduler-config-k8s-io-v1beta2-Plugins) + +<!-- +PluginSet specifies enabled and disabled plugins for an extension point. +If an array is empty, missing, or nil, default plugins at that extension point will be used. +--> +PluginSet 为某扩展点设置要启用或禁用的插件。 +如果数组为空，或者取值为 null，则使用该扩展点的默认插件集合。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>enabled</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-Plugin"><code>[]Plugin</code></a> +</td> +<td> + <!-- + Enabled specifies plugins that should be enabled in addition to default plugins. +If the default plugin is also configured in the scheduler config file, the weight of plugin will +be overridden accordingly. +These are called after default plugins and in the same order specified here. + --> + <code>enabled</code> 设置在默认插件之外要启用的插件。如果在调度器的配置 +文件中也配置了默认插件，则对应插件的权重会被覆盖。 +此处所设置的插件会在默认插件之后被调用，调用顺序与数组中元素顺序相同。 +</td> +</tr> +<tr><td><code>disabled</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-Plugin"><code>[]Plugin</code></a> +</td> +<td> + <!-- + Disabled specifies default plugins that should be disabled. +When all default plugins need to be disabled, an array containing only one "∗" should be provided. + --> + <code>disabled</code> 设置要被禁用的默认插件。 +如果需要禁用所有的默认插件，应该提供仅包含一个元素 "∗" 的数组。 +</td> +</tr> +</tbody> +</table> + +## `Plugins` {#kubescheduler-config-k8s-io-v1beta2-Plugins} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile) + +<!-- +Plugins include multiple extension points. When specified, the list of plugins for +a particular extension point are the only ones enabled. If an extension point is +omitted from the config, then the default set of plugins is used for that extension point. +Enabled plugins are called in the order specified here, after default plugins. If they need to +be invoked before default plugins, default plugins must be disabled and re-enabled here in desired order. +--> +Plugins 结构中包含多个扩展点。当此结构被设置时，针对特定扩展点所启用 +的所有插件都在这一列表中。 +如果配置中不包含某个扩展点，则使用该扩展点的默认插件集合。 +被启用的插件的调用顺序与这里指定的顺序相同，都在默认插件之后调用。 +如果它们需要在默认插件之前调用，则需要先行禁止默认插件，之后在这里 +按期望的顺序重新启用。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>queueSort</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue. + --> + <code>queueSort</code> 是一个在对调度队列中 Pod 排序时要调用的插件列表。 +</td> +</tr> +<tr><td><code>preFilter</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework. + --> + <code>preFilter</code> 是一个在调度框架中“PreFilter（预过滤）”扩展点上要 +调用的插件列表。 +</td> +</tr> +<tr><td><code>filter</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod. + --> + <code>filter</code> 是一个在需要过滤掉无法运行 Pod 的节点时被调用的插件列表。 +</td> +</tr> +<tr><td><code>postFilter</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + PostFilter is a list of plugins that are invoked after filtering phase, but only when no feasible nodes were found for the pod. + --> + <code>postFilter</code> 是一个在过滤阶段结束后会被调用的插件列表； +这里的插件只有在找不到合适的节点来运行 Pod 时才会被调用。 +</td> +</tr> +<tr><td><code>preScore</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + PreScore is a list of plugins that are invoked before scoring. + --> + <code>preScore</code> 是一个在打分之前要调用的插件列表。 +</td> +</tr> +<tr><td><code>score</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase. + --> + <code>score</code> 是一个在对已经通过过滤阶段的节点进行排序时调用的插件的列表。 +</td> +</tr> +<tr><td><code>reserve</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + Reserve is a list of plugins invoked when reserving/unreserving resources +after a node is assigned to run the pod. + --> + <code>reserve</code> 是一组在运行 Pod 的节点已被选定后，需要预留或者释放资源时调用的插件的列表。 +</td> +</tr> +<tr><td><code>permit</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod. + --> + <code>permit</code> 是一个用来控制 Pod 绑定关系的插件列表。这些插件可以 +禁止或者延迟 Pod 的绑定。 +</td> +</tr> +<tr><td><code>preBind</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + PreBind is a list of plugins that should be invoked before a pod is bound. + --> + <code>preBind</code> 是一个在 Pod 被绑定到某节点之前要被调用的插件的列表。 +</td> +</tr> +<tr><td><code>bind</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. +The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success. + --> + <code>bind</code> 是一个在调度框架中“Bind（绑定）”扩展点上要调用的 +插件的列表。调度器按顺序调用这些插件。只要其中某个插件返回成功，则调度器 +就略过余下的插件。 +</td> +</tr> +<tr><td><code>postBind</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + PostBind is a list of plugins that should be invoked after a pod is successfully bound. + --> + <code>postBind</code> 是一个在 Pod 已经被成功绑定之后要调用的插件的列表。 +</td> +</tr> +<tr><td><code>multiPoint</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + MultiPoint is a simplified config section to enable plugins for all valid extension points. + --> + <p><code>multiPoint</code> 是一个简化的配置段落，用来为所有合法的扩展点启用插件。 +</td> +</tr> +</tbody> +</table> + +## `PodTopologySpreadConstraintsDefaulting` {#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadConstraintsDefaulting} + + <!-- +(Alias of `string`) + +**Appears in:** +--> +（`string` 类型的别名） + +**出现在：** + +- [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadArgs) + +<!-- +PodTopologySpreadConstraintsDefaulting defines how to set default constraints +for the PodTopologySpread plugin. +--> +PodTopologySpreadConstraintsDefaulting 定义如何为 PodTopologySpread 插件 +设置默认的约束。 + +## `RequestedToCapacityRatioParam` {#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioParam} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) + +<!-- +RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters +--> +RequestedToCapacityRatioParam 结构定义 RequestedToCapacityRatio 的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>shape</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-UtilizationShapePoint"><code>[]UtilizationShapePoint</code></a> +</td> +<td> + <!-- + Shape is a list of points defining the scoring function shape. + --> + <code>shape</code> 是一个定义评分函数曲线的计分点的列表。 +</td> +</tr> +</tbody> +</table> + +## `ResourceSpec` {#kubescheduler-config-k8s-io-v1beta2-ResourceSpec} + +<!-- +**Appears in:** +--> +**出现在：** + +- [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesBalancedAllocationArgs) +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) + +<!-- +ResourceSpec represents a single resource. +--> +ResourceSpec 用来代表某个资源。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Name of the resource. + --> + 资源名称。 +</td> +</tr> +<tr><td><code>weight</code> <B><!--[Required]-->[必需]</B><br/> +<code>int64</code> +</td> +<td> + <!-- + Weight of the resource. + --> + 资源权重。 +</td> +</tr> +</tbody> +</table> + +## `ScoringStrategy` {#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy} + +<!-- +**Appears in:** +--> +**出现在：** + +- [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesFitArgs) + +<!-- +ScoringStrategy define ScoringStrategyType for node resource plugin +--> +ScoringStrategy 为节点资源插件定义 ScoringStrategyType。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>type</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-ScoringStrategyType"><code>ScoringStrategyType</code></a> +</td> +<td> + <!-- + Type selects which strategy to run. + --> + <code>type</code> 用来选择要运行的策略。 +</td> +</tr> +<tr><td><code>resources</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-ResourceSpec"><code>[]ResourceSpec</code></a> +</td> +<td> + <!-- + Resources to consider when scoring. +The default resource set includes "cpu" and "memory" with an equal weight. +Allowed weights go from 1 to 100. +Weight defaults to 1 if not specified or explicitly set to 0. + --> + <p><code>resources</code> 设置在评分时要考虑的资源。</p> + <p>默认的资源集合包含 "cpu" 和 "memory"，且二者权重相同。</p> + <p>权重的取值范围为 1 到 100。</p> + <p>当权重未设置或者显式设置为 0 时，意味着使用默认值 1。</p> +</td> +</tr> +<tr><td><code>requestedToCapacityRatio</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioParam"><code>RequestedToCapacityRatioParam</code></a> +</td> +<td> + <!-- + Arguments specific to RequestedToCapacityRatio strategy. + --> + 特定于 RequestedToCapacityRatio 策略的参数。 +</td> +</tr> +</tbody> +</table> + +## `ScoringStrategyType` {#kubescheduler-config-k8s-io-v1beta2-ScoringStrategyType} + + <!-- +(Alias of `string`) + +**Appears in:** +--> +（`string` 数据类型的别名） + +**出现在：** + +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) + +<!-- +ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin. +--> +ScoringStrategyType 是 NodeResourcesFit 插件所使用的的评分策略类型。 + +## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1beta2-UtilizationShapePoint} + +<!-- +**Appears in:** +--> +**出现在：** + +- [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta2-VolumeBindingArgs) +- [RequestedToCapacityRatioParam](#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioParam) + +<!-- +UtilizationShapePoint represents single point of priority function shape. +--> +UtilizationShapePoint 代表的是优先级函数曲线中的一个评分点。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>utilization</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100. + --> + 利用率（x 轴）。合法值为 0 到 100。完全被利用的节点映射到 100。 +</td> +</tr> +<tr><td><code>score</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + Score assigned to given utilization (y axis). Valid values are 0 to 10. + --> + 分配给指定利用率的分值（y 轴）。合法值为 0 到 10。 +</td> +</tr> +</tbody> +</table> + +## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +<!-- +ClientConnectionConfiguration contains details for constructing a client. +--> +ClientConnectionConfiguration 中包含用来构造一个客户端所需的细节。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>kubeconfig</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + kubeconfig is the path to a KubeConfig file. + --> + 此字段为指向某 KubeConfig 文件的路径。 +</td> +</tr> +<tr><td><code>acceptContentTypes</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the +default value of 'application/json'. This field will control all connections to the server used by a particular client. + --> + <code>acceptContentTypes</code> 定义的是客户端与服务器建立连接时要发送的 +Accept 头部；这里的设置值会覆盖默认值 "application/json"。 +此字段会影响某特定客户端与服务器的所有连接。 +</td> +</tr> +<tr><td><code>contentType</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + contentType is the content type used when sending data to the server from this client. + --> + <code>contentType</code> 包含的是此客户端向服务器发送数据时使用的 +内容类型（Content Type）。 +</td> +</tr> +<tr><td><code>qps</code> <B><!--[Required]-->[必需]</B><br/> +<code>float32</code> +</td> +<td> + <!-- + qps controls the number of queries per second allowed for this connection. + --> + <code>qps</code> 控制的是此连接上每秒可以发送的查询个数。 +</td> +</tr> +<tr><td><code>burst</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + burst allows extra queries to accumulate when a client is exceeding its rate. + --> + <code>burst</code> 允许在客户端超出其速率限制时可以累积的额外查询个数。 +</td> +</tr> +</tbody> +</table> + +## `DebuggingConfiguration` {#DebuggingConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +<!-- +DebuggingConfiguration holds configuration for Debugging related features. +--> +DebuggingConfiguration 保存与调试功能相关的配置。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>enableProfiling</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + enableProfiling enables profiling via web interface host:port/debug/pprof/ + --> + 此字段允许通过 Web 接口 host:port/debug/pprof/ 执行性能分析。 +</td> +</tr> +<tr><td><code>enableContentionProfiling</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + enableContentionProfiling enables lock contention profiling, if +enableProfiling is true. + --> + 此字段在 <code>enableProfiling</code> 为 true 时允许执行锁竞争分析。 +</td> +</tr> +</tbody> +</table> + +## `FormatOptions` {#FormatOptions} + +<!-- +**Appears in:** +--> + +<!-- +FormatOptions contains options for the different logging formats. +--> +FormatOptions 中包含不同日志格式的配置选项。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>json</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#JSONOptions"><code>JSONOptions</code></a> +</td> +<td> + <!-- + [Experimental] JSON contains options for logging format "json". + --> + [实验特性] <code>json</code> 字段包含为 "json" 日志格式提供的配置选项。 +</td> +</tr> +</tbody> +</table> + +## `JSONOptions` {#JSONOptions} + +<!-- +**Appears in:** +--> +**出现在：** + +- [FormatOptions](#FormatOptions) + +<!-- +JSONOptions contains options for logging format "json". +--> +JSONOptions 包含为 "json" 日志格式所设置的配置选项。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>splitStream</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + [Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering. + --> + [实验特性] 此字段将错误信息重定向到标准错误输出（stderr），将提示消息 +重定向到标准输出（stdout），并且支持缓存。默认配置为将二者都输出到 +标准输出（stdout），且不提供缓存。 +</td> +</tr> +<tr><td><code>infoBufferSize</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/api/resource#QuantityValue"><code>k8s.io/apimachinery/pkg/api/resource.QuantityValue</code></a> +</td> +<td> + <!-- + [Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering. + --> + [实验特性] <code>infoBufferSize</code> 用来在分离数据流场景是设置提示 +信息数据流的大小。默认值为 0，意味着禁止缓存。 +</td> +</tr> +</tbody> +</table> + +## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +<!-- +LeaderElectionConfiguration defines the configuration of leader election +clients for components that can run with leader election enabled. +--> +LeaderElectionConfiguration 为能够支持领导者选举的组件定义其领导者选举 +客户端的配置。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>leaderElect</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + leaderElect enables a leader election client to gain leadership +before executing the main loop. Enable this when running replicated +components for high availability. + --> + <code>leaderElect</code> 启用领导者选举客户端，从而在进入主循环执行之前 +先要获得领导者角色。当运行多副本组件时启用此功能有助于提高可用性。 +</td> +</tr> +<tr><td><code>leaseDuration</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <!-- + leaseDuration is the duration that non-leader candidates will wait +after observing a leadership renewal until attempting to acquire +leadership of a led but unrenewed leader slot. This is effectively the +maximum duration that a leader can be stopped before it is replaced +by another candidate. This is only applicable if leader election is +enabled. + --> + <code>leaseDuration</code> 是非领导角色候选者在观察到需要领导席位更新时 +要等待的时间；只有经过所设置时长才可以尝试去获得一个仍处于领导状态但需要 +被刷新的席位。这里的设置值本质上意味着某个领导者在被另一个候选者替换掉 +之前可以停止运行的最长时长。只有当启用了领导者选举时此字段有意义。 +</td> +</tr> +<tr><td><code>renewDeadline</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <!-- + renewDeadline is the interval between attempts by the acting master to +renew a leadership slot before it stops leading. This must be less +than or equal to the lease duration. This is only applicable if leader +election is enabled. + --> + <code>renewDeadline</code> 设置的是当前领导者在停止扮演领导角色之前 +需要刷新领导状态的时间间隔。此值必须小于或等于租约期限的长度。 +只有到启用了领导者选举时此字段才有意义。 +</td> +</tr> +<tr><td><code>retryPeriod</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <!-- + retryPeriod is the duration the clients should wait between attempting +acquisition and renewal of a leadership. This is only applicable if +leader election is enabled. + --> + <code>retryPeriod</code> 是客户端在连续两次尝试获得或者刷新领导状态 +之间需要等待的时长。只有当启用了领导者选举时此字段才有意义。 +</td> +</tr> +<tr><td><code>resourceLock</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + resourceLock indicates the resource object type that will be used to lock +during leader election cycles. + --> + 此字段给出在领导者选举期间要作为锁来使用的资源对象类型。 +</td> +</tr> +<tr><td><code>resourceName</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + resourceName indicates the name of resource object that will be used to lock +during leader election cycles. + --> + 此字段给出在领导者选举期间要作为锁来使用的资源对象名称。 +</td> +</tr> +<tr><td><code>resourceNamespace</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + resourceName indicates the namespace of resource object that will be used to lock +during leader election cycles. + --> + 此字段给出在领导者选举期间要作为锁来使用的资源对象所在名字空间。 +</td> +</tr> +</tbody> +</table> + +## `VModuleConfiguration` {#VModuleConfiguration} + + <!-- +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + +**Appears in:** +--> +（`[]k8s.io/component-base/config/v1alpha1.VModuleItem` 的别名) + +<!-- +VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold. +--> +VModuleConfiguration 是一组文件名（通配符）及其对应的日志详尽程度阈值。 + From 4efe336440bb00f625c7481ae40a594b53cb4ada Mon Sep 17 00:00:00 2001 From: Shivam Singhal <shivams2799@gmail.com> Date: Fri, 11 Feb 2022 16:26:53 +0200 Subject: [PATCH 027/104] [de] Fix broken links due to using githubbranch param --- content/de/docs/concepts/overview/what-is-kubernetes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/de/docs/concepts/overview/what-is-kubernetes.md b/content/de/docs/concepts/overview/what-is-kubernetes.md index 66b79d6928..2480e24e5a 100644 --- a/content/de/docs/concepts/overview/what-is-kubernetes.md +++ b/content/de/docs/concepts/overview/what-is-kubernetes.md @@ -50,7 +50,7 @@ für Managementtools zu bieten, den Status von Kontrollpunkten zu ermitteln. Darüber hinaus basiert die [Kubernetes-Steuerungsebene](/docs/concepts/overview/components/) auf den gleichen APIs, die Entwicklern und Anwendern zur Verfügung stehen. Benutzer können ihre eigenen Controller, wie z.B. -[Scheduler](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/devel/scheduler.md), mit +[Scheduler](https://github.com/kubernetes/community/blob/master/contributors/devel/scheduler.md), mit ihren [eigenen APIs](/docs/concepts/api-extension/custom-resources/) schreiben, die von einem universellen [Kommandozeilen-Tool](/docs/user-guide/kubectl-overview/) angesprochen werden können. From 88fae789bd137f5319797197c07eec09fc4431ef Mon Sep 17 00:00:00 2001 From: Vedant Koditkar <vedant.koditkar@outlook.com> Date: Tue, 15 Feb 2022 12:23:47 +0530 Subject: [PATCH 028/104] Update hyperlinks to point to main branch --- content/de/docs/contribute/localization.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/content/de/docs/contribute/localization.md b/content/de/docs/contribute/localization.md index d40f941776..0d1259b0ad 100644 --- a/content/de/docs/contribute/localization.md +++ b/content/de/docs/contribute/localization.md @@ -213,7 +213,7 @@ Die neueste Version ist {{< latest-version >}}, so dass der neueste Versionszwei ### Seitenverlinkung in der Internationalisierung -Lokalisierungen müssen den Inhalt von [`i18n/de.toml`](https://github.com/kubernetes/website/blob/master/i18n/en.toml) in einer neuen sprachspezifischen Datei enthalten. Als Beispiel: `i18n/de.toml`. +Lokalisierungen müssen den Inhalt von [`i18n/de.toml`](https://github.com/kubernetes/website/blob/main/i18n/en.toml) in einer neuen sprachspezifischen Datei enthalten. Als Beispiel: `i18n/de.toml`. Füge eine neue Lokalisierungsdatei zu `i18n/` hinzu. Zum Beispiel mit Deutsch (`de`): @@ -278,7 +278,7 @@ Die Teams müssen den lokalisierten Inhalt in demselben Versionszweig zusammenf Ein Genehmiger muss einen Entwicklungszweig aufrechterhalten, indem er seinen Quellzweig auf dem aktuellen Stand hält und Merge-Konflikte auflöst. Je länger ein Entwicklungszweig geöffnet bleibt, desto mehr Wartung erfordert er in der Regel. Ziehe in Betracht, regelmäßig Entwicklungszweige zusammenzuführen und neue zu eröffnen, anstatt einen extrem lang laufenden Entwicklungszweig zu unterhalten. -Zu Beginn jedes Team-Meilensteins ist es hilfreich, ein Problem [Vergleich der Upstream-Änderungen](https://github.com/kubernetes/website/blob/master/scripts/upstream_changes.py) zwischen dem vorherigen Entwicklungszweig und dem aktuellen Entwicklungszweig zu öffnen. +Zu Beginn jedes Team-Meilensteins ist es hilfreich, ein Problem [Vergleich der Upstream-Änderungen](https://github.com/kubernetes/website/blob/main/scripts/upstream_changes.py) zwischen dem vorherigen Entwicklungszweig und dem aktuellen Entwicklungszweig zu öffnen. Während nur Genehmiger einen neuen Entwicklungszweig eröffnen und Pull-Anfragen zusammenführen können, kann jeder eine Pull-Anfrage für einen neuen Entwicklungszweig eröffnen. Es sind keine besonderen Genehmigungen erforderlich. @@ -301,5 +301,3 @@ Sobald eine Lokalisierung die Anforderungen an den Arbeitsablauf und die Mindest - Die Sprachauswahl auf der Website aktivieren - Die Verfügbarkeit der Lokalisierung über die Kanäle der [Cloud Native Computing Foundation](https://www.cncf.io/about/) (CNCF), einschließlich des [Kubernetes Blogs](https://kubernetes.io/blog/) veröffentlichen. - - From 70827d597006a413cf3d5c451966e9d84cb40d9a Mon Sep 17 00:00:00 2001 From: Arhell <arhell333@gmail.com> Date: Mon, 21 Feb 2022 01:17:11 +0200 Subject: [PATCH 029/104] [id] update schedule --- content/id/examples/application/job/cronjob.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/id/examples/application/job/cronjob.yaml b/content/id/examples/application/job/cronjob.yaml index 34ab2a3f06..5691950410 100644 --- a/content/id/examples/application/job/cronjob.yaml +++ b/content/id/examples/application/job/cronjob.yaml @@ -3,7 +3,7 @@ kind: CronJob metadata: name: hello spec: - schedule: "*/1 * * * *" + schedule: "* * * * *" jobTemplate: spec: template: From 9823ecda09c495b636707f26d8b90682a3019c05 Mon Sep 17 00:00:00 2001 From: Marco Voelz <voelzmo@users.noreply.github.com> Date: Mon, 21 Feb 2022 10:54:50 +0100 Subject: [PATCH 030/104] Update proposal link to point to archive Original link says ``` Design proposals have been archived. To view the last version of this document, see the Design Proposals Archive Repo. Please remove after 2022-04-01 or the release of Kubernetes 1.24, whichever comes first. ``` --- .../docs/tasks/administer-cluster/reserve-compute-resources.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/reserve-compute-resources.md b/content/en/docs/tasks/administer-cluster/reserve-compute-resources.md index 06e4958697..0dd24d3f6e 100644 --- a/content/en/docs/tasks/administer-cluster/reserve-compute-resources.md +++ b/content/en/docs/tasks/administer-cluster/reserve-compute-resources.md @@ -91,7 +91,7 @@ flag. It is recommended that the kubernetes system daemons are placed under a top level control group (`runtime.slice` on systemd machines for example). Each system daemon should ideally run within its own child control group. Refer to -[the design proposal](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md#recommended-cgroups-setup) +[the design proposal](https://git.k8s.io/design-proposals-archive/node/node-allocatable.md#recommended-cgroups-setup) for more details on recommended control group hierarchy. Note that Kubelet **does not** create `--kube-reserved-cgroup` if it doesn't From 8699ee6ff1f591e969b781225691c89a6581d51c Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Sat, 18 Dec 2021 09:42:57 +0800 Subject: [PATCH 031/104] [zh] Translate scheduler config API v1beta3 --- .../kube-scheduler-config.v1beta3.md | 1742 +++++++++++++++++ 1 file changed, 1742 insertions(+) create mode 100644 content/zh/docs/reference/config-api/kube-scheduler-config.v1beta3.md diff --git a/content/zh/docs/reference/config-api/kube-scheduler-config.v1beta3.md b/content/zh/docs/reference/config-api/kube-scheduler-config.v1beta3.md new file mode 100644 index 0000000000..d20017253f --- /dev/null +++ b/content/zh/docs/reference/config-api/kube-scheduler-config.v1beta3.md @@ -0,0 +1,1742 @@ +--- +title: kube-scheduler 配置 (v1beta3) +content_type: tool-reference +package: kubescheduler.config.k8s.io/v1beta3 +auto_generated: true +--- +<!-- +title: kube-scheduler Configuration (v1beta3) +content_type: tool-reference +package: kubescheduler.config.k8s.io/v1beta3 +auto_generated: true +--> + +<!-- +## Resource Types +--> +## 资源类型 + +- [DefaultPreemptionArgs](#kubescheduler-config-k8s-io-v1beta3-DefaultPreemptionArgs) +- [InterPodAffinityArgs](#kubescheduler-config-k8s-io-v1beta3-InterPodAffinityArgs) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) +- [NodeAffinityArgs](#kubescheduler-config-k8s-io-v1beta3-NodeAffinityArgs) +- [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesBalancedAllocationArgs) +- [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesFitArgs) +- [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadArgs) +- [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta3-VolumeBindingArgs) + +## `DefaultPreemptionArgs` {#kubescheduler-config-k8s-io-v1beta3-DefaultPreemptionArgs} + +<!-- +DefaultPreemptionArgs holds arguments used to configure the +DefaultPreemption plugin. +--> +DefaultPreemptionArgs 包含用来配置 DefaultPreemption 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta3</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>DefaultPreemptionArgs</code></td></tr> + +<tr><td><code>minCandidateNodesPercentage</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + MinCandidateNodesPercentage is the minimum number of candidates to +shortlist when dry running preemption as a percentage of number of nodes. +Must be in the range [0, 100]. Defaults to 10% of the cluster size if +unspecified. + --> + 此字段为试运行抢占时 shortlist 中候选节点数的下限，数值为节点数的百分比。 +字段值必须介于 [0, 100] 之间。未指定时默认值为整个集群规模的 10%。 +</td> +</tr> +<tr><td><code>minCandidateNodesAbsolute</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + MinCandidateNodesAbsolute is the absolute minimum number of candidates to +shortlist. The likely number of candidates enumerated for dry running +preemption is given by the formula: +numCandidates = max(numNodes ∗ minCandidateNodesPercentage, minCandidateNodesAbsolute) +We say "likely" because there are other factors such as PDB violations +that play a role in the number of candidates shortlisted. Must be at least +0 nodes. Defaults to 100 nodes if unspecified. + --> + 此字段设置 shortlist 中候选节点的绝对下限。用于试运行抢占而列举的 +候选节点个数近似于通过下面的公式计算的：<br/> +候选节点数 = max(节点数 * minCandidateNodesPercentage, minCandidateNodesAbsolute) +之所以说是“近似于”是因为存在一些类似于 PDB 违例这种因素，会影响到进入 shortlist +中候选节点的个数。取值至少为 0 节点。若未设置默认为 100 节点。 +</td> +</tr> +</tbody> +</table> + +## `InterPodAffinityArgs` {#kubescheduler-config-k8s-io-v1beta3-InterPodAffinityArgs} + +<!-- +InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plugin. +--> +InterPodAffinityArgs 包含用来配置 InterPodAffinity 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta3</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>InterPodAffinityArgs</code></td></tr> + +<tr><td><code>hardPodAffinityWeight</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + HardPodAffinityWeight is the scoring weight for existing pods with a +matching hard affinity to the incoming pod. + --> + 此字段是一个计分权重值。针对新增的 Pod，要对现存的、带有与新 Pod 匹配的 +硬性亲和性设置的 Pods 计算亲和性得分。 +</td> +</tr> +</tbody> +</table> + +## `KubeSchedulerConfiguration` {#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration} + +<!-- +KubeSchedulerConfiguration configures a scheduler +--> +KubeSchedulerConfiguration 用来配置调度器。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta3</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>KubeSchedulerConfiguration</code></td></tr> + +<tr><td><code>parallelism</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16 + --> + 此字段设置为调度 Pod 而执行算法时的并发度。此值必须大于 0。 +默认值为 16。 +</td> +</tr> +<tr><td><code>leaderElection</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#LeaderElectionConfiguration"><code>LeaderElectionConfiguration</code></a> +</td> +<td> + <!-- + LeaderElection defines the configuration of leader election client. + --> + 此字段用来定义领导者选举客户端的配置。 +</td> +</tr> +<tr><td><code>clientConnection</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#ClientConnectionConfiguration"><code>ClientConnectionConfiguration</code></a> +</td> +<td> + <!-- + ClientConnection specifies the kubeconfig file and client connection +settings for the proxy server to use when communicating with the apiserver. + --> + 此字段为与 API 服务器通信时使用的代理服务器设置 kubeconfig 文件和客户端 +连接配置。 +</td> +</tr> +<tr><td><code>DebuggingConfiguration</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#DebuggingConfiguration"><code>DebuggingConfiguration</code></a> +</td> +<td>（<code>DebuggingConfiguration</code> 的成员被内嵌到此类型中） + <!-- + DebuggingConfiguration holds configuration for Debugging related features + --> + 此字段设置与调试相关功能特性的配置。 +</td> +</tr> +<tr><td><code>percentageOfNodesToScore</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + PercentageOfNodesToScore is the percentage of all nodes that once found feasible +for running a pod, the scheduler stops its search for more feasible nodes in +the cluster. This helps improve scheduler's performance. Scheduler always tries to find +at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. +Example: if the cluster size is 500 nodes and the value of this flag is 30, +then scheduler stops finding further feasible nodes once it finds 150 feasible ones. +When the value is 0, default percentage (5%--50% based on the size of the cluster) of the +nodes will be scored. + --> + 此字段为所有节点的百分比，一旦调度器找到所设置比例的、能够运行 Pod 的节点， +则停止在集群中继续寻找更合适的节点。这一配置有助于提高调度器的性能。调度器 +总会尝试寻找至少 "minFeasibleNodesToFind" 个可行节点，无论此字段的取值如何。 +例如：当集群规模为 500 个节点，而此字段的取值为 30，则调度器在找到 150 个合适 +的节点后会停止继续寻找合适的节点。当此值为 0 时，调度器会使用默认节点数百分比（基于集群规模 +确定的值，在 5% 到 50% 之间）来执行打分操作。 +</td> +</tr> +<tr><td><code>podInitialBackoffSeconds</code> <B><!--[Required]-->[必需]</B><br/> +<code>int64</code> +</td> +<td> + <!-- + PodInitialBackoffSeconds is the initial backoff for unschedulable pods. +If specified, it must be greater than 0. If this value is null, the default value (1s) +will be used. + --> + 此字段设置不可调度 Pod 的初始回退秒数。如果设置了此字段，其取值必须大于零。 +若此值为 null，则使用默认值（1s）。 +</td> +</tr> +<tr><td><code>podMaxBackoffSeconds</code> <B><!--[Required]-->[必需]</B><br/> +<code>int64</code> +</td> +<td> + <!-- + PodMaxBackoffSeconds is the max backoff for unschedulable pods. +If specified, it must be greater than podInitialBackoffSeconds. If this value is null, +the default value (10s) will be used. + --> + 此字段设置不可调度的 Pod 的最大回退秒数。如果设置了此字段，则其值必须大于 +podInitialBackoffSeconds 字段值。如果此值设置为 null，则使用默认值（10s）。 +</td> +</tr> +<tr><td><code>profiles</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile"><code>[]KubeSchedulerProfile</code></a> +</td> +<td> + <!-- + Profiles are scheduling profiles that kube-scheduler supports. Pods can +choose to be scheduled under a particular profile by setting its associated +scheduler name. Pods that don't specify any scheduler name are scheduled +with the "default-scheduler" profile, if present here. + --> + 此字段为 kube-scheduler 所支持的方案（profiles）。Pod 可以通过设置其对应 +的调度器名称来选择使用特定的方案。未指定调度器名称的 Pod 会使用 +“default-scheduler”方案来调度，如果存在的话。 +</td> +</tr> +<tr><td><code>extenders</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-Extender"><code>[]Extender</code></a> +</td> +<td> + <!-- + Extenders are the list of scheduler extenders, each holding the values of how to communicate +with the extender. These extenders are shared by all scheduler profiles. + --> + 此字段为调度器扩展模块（Extender）的列表，每个元素包含如何与某扩展模块 +通信的配置信息。所有调度器模仿会共享此扩展模块列表。 +</td> +</tr> +</tbody> +</table> + +## `NodeAffinityArgs` {#kubescheduler-config-k8s-io-v1beta3-NodeAffinityArgs} + +<!-- +NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. +--> +NodeAffinityArgs 中包含配置 NodeAffinity 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta3</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>NodeAffinityArgs</code></td></tr> + +<tr><td><code>addedAffinity</code><br/> +<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#nodeaffinity-v1-core"><code>core/v1.NodeAffinity</code></a> +</td> +<td> + <!-- + AddedAffinity is applied to all Pods additionally to the NodeAffinity +specified in the PodSpec. That is, Nodes need to satisfy AddedAffinity +AND .spec.NodeAffinity. AddedAffinity is empty by default (all Nodes +match). +When AddedAffinity is used, some Pods with affinity requirements that match +a specific Node (such as Daemonset Pods) might remain unschedulable. + --> + <code>addedAffinity</code> 会作为附加的亲和性属性添加到所有 Pod 的 +规约中指定的 NodeAffinity 中。换言之，节点需要同时满足 addedAffinity +和 .spec.nodeAffinity。默认情况下，addedAffinity 为空（与所有节点匹配）。 +使用了 addedAffinity 时，某些带有已经能够与某特定节点匹配的亲和性需求 +的 Pod （例如 DaemonSet Pod）可能会继续呈现不可调度状态。 +</td> +</tr> +</tbody> +</table> + +## `NodeResourcesBalancedAllocationArgs` {#kubescheduler-config-k8s-io-v1beta3-NodeResourcesBalancedAllocationArgs} + +<!-- +NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResourcesBalancedAllocation plugin. +--> +NodeResourcesBalancedAllocationArgs 包含用来配置 NodeResourcesBalancedAllocation 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta3</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>NodeResourcesBalancedAllocationArgs</code></td></tr> + +<tr><td><code>resources</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-ResourceSpec"><code>[]ResourceSpec</code></a> +</td> +<td> + <!-- + Resources to be managed, the default is "cpu" and "memory" if not specified. + --> + 要管理的资源；如果未设置，则默认值为 "cpu" 和 "memory"。 +</td> +</tr> +</tbody> +</table> + +## `NodeResourcesFitArgs` {#kubescheduler-config-k8s-io-v1beta3-NodeResourcesFitArgs} + +<!-- +NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plugin. +--> +NodeResourcesFitArgs 包含用来配置 NodeResourcesFit 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta3</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>NodeResourcesFitArgs</code></td></tr> + +<tr><td><code>ignoredResources</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!-- + IgnoredResources is the list of resources that NodeResources fit filter +should ignore. This doesn't apply to scoring. + --> + 此字段为 NodeResources 匹配过滤器要忽略的资源列表。此列表不影响节点打分。 +</td> +</tr> +<tr><td><code>ignoredResourceGroups</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <!-- + IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. +e.g. if group is ["example.com"], it will ignore all resource names that begin +with "example.com", such as "example.com/aaa" and "example.com/bbb". +A resource group name can't contain '/'. This doesn't apply to scoring. + --> + 此字段定义 NodeResources 匹配过滤器要忽略的资源组列表。 +例如，如果配置值为 ["example.com"]，则以 "example.com" 开头的资源名（如 +"example.com/aaa" 和 "example.com/bbb"）都会被忽略。 +资源组名称中不可以包含 '/'。此设置不影响节点的打分。 +</td> +</tr> +<tr><td><code>scoringStrategy</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy"><code>ScoringStrategy</code></a> +</td> +<td> + <!-- + ScoringStrategy selects the node resource scoring strategy. +The default strategy is LeastAllocated with an equal "cpu" and "memory" weight. + --> + 此字段用来选择节点资源打分策略。默认的策略为 LeastAllocated，且 "cpu" 和 +"memory" 的权重相同。 +</td> +</tr> +</tbody> +</table> + +## `PodTopologySpreadArgs` {#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadArgs} + +<!-- +PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread plugin. +--> +PodTopologySpreadArgs 包含用来配置 PodTopologySpread 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta3</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>PodTopologySpreadArgs</code></td></tr> + +<tr><td><code>defaultConstraints</code><br/> +<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#topologyspreadconstraint-v1-core"><code>[]core/v1.TopologySpreadConstraint</code></a> +</td> +<td> + <!-- + DefaultConstraints defines topology spread constraints to be applied to +Pods that don't define any in `pod.spec.topologySpreadConstraints`. +`.defaultConstraints[∗].labelSelectors` must be empty, as they are +deduced from the Pod's membership to Services, ReplicationControllers, +ReplicaSets or StatefulSets. +When not empty, .defaultingType must be "List". + --> + 此字段针对未定义 <code>.spec.topologySpreadConstraints</code> 的 Pod， +为其提供拓扑分布约束。<code>.defaultConstraints[∗].labelSelectors</code> +必须为空，因为这一信息要从 Pod 所属的 Service、ReplicationController、 +ReplicaSet 或 StatefulSet 来推导。 +此字段不为空时，<code>.defaultingType</code> 必须为 "List"。 +</td> +</tr> +<tr><td><code>defaultingType</code><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadConstraintsDefaulting"><code>PodTopologySpreadConstraintsDefaulting</code></a> +</td> +<td> + <!-- + DefaultingType determines how .defaultConstraints are deduced. Can be one +of "System" or "List". +- "System": Use kubernetes defined constraints that spread Pods among + Nodes and Zones. +- "List": Use constraints defined in .defaultConstraints. +Defaults to "List" if feature gate DefaultPodTopologySpread is disabled +and to "System" if enabled. + --> + <p><code>defaultingType</code> 决定如何推导 <code>.defaultConstraints</code>。 +可选值为 "System" 或 "List"。</p> + <ul> + <li>"System"：使用 Kubernetes 定义的约束，将 Pod 分布到不同节点和可用区；</li> + <li>"List"：使用 <code>.defaultConstraints</code> 中定义的约束。</li> + </ul> + <p>当特性门控 DefaultPodTopologySpread 被禁用时，默认值为 "list"；反之，默认值为 "System"。</p> +</td> +</tr> +</tbody> +</table> + +## `VolumeBindingArgs` {#kubescheduler-config-k8s-io-v1beta3-VolumeBindingArgs} + +<!-- +VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin. +--> +VolumeBindingArgs 包含用来配置 VolumeBinding 插件的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>kubescheduler.config.k8s.io/v1beta3</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>VolumeBindingArgs</code></td></tr> + +<tr><td><code>bindTimeoutSeconds</code> <B><!--[Required]-->[必需]</B><br/> +<code>int64</code> +</td> +<td> + <!-- + BindTimeoutSeconds is the timeout in seconds in volume binding operation. +Value must be non-negative integer. The value zero indicates no waiting. +If this value is nil, the default value (600) will be used. + --> + 此字段设置卷绑定操作的超时秒数。字段值必须是非负数。 +取值为 0 意味着不等待。如果此值为 null，则使用默认值（600）。 +</td> +</tr> +<tr><td><code>shape</code><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-UtilizationShapePoint"><code>[]UtilizationShapePoint</code></a> +</td> +<td> + <!-- + Shape specifies the points defining the score function shape, which is +used to score nodes based on the utilization of statically provisioned +PVs. The utilization is calculated by dividing the total requested +storage of the pod by the total capacity of feasible PVs on each node. +Each point contains utilization (ranges from 0 to 100) and its +associated score (ranges from 0 to 10). You can turn the priority by +specifying different scores for different utilization numbers. +The default shape points are: +1) 0 for 0 utilization +2) 10 for 100 utilization +All points must be sorted in increasing order by utilization. + --> + <p><code>shape</code> 用来设置打分函数曲线所使用的计分点，这些计分点 +用来基于静态制备的 PV 卷的利用率为节点打分。 +卷的利用率是计算得来的，将 Pod 所请求的总的存储空间大小除以每个节点 +上可用的总的卷容量。每个计分点包含利用率（范围从 0 到 100）和其对应 +的得分（范围从 0 到 10）。你可以通过为不同的使用率值设置不同的得分来 +反转优先级：</p> + <p>默认的曲线计分点为：</p> + <ul> + <li>利用率为 0 时得分为 0；</li> + <li>利用率为 100 时得分为 10。</li> + </ul> + <p>所有计分点必须按利用率值的升序来排序。</p> +</td> +</tr> +</tbody> +</table> + +## `Extender` {#kubescheduler-config-k8s-io-v1beta3-Extender} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + +<!-- +Extender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, +it is assumed that the extender chose not to provide that extension. +--> +Extender 包含与扩展模块（Extender）通信所用的参数。 +如果未指定 verb 或者 verb 为空，则假定对应的扩展模块选择不提供该扩展功能。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>urlPrefix</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + URLPrefix at which the extender is available + --> + 用来访问扩展模块的 URL 前缀。 +</td> +</tr> +<tr><td><code>filterVerb</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender. + --> + filter 调用所使用的动词，如果不支持过滤操作则为空。 +此动词会在向扩展模块发送 filter 调用时追加到 urlPrefix 后面。 +</td> +</tr> +<tr><td><code>preemptVerb</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender. + --> + preempt 调用所使用的动词，如果不支持过滤操作则为空。 +此动词会在向扩展模块发送 preempt 调用时追加到 urlPrefix 后面。 +</td> +</tr> +<tr><td><code>prioritizeVerb</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender. + --> + prioritize 调用所使用的动词，如果不支持过滤操作则为空。 +此动词会在向扩展模块发送 prioritize 调用时追加到 urlPrefix 后面。 +</td> +</tr> +<tr><td><code>weight</code> <B><!--[Required]-->[必需]</B><br/> +<code>int64</code> +</td> +<td> + <!-- + The numeric multiplier for the node scores that the prioritize call generates. +The weight should be a positive integer + --> + 针对 prioritize 调用所生成的节点分数要使用的数值系数。 +weight 值必须是正整数。 +</td> +</tr> +<tr><td><code>bindVerb</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. +If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender +can implement this function. + --> + bind 调用所使用的动词，如果不支持过滤操作则为空。 +此动词会在向扩展模块发送 bind 调用时追加到 urlPrefix 后面。 +如果扩展模块实现了此方法，扩展模块要负责将 Pod 绑定到 API 服务器。 +只有一个扩展模块可以实现此函数。 +</td> +</tr> +<tr><td><code>enableHTTPS</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + EnableHTTPS specifies whether https should be used to communicate with the extender + --> + 此字段设置是否需要使用 HTTPS 来与扩展模块通信。 +</td> +</tr> +<tr><td><code>tlsConfig</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-ExtenderTLSConfig"><code>ExtenderTLSConfig</code></a> +</td> +<td> + <!-- + TLSConfig specifies the transport layer security config + --> + 此字段设置传输层安全性（TLS）配置。 +</td> +</tr> +<tr><td><code>httpTimeout</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <!-- + HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize +timeout is ignored, k8s/other extenders priorities are used to select the node. + --> + 此字段给出扩展模块功能调用的超时值。filter 操作超时会导致 Pod 无法被调度。 +prioritize 操作超时会被忽略，Kubernetes 或者其他扩展模块所给出的优先级值 +会被用来选择节点。 +</td> +</tr> +<tr><td><code>nodeCacheCapable</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + NodeCacheCapable specifies that the extender is capable of caching node information, +so the scheduler should only send minimal information about the eligible nodes +assuming that the extender already cached full details of all nodes in the cluster + --> + 此字段指示扩展模块可以缓存节点信息，从而调度器应该发送关于可选节点的最少信息， +假定扩展模块已经缓存了集群中所有节点的全部详细信息。 +</td> +</tr> +<tr><td><code>managedResources</code><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-ExtenderManagedResource"><code>[]ExtenderManagedResource</code></a> +</td> +<td> + <!-- + ManagedResources is a list of extended resources that are managed by +this extender. +- A pod will be sent to the extender on the Filter, Prioritize and Bind + (if the extender is the binder) phases iff the pod requests at least + one of the extended resources in this list. If empty or unspecified, + all pods will be sent to this extender. +- If IgnoredByScheduler is set to true for a resource, kube-scheduler + will skip checking the resource in predicates. + --> + <p><code>managedResources</code> 是一个由此扩展模块所管理的扩展资源的列表。</p> + <ul> + <li>如果某 Pod 请求了此列表中的至少一个扩展资源，则 Pod 会在 filter、 +prioritize 和 bind （如果扩展模块可以执行绑定操作）阶段被发送到该扩展模块。</li> + <li>如果某资源上设置了 <code>ignoredByScheduler</code> 为 true，则 kube-scheduler +会在断言阶段略过对该资源的检查。</li> + </ul> +</td> +</tr> +<tr><td><code>ignorable</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + Ignorable specifies if the extender is ignorable, i.e. scheduling should not +fail when the extender returns an error or is not reachable. + --> + 此字段用来设置扩展模块是否是可忽略的。换言之，当扩展模块返回错误或者 +完全不可达时，调度操作不应失败。 +</td> +</tr> +</tbody> +</table> + +## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1beta3-ExtenderManagedResource} + +<!-- +**Appears in:** +--> +**出现在：** + +- [Extender](#kubescheduler-config-k8s-io-v1beta3-Extender) + +<!-- +ExtenderManagedResource describes the arguments of extended resources +managed by an extender. +--> +ExtenderManagedResource 描述某扩展模块所管理的扩展资源的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Name is the extended resource name. + --> + 扩展资源的名称。 +</td> +</tr> +<tr><td><code>ignoredByScheduler</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + IgnoredByScheduler indicates whether kube-scheduler should ignore this +resource when applying predicates. + --> + 此字段标明 kube-scheduler 是否应在应用断言时忽略此资源。 +</td> +</tr> +</tbody> +</table> + +## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1beta3-ExtenderTLSConfig} + +<!-- +**Appears in:** +--> +**出现在：** + +- [Extender](#kubescheduler-config-k8s-io-v1beta3-Extender) + +<!-- +ExtenderTLSConfig contains settings to enable TLS with extender +--> +ExtenderTLSConfig 包含启用与扩展模块间 TLS 传输所需的配置参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>insecure</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + Server should be accessed without verifying the TLS certificate. For testing only. + --> + 访问服务器时不需要检查 TLS 证书。此配置仅针对测试用途。 +</td> +</tr> +<tr><td><code>serverName</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + ServerName is passed to the server for SNI and is used in the client to check server +certificates against. If ServerName is empty, the hostname used to contact the +server is used. + --> + <code>serverName</code> 会被发送到服务器端，作为 SNI 标志；客户端会使用 +此设置来检查服务器证书。如果 <code>serverName</code> 为空，则会使用联系 +服务器时所用的主机名。 +</td> +</tr> +<tr><td><code>certFile</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Server requires TLS client certificate authentication + --> + 服务器端所要求的 TLS 客户端证书认证。 +</td> +</tr> +<tr><td><code>keyFile</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Server requires TLS client certificate authentication + --> + 服务器端所要求的 TLS 客户端秘钥认证。 +</td> +</tr> +<tr><td><code>caFile</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Trusted root certificates for server + --> + 服务器端被信任的根证书。 +</td> +</tr> +<tr><td><code>certData</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]byte</code> +</td> +<td> + <!-- + CertData holds PEM-encoded bytes (typically read from a client certificate file). +CertData takes precedence over CertFile + --> + <code>certData</code> 包含 PEM 编码的字节流（通常从某客户端证书文件读入）。 +此字段优先级高于 certFile 字段。 +</td> +</tr> +<tr><td><code>keyData</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]byte</code> +</td> +<td> + <!-- + KeyData holds PEM-encoded bytes (typically read from a client certificate key file). +KeyData takes precedence over KeyFile + --> + <code>keyData</code> 包含 PEM 编码的字节流（通常从某客户端证书秘钥文件读入）。 +此字段优先级高于 keyFile 字段。 +</td> +</tr> +<tr><td><code>caData</code> <B><!--[Required]-->[必需]</B><br/> +<code>[]byte</code> +</td> +<td> + <!-- + CAData holds PEM-encoded bytes (typically read from a root certificates bundle). +CAData takes precedence over CAFile + --> + <code>caData</code> 包含 PEM 编码的字节流（通常从某根证书包文件读入）。 +此字段优先级高于 caFile 字段。 +</td> +</tr> +</tbody> +</table> + +## `KubeSchedulerProfile` {#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + +<!-- +KubeSchedulerProfile is a scheduling profile. +--> +KubeSchedulerProfile 是一个调度方案。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>schedulerName</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + schedulername is the name of the scheduler associated to this profile. +if schedulername matches with the pod's "spec.schedulername", then the pod +is scheduled with this profile. + --> + <code>schedulerName</code> 是与此调度方案相关联的调度器的名称。 +如果 <code>schedulerName</code> 与 Pod 的 <code>spec.schedulerName</code> +匹配，则该 Pod 会使用此方案来调度。 +</td> +</tr> +<tr><td><code>plugins</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-Plugins"><code>Plugins</code></a> +</td> +<td> + <!-- + Plugins specify the set of plugins that should be enabled or disabled. +Enabled plugins are the ones that should be enabled in addition to the +default plugins. Disabled plugins are any of the default plugins that +should be disabled. +When no enabled or disabled plugin is specified for an extension point, +default plugins for that extension point will be used if there is any. +If a QueueSort plugin is specified, the same QueueSort Plugin and +PluginConfig must be specified for all profiles. + --> + <p><code>plugins</code> 设置一组应该被启用或禁止的插件。 +被启用的插件是指除了默认插件之外需要被启用的插件。被禁止的插件 +是指需要被禁用的默认插件。</p> + <p>如果针对某个扩展点没有设置被启用或被禁止的插件，则使用该扩展点 +的默认插件（如果有的话）。如果设置了 QueueSort 插件，则同一个 QueueSort +插件和 <code>pluginConfig</code> 要被设置到所有调度方案之上。</p> +</td> +</tr> +<tr><td><code>pluginConfig</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginConfig"><code>[]PluginConfig</code></a> +</td> +<td> + <!-- + PluginConfig is an optional set of custom plugin arguments for each plugin. +Omitting config args for a plugin is equivalent to using the default config +for that plugin. + --> + <code>pluginConfig</code> 是为每个插件提供的一组可选的定制插件参数。 +如果忽略了插件的配置参数，则意味着使用该插件的默认配置。 +</td> +</tr> +</tbody> +</table> + +## `Plugin` {#kubescheduler-config-k8s-io-v1beta3-Plugin} + +<!-- +**Appears in:** +--> +**出现在：** + +- [PluginSet](#kubescheduler-config-k8s-io-v1beta3-PluginSet) + +<!-- +Plugin specifies a plugin name and its weight when applicable. Weight is used only for Score plugins. +--> +Plugin 指定插件的名称及其权重（如果适用的话）。权重仅用于评分（Score）插件。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Name defines the name of plugin + --> + 插件的名称。 +</td> +</tr> +<tr><td><code>weight</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + Weight defines the weight of plugin, only used for Score plugins. + --> + 插件的权重；仅适用于评分（Score）插件。 +</td> +</tr> +</tbody> +</table> + +## `PluginConfig` {#kubescheduler-config-k8s-io-v1beta3-PluginConfig} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile) + +<!-- +PluginConfig specifies arguments that should be passed to a plugin at the time of initialization. +A plugin that is invoked at multiple extension points is initialized once. Args can have arbitrary structure. +It is up to the plugin to process these Args. +--> +PluginConfig 给出初始化阶段要传递给插件的参数。 +在多个扩展点被调用的插件仅会被初始化一次。 +参数可以是任意结构。插件负责处理这里所传的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Name defines the name of plugin being configured + --> + <code>name</code> 是所配置的插件的名称。 +</td> +</tr> +<tr><td><code>args</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/runtime/#RawExtension"><code>k8s.io/apimachinery/pkg/runtime.RawExtension</code></a> +</td> +<td> + <!-- + Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure. + --> + <code>args</code> 定义在初始化阶段要传递给插件的参数。参数可以为任意结构。 +</td> +</tr> +</tbody> +</table> + +## `PluginSet` {#kubescheduler-config-k8s-io-v1beta3-PluginSet} + +<!-- +**Appears in:** +--> +**出现在：** + +- [Plugins](#kubescheduler-config-k8s-io-v1beta3-Plugins) + +<!-- +PluginSet specifies enabled and disabled plugins for an extension point. +If an array is empty, missing, or nil, default plugins at that extension point will be used. +--> +PluginSet 为某扩展点设置要启用或禁用的插件。 +如果数组为空，或者取值为 null，则使用该扩展点的默认插件集合。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>enabled</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-Plugin"><code>[]Plugin</code></a> +</td> +<td> + <!-- + Enabled specifies plugins that should be enabled in addition to default plugins. +If the default plugin is also configured in the scheduler config file, the weight of plugin will +be overridden accordingly. +These are called after default plugins and in the same order specified here. + --> + <code>enabled</code> 设置在默认插件之外要启用的插件。如果在调度器的配置 +文件中也配置了默认插件，则对应插件的权重会被覆盖。 +此处所设置的插件会在默认插件之后被调用，调用顺序与数组中元素顺序相同。 +</td> +</tr> +<tr><td><code>disabled</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-Plugin"><code>[]Plugin</code></a> +</td> +<td> + <!-- + Disabled specifies default plugins that should be disabled. +When all default plugins need to be disabled, an array containing only one "∗" should be provided. + --> + <code>disabled</code> 设置要被禁用的默认插件。 +如果需要禁用所有的默认插件，应该提供仅包含一个元素 "∗" 的数组。 +</td> +</tr> +</tbody> +</table> + +## `Plugins` {#kubescheduler-config-k8s-io-v1beta3-Plugins} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile) + +<!-- +Plugins include multiple extension points. When specified, the list of plugins for +a particular extension point are the only ones enabled. If an extension point is +omitted from the config, then the default set of plugins is used for that extension point. +Enabled plugins are called in the order specified here, after default plugins. If they need to +be invoked before default plugins, default plugins must be disabled and re-enabled here in desired order. +--> +Plugins 结构中包含多个扩展点。当此结构被设置时，针对特定扩展点所启用 +的所有插件都在这一列表中。 +如果配置中不包含某个扩展点，则使用该扩展点的默认插件集合。 +被启用的插件的调用顺序与这里指定的顺序相同，都在默认插件之后调用。 +如果它们需要在默认插件之前调用，则需要先行禁止默认插件，之后在这里 +按期望的顺序重新启用。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>queueSort</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue. + --> + <code>queueSort</code> 是一个在对调度队列中 Pod 排序时要调用的插件列表。 +</td> +</tr> +<tr><td><code>preFilter</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework. + --> + <code>preFilter</code> 是一个在调度框架中“PreFilter（预过滤）”扩展点上要 +调用的插件列表。 +</td> +</tr> +<tr><td><code>filter</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod. + --> + <code>filter</code> 是一个在需要过滤掉无法运行 Pod 的节点时被调用的插件列表。 +</td> +</tr> +<tr><td><code>postFilter</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + PostFilter is a list of plugins that are invoked after filtering phase, but only when no feasible nodes were found for the pod. + --> + <code>postFilter</code> 是一个在过滤阶段结束后会被调用的插件列表； +这里的插件只有在找不到合适的节点来运行 Pod 时才会被调用。 +</td> +</tr> +<tr><td><code>preScore</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + PreScore is a list of plugins that are invoked before scoring. + --> + <code>preScore</code> 是一个在打分之前要调用的插件列表。 +</td> +</tr> +<tr><td><code>score</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase. + --> + <code>score</code> 是一个在对已经通过过滤阶段的节点进行排序时调用的插件的列表。 +</td> +</tr> +<tr><td><code>reserve</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + Reserve is a list of plugins invoked when reserving/unreserving resources +after a node is assigned to run the pod. + --> + <code>reserve</code> 是一组在运行 Pod 的节点已被选定后，需要预留或者释放资源时调用的插件的列表。 +</td> +</tr> +<tr><td><code>permit</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod. + --> + <code>permit</code> 是一个用来控制 Pod 绑定关系的插件列表。这些插件可以 +禁止或者延迟 Pod 的绑定。 +</td> +</tr> +<tr><td><code>preBind</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + PreBind is a list of plugins that should be invoked before a pod is bound. + --> + <code>preBind</code> 是一个在 Pod 被绑定到某节点之前要被调用的插件的列表。 +</td> +</tr> +<tr><td><code>bind</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. +The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success. + --> + <code>bind</code> 是一个在调度框架中“Bind（绑定）”扩展点上要调用的 +插件的列表。调度器按顺序调用这些插件。只要其中某个插件返回成功，则调度器 +就略过余下的插件。 +</td> +</tr> +<tr><td><code>postBind</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + PostBind is a list of plugins that should be invoked after a pod is successfully bound. + --> + <code>postBind</code> 是一个在 Pod 已经被成功绑定之后要调用的插件的列表。 +</td> +</tr> +<tr><td><code>multiPoint</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-PluginSet"><code>PluginSet</code></a> +</td> +<td> + <!-- + MultiPoint is a simplified config section to enable plugins for all valid extension points. +Plugins enabled through MultiPoint will automatically register for every individual extension +point the plugin has implemented. Disabling a plugin through MultiPoint disables that behavior. +The same is true for disabling "∗" through MultiPoint (no default plugins will be automatically registered). +Plugins can still be disabled through their individual extension points. + --> + <p><code>multiPoint</code> 是一个简化的配置段落，用来为所有合法的扩展点启用插件。 +通过 <code>multiPoint</code> 启用的插件会自动注册到插件所实现的每个独立的扩展点上。 +通过 <code>multiPoint</code> 禁用的插件会禁用对应的操作行为。 +通过 <code>multiPoint</code> 所禁止的 "∗" 也是如此，意味着所有默认 +插件都不会被自动注册。 +插件也可以通过各个独立的扩展点来禁用。</p> + <!-- +In terms of precedence, plugin config follows this basic hierarchy + 1. Specific extension points + 2. Explicitly configured MultiPoint plugins + 3. The set of default plugins, as MultiPoint plugins +This implies that a higher precedence plugin will run first and overwrite any settings within MultiPoint. +Explicitly user-configured plugins also take a higher precedence over default plugins. +Within this hierarchy, an Enabled setting takes precedence over Disabled. For example, if a plugin is +set in both `multiPoint.Enabled` and `multiPoint.Disabled`, the plugin will be enabled. Similarly, +including `multiPoint.Disabled = '∗'` and `multiPoint.Enabled = pluginA` will still register that specific +plugin through MultiPoint. This follows the same behavior as all other extension point configurations. + --> + <p>就优先序而言，插件配置遵从以下基本层次：</p> + <ol> + <li>特定的扩展点；</li> + <li>显式配置的 <code>multiPoint</code> 插件；</li> + <li>默认插件的集合，以及 <code>multiPoint</code> 插件。</li> + </ol> + <p>这意味着优先序较高的插件会先被运行，并且覆盖 <code>multiPoint</code> 中的任何配置。</p> + <p>用户显式配置的插件也会比默认插件优先序高。</p> + <p>在这样的层次结构设计之下，<code>enabled</code> 的优先序高于 <code>disabled</code>。 +例如，某插件同时出现在 <code>multiPoint.enabled</code> 和 <code>multiPoint.disalbed</code> 时， +该插件会被启用。类似的，同时设置 <code>multiPoint.disabled = '∗'</code> +和 <code>multiPoint.enabled = pluginA</code> 时，插件 pluginA 仍然会被注册。 +这一设计与所有其他扩展点的配置行为是相符的。 +</td> +</tr> +</tbody> +</table> + +## `PodTopologySpreadConstraintsDefaulting` {#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadConstraintsDefaulting} + +<!-- +(Alias of `string`) + +**Appears in:** +--> +（`string` 类型的别名） + +**出现在：** + +- [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadArgs) + +<!-- +PodTopologySpreadConstraintsDefaulting defines how to set default constraints +for the PodTopologySpread plugin. +--> +PodTopologySpreadConstraintsDefaulting 定义如何为 PodTopologySpread 插件 +设置默认的约束。 + +## `RequestedToCapacityRatioParam` {#kubescheduler-config-k8s-io-v1beta3-RequestedToCapacityRatioParam} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) + +<!-- +RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters +--> +RequestedToCapacityRatioParam 结构定义 RequestedToCapacityRatio 的参数。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>shape</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-UtilizationShapePoint"><code>[]UtilizationShapePoint</code></a> +</td> +<td> + <!-- + Shape is a list of points defining the scoring function shape. + --> + <code>shape</code> 是一个定义评分函数曲线的计分点的列表。 +</td> +</tr> +</tbody> +</table> + +## `ResourceSpec` {#kubescheduler-config-k8s-io-v1beta3-ResourceSpec} + +<!-- +**Appears in:** +--> +**出现在：** + +- [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesBalancedAllocationArgs) +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) + +<!-- +ResourceSpec represents a single resource. +--> +ResourceSpec 用来代表某个资源。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Name of the resource. + --> + 资源名称。 +</td> +</tr> +<tr><td><code>weight</code> <B><!--[Required]-->[必需]</B><br/> +<code>int64</code> +</td> +<td> + <!-- + Weight of the resource. + --> + 资源权重。 +</td> +</tr> +</tbody> +</table> + +## `ScoringStrategy` {#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy} + +<!-- +**Appears in:** +--> +**出现在：** + +- [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesFitArgs) + +<!-- +ScoringStrategy define ScoringStrategyType for node resource plugin +--> +ScoringStrategy 为节点资源插件定义 ScoringStrategyType。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>type</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-ScoringStrategyType"><code>ScoringStrategyType</code></a> +</td> +<td> + <!-- + Type selects which strategy to run. + --> + <code>type</code> 用来选择要运行的策略。 +</td> +</tr> +<tr><td><code>resources</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-ResourceSpec"><code>[]ResourceSpec</code></a> +</td> +<td> + <!-- + Resources to consider when scoring. +The default resource set includes "cpu" and "memory" with an equal weight. +Allowed weights go from 1 to 100. +Weight defaults to 1 if not specified or explicitly set to 0. + --> + <p><code>resources</code> 设置在评分时要考虑的资源。</p> + <p>默认的资源集合包含 "cpu" 和 "memory"，且二者权重相同。</p> + <p>权重的取值范围为 1 到 100。</p> + <p>当权重未设置或者显式设置为 0 时，意味着使用默认值 1。</p> +</td> +</tr> +<tr><td><code>requestedToCapacityRatio</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#kubescheduler-config-k8s-io-v1beta3-RequestedToCapacityRatioParam"><code>RequestedToCapacityRatioParam</code></a> +</td> +<td> + <!-- + Arguments specific to RequestedToCapacityRatio strategy. + --> + 特定于 RequestedToCapacityRatio 策略的参数。 +</td> +</tr> +</tbody> +</table> + +## `ScoringStrategyType` {#kubescheduler-config-k8s-io-v1beta3-ScoringStrategyType} + +<!-- +(Alias of `string`) + +**Appears in:** +--> +（`string` 数据类型的别名） + +**出现在：** + +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) + +<!-- +ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin. +--> +ScoringStrategyType 是 NodeResourcesFit 插件所使用的的评分策略类型。 + +## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1beta3-UtilizationShapePoint} + +<!-- +**Appears in:** +--> +**出现在：** + +- [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta3-VolumeBindingArgs) +- [RequestedToCapacityRatioParam](#kubescheduler-config-k8s-io-v1beta3-RequestedToCapacityRatioParam) + +<!-- +UtilizationShapePoint represents single point of priority function shape. +--> +UtilizationShapePoint 代表的是优先级函数曲线中的一个评分点。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>utilization</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100. + --> + 利用率（x 轴）。合法值为 0 到 100。完全被利用的节点映射到 100。 +</td> +</tr> +<tr><td><code>score</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + Score assigned to given utilization (y axis). Valid values are 0 to 10. + --> + 分配给指定利用率的分值（y 轴）。合法值为 0 到 10。 +</td> +</tr> +</tbody> +</table> + +## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + +<!-- +ClientConnectionConfiguration contains details for constructing a client. +--> +ClientConnectionConfiguration 中包含用来构造一个客户端所需的细节。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>kubeconfig</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + kubeconfig is the path to a KubeConfig file. + --> + 此字段为指向某 KubeConfig 文件的路径。 +</td> +</tr> +<tr><td><code>acceptContentTypes</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the +default value of 'application/json'. This field will control all connections to the server used by a particular client. + --> + <code>acceptContentTypes</code> 定义的是客户端与服务器建立连接时要发送的 +Accept 头部；这里的设置值会覆盖默认值 "application/json"。 +此字段会影响某特定客户端与服务器的所有连接。 +</td> +</tr> +<tr><td><code>contentType</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + contentType is the content type used when sending data to the server from this client. + --> + <code>contentType</code> 包含的是此客户端向服务器发送数据时使用的 +内容类型（Content Type）。 +</td> +</tr> +<tr><td><code>qps</code> <B><!--[Required]-->[必需]</B><br/> +<code>float32</code> +</td> +<td> + <!-- + qps controls the number of queries per second allowed for this connection. + --> + <code>qps</code> 控制的是此连接上每秒可以发送的查询个数。 +</td> +</tr> +<tr><td><code>burst</code> <B><!--[Required]-->[必需]</B><br/> +<code>int32</code> +</td> +<td> + <!-- + burst allows extra queries to accumulate when a client is exceeding its rate. + --> + <code>burst</code> 允许在客户端超出其速率限制时可以累积的额外查询个数。 +</td> +</tr> +</tbody> +</table> + +## `DebuggingConfiguration` {#DebuggingConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +<!-- +DebuggingConfiguration holds configuration for Debugging related features. +--> +DebuggingConfiguration 保存与调试功能相关的配置。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>enableProfiling</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + enableProfiling enables profiling via web interface host:port/debug/pprof/ + --> + 此字段允许通过 Web 接口 host:port/debug/pprof/ 执行性能分析。 +</td> +</tr> +<tr><td><code>enableContentionProfiling</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + enableContentionProfiling enables lock contention profiling, if +enableProfiling is true. + --> + 此字段在 <code>enableProfiling</code> 为 true 时允许执行锁竞争分析。 +</td> +</tr> +</tbody> +</table> + +## `FormatOptions` {#FormatOptions} + +<!-- +**Appears in:** +--> + +<!-- +FormatOptions contains options for the different logging formats. +--> +FormatOptions 中包含不同日志格式的配置选项。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>json</code> <B><!--[Required]-->[必需]</B><br/> +<a href="#JSONOptions"><code>JSONOptions</code></a> +</td> +<td> + <!-- + [Experimental] JSON contains options for logging format "json". + --> + [实验特性] <code>json</code> 字段包含为 "json" 日志格式提供的配置选项。 +</td> +</tr> +</tbody> +</table> + +## `JSONOptions` {#JSONOptions} + +<!-- +**Appears in:** +--> +**出现在：** + +- [FormatOptions](#FormatOptions) + +<!-- +JSONOptions contains options for logging format "json". +--> +JSONOptions 包含为 "json" 日志格式所设置的配置选项。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>splitStream</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + [Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering. + --> + [实验特性] 此字段将错误信息重定向到标准错误输出（stderr），将提示消息 +重定向到标准输出（stdout），并且支持缓存。默认配置为将二者都输出到 +标准输出（stdout），且不提供缓存。 +</td> +</tr> +<tr><td><code>infoBufferSize</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/api/resource#QuantityValue"><code>k8s.io/apimachinery/pkg/api/resource.QuantityValue</code></a> +</td> +<td> + <!-- + [Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering. + --> + [实验特性] <code>infoBufferSize</code> 用来在分离数据流场景是设置提示 +信息数据流的大小。默认值为 0，意味着禁止缓存。 +</td> +</tr> +</tbody> +</table> + +## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + +<!-- +LeaderElectionConfiguration defines the configuration of leader election +clients for components that can run with leader election enabled. +--> +LeaderElectionConfiguration 为能够支持领导者选举的组件定义其领导者选举 +客户端的配置。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>leaderElect</code> <B><!--[Required]-->[必需]</B><br/> +<code>bool</code> +</td> +<td> + <!-- + leaderElect enables a leader election client to gain leadership +before executing the main loop. Enable this when running replicated +components for high availability. + --> + <code>leaderElect</code> 启用领导者选举客户端，从而在进入主循环执行之前 +先要获得领导者角色。当运行多副本组件时启用此功能有助于提高可用性。 +</td> +</tr> +<tr><td><code>leaseDuration</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <!-- + leaseDuration is the duration that non-leader candidates will wait +after observing a leadership renewal until attempting to acquire +leadership of a led but unrenewed leader slot. This is effectively the +maximum duration that a leader can be stopped before it is replaced +by another candidate. This is only applicable if leader election is +enabled. + --> + <code>leaseDuration</code> 是非领导角色候选者在观察到需要领导席位更新时 +要等待的时间；只有经过所设置时长才可以尝试去获得一个仍处于领导状态但需要 +被刷新的席位。这里的设置值本质上意味着某个领导者在被另一个候选者替换掉 +之前可以停止运行的最长时长。只有当启用了领导者选举时此字段有意义。 +</td> +</tr> +<tr><td><code>renewDeadline</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <!-- + renewDeadline is the interval between attempts by the acting master to +renew a leadership slot before it stops leading. This must be less +than or equal to the lease duration. This is only applicable if leader +election is enabled. + --> + <code>renewDeadline</code> 设置的是当前领导者在停止扮演领导角色之前 +需要刷新领导状态的时间间隔。此值必须小于或等于租约期限的长度。 +只有到启用了领导者选举时此字段才有意义。 +</td> +</tr> +<tr><td><code>retryPeriod</code> <B><!--[Required]-->[必需]</B><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <!-- + retryPeriod is the duration the clients should wait between attempting +acquisition and renewal of a leadership. This is only applicable if +leader election is enabled. + --> + <code>retryPeriod</code> 是客户端在连续两次尝试获得或者刷新领导状态 +之间需要等待的时长。只有当启用了领导者选举时此字段才有意义。 +</td> +</tr> +<tr><td><code>resourceLock</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + resourceLock indicates the resource object type that will be used to lock +during leader election cycles. + --> + 此字段给出在领导者选举期间要作为锁来使用的资源对象类型。 +</td> +</tr> +<tr><td><code>resourceName</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + resourceName indicates the name of resource object that will be used to lock +during leader election cycles. + --> + 此字段给出在领导者选举期间要作为锁来使用的资源对象名称。 +</td> +</tr> +<tr><td><code>resourceNamespace</code> <B><!--[Required]-->[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + resourceName indicates the namespace of resource object that will be used to lock +during leader election cycles. + --> + 此字段给出在领导者选举期间要作为锁来使用的资源对象所在名字空间。 +</td> +</tr> +</tbody> +</table> + +## `VModuleConfiguration` {#VModuleConfiguration} + +<!-- +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + +**Appears in:** +--> + +（`[]k8s.io/component-base/config/v1alpha1.VModuleItem` 的别名) + +<!-- +VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold. +--> +VModuleConfiguration 是一组文件名（通配符）及其对应的日志详尽程度阈值。 + From d62a8da5b6e310e3ee6ec9e6bee749aa34aa8a25 Mon Sep 17 00:00:00 2001 From: howieyuen <howieyuen@outlook.com> Date: Wed, 23 Feb 2022 14:12:32 +0800 Subject: [PATCH 032/104] add howieyuen to sig-doc-zh-owners --- OWNERS_ALIASES | 1 + 1 file changed, 1 insertion(+) diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index 6c6558ade1..72adfa668d 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -152,6 +152,7 @@ aliases: # dchen1107 # haibinxie # hanjiayao + - howieyuen # lichuqiang - SataQiu - tanjunchen From 92788263bbff220ee4657b8cadc9805b266d9070 Mon Sep 17 00:00:00 2001 From: howieyuen <howieyuen@outlook.com> Date: Wed, 23 Feb 2022 14:34:59 +0800 Subject: [PATCH 033/104] [zh]translate Container Runtime Interface(CRI) --- content/zh/docs/concepts/architecture/cri.md | 88 +++++++++++++++++++ .../glossary/container-runtime-interface.md | 42 +++++++++ 2 files changed, 130 insertions(+) create mode 100644 content/zh/docs/concepts/architecture/cri.md create mode 100644 content/zh/docs/reference/glossary/container-runtime-interface.md diff --git a/content/zh/docs/concepts/architecture/cri.md b/content/zh/docs/concepts/architecture/cri.md new file mode 100644 index 0000000000..68cd082fc0 --- /dev/null +++ b/content/zh/docs/concepts/architecture/cri.md @@ -0,0 +1,88 @@ +--- +title: 容器运行时接口（CRI） +content_type: concept +weight: 50 +--- + +<!-- +title: Container Runtime Interface (CRI) +content_type: concept +weight: 50 +--> + +<!-- overview --> +<!-- +The CRI is a plugin interface which enables the kubelet to use a wide variety of +container runtimes, without having a need to recompile the cluster components. + +You need a working +{{<glossary_tooltip text="container runtime" term_id="container-runtime">}} on +each Node in your cluster, so that the +{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} can launch +{{< glossary_tooltip text="Pods" term_id="pod" >}} and their containers. +--> +CRI 是一个插件接口，它使 kubelet 能够使用各种容器运行时，无需重新编译集群组件。 + +你需要在集群中的每个节点上都有一个可以正常工作的 +{{<glossary_tooltip text="容器运行时" term_id="container-runtime">}}， +这样 +{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} 能启动 +{{< glossary_tooltip text="Pod" term_id="pod" >}} 及其容器。 + +{{< glossary_definition prepend="容器运行时接口（CRI）是" term_id="container-runtime-interface" length="all" >}} + +<!-- body --> +<!-- ## The API {#api} --> +## API {#api} + +{{< feature-state for_k8s_version="v1.23" state="stable" >}} + +<!-- +The kubelet acts as a client when connecting to the container runtime via gRPC. +The runtime and image service endpoints have to be available in the container +runtime, which can be configured separately within the kubelet by using the +`--image-service-endpoint` and `--container-runtime-endpoint` [command line +flags](/docs/reference/command-line-tools-reference/kubelet) +--> +当通过 gRPC 连接到容器运行时时，kubelet 充当客户端。 +运行时和镜像服务端点必须在容器运行时中可用，可以使用 +[命令行标志](/zh/docs/reference/command-line-tools-reference/kubelet)的 +`--image-service-endpoint` 和 `--container-runtime-endpoint` +在 kubelet 中单独配置。 + +<!-- +For Kubernetes v{{< skew currentVersion >}}, the kubelet prefers to use CRI `v1`. +If a container runtime does not support `v1` of the CRI, then the kubelet tries to +negotiate any older supported version. +The v{{< skew currentVersion >}} kubelet can also negotiate CRI `v1alpha2`, but +this version is considered as deprecated. +If the kubelet cannot negotiate a supported CRI version, the kubelet gives up +and doesn't register as a node. +--> +对 Kubernetes v{{< skew currentVersion >}}，kubelet 偏向于使用 CRI `v1` 版本。 +如果容器运行时不支持 CRI 的 `v1` 版本，那么 kubelet 会尝试协商任何旧的其他支持版本。 +如果 kubelet 无法协商支持的 CRI 版本，则 kubelet 放弃并且不会注册为节点。 + +<!-- +## Upgrading + +When upgrading Kubernetes, then the kubelet tries to automatically select the +latest CRI version on restart of the component. If that fails, then the fallback +will take place as mentioned above. If a gRPC re-dial was required because the +container runtime has been upgraded, then the container runtime must also +support the initially selected version or the redial is expected to fail. This +requires a restart of the kubelet. +--> +## 升级 {#upgrading} + +升级 Kubernetes 时，kubelet 会尝试在组件重启时自动选择最新的 CRI 版本。 +如果失败，则将如上所述进行回退。如果由于容器运行时已升级而需要 gRPC 重拨， +则容器运行时还必须支持最初选择的版本，否则重拨预计会失败。 +这需要重新启动 kubelet。 + +## {{% heading "whatsnext" %}} + +<!-- +- Learn more about the CRI [protocol definition](https://github.com/kubernetes/cri-api/blob/c75ef5b/pkg/apis/runtime/v1/api.proto) +--> +- 了解更多有关 CRI [协议定义](https://github.com/kubernetes/cri-api/blob/c75ef5b/pkg/apis/runtime/v1/api.proto) diff --git a/content/zh/docs/reference/glossary/container-runtime-interface.md b/content/zh/docs/reference/glossary/container-runtime-interface.md new file mode 100644 index 0000000000..39bc8d0017 --- /dev/null +++ b/content/zh/docs/reference/glossary/container-runtime-interface.md @@ -0,0 +1,42 @@ +--- +title: 容器运行时接口 +id: container-runtime-interface +date: 2021-11-24 +full_link: /zh/docs/concepts/architecture/cri +short_description: > + kubelet 和容器运行时之间通信的主要协议。 + +aka: +tags: + - cri +--- + +<!-- +title: Container Runtime Interface +id: container-runtime-interface +date: 2021-11-24 +full_link: /docs/concepts/architecture/cri +short_description: > + The main protocol for the communication between the kubelet and Container Runtime. + +aka: +tags: + - cri +--> + +<!-- The main protocol for the communication between the kubelet and Container Runtime. --> +kubelet 和容器运行时之间通信的主要协议。 + +<!--more--> + +<!-- +The Kubernetes Container Runtime Interface (CRI) defines the main +[gRPC](https://grpc.io) protocol for the communication between the +[cluster components](/docs/concepts/overview/components/#node-components) +{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} and +{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}. +--> +Kubernetes 容器运行时接口（CRI）定义了主要 [gRPC](https://grpc.io) 协议， +用于[集群组件](/zh/docs/concepts/overview/components/#node-components) +{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} 和 +{{< glossary_tooltip text="容器运行时" term_id="container-runtime" >}}。 \ No newline at end of file From 0523f824bd8f1c2b38200450f76e5cc339d545e8 Mon Sep 17 00:00:00 2001 From: howieyuen <howieyuen@outlook.com> Date: Wed, 23 Feb 2022 20:59:55 +0800 Subject: [PATCH 034/104] [zh]sync content/zh/docs/tutorials/security/seccomp.md --- content/zh/docs/tutorials/clusters/seccomp.md | 626 -------------- content/zh/docs/tutorials/security/seccomp.md | 783 ++++++++++++++++++ 2 files changed, 783 insertions(+), 626 deletions(-) delete mode 100644 content/zh/docs/tutorials/clusters/seccomp.md create mode 100644 content/zh/docs/tutorials/security/seccomp.md diff --git a/content/zh/docs/tutorials/clusters/seccomp.md b/content/zh/docs/tutorials/clusters/seccomp.md deleted file mode 100644 index d724d605b6..0000000000 --- a/content/zh/docs/tutorials/clusters/seccomp.md +++ /dev/null @@ -1,626 +0,0 @@ ---- -title: 使用 Seccomp 限制容器的系统调用 -content_type: tutorial -weight: 20 -min-kubernetes-server-version: v1.22 ---- - -<!-- overview --> - -{{< feature-state for_k8s_version="v1.19" state="stable" >}} - -<!-- -Seccomp stands for secure computing mode and has been a feature of the Linux -kernel since version 2.6.12. It can be used to sandbox the privileges of a -process, restricting the calls it is able to make from userspace into the -kernel. Kubernetes lets you automatically apply seccomp profiles loaded onto a -Node to your Pods and containers. - -Identifying the privileges required for your workloads can be difficult. In this -tutorial, you will go through how to load seccomp profiles into a local -Kubernetes cluster, how to apply them to a Pod, and how you can begin to craft -profiles that give only the necessary privileges to your container processes. ---> -Seccomp 代表安全计算模式，自 2.6.12 版本以来一直是 Linux 内核的功能。 -它可以用来对进程的特权进行沙盒处理，从而限制了它可以从用户空间向内核进行的调用。 -Kubernetes 允许你将加载到节点上的 seccomp 配置文件自动应用于 Pod 和容器。 - -确定工作负载所需的特权可能很困难。在本教程中，你将了解如何将 seccomp 配置文件 -加载到本地 Kubernetes 集群中，如何将它们应用到 Pod，以及如何开始制作仅向容器 -进程提供必要特权的配置文件。 - -## {{% heading "objectives" %}} - -<!-- -* Learn how to load seccomp profiles on a node -* Learn how to apply a seccomp profile to a container -* Observe auditing of syscalls made by a container process -* Observe behavior when a missing profile is specified -* Observe a violation of a seccomp profile -* Learn how to create fine-grained seccomp profiles -* Learn how to apply a container runtime default seccomp profile ---> -* 了解如何在节点上加载 seccomp 配置文件 -* 了解如何将 seccomp 配置文件应用于容器 -* 观察由容器进程进行的系统调用的审核 -* 观察当指定了一个不存在的配置文件时的行为 -* 观察违反 seccomp 配置的情况 -* 了解如何创建精确的 seccomp 配置文件 -* 了解如何应用容器运行时默认 seccomp 配置文件 - -## {{% heading "prerequisites" %}} - -{{< version-check >}} - -<!-- -In order to complete all steps in this tutorial, you must install -[kind](https://kind.sigs.k8s.io/docs/user/quick-start/) and -[kubectl](/docs/tasks/tools/). This tutorial will show examples -both alpha (new in v1.22) and generally available seccomp functionality. You should -make sure that your cluster is [configured -correctly](https://kind.sigs.k8s.io/docs/user/quick-start/#setting-kubernetes-version) -for the version you are using. ---> -为了完成本教程中的所有步骤，你必须安装 [kind](https://kind.sigs.k8s.io/docs/user/quick-start/) -和 [kubectl](/zh/docs/tasks/tools/)。本教程将显示同时具有 alpha（v1.22 新版本） -和通常可用的 seccomp 功能的示例。 -你应该确保为所使用的版本[正确配置](https://kind.sigs.k8s.io/docs/user/quick-start/#setting-kubernetes-version)了集群。 - -<!-- steps --> - -<!-- -## Enable the use of `RuntimeDefault` as the default seccomp profile for all workloads - -{{< feature-state state="alpha" for_k8s_version="v1.22" >}} - -`SeccompDefault` is an optional kubelet -[feature gate](/docs/reference/command-line-tools-reference/feature-gates) as -well as corresponding `--seccomp-default` -[command line flag](/docs/reference/command-line-tools-reference/kubelet). -Both have to be enabled simultaneously to use the feature. ---> -## 启用 `RuntimeDefault` 作为所有工作负载的默认 seccomp 配置文件 - -{{< feature-state state="alpha" for_k8s_version="v1.22" >}} - -`SeccompDefault` 是一个可选的 kubelet -[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates)， -相应地，`--seccomp-default` 是此特性门控的 -[命令行标志](/zh/docs/reference/command-line-tools-reference/kubelet)。 -必须同时启用两者才能使用该功能。 - -<!-- -If enabled, the kubelet will use the `RuntimeDefault` seccomp profile by default, which is -defined by the container runtime, instead of using the `Unconfined` (seccomp disabled) mode. -The default profiles aim to provide a strong set -of security defaults while preserving the functionality of the workload. It is -possible that the default profiles differ between container runtimes and their -release versions, for example when comparing those from CRI-O and containerd. ---> -如果启用，kubelet 将默认使用 `RuntimeDefault` seccomp 配置， -而不是使用 `Unconfined`（禁用 seccomp）模式，该配置由容器运行时定义。 -默认配置旨在提供一组强大的安全默认值设置，同时避免影响工作负载的功能。 -不同的容器运行时之间及其不同的发布版本之间的默认配置可能不同， -例如在比较 CRI-O 和 containerd 的配置文件时（就会发现这点）。 - -<!-- -Some workloads may require a lower amount of syscall restrictions than others. -This means that they can fail during runtime even with the `RuntimeDefault` -profile. To mitigate such a failure, you can: - -- Run the workload explicitly as `Unconfined`. -- Disable the `SeccompDefault` feature for the nodes. Also making sure that - workloads get scheduled on nodes where the feature is disabled. -- Create a custom seccomp profile for the workload. ---> -某些工作负载可能相比其他工作负载需要更少的系统调用限制。 -这意味着即使使用 `RuntimeDefault` 配置文件，它们也可能在运行时失败。 -要处理此类失效，你可以： - -- 将工作负载显式运行为 `Unconfined`。 -- 禁用节点的 `SeccompDefault` 功能。 - 还要确保工作负载被安排在禁用该功能的节点上。 -- 为工作负载创建自定义 seccomp 配置文件。 - -<!-- -If you were introducing this feature into production-like cluster, the Kubernetes project -recommends that you enable this feature gate on a subset of your nodes and then -test workload execution before rolling the change out cluster-wide. - -More detailed information about a possible upgrade and downgrade strategy can be -found in the [related Kubernetes Enhancement Proposal (KEP)](https://github.com/kubernetes/enhancements/tree/a70cc18/keps/sig-node/2413-seccomp-by-default#upgrade--downgrade-strategy). ---> -如果你将此功能引入到类似生产的集群中， -Kubernetes 项目建议你在节点的子集上启用此特性门控， -然后在集群范围内推出更改之前测试工作负载的执行情况。 - -有关可能的升级和降级策略的更多详细信息， -请参见[相关 Kubernetes 增强提案 (KEP)](https://github.com/kubernetes/enhancements/tree/a70cc18/keps/sig-node/2413-seccomp-by-default#upgrade--downgrade-strategy)。 - -<!-- -Since the feature is in alpha state it is disabled per default. To enable it, -pass the flags `--feature-gates=SeccompDefault=true --seccomp-default` to the -`kubelet` CLI or enable it via the [kubelet configuration -file](/docs/tasks/administer-cluster/kubelet-config-file/). To enable the -feature gate in [kind](https://kind.sigs.k8s.io), ensure that `kind` provides -the minimum required Kubernetes version and enables the `SeccompDefault` feature -[in the kind configuration](https://kind.sigs.k8s.io/docs/user/quick-start/#enable-feature-gates-in-your-cluster): ---> -由于该功能处于 alpha 状态，因此默认情况下是被禁用的。要启用它， -请将标志 `--feature-gates=SeccompDefault=true --seccomp-default` -传递给 `kubelet` CLI 或通过 -[kubelet 配置文件](/zh/docs/tasks/administer-cluster/kubelet-config-file/)启用它。 -要在 [kind](https://kind.sigs.k8s.io) 中启用特性门控， -请确保 `kind` 提供所需的最低 Kubernetes 版本并 -[在 kind 配置中](https://kind.sigs.k8s.io/docs/user/quick-start/#enable-feature-gates-in-your-cluster) -启用 `SeccompDefault` 功能： - -```yaml -kind: Cluster -apiVersion: kind.x-k8s.io/v1alpha4 -featureGates: - SeccompDefault: true -``` - -<!-- -## Create Seccomp Profiles - -The contents of these profiles will be explored later on, but for now go ahead -and download them into a directory named `profiles/` so that they can be loaded -into the cluster. ---> -## 创建 Seccomp 文件 - -这些配置文件的内容将在以后进行探讨，但现在继续进行，并将其下载到名为 `profiles/` 的目录中，以便可以将其加载到集群中。 - -{{< tabs name="tab_with_code" >}} -{{{< tab name="audit.json" >}} -{{< codenew file="pods/security/seccomp/profiles/audit.json" >}} -{{< /tab >}} -{{< tab name="violation.json" >}} -{{< codenew file="pods/security/seccomp/profiles/violation.json" >}} -{{< /tab >}}} -{{< tab name="fine-grained.json" >}} -{{< codenew file="pods/security/seccomp/profiles/fine-grained.json" >}} -{{< /tab >}}} -{{< /tabs >}} - -<!-- -## Create a Local Kubernetes Cluster with Kind - -For simplicity, [kind](https://kind.sigs.k8s.io/) can be used to create a single -node cluster with the seccomp profiles loaded. Kind runs Kubernetes in Docker, -so each node of the cluster is a container. This allows for files -to be mounted in the filesystem of each container similar to loading files -onto a node. - -Download the example above, and save it to a file named `kind.yaml`. Then create -the cluster with the configuration. ---> -## 使用 Kind 创建一个本地 Kubernetes 集群 - -为简单起见，可以使用 [kind](https://kind.sigs.k8s.io/) 创建一个已经加载 seccomp 配置文件的单节点集群。 -Kind 在 Docker 中运行 Kubernetes，因此集群的每个节点都是一个容器。这允许将文件挂载到每个容器的文件系统中， -类似于将文件挂载到节点上。 - -{{< codenew file="pods/security/seccomp/kind.yaml" >}} -<br> - -下载上面的这个示例，并将其保存为 `kind.yaml`。然后使用这个配置创建集群。 - -``` -kind create cluster --config=kind.yaml -``` - -<!-- -Once the cluster is ready, identify the container running as the single node -cluster: ---> -一旦这个集群已经就绪，找到作为单节点集群运行的容器： - -``` -docker ps -``` - -<!-- -You should see output indicating that a container is running with name -`kind-control-plane`. ---> -你应该看到输出显示正在运行的容器名称为 `kind-control-plane`。 - -``` -CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES -6a96207fed4b kindest/node:v1.18.2 "/usr/local/bin/entr…" 27 seconds ago Up 24 seconds 127.0.0.1:42223->6443/tcp kind-control-plane -``` - -<!-- -If observing the filesystem of that container, one should see that the -`profiles/` directory has been successfully loaded into the default seccomp path -of the kubelet. Use `docker exec` to run a command in the Pod: ---> -如果观察该容器的文件系统，则应该看到 `profiles/` 目录已成功加载到 kubelet 的默认 seccomp 路径中。 -使用 `docker exec` 在 Pod 中运行命令： - -``` -docker exec -it 6a96207fed4b ls /var/lib/kubelet/seccomp/profiles -``` - -``` -audit.json fine-grained.json violation.json -``` - -<!-- -## Create a Pod with a seccomp profile for syscall auditing - -To start off, apply the `audit.json` profile, which will log all syscalls of the -process, to a new Pod. - -Download the correct manifest for your Kubernetes version: ---> -## 使用 seccomp 配置文件创建 Pod 以进行系统调用审核 - -首先，将 `audit.json` 配置文件应用到新的 Pod 中，该配置文件将记录该进程的所有系统调用。 - -为你的 Kubernetes 版本下载正确的清单： - -{{< tabs name="audit_pods" >}} -{{< tab name="v1.19 或更新版本（GA）" >}} -{{< codenew file="pods/security/seccomp/ga/audit-pod.yaml" >}} -{{< /tab >}}} -{{{< tab name="v1.19之前版本（alpha）" >}} -{{< codenew file="pods/security/seccomp/alpha/audit-pod.yaml" >}} -{{< /tab >}} -{{< /tabs >}} -<br> - -<!-- -Create the Pod in the cluster: ---> -在集群中创建 Pod： - -``` -kubectl apply -f audit-pod.yaml -``` - -<!-- -This profile does not restrict any syscalls, so the Pod should start -successfully. ---> -这个配置文件并不限制任何系统调用，所以这个 Pod 应该会成功启动。 - -``` -kubectl get pod/audit-pod -``` - -``` -NAME READY STATUS RESTARTS AGE -audit-pod 1/1 Running 0 30s -``` - -<!-- -In order to be able to interact with this endpoint exposed by this -container,create a NodePort Service that allows access to the endpoint from -inside the kind control plane container. ---> -为了能够与该容器公开的端点进行交互，请创建一个 NodePort 服务， -该服务允许从 kind 控制平面容器内部访问该端点。 - -``` -kubectl expose pod/audit-pod --type NodePort --port 5678 -``` - -<!-- -Check what port the Service has been assigned on the node. ---> -检查这个服务在这个节点上被分配了什么端口。 - -``` -kubectl get svc/audit-pod -``` - -``` -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -audit-pod NodePort 10.111.36.142 <none> 5678:32373/TCP 72s -``` - -<!-- -Now you can `curl` the endpoint from inside the kind control plane container at -the port exposed by this Service. Use `docker exec` to run a command in the Pod: ---> -现在你可以使用 `curl` 命令从 kind 控制平面容器内部通过该服务暴露出来的端口来访问这个端点。 - -``` -docker exec -it 6a96207fed4b curl localhost:32373 -``` - -``` -just made some syscalls! -``` - -<!-- -You can see that the process is running, but what syscalls did it actually make? -Because this Pod is running in a local cluster, you should be able to see those -in `/var/log/syslog`. Open up a new terminal window and `tail` the output for -calls from `http-echo`: - -``` -tail -f /var/log/syslog | grep 'http-echo' -``` - -You should already see some logs of syscalls made by `http-echo`, and if you -`curl` the endpoint in the control plane container you will see more written. ---> -你可以看到该进程正在运行，但是实际上执行了哪些系统调用？因为该 Pod 是在本地集群中运行的， -你应该可以在 `/var/log/syslog` 日志中看到这些。打开一个新的终端窗口，使用 `tail` 命令来 -查看来自 `http-echo` 的调用输出： - -``` -tail -f /var/log/syslog | grep 'http-echo' -``` - -你应该已经可以看到 `http-echo` 发出的一些系统调用日志， -如果你在控制面板容器内 `curl` 了这个端点，你会看到更多的日志。 - -``` -Jul 6 15:37:40 my-machine kernel: [369128.669452] audit: type=1326 audit(1594067860.484:14536): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=51 compat=0 ip=0x46fe1f code=0x7ffc0000 -Jul 6 15:37:40 my-machine kernel: [369128.669453] audit: type=1326 audit(1594067860.484:14537): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=54 compat=0 ip=0x46fdba code=0x7ffc0000 -Jul 6 15:37:40 my-machine kernel: [369128.669455] audit: type=1326 audit(1594067860.484:14538): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=202 compat=0 ip=0x455e53 code=0x7ffc0000 -Jul 6 15:37:40 my-machine kernel: [369128.669456] audit: type=1326 audit(1594067860.484:14539): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=288 compat=0 ip=0x46fdba code=0x7ffc0000 -Jul 6 15:37:40 my-machine kernel: [369128.669517] audit: type=1326 audit(1594067860.484:14540): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=0 compat=0 ip=0x46fd44 code=0x7ffc0000 -Jul 6 15:37:40 my-machine kernel: [369128.669519] audit: type=1326 audit(1594067860.484:14541): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=270 compat=0 ip=0x4559b1 code=0x7ffc0000 -Jul 6 15:38:40 my-machine kernel: [369188.671648] audit: type=1326 audit(1594067920.488:14559): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=270 compat=0 ip=0x4559b1 code=0x7ffc0000 -Jul 6 15:38:40 my-machine kernel: [369188.671726] audit: type=1326 audit(1594067920.488:14560): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=202 compat=0 ip=0x455e53 code=0x7ffc0000 -``` - -<!-- -You can begin to understand the syscalls required by the `http-echo` process by -looking at the `syscall=` entry on each line. While these are unlikely to -encompass all syscalls it uses, it can serve as a basis for a seccomp profile -for this container. - -Clean up that Pod and Service before moving to the next section: - -``` -kubectl delete pod/audit-pod -kubectl delete svc/audit-pod -``` ---> -通过查看每一行上的 `syscall=` 条目，你可以开始了解 `http-echo` 进程所需的系统调用。 -尽管这些不太可能包含它使用的所有系统调用，但它可以作为该容器的 seccomp 配置文件的基础。 - -开始下一节之前，请清理该 Pod 和 Service： - -``` -kubectl delete pod/audit-pod -kubectl delete svc/audit-pod -``` - -<!-- -## Create Pod with seccomp Profile that Causes Violation - -For demonstration, apply a profile to the Pod that does not allow for any -syscalls. - -Download the correct manifest for your Kubernetes version: ---> -## 使用导致违规的 seccomp 配置文件创建 Pod - -为了进行演示，请将不允许任何系统调用的配置文件应用于 Pod。 - -为你的 Kubernetes 版本下载正确的清单： - -{{< tabs name="violation_pods" >}} -{{< tab name="v1.19 或更新版本（GA）" >}} -{{< codenew file="pods/security/seccomp/ga/violation-pod.yaml" >}} -{{< /tab >}}} -{{{< tab name="v1.19 之前版本（alpha）" >}} -{{< codenew file="pods/security/seccomp/alpha/violation-pod.yaml" >}} -{{< /tab >}} -{{< /tabs >}} -<br> - -<!-- -Create the Pod in the cluster: ---> -在集群中创建 Pod： - -``` -kubectl apply -f violation-pod.yaml -``` - -<!-- -If you check the status of the Pod, you should see that it failed to start. ---> -如果你检查 Pod 的状态，你将会看到该 Pod 启动失败。 - -``` -kubectl get pod/violation-pod -``` - -``` -NAME READY STATUS RESTARTS AGE -violation-pod 0/1 CrashLoopBackOff 1 6s -``` - -<!-- -As seen in the previous example, the `http-echo` process requires quite a few -syscalls. Here seccomp has been instructed to error on any syscall by setting -`"defaultAction": "SCMP_ACT_ERRNO"`. This is extremely secure, but removes the -ability to do anything meaningful. What you really want is to give workloads -only the privileges they need. - -Clean up that Pod and Service before moving to the next section: ---> -如上例所示，`http-echo` 进程需要大量的系统调用。通过设置 `"defaultAction": "SCMP_ACT_ERRNO"`， -来指示 seccomp 在任何系统调用上均出错。这是非常安全的，但是会删除执行有意义的操作的能力。 -你真正想要的只是给工作负载所需的特权。 - -开始下一节之前，请清理该 Pod 和 Service： - -``` -kubectl delete pod/violation-pod -kubectl delete svc/violation-pod -``` - -<!-- -## Create Pod with seccomp Profile that Only Allows Necessary Syscalls - -If you take a look at the `fine-pod.json`, you will notice some of the syscalls -seen in the first example where the profile set `"defaultAction": -"SCMP_ACT_LOG"`. Now the profile is setting `"defaultAction": "SCMP_ACT_ERRNO"`, -but explicitly allowing a set of syscalls in the `"action": "SCMP_ACT_ALLOW"` -block. Ideally, the container will run successfully and you will see no messages -sent to `syslog`. - -Download the correct manifest for your Kubernetes version: ---> -## 使用设置仅允许需要的系统调用的 seccomp 配置文件来创建 Pod - -如果你看一下 `fine-pod.json` 文件，你会注意到在第一个示例中配置文件设置为 `"defaultAction": "SCMP_ACT_LOG"` 的一些系统调用。 -现在，配置文件设置为 `"defaultAction": "SCMP_ACT_ERRNO"`，但是在 `"action": "SCMP_ACT_ALLOW"` 块中明确允许一组系统调用。 -理想情况下，容器将成功运行，并且你将不会看到任何发送到 `syslog` 的消息。 - -为你的 Kubernetes 版本下载正确的清单： - -{{< tabs name="fine_pods" >}} -{{< tab name="v1.19 或更新版本（GA）" >}} -{{< codenew file="pods/security/seccomp/ga/fine-pod.yaml" >}} -{{< /tab >}}} -{{{< tab name="v1.19 之前版本（alpha）" >}} -{{< codenew file="pods/security/seccomp/alpha/fine-pod.yaml" >}} -{{< /tab >}} -{{< /tabs >}} -<br> - -<!-- -Create the Pod in your cluster: ---> -在你的集群上创建Pod： - -``` -kubectl apply -f fine-pod.yaml -``` - -<!-- -The Pod should start successfully. ---> -Pod 应该被成功启动。 - -``` -kubectl get pod/fine-pod -``` - -``` -NAME READY STATUS RESTARTS AGE -fine-pod 1/1 Running 0 30s -``` - -<!-- -Open up a new terminal window and `tail` the output for calls from `http-echo`: ---> -打开一个新的终端窗口，使用 `tail` 命令查看来自 `http-echo` 的调用的输出： - -``` -tail -f /var/log/syslog | grep 'http-echo' -``` - -<!-- -Expose the Pod with a NodePort Service: ---> -使用 NodePort 服务为该 Pod 开一个端口： - -``` -kubectl expose pod/fine-pod --type NodePort --port 5678 -``` - -<!-- -Check what port the Service has been assigned on the node: ---> -检查服务在该节点被分配了什么端口： - -``` -kubectl get svc/fine-pod -``` - -``` -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -fine-pod NodePort 10.111.36.142 <none> 5678:32373/TCP 72s -``` - -<!-- -`curl` the endpoint from inside the kind control plane container: ---> -使用 `curl` 命令从 kind 控制面板容器内部请求这个端点： - -``` -docker exec -it 6a96207fed4b curl localhost:32373 -``` - -``` -just made some syscalls! -``` - -<!-- -You should see no output in the `syslog` because the profile allowed all -necessary syscalls and specified that an error should occur if one outside of -the list is invoked. This is an ideal situation from a security perspective, but -required some effort in analyzing the program. It would be nice if there was a -simple way to get closer to this security without requiring as much effort. - -Clean up that Pod and Service before moving to the next section: ---> -你会看到 `syslog` 中没有任何输出，因为这个配置文件允许了所有需要的系统调用， -并指定如果有发生列表之外的系统调用将发生错误。从安全角度来看，这是理想的情况， -但是在分析程序时需要多付出一些努力。如果有一种简单的方法无需花费太多精力就能更接近此安全性，那就太好了。 - -开始下一节之前，请清理该 Pod 和 Service： - -``` -kubectl delete pod/fine-pod -kubectl delete svc/fine-pod -``` - -<!-- -## Create Pod that uses the Container Runtime Default seccomp Profile - -Most container runtimes provide a sane set of default syscalls that are allowed -or not. The defaults can easily be applied in Kubernetes by using the -`runtime/default` annotation or setting the seccomp type in the security context -of a pod or container to `RuntimeDefault`. - -Download the correct manifest for your Kubernetes version: ---> -## 使用容器运行时默认的 seccomp 配置文件创建 Pod - -大多数容器运行时都提供一组允许或不允许的默认系统调用。通过使用 `runtime/default` 注释 -或将 Pod 或容器的安全上下文中的 seccomp 类型设置为 `RuntimeDefault`，可以轻松地在 Kubernetes 中应用默认值。 - -为你的 Kubernetes 版本下载正确的清单： - -{{< tabs name="default_pods" >}} -{{< tab name="v1.19 或更新版本（GA）" >}} -{{< codenew file="pods/security/seccomp/ga/default-pod.yaml" >}} -{{< /tab >}}} -{{{< tab name="v1.19 之前版本（alpha）" >}} -{{< codenew file="pods/security/seccomp/alpha/default-pod.yaml" >}} -{{< /tab >}} -{{< /tabs >}} -<br> - -<!-- -The default seccomp profile should provide adequate access for most workloads. ---> -默认的 seccomp 配置文件应该为大多数工作负载提供足够的权限。 - -## {{% heading "whatsnext" %}} - -<!-- -Additional resources: - -* [A seccomp Overview](https://lwn.net/Articles/656307/) -* [Seccomp Security Profiles for Docker](https://docs.docker.com/engine/security/seccomp/) ---> -额外的资源： - -* [seccomp 概要](https://lwn.net/Articles/656307/) -* [Seccomp 在 Docker 中的安全配置](https://docs.docker.com/engine/security/seccomp/) \ No newline at end of file diff --git a/content/zh/docs/tutorials/security/seccomp.md b/content/zh/docs/tutorials/security/seccomp.md new file mode 100644 index 0000000000..9fe9b14b12 --- /dev/null +++ b/content/zh/docs/tutorials/security/seccomp.md @@ -0,0 +1,783 @@ +--- +title: 使用 seccomp 限制容器的系统调用 +content_type: tutorial +weight: 20 +min-kubernetes-server-version: v1.22 +--- +<!-- +reviewers: +- hasheddan +- pjbgf +- saschagrunert +title: Restrict a Container's Syscalls with seccomp +content_type: tutorial +weight: 20 +min-kubernetes-server-version: v1.22 +--> + +<!-- overview --> + +{{< feature-state for_k8s_version="v1.19" state="stable" >}} + +<!-- +Seccomp stands for secure computing mode and has been a feature of the Linux +kernel since version 2.6.12. It can be used to sandbox the privileges of a +process, restricting the calls it is able to make from userspace into the +kernel. Kubernetes lets you automatically apply seccomp profiles loaded onto a +{{< glossary_tooltip text="node" term_id="node" >}} to your Pods and containers. + +Identifying the privileges required for your workloads can be difficult. In this +tutorial, you will go through how to load seccomp profiles into a local +Kubernetes cluster, how to apply them to a Pod, and how you can begin to craft +profiles that give only the necessary privileges to your container processes. +--> +Seccomp 代表安全计算（Secure Computing）模式，自 2.6.12 版本以来，一直是 Linux 内核的一个特性。 +它可以用来沙箱化进程的权限，限制进程从用户态到内核态的调用。 +Kubernetes 能使你自动将加载到 {{< glossary_tooltip text="节点" term_id="node" >}}上的 +seccomp 配置文件应用到你的 Pod 和容器。 + +识别你的工作负载所需要的权限是很困难的。在本篇教程中， +你将了解如何将 seccomp 配置文件加载到本地的 Kubernetes 集群中， +如何将它们应用到 Pod，以及如何开始制作只为容器进程提供必要的权限的配置文件。 + +## {{% heading "objectives" %}} + +<!-- +* Learn how to load seccomp profiles on a node +* Learn how to apply a seccomp profile to a container +* Observe auditing of syscalls made by a container process +* Observe behavior when a missing profile is specified +* Observe a violation of a seccomp profile +* Learn how to create fine-grained seccomp profiles +* Learn how to apply a container runtime default seccomp profile +--> +* 了解如何在节点上加载 seccomp 配置文件 +* 了解如何将 seccomp 配置文件应用到容器上 +* 观察容器进程对系统调用的审计 +* 观察指定的配置文件缺失时的行为 +* 观察违反 seccomp 配置文件的行为 +* 了解如何创建细粒度的 seccomp 配置文件 +* 了解如何应用容器运行时所默认的 seccomp 配置文件 + +## {{% heading "prerequisites" %}} + +<!-- +In order to complete all steps in this tutorial, you must install +[kind](/docs/tasks/tools/#kind) and [kubectl](/docs/tasks/tools/#kubectl). + +This tutorial shows some examples that are still alpha (since v1.22) and +others that use only generally available seccomp functionality. You should +make sure that your cluster is +[configured correctly](https://kind.sigs.k8s.io/docs/user/quick-start/#setting-kubernetes-version) +for the version you are using. + +The tutorial also uses the `curl` tool for downloading examples to your computer. +You can adapt the steps to use a different tool if you prefer. +--> +为了完成本篇教程中的所有步骤，你必须安装 [kind](/zh/docs/tasks/tools/#kind) +和 [kubectl](/zh/docs/tasks/tools/#kubectl)。 + +本篇教程演示的某些示例仍然是 alpha 状态（自 v1.22 起），另一些示例则仅使用 seccomp 正式发布的功能。 +你应该确保，针对你使用的版本， +[正确配置](https://kind.sigs.k8s.io/docs/user/quick-start/#setting-kubernetes-version)了集群。 + +本篇教程也使用了 `curl` 工具来下载示例到你的计算机上。 +你可以使用其他自己偏好的工具来自适应这些步骤。 + +{{< note >}} +<!-- +It is not possible to apply a seccomp profile to a container running with +`privileged: true` set in the container's `securityContext`. Privileged containers always +run as `Unconfined`. +--> +无法将 seccomp 配置文件应用于在容器的 `securityContext` 中设置了 `privileged: true` 的容器。 +特权容器始终以 `Unconfined` 的方式运行。 +{{< /note >}} + +<!-- steps --> + +<!-- +## Download example seccomp profiles {#download-profiles} + +The contents of these profiles will be explored later on, but for now go ahead +and download them into a directory named `profiles/` so that they can be loaded +into the cluster. +--> +## 下载示例 seccomp 配置文件 {#download-profiles} + +这些配置文件的内容将在稍后进行分析， +现在先将它们下载到名为 `profiles/` 的目录中，以便将它们加载到集群中。 + +{{< tabs name="tab_with_code" >}} +{{{< tab name="audit.json" >}} +{{< codenew file="pods/security/seccomp/profiles/audit.json" >}} +{{< /tab >}} +{{< tab name="violation.json" >}} +{{< codenew file="pods/security/seccomp/profiles/violation.json" >}} +{{< /tab >}}} +{{< tab name="fine-grained.json" >}} +{{< codenew file="pods/security/seccomp/profiles/fine-grained.json" >}} +{{< /tab >}}} +{{< /tabs >}} + +<!-- Run these commands: --> +执行这些命令： + +```shell +mkdir ./profiles +curl -L -o profiles/audit.json https://k8s.io/examples/pods/security/seccomp/profiles/audit.json +curl -L -o profiles/violation.json https://k8s.io/examples/pods/security/seccomp/profiles/violation.json +curl -L -o profiles/fine-grained.json https://k8s.io/examples/pods/security/seccomp/profiles/fine-grained.json +ls profiles +``` + +<!-- You should see three profiles listed at the end of the final step: --> +你应该看到在最后一步的末尾列出有三个配置文件： +``` +audit.json fine-grained.json violation.json +``` + +<!-- +## Create a local Kubernetes cluster with kind + +For simplicity, [kind](https://kind.sigs.k8s.io/) can be used to create a single +node cluster with the seccomp profiles loaded. Kind runs Kubernetes in Docker, +so each node of the cluster is a container. This allows for files +to be mounted in the filesystem of each container similar to loading files +onto a node. +--> + +## 使用 kind 创建本地 Kubernetes 集群 {#create-a-local-kubernetes-cluster-with-kind} + +为简单起见，[kind](https://kind.sigs.k8s.io/) 可用来创建加载了 seccomp 配置文件的单节点集群。 +Kind 在 Docker 中运行 Kubernetes，因此集群的每个节点都是一个容器。 +这允许将文件挂载到每个容器的文件系统中，类似于将文件加载到节点上。 + +{{< codenew file="pods/security/seccomp/kind.yaml" >}} + +<!-- +Download that example kind configuration, and save it to a file named `kind.yaml`: +--> +下载该示例 kind 配置，并将其保存到名为 `kind.yaml` 的文件中： +```shell +curl -L -O https://k8s.io/examples/pods/security/seccomp/kind.yaml +``` + +<!-- +You can set a specific Kubernetes version by setting the node's container image. +See [Nodes](https://kind.sigs.k8s.io/docs/user/configuration/#nodes) within the +kind documentation about configuration for more details on this. +This tutorial assumes you are using Kubernetes {{< param "version" >}}. +--> +你可以通过设置节点的容器镜像来设置特定的 Kubernetes 版本。 +有关此类配置的更多信息， +参阅 kind 文档中[节点](https://kind.sigs.k8s.io/docs/user/configuration/#nodes)小节。 +本篇教程假定你正在使用 Kubernetes {{< param "version" >}}。 + +<!-- +As an alpha feature, you can configure Kubernetes to use the profile that the +{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} +prefers by default, rather than falling back to `Unconfined`. +If you want to try that, see +[enable the use of `RuntimeDefault` as the default seccomp profile for all workloads](#enable-the-use-of-runtimedefault-as-the-default-seccomp-profile-for-all-workloads) +before you continue. +--> +作为 alpha 特性，你可以将 Kubernetes 配置为使用 +{{< glossary_tooltip text="容器运行时" term_id="container-runtime" >}} +默认首选的配置文件，而不是回退到 `Unconfined`。 +如果你想尝试，请在继续之前参阅 +[启用使用 `RuntimeDefault` 作为所有工作负载的默认 seccomp 配置文件](#enable-runtimedefault-as-default) + +<!-- +Once you have a kind configuration in place, create the kind cluster with +that configuration: +--> +有了 kind 配置后，使用该配置创建 kind 集群： + +```shell +kind create cluster --config=kind.yaml +``` + +<!-- +After the new Kubernetes cluster is ready, identify the Docker container running +as the single node cluster: +--> +新的 Kubernetes 集群准备就绪后，找出作为单节点集群运行的 Docker 容器： + +```shell +docker ps +``` + +<!-- +You should see output indicating that a container is running with name +`kind-control-plane`. The output is similar to: +--> +你应该看到输出中名为 `kind-control-plane` 的容器正在运行。 +输出类似于： +``` +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +6a96207fed4b kindest/node:v1.18.2 "/usr/local/bin/entr…" 27 seconds ago Up 24 seconds 127.0.0.1:42223->6443/tcp kind-control-plane +``` + +<!-- +If observing the filesystem of that container, you should see that the +`profiles/` directory has been successfully loaded into the default seccomp path +of the kubelet. Use `docker exec` to run a command in the Pod: +--> +如果观察该容器的文件系统， +你应该会看到 `profiles/` 目录已成功加载到 kubelet 的默认 seccomp 路径中。 +使用 `docker exec` 在 Pod 中运行命令： + +```shell +# 将 6a96207fed4b 更改为你从 “docker ps” 看到的容器 ID +docker exec -it 6a96207fed4b ls /var/lib/kubelet/seccomp/profiles +``` + +``` +audit.json fine-grained.json violation.json +``` + +<!-- +You have verified that these seccomp profiles are available to the kubelet +running within kind. +--> +你已验证这些 seccomp 配置文件可用于在 kind 中运行的 kubelet。 + +<!-- +## Enable the use of `RuntimeDefault` as the default seccomp profile for all workloads +--> +## 启用使用 `RuntimeDefault` 作为所有工作负载的默认 seccomp 配置文件 {#enable-runtimedefault-as-default} + +{{< feature-state state="alpha" for_k8s_version="v1.22" >}} + +<!-- +`SeccompDefault` is an optional kubelet +[feature gate](/docs/reference/command-line-tools-reference/feature-gates) as +well as corresponding `--seccomp-default` +[command line flag](/docs/reference/command-line-tools-reference/kubelet). +Both have to be enabled simultaneously to use the feature. +--> +`SeccompDefault` 是一个可选的 kubelet [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates) +以及相应的 `--seccomp-default` [命令行标志](/zh/docs/reference/command-line-tools-reference/kubelet)。 +两者必须同时启用才能使用该功能。 + +<!-- +If enabled, the kubelet will use the `RuntimeDefault` seccomp profile by default, which is +defined by the container runtime, instead of using the `Unconfined` (seccomp disabled) mode. +The default profiles aim to provide a strong set +of security defaults while preserving the functionality of the workload. It is +possible that the default profiles differ between container runtimes and their +release versions, for example when comparing those from CRI-O and containerd. +--> +如果启用，kubelet 将会默认使用 `RuntimeDefault` seccomp 配置文件， +（这一配置文明是由容器运行时定义的），而不是使用 `Unconfined`（禁用 seccomp）模式。 +默认的配置文件旨在提供一组限制性较强且能保留工作负载功能的安全默认值。 +不同容器运行时及其不同发布版本之间的默认配置文件可能有所不同， +例如在比较来自 CRI-O 和 containerd 的配置文件时。 + +{{< note >}} +<!-- +Enabling the feature will neither change the Kubernetes +`securityContext.seccompProfile` API field nor add the deprecated annotations of +the workload. This provides users the possibility to rollback anytime without +actually changing the workload configuration. Tools like +[`crictl inspect`](https://github.com/kubernetes-sigs/cri-tools) can be used to +verify which seccomp profile is being used by a container. +--> +启用该功能既不会更改 Kubernetes `securityContext.seccompProfile` API 字段， +也不会添加已弃用的工作负载注解。 +这为用户提供了随时回滚的可能性，而且无需实际更改工作负载配置。 +[`crictl inspect`](https://github.com/kubernetes-sigs/cri-tools) +之类的工具可用于验证容器正在使用哪个 seccomp 配置文件。 +{{< /note >}} + +<!-- +Some workloads may require a lower amount of syscall restrictions than others. +This means that they can fail during runtime even with the `RuntimeDefault` +profile. To mitigate such a failure, you can: + +- Run the workload explicitly as `Unconfined`. +- Disable the `SeccompDefault` feature for the nodes. Also making sure that + workloads get scheduled on nodes where the feature is disabled. +- Create a custom seccomp profile for the workload. +--> +与其他工作负载相比，某些工作负载可能需要更少的系统调用限制。 +这意味着即使使用 `RuntimeDefault` 配置文件，它们也可能在运行时失败。 +要应对此类故障，你可以： + +- 将工作负载显式运行为 `Unconfined`。 +- 禁用节点的 `SeccompDefault` 功能。还要确保工作负载被调度到禁用该功能的节点上。 +- 为工作负载创建自定义 seccomp 配置文件。 + +<!-- +If you were introducing this feature into production-like cluster, the Kubernetes project +recommends that you enable this feature gate on a subset of your nodes and then +test workload execution before rolling the change out cluster-wide. + +More detailed information about a possible upgrade and downgrade strategy can be +found in the [related Kubernetes Enhancement Proposal (KEP)](https://github.com/kubernetes/enhancements/tree/a70cc18/keps/sig-node/2413-seccomp-by-default#upgrade--downgrade-strategy). +--> +如果你将此功能引入到类似生产的集群中， +Kubernetes 项目建议你在部分节点上启用此特性门控， +然后在整个集群范围内推出更改之前，测试工作负载执行情况。 + +有关可能的升级和降级策略的更多详细信息， +请参阅[相关的 Kubernetes 增强提案 (KEP)](https://github.com/kubernetes/enhancements/tree/a70cc18/keps/sig-node/2413-seccomp-by-default#upgrade--downgrade-strategy)。 + +<!-- +Since the feature is in alpha state it is disabled per default. To enable it, +pass the flags `--feature-gates=SeccompDefault=true --seccomp-default` to the +`kubelet` CLI or enable it via the [kubelet configuration +file](/docs/tasks/administer-cluster/kubelet-config-file/). To enable the +feature gate in [kind](https://kind.sigs.k8s.io), ensure that `kind` provides +the minimum required Kubernetes version and enables the `SeccompDefault` feature +[in the kind configuration](https://kind.sigs.k8s.io/docs/user/quick-start/#enable-feature-gates-in-your-cluster): +--> +由于此特性处于 alpha 阶段，默认是被禁用的。 +要启用它，传递标志 `--feature-gates=SeccompDefault=true --seccomp-default` 到 +kubelet CLI 或者通过 [kubelet 配置文件](/docs/tasks/administer-cluster/kubelet-config-file/)启用。 +要在 [kind](https://kind.sigs.k8s.io) 启用特性门控， +请确保 `kind` 提供所需的最低 Kubernetes 版本， +并[在 kind 配置中](https://kind.sigs.k8s.io/docs/user/quick-start/#enable-feature-gates-in-your-cluster) +启用了 `SeccompDefault` 特性： + +```yaml +kind: Cluster +apiVersion: kind.x-k8s.io/v1alpha4 +featureGates: + SeccompDefault: true +nodes: + - role: control-plane + image: kindest/node:v1.23.0@sha256:49824ab1727c04e56a21a5d8372a402fcd32ea51ac96a2706a12af38934f81ac + kubeadmConfigPatches: + - | + kind: JoinConfiguration + nodeRegistration: + kubeletExtraArgs: + seccomp-default: "true" + - role: worker + image: kindest/node:v1.23.0@sha256:49824ab1727c04e56a21a5d8372a402fcd32ea51ac96a2706a12af38934f81ac + kubeadmConfigPatches: + - | + kind: JoinConfiguration + nodeRegistration: + kubeletExtraArgs: + feature-gates: SeccompDefault=true + seccomp-default: "true" +``` + +<!-- If the cluster is ready, then running a pod: --> +如果集群已就绪，则运行一个 Pod： + +```shell +kubectl run --rm -it --restart=Never --image=alpine alpine -- sh +``` + +<!-- +Should now have the default seccomp profile attached. This can be verified by +using `docker exec` to run `crictl inspect` for the container on the kind +worker: +--> +现在应该附加了默认的 seccomp 配置文件。 +这可以通过使用 `docker exec` 为 kind 上的容器运行 `crictl inspect` 来验证： + +```shell +docker exec -it kind-worker bash -c \ + 'crictl inspect $(crictl ps --name=alpine -q) | jq .info.runtimeSpec.linux.seccomp' +``` + +```json +{ + "defaultAction": "SCMP_ACT_ERRNO", + "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32"], + "syscalls": [ + { + "names": ["..."] + } + ] +} +``` + +<!-- +## Create a Pod with a seccomp profile for syscall auditing + +To start off, apply the `audit.json` profile, which will log all syscalls of the +process, to a new Pod. + +Here's a manifest for that Pod: +--> +## 使用 seccomp 配置文件创建 Pod 以进行系统调用审计 {#create-a-pod-with-a-seccomp-profile-for-syscall-auditing} + +首先，将 `audit.json` 配置文件应用到新的 Pod 上，该配置文件将记录进程的所有系统调用。 + +这是该 Pod 的清单： + +{{< codenew file="pods/security/seccomp/ga/audit-pod.yaml" >}} + +{{< note >}} +<!-- +The functional support for the already deprecated seccomp annotations +`seccomp.security.alpha.kubernetes.io/pod` (for the whole pod) and +`container.seccomp.security.alpha.kubernetes.io/[name]` (for a single container) +is going to be removed with the release of Kubernetes v1.25. Please always use +the native API fields in favor of the annotations. +--> +已弃用的 seccomp 注解 `seccomp.security.alpha.kubernetes.io/pod`（针对整个 Pod）和 +`container.seccomp.security.alpha.kubernetes.io/[name]`（针对单个容器） +将随着 Kubernetes v1.25 的发布而被删除。 +请在可能的情况下使用原生 API 字段而不是注解。 +{{< /note >}} + +<!-- Create the Pod in the cluster: --> +在集群中创建 Pod： + +```shell +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/audit-pod.yaml +``` + +<!-- +This profile does not restrict any syscalls, so the Pod should start +successfully. +--> +此配置文件不限制任何系统调用，因此 Pod 应该成功启动。 + +```shell +kubectl get pod/audit-pod +``` + +``` +NAME READY STATUS RESTARTS AGE +audit-pod 1/1 Running 0 30s +``` + +<!-- +In order to be able to interact with this endpoint exposed by this +container, create a NodePort {{< glossary_tooltip text="Services" term_id="service" >}} +that allows access to the endpoint from inside the kind control plane container. +--> +为了能够与容器暴露的端点交互， +创建一个 NodePort 类型的 {{< glossary_tooltip text="Service" term_id="service" >}}， +允许从 kind 控制平面容器内部访问端点。 + +```shell +kubectl expose pod audit-pod --type NodePort --port 5678 +``` + +<!-- Check what port the Service has been assigned on the node. --> +检查 Service 在节点上分配的端口。 + +```shell +kubectl get service audit-pod +``` + +<!-- The output is similar to: --> +输出类似于： +``` +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +audit-pod NodePort 10.111.36.142 <none> 5678:32373/TCP 72s +``` + +<!-- +Now you can use `curl` to access that endpoint from inside the kind control plane container, +at the port exposed by this Service. Use `docker exec` to run the `curl` command within the +container belonging to that control plane container: +--> +现在，你可以使用 `curl` 从 kind 控制平面容器内部访问该端点，位于该服务所公开的端口上。 +使用 `docker exec` 在属于该控制平面容器的容器中运行 `curl` 命令： + +```shell +# 将 6a96207fed4b 更改为你从 “docker ps” 看到的控制平面容器 ID +docker exec -it 6a96207fed4b curl localhost:32373 +``` + +``` +just made some syscalls! +``` + +<!-- +You can see that the process is running, but what syscalls did it actually make? +Because this Pod is running in a local cluster, you should be able to see those +in `/var/log/syslog`. Open up a new terminal window and `tail` the output for +calls from `http-echo`: +--> +你可以看到该进程正在运行，但它实际上进行了哪些系统调用？ +因为这个 Pod 在本地集群中运行，你应该能够在 `/var/log/syslog` 中看到它们。 +打开一个新的终端窗口并 `tail` 来自 `http-echo` 的调用的输出： + +```shell +tail -f /var/log/syslog | grep 'http-echo' +``` + +<!-- +You should already see some logs of syscalls made by `http-echo`, and if you +`curl` the endpoint in the control plane container you will see more written. + +For example: +--> +你应该已经看到了一些由 `http-echo` 进行的系统调用的日志， +如果你在控制平面容器中 `curl` 端点，你会看到更多的写入。 + +例如： +``` +Jul 6 15:37:40 my-machine kernel: [369128.669452] audit: type=1326 audit(1594067860.484:14536): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=51 compat=0 ip=0x46fe1f code=0x7ffc0000 +Jul 6 15:37:40 my-machine kernel: [369128.669453] audit: type=1326 audit(1594067860.484:14537): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=54 compat=0 ip=0x46fdba code=0x7ffc0000 +Jul 6 15:37:40 my-machine kernel: [369128.669455] audit: type=1326 audit(1594067860.484:14538): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=202 compat=0 ip=0x455e53 code=0x7ffc0000 +Jul 6 15:37:40 my-machine kernel: [369128.669456] audit: type=1326 audit(1594067860.484:14539): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=288 compat=0 ip=0x46fdba code=0x7ffc0000 +Jul 6 15:37:40 my-machine kernel: [369128.669517] audit: type=1326 audit(1594067860.484:14540): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=0 compat=0 ip=0x46fd44 code=0x7ffc0000 +Jul 6 15:37:40 my-machine kernel: [369128.669519] audit: type=1326 audit(1594067860.484:14541): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=270 compat=0 ip=0x4559b1 code=0x7ffc0000 +Jul 6 15:38:40 my-machine kernel: [369188.671648] audit: type=1326 audit(1594067920.488:14559): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=270 compat=0 ip=0x4559b1 code=0x7ffc0000 +Jul 6 15:38:40 my-machine kernel: [369188.671726] audit: type=1326 audit(1594067920.488:14560): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=202 compat=0 ip=0x455e53 code=0x7ffc0000 +``` + +<!-- +You can begin to understand the syscalls required by the `http-echo` process by +looking at the `syscall=` entry on each line. While these are unlikely to +encompass all syscalls it uses, it can serve as a basis for a seccomp profile +for this container. + +Clean up that Pod and Service before moving to the next section: +--> +通过查看每一行的 `syscall=` 条目，你可以开始了解 `http-echo` 进程所需的系统调用。 +虽然这些不太可能包含它使用的所有系统调用，但它可以作为此容器的 seccomp 配置文件的基础。 + +在转到下一部分之前清理该 Pod 和 Service： + +```shell +kubectl delete service audit-pod --wait +kubectl delete pod audit-pod --wait --now +``` + +<!-- +## Create Pod with seccomp profile that causes violation + +For demonstration, apply a profile to the Pod that does not allow for any +syscalls. + +The manifest for this demonstration is: +--> +## 使用导致违规的 seccomp 配置文件创建 Pod {#create-pod-with-seccomp-profile-that-causes-violation} + +出于演示目的，将配置文件应用于不允许任何系统调用的 Pod 上。 + +此演示的清单是： + +{{< codenew file="pods/security/seccomp/ga/violation-pod.yaml" >}} + +<!-- Attempt to create the Pod in the cluster: --> +尝试在集群中创建 Pod： + +```shell +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/violation-pod.yaml +``` + +<!-- +The Pod creates, but there is an issue. +If you check the status of the Pod, you should see that it failed to start. +--> +Pod 创建，但存在问题。 +如果你检查 Pod 状态，你应该看到它没有启动。 + +```shell +kubectl get pod/violation-pod +``` + +``` +NAME READY STATUS RESTARTS AGE +violation-pod 0/1 CrashLoopBackOff 1 6s +``` + +<!-- +As seen in the previous example, the `http-echo` process requires quite a few +syscalls. Here seccomp has been instructed to error on any syscall by setting +`"defaultAction": "SCMP_ACT_ERRNO"`. This is extremely secure, but removes the +ability to do anything meaningful. What you really want is to give workloads +only the privileges they need. + +Clean up that Pod before moving to the next section: +--> +如上例所示，`http-echo` 进程需要相当多的系统调用。 +这里 seccomp 已通过设置 `"defaultAction": "SCMP_ACT_ERRNO"` 被指示为在发生任何系统调用时报错。 +这是非常安全的，但消除了做任何有意义的事情的能力。 +你真正想要的是只给工作负载它们所需要的权限。 + +在转到下一部分之前清理该 Pod： + +```shell +kubectl delete pod violation-pod --wait --now +``` + +<!-- +## Create Pod with seccomp profile that only allows necessary syscalls + +If you take a look at the `fine-grained.json` profile, you will notice some of the syscalls +seen in syslog of the first example where the profile set `"defaultAction": +"SCMP_ACT_LOG"`. Now the profile is setting `"defaultAction": "SCMP_ACT_ERRNO"`, +but explicitly allowing a set of syscalls in the `"action": "SCMP_ACT_ALLOW"` +block. Ideally, the container will run successfully and you will see no messages +sent to `syslog`. + +The manifest for this example is: +--> +## 使用只允许必要的系统调用的 seccomp 配置文件创建 Pod {#create-pod-with-seccomp-profile-that-only-allows-necessary-syscalls} + +如果你看一看 `fine-grained.json` 配置文件， +你会注意到第一个示例的 syslog 中看到的一些系统调用， +其中配置文件设置为 `"defaultAction": "SCMP_ACT_LOG"`。 +现在的配置文件设置 `"defaultAction": "SCMP_ACT_ERRNO"`, +但在 `"action": "SCMP_ACT_ALLOW"` 块中明确允许一组系统调用。 +理想情况下，容器将成功运行，并且你看到没有消息发送到 `syslog`。 + +此示例的清单是： + +{{< codenew file="pods/security/seccomp/ga/fine-pod.yaml" >}} + +<!-- Create the Pod in your cluster: --> +在你的集群中创建 Pod： + +```shell +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/fine-pod.yaml +``` + +```shell +kubectl get pod fine-pod +``` + +<!-- The Pod should be showing as having started successfully: --> +此 Pod 应该显示为已成功启动： +``` +NAME READY STATUS RESTARTS AGE +fine-pod 1/1 Running 0 30s +``` + +<!-- +Open up a new terminal window and use `tail` to monitor for log entries that +mention calls from `http-echo`: +--> +打开一个新的终端窗口并使用 `tail` 来监视提到来自 `http-echo` 的调用的日志条目： + +```shell +# 你计算机上的日志路径可能与 “/var/log/syslog” 不同 +tail -f /var/log/syslog | grep 'http-echo' +``` + +<!-- Next, expose the Pod with a NodePort Service: --> +接着，使用 NodePort Service 公开 Pod： + +```shell +kubectl expose pod fine-pod --type NodePort --port 5678 +``` + +<!-- Check what port the Service has been assigned on the node: --> +检查节点上的 Service 分配了什么端口： + +```shell +kubectl get service fine-pod +``` + +<!-- The output is similar to: --> +输出类似于： +``` +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +fine-pod NodePort 10.111.36.142 <none> 5678:32373/TCP 72s +``` + +<!-- Use `curl` to access that endpoint from inside the kind control plane container: --> +使用 `curl` 从 kind 控制平面容器内部访问端点： + +```shell +# 将 6a96207fed4b 更改为你从 “docker ps” 看到的控制平面容器 ID +docker exec -it 6a96207fed4b curl localhost:32373 +``` + +``` +just made some syscalls! +``` + +<!-- +You should see no output in the `syslog`. This is because the profile allowed all +necessary syscalls and specified that an error should occur if one outside of +the list is invoked. This is an ideal situation from a security perspective, but +required some effort in analyzing the program. It would be nice if there was a +simple way to get closer to this security without requiring as much effort. + +Clean up that Pod and Service before moving to the next section: +--> +你应该在 `syslog` 中看不到任何输出。 +这是因为配置文件允许所有必要的系统调用，并指定如果调用列表之外的系统调用应发生错误。 +从安全角度来看，这是一种理想的情况，但需要在分析程序时付出一些努力。 +如果有一种简单的方法可以在不需要太多努力的情况下更接近这种安全性，那就太好了。 + +在转到下一部分之前清理该 Pod 和服务： + +```shell +kubectl delete service fine-pod --wait +kubectl delete pod fine-pod --wait --now +``` + +<!-- +## Create Pod that uses the container runtime default seccomp profile + +Most container runtimes provide a sane set of default syscalls that are allowed +or not. You can adopt these defaults for your workload by setting the seccomp +type in the security context of a pod or container to `RuntimeDefault`. +--> +## 创建使用容器运行时默认 seccomp 配置文件的 Pod {#create-pod-that-uses-the-container-runtime-default-seccomp-profile} + +大多数容器运行时都提供了一组合理的默认系统调用，以及是否允许执行这些系统调用。 +你可以通过将 Pod 或容器的安全上下文中的 seccomp 类型设置为 `RuntimeDefault` +来为你的工作负载采用这些默认值。 + +{{< note >}} +<!-- +If you have the `SeccompDefault` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) enabled, then Pods use the `RuntimeDefault` seccomp profile whenever +no other seccomp profile is specified. Otherwise, the default is `Unconfined`. +--> +如果你已经启用了 `SeccompDefault` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)， +只要没有指定其他 seccomp 配置文件，那么 Pod 就会使用 `SeccompDefault` 的 seccomp 配置文件。 +否则，默认值为 `Unconfined`。 +{{< /note >}} + +<!-- +Here's a manifest for a Pod that requests the `RuntimeDefault` seccomp profile +for all its containers: +--> +这是一个 Pod 的清单，它要求其所有容器使用 `RuntimeDefault` seccomp 配置文件： + +{{< codenew file="pods/security/seccomp/ga/default-pod.yaml" >}} + +<!-- Create that Pod: --> +创建此 Pod： +```shell +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/default-pod.yaml +``` + +```shell +kubectl get pod default-pod +``` + +<!-- The Pod should be showing as having started successfully: --> +此 Pod 应该显示为成功启动： +``` +NAME READY STATUS RESTARTS AGE +default-pod 1/1 Running 0 20s +``` + +<!-- Finally, now that you saw that work OK, clean up: --> +最后，你看到一切正常之后，请清理： + +```shell +kubectl delete pod default-pod --wait --now +``` + +## {{% heading "whatsnext" %}} + +<!-- +You can learn more about Linux seccomp: + +* [A seccomp Overview](https://lwn.net/Articles/656307/) +* [Seccomp Security Profiles for Docker](https://docs.docker.com/engine/security/seccomp/) +--> +你可以了解有关 Linux seccomp 的更多信息： + +* [seccomp 概述](https://lwn.net/Articles/656307/) +* [Docker 的 Seccomp 安全配置文件](https://docs.docker.com/engine/security/seccomp/) \ No newline at end of file From 88d33034b79efa3f5845383e245cf5fa05999a16 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Filip=20K=C5=99epinsk=C3=BD?= <fkrepins@redhat.com> Date: Wed, 2 Feb 2022 19:52:39 +0100 Subject: [PATCH 035/104] add note about Terminating pods when rolling out a Deployment - fix number of Pods when describing the rollout functionality --- .../workloads/controllers/deployment.md | 22 +++++++++++++------ 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/deployment.md b/content/en/docs/concepts/workloads/controllers/deployment.md index ad3170b1d2..30a7457d4c 100644 --- a/content/en/docs/concepts/workloads/controllers/deployment.md +++ b/content/en/docs/concepts/workloads/controllers/deployment.md @@ -255,10 +255,11 @@ up to 3 replicas, as well as scaling down the old ReplicaSet to 0 replicas. Deployment also ensures that only a certain number of Pods are created above the desired number of Pods. By default, it ensures that at most 125% of the desired number of Pods are up (25% max surge). - For example, if you look at the above Deployment closely, you will see that it first created a new Pod, - then deleted some old Pods, and created new ones. It does not kill old Pods until a sufficient number of + For example, if you look at the above Deployment closely, you will see that it first creates a new Pod, + then deletes an old Pod, and creates another new one. It does not kill old Pods until a sufficient number of new Pods have come up, and does not create new Pods until a sufficient number of old Pods have been killed. - It makes sure that at least 2 Pods are available and that at max 4 Pods in total are available. + It makes sure that at least 3 Pods are available and that at max 4 Pods in total are available. In case of + a Deployment with 4 replicas, the number of Pods would be between 3 and 5. * Get details of your Deployment: ```shell @@ -305,10 +306,17 @@ up to 3 replicas, as well as scaling down the old ReplicaSet to 0 replicas. ``` Here you see that when you first created the Deployment, it created a ReplicaSet (nginx-deployment-2035384211) and scaled it up to 3 replicas directly. When you updated the Deployment, it created a new ReplicaSet - (nginx-deployment-1564180365) and scaled it up to 1 and then scaled down the old ReplicaSet to 2, so that at - least 2 Pods were available and at most 4 Pods were created at all times. It then continued scaling up and down - the new and the old ReplicaSet, with the same rolling update strategy. Finally, you'll have 3 available replicas - in the new ReplicaSet, and the old ReplicaSet is scaled down to 0. + (nginx-deployment-1564180365) and scaled it up to 1 and waited for it to come up. Then it scaled down the old ReplicaSet + to 2 and scaled up the new ReplicaSet to 2 so that at least 3 Pods were available and at most 4 Pods were created at all times. + It then continued scaling up and down the new and the old ReplicaSet, with the same rolling update strategy. + Finally, you'll have 3 available replicas in the new ReplicaSet, and the old ReplicaSet is scaled down to 0. + +{{< note >}} +Kubernetes doesn't count terminating Pods when calculating the number of `availableReplicas`, which must be between +`replicas - maxUnavailable` and `replicas + maxSurge`. As a result, you might notice that there are more Pods than +expected during a rollout, and that the total resources consumed by the Deployment is more than `replicas + maxSurge` +until the `terminationGracePeriodSeconds` of the terminating Pods expires. +{{< /note >}} ### Rollover (aka multiple updates in-flight) From eeb95d89b889a6838d46db27150e51afd9149d59 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Fri, 25 Feb 2022 20:12:05 +0800 Subject: [PATCH 036/104] [zh] Translate kubeadm kubeconfig command reference This PR renames the kubeadm kubeconfig command reference as did in the English upstream. --- ...ha_kubeconfig.md => kubeadm_kubeconfig.md} | 40 +++++++++-------- ...fig_user.md => kubeadm_kubeconfig_user.md} | 43 +++++++++++++------ .../setup-tools/kubeadm/kubeadm-kubeconfig.md | 33 ++++++++++++++ 3 files changed, 87 insertions(+), 29 deletions(-) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_kubeconfig.md => kubeadm_kubeconfig.md} (50%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_kubeconfig_user.md => kubeadm_kubeconfig_user.md} (64%) create mode 100644 content/zh/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig.md similarity index 50% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig.md index b5168e2cb1..323fddd39e 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig.md @@ -1,27 +1,32 @@ - <!-- +The file is auto-generated from the Go source code of the component using a generic +[generator](https://github.com/kubernetes-sigs/reference-docs/). To learn how +to generate the reference documentation, please read +[Contributing to the reference documentation](/docs/contribute/generate-ref-docs/). +To update the reference conent, please follow the +[Contributing upstream](/docs/contribute/generate-ref-docs/contribute-upstream/) +guide. You can file document formatting bugs against the +[reference-docs](https://github.com/kubernetes-sigs/reference-docs/) project. +--> +<!-- +Kubeconfig file utilities + ### Synopsis ---> -### 概要 - -<!-- Kubeconfig file utilities. ---> -kubeconfig 文件应用程序。 - -<!-- Alpha Disclaimer: this command is currently alpha. --> - -Alpha 免责声明：此命令当前为 alpha 功能。 - -<!-- ### Options --> +Kubeconfig 文件工具。 + +### 概要 + +kubeconfig 文件工具。 + ### 选项 - <table style="width: 100%; table-layout: fixed;"> +<table style="width: 100%; table-layout: fixed;"> <colgroup> <col span="1" style="width: 10px;" /> <col span="1" /> @@ -41,11 +46,12 @@ kubeconfig 操作的帮助命令 </tbody> </table> -<!-- ### Options inherited from parent commands --> - +<!-- +### Options inherited from parent commands +--> ### 从父命令继承的选项 - <table style="width: 100%; table-layout: fixed;"> +<table style="width: 100%; table-layout: fixed;"> <colgroup> <col span="1" style="width: 10px;" /> <col span="1" /> diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig_user.md similarity index 64% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig_user.md index daa5b679e2..e178c5e50a 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig_user.md @@ -1,25 +1,33 @@ - <!-- -### Synopsis +The file is auto-generated from the Go source code of the component using a generic +[generator](https://github.com/kubernetes-sigs/reference-docs/). To learn how +to generate the reference documentation, please read +[Contributing to the reference documentation](/docs/contribute/generate-ref-docs/). +To update the reference conent, please follow the +[Contributing upstream](/docs/contribute/generate-ref-docs/contribute-upstream/) +guide. You can file document formatting bugs against the +[reference-docs](https://github.com/kubernetes-sigs/reference-docs/) project. --> -### 概要 <!-- +Output a kubeconfig file for an additional user + +### Synopsis + Output a kubeconfig file for an additional user. --> -为其他用户输出 kubeconfig 文件。 +为其他用户输出一个 kubeconfig 文件。 -<!-- -Alpha Disclaimer: this command is currently alpha. ---> -Alpha 免责声明：此命令当前为 Alpha 功能。 +### 概要 + +为其他用户输出一个 kubeconfig 文件。 ``` kubeadm alpha kubeconfig user [flags] ``` <!-- -### Examples # Output a kubeconfig file for an additional user named foo +### Examples ``` # Output a kubeconfig file for an additional user named foo using a kubeadm config file bar @@ -30,7 +38,7 @@ kubeadm alpha kubeconfig user [flags] ``` # 使用名为 bar 的 kubeadm 配置文件为名为 foo 的另一用户输出 kubeconfig 文件 -kubeadm alpha kubeconfig user --client-name=foo --config=bar +kubeadm kubeconfig user --client-name=foo --config=bar ``` <!-- @@ -82,7 +90,7 @@ user 操作的帮助命令 </tr> <tr> -<td colspan="2">--org stringSlice</td> +<td colspan="2">--org strings</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -102,10 +110,21 @@ The orgnizations of the client certificate. It will be used as the O if client c <!-- The token that should be used as the authentication mechanism for this kubeconfig, instead of client certificates --> -应该用此 kubeconfig 的身份验证机制的令牌，而不是客户端证书 +应该用此令牌做为 kubeconfig 的身份验证机制，而不是客户端证书 </td> </tr> +<tr> +<td colspan="2">--validity-period duration     Default: 8760h0m0s</td> +</tr> +<tr> +<td></td><td style="line-height: 130%; word-wrap: break-word;"><!--The validity period of the client certificate. It is an offset from the current time.--> +<p> +客户证书的合法期限。所设置值为相对当前时间的偏移。 +</p></td> +</tr> + + </tbody> </table> diff --git a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md new file mode 100644 index 0000000000..c90f621bc2 --- /dev/null +++ b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md @@ -0,0 +1,33 @@ +--- +title: kubeadm kubeconfig +content_type: concept +weight: 90 +--- + +<!-- +`kubeadm kubeconfig` provides utilities for managing kubeconfig files. + +For examples on how to use `kubeadm kubeconfig user` see +[Generating kubeconfig files for additional users](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#kubeconfig-additional-users). +--> +`kubeadm kubeconfig` 提供用来管理 kubeconfig 文件的工具。 + +如果希望查看如何使用 `kubeadm kubeconfig user` 的示例，请参阅 +[为其他用户生成 kubeconfig 文件](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#kubeconfig-additional-users). + +## kubeadm kubeconfig {#cmd-kubeconfig} + +{{< tabs name="tab-kubeconfig" >}} +{{< tab name="overview" include="generated/kubeadm_kubeconfig.md" />}} +{{< /tabs >}} + +## kubeadm kubeconfig user {#cmd-kubeconfig-user} + +<!-- +This command can be used to output a kubeconfig file for an additional user. +--> +此命令可用来为其他用户生成一个 kubeconfig 文件。 + +{{< tabs name="tab-kubeconfig-user" >}} +{{< tab name="user" include="generated/kubeadm_kubeconfig_user.md" />}} +{{< /tabs >}} From fbd60207806fd75dbbac2bf032e1af1547cd8aa1 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Sun, 27 Feb 2022 16:34:34 +0800 Subject: [PATCH 037/104] [zh] Translate mapping PSP to PSS page --- .../psp-to-pod-security-standards.md | 341 ++++++++++++++++++ 1 file changed, 341 insertions(+) create mode 100644 content/zh/docs/reference/access-authn-authz/psp-to-pod-security-standards.md diff --git a/content/zh/docs/reference/access-authn-authz/psp-to-pod-security-standards.md b/content/zh/docs/reference/access-authn-authz/psp-to-pod-security-standards.md new file mode 100644 index 0000000000..97f6663629 --- /dev/null +++ b/content/zh/docs/reference/access-authn-authz/psp-to-pod-security-standards.md @@ -0,0 +1,341 @@ +--- +title: 从 PodSecurityPolicy 映射到 Pod 安全性标准 +content_type: concept +weight: 95 +--- + +<!-- +reviewers: +- tallclair +- liggitt +title: Mapping PodSecurityPolicies to Pod Security Standards +content_type: concept +weight: 95 +--> + +<!-- overview --> +<!-- +The tables below enumerate the configuration parameters on +[PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/) objects, whether the field mutates +and/or validates pods, and how the configuration values map to the +[Pod Security Standards](/docs/concepts/security/pod-security-standards/). +--> +下面的表格列举了[PodSecurityPolicy](/zh/docs/concepts/policy/pod-security-policy/) +对象上的配置参数，这些字段是否会变更或检查 Pod 配置，以及这些配置值如何映射到 +[Pod 安全性标准（Pod Security Standards）](/zh/docs/concepts/security/pod-security-standards/) +之上。 + +<!-- +For each applicable parameter, the allowed values for the +[Baseline](/docs/concepts/security/pod-security-standards/#baseline) and +[Restricted](/docs/concepts/security/pod-security-standards/#restricted) profiles are listed. +Anything outside the allowed values for those profiles would fall under the +[Privileged](/docs/concepts/security/pod-security-standards/#priveleged) profile. "No opinion" +means all values are allowed under all Pod Security Standards. +--> +对于每个可应用的参数，表格中给出了 +[Baseline](/zh/docs/concepts/security/pod-security-standards/#baseline) 和 +[Restricted](/zh/docs/concepts/security/pod-security-standards/#restricted) +配置下可接受的取值。 +对这两种配置而言不可接受的取值均归入 +[Privileged](/zh/docs/concepts/security/pod-security-standards/#priveleged) +配置下。“无意见”意味着对所有 Pod 安全性标准而言所有取值都可接受。 + +<!-- +For a step-by-step migration guide, see +[Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller](/docs/tasks/configure-pod-container/migrate-from-psp/). +--> +如果想要了解如何一步步完成迁移，可参阅 +[从 PodSecurityPolicy 迁移到内置的 PodSecurity 准入控制器](/zh/docs/tasks/configure-pod-container/migrate-from-psp/)。 + +<!-- body --> + +<!-- +## PodSecurityPolicy Spec +--> +## PodSecurityPolicy 规约 {#podsecuritypolicy-spec} + +<!-- +The fields enumerated in this table are part of the `PodSecurityPolicySpec`, which is specified +under the `.spec` field path. +--> +下面表格中所列举的字段是 `PodSecurityPolicySpec` 的一部分，是通过 `.spec` +字段路径来设置的。 + +<table class="no-word-break"> + <caption style="display:none"><!--Mapping PodSecurityPolicySpec fields to Pod Security Standards-->从 PodSecurityPolicySpec 字段映射到 Pod Security 标准</caption> + <tbody> + <tr> + <th><code>PodSecurityPolicySpec</code></th> + <th><!-- Type -->类型</th> + <th><!--Pod Security Standards Equivalent-->Pod 安全性标准中对应设置</th> + </tr> + <tr> + <td><code>privileged</code></td> + <td><!-- Validating -->检查性质</td> + <td><b>Baseline & Restricted</b>: <code>false</code> / 未定义 / nil</td> + </tr> + <tr> + <td><code>defaultAddCapabilities</code></td> + <td><!-- Mutating & Validating -->更改性质 & 检查性质</td> + <td><!--Requirements match <code>allowedCapabilities</code> below.-->需求满足下面的 <code>allallowedCapabilities</code></td> + </tr> + <tr> + <td><code>allowedCapabilities</code></td> + <td><!-- Validating -->检查性质</td> + <td> + <!-- p><b>Baseline</b>: subset of</p --> + <p><b>Baseline</b>：下面各项的子集</p> + <ul> + <li><code>AUDIT_WRITE</code></li> + <li><code>CHOWN</code></li> + <li><code>DAC_OVERRIDE</code></li> + <li><code>FOWNER</code></li> + <li><code>FSETID</code></li> + <li><code>KILL</code></li> + <li><code>MKNOD</code></li> + <li><code>NET_BIND_SERVICE</code></li> + <li><code>SETFCAP</code></li> + <li><code>SETGID</code></li> + <li><code>SETPCAP</code></li> + <li><code>SETUID</code></li> + <li><code>SYS_CHROOT</code></li> + </ul> + <!-- p><b>Restricted</b>: empty / undefined / nil OR a list containing <i>only</i> <code>NET_BIND_SERVICE</code --> + <p><b>Restricted</b>：空 / 未定义 / nil 或<i>仅</i>包含 <code>NET_BIND_SERVICE</code> 的列表</p> + </td> + </tr> + <tr> + <td><code>requiredDropCapabilities</code></td> + <td><!--Mutating & Validating-->更改性质 & 检查性质</td> + <td> + <p><b>Baseline</b><!-- : no opinion-->：无意见</p> + <p><b>Restricted</b><!-- : must include-->：必须包含 <code>ALL</code></p> + </td> + </tr> + <tr> + <td><code>volumes</code></td> + <td><!-- Validating -->检查性质</td> + <td> + <p><b>Baseline</b><!--: anything except -->除下列取值之外的任何值</p> + <ul> + <li><code>hostPath</code></li> + <li><code>*</code></li> + </ul> + <p><b>Restricted</b><!-- : subset of-->：下列取值的子集</p> + <ul> + <li><code>configMap</code></li> + <li><code>csi</code></li> + <li><code>downwardAPI</code></li> + <li><code>emptyDir</code></li> + <li><code>ephemeral</code></li> + <li><code>persistentVolumeClaim</code></li> + <li><code>projected</code></li> + <li><code>secret</code></li> + </ul> + </td> + </tr> + <tr> + <td><code>hostNetwork</code></td> + <td><!-- Validating -->检查性质</td> + <td><b>Baseline & Restricted</b>：<code>false</code> / 未定义 / nil</td> + </tr> + <tr> + <td><code>hostPorts</code></td> + <td><!-- Validating -->检查性质</td> + <td><b>Baseline & Restricted</b>：未定义 / nil / 空</td> + </tr> + <tr> + <td><code>hostPID</code></td> + <td><!-- Validating -->检查性质</td> + <td><b>Baseline & Restricted</b>：<code>false</code> / 未定义 / nil</td> + </tr> + <tr> + <td><code>hostIPC</code></td> + <td><!-- Validating -->检查性质</td> + <td><b>Baseline & Restricted</b>：<code>false</code> / 未定义 / nil</td> + </tr> + <tr> + <td><code>seLinux</code></td> + <td><!-- Mutating & Validating -->更改性质 & 检查性质</td> + <td> + <p><b>Baseline & Restricted</b>： + <!-- code>seLinux.rule</code> is <code>MustRunAs</code>, with the following <code>options</code--> + <code>seLinux.rule</code> 为 <code>MustRunAs</code>，且 <code>options</code> 如下： + </p> + <ul> + <!-- + <li><code>user</code> is unset (<code>""</code> / undefined / nil)</li> + <li><code>role</code> is unset (<code>""</code> / undefined / nil)</li> + <li><code>type</code> is unset or one of: <code>container_t, container_init_t, container_kvm_t</code></li> + <li><code>level</code> is anything</li> + --> + <li><code>user</code> 未设置（<code>""</code> / 未定义 / nil）</li> + <li><code>role</code> 未设置（<code>""</code> / 未定义 / nil）</li> + <li><code>type</code> 未设置或者取值为 <code>container_t</code>、<code>container_init_t</code> 或 <code>container_kvm_t</code> 之一</li> + <li><code>level</code> 是任何取值</li> + </ul> + </td> + </tr> + <tr> + <td><code>runAsUser</code></td> + <td><!-- Mutating & Validating -->变更性质 & 检查性质</td> + <td> + <p><b>Baseline</b><!-- : Anything -->：任何取值</p> + <p><b>Restricted</b><!-- : <code>rule</code> is <code>MustRunAsNonRoot</code -->：<code>rule</code> 是 <code>MustRunAsNonRoot</code></p> + </td> + </tr> + <tr> + <td><code>runAsGroup</code></td> + <td><!-- Mutating (MustRunAs) & Validating-->变更性质（MustRunAs）& 检查性质</td> + <td> + <i><!-- No opinion -->无意见</i> + </td> + </tr> + <tr> + <td><code>supplementalGroups</code></td> + <td><!-- Mutating & Validating -->变更性质 & 检查性质</td> + <td> + <i><!-- No opinion -->无意见</i> + </td> + </tr> + <tr> + <td><code>fsGroup</code></td> + <td><!-- Mutating & Validating -->变更性质 & 验证性质</td> + <td> + <i><!-- No opinion -->无意见</i> + </td> + </tr> + <tr> + <td><code>readOnlyRootFilesystem</code></td> + <td><!-- Mutating & Validating -->变更性质 & 检查性质</td> + <td> + <i><!-- No opinion -->无意见</i> + </td> + </tr> + <tr> + <td><code>defaultAllowPrivilegeEscalation</code></td> + <td><!-- Mutating -->变更性质</td> + <td> + <i><!-- No opinion (non-validating) -->无意见（非变更性质）</i> + </td> + </tr> + <tr> + <td><code>allowPrivilegeEscalation</code></td> + <td><!-- Mutating & Validating -->变更性质 & 检查性质</td> + <td> + <!-- + <p><i>Only mutating if set to <code>false</code></i></p> + <p><b>Baseline</b>: No opinion</p> + <p><b>Restricted</b>: <code>false</code></p> + --> + <p><i>只有设置为 <code>false</code> 时才执行变更动作</i></p> + <p><b>Baseline</b>：无意见</p> + <p><b>Restricted</b>：<code>false</code></p> + </td> + </tr> + <tr> + <td><code>allowedHostPaths</code></td> + <td><!-- Validating -->检查性质</td> + <td><i><!-- No opinion (volumes takes precedence)-->无意见（volumes 优先）</i></td> + </tr> + <tr> + <td><code>allowedFlexVolumes</code></td> + <td><!-- Validating -->检查性质</td> + <td><i><!-- No opinion (volumes takes precedence)-->无意见（volumes 优先）</i></td> + </tr> + <tr> + <td><code>allowedCSIDrivers</code></td> + <td><!-- Validating -->检查性质</td> + <td><i><!-- No opinion (volumes takes precedence) -->无意见（volumes 优先）</i></td> + </tr> + <tr> + <td><code>allowedUnsafeSysctls</code></td> + <td><!-- Validating -->检查性质</td> + <td><b>Baseline & Restricted</b>：未定义 / nil / 空</td> + </tr> + <tr> + <td><code>forbiddenSysctls</code></td> + <td><!-- Validating -->检查性质</td> + <td><i><!-- No opinion -->无意见</i></td> + </tr> + <tr> + <td><code>allowedProcMountTypes</code><br><i>(alpha feature)</i></td> + <td><!-- Validating -->检查性质</td> + <!-- td><b>Baseline & Restricted</b>: <code>["Default"]</code> OR undefined / nil / empty</td --> + <td><b>Baseline & Restricted</b>：<code>["Default"]</code> 或者未定义 / nil / 空</td> + </tr> + <tr> + <td><code>runtimeClass</code><br><code> .defaultRuntimeClassName</code></td> + <td><!-- Mutating -->变更性质</td> + <td><i><!-- No opinion -->无意见</i></td> + </tr> + <tr> + <td><code>runtimeClass</code><br><code> .allowedRuntimeClassNames</code></td> + <td><!-- Validating -->检查性质</td> + <td><i><!-- No opinion -->无意见</i></td> + </tr> + </tbody> +</table> + +<!-- +## PodSecurityPolicy annotations +--> +## PodSecurityPolicy 注解 {#podsecuritypolicy-annotations} + +<!-- +The [annotations](/docs/concepts/overview/working-with-objects/annotations/) enumerated in this +table can be specified under `.metadata.annotations` on the PodSecurityPolicy object. +--> +下面表格中所列举的[注解](/zh/docs/concepts/overview/working-with-objects/annotations/) +可以通过 `.metadata.annotations` 设置到 PodSecurityPolicy 对象之上。 + +<table class="no-word-break"> + <caption style="display:none"><!-- Mapping PodSecurityPolicy annotations to Pod Security Standards-->将 PodSecurityPolicy 注解映射到 Pod 安全性标准</caption> + <tbody> + <tr> + <th><code><!--PSP Annotation-->PSP 注解</code></th> + <th><!-- Type -->类型</th> + <th><!-- Pod Security Standards Equivalent-->Pod 安全性标准中对应设置</th> + </tr> + <tr> + <td><code>seccomp.security.alpha.kubernetes.io</code><br><code>/defaultProfileName</code></td> + <td><!-- Mutating -->变更性质</td> + <td><i><!-- No opinion -->无意见</i></td> + </tr> + <tr> + <td><code>seccomp.security.alpha.kubernetes.io</code><br><code>/allowedProfileNames</code></td> + <td><!-- Validating -->检查性质</td> + <td> + <!-- + <p><b>Baseline</b>: <code>"runtime/default,"</code> <i>(Trailing comma to allow unset)</i></p> + <p><b>Restricted</b>: <code>"runtime/default"</code> <i>(No trailing comma)</i></p> + <p><i><code>localhost/*</code> values are also permitted for both Baseline & Restricted.</i></p> + --> + <p><b>Baseline</b>：<code>"runtime/default,"</code> <i>（其中尾部的逗号允许取消设置）</i></p> + <p><b>Restricted</b>：<code>"runtime/default"</code> <i>（没有尾部逗号）</i></p> + <p><i><code>localhost/*</code> 取值对于 Baseline 和 Restricted 都是可接受的</i></p> + </td> + </tr> + <tr> + <td><code>apparmor.security.beta.kubernetes.io</code><br><code>/defaultProfileName</code></td> + <td><!-- Mutating -->变更性质</td> + <td><i><!-- No opinion -->无意见</i></td> + </tr> + <tr> + <td><code>apparmor.security.beta.kubernetes.io</code><br><code>/allowedProfileNames</code></td> + <td><!-- Validating -->检查性质</td> + <td> + <!-- + <p><b>Baseline</b>: <code>"runtime/default,"</code> <i>(Trailing comma to allow unset)</i></p> + <p><b>Restricted</b>: <code>"runtime/default"</code> <i>(No trailing comma)</i></p> + <p><i><code>localhost/*</code> values are also permitted for both Baseline & Restricted.</i></p> + --> + <p><b>Baseline</b>：<code>"runtime/default,"</code> <i>（其中尾部的逗号允许取消设置）</i></p> + <p><b>Restricted</b>：<code>"runtime/default"</code> <i>（没有尾部逗号）</i></p> + <p><i><code>localhost/*</code> 取值对于 Baseline 和 Restricted 都是可接受的</i></p> + </td> + </tr> + </tbody> +</table> + From d3946657d5398df820f16addc2e49e28f843a083 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Sun, 27 Feb 2022 17:12:58 +0800 Subject: [PATCH 038/104] [zh] Translate API server config v1 reference --- .../config-api/apiserver-config.v1.md | 108 ++++++++++++++++++ 1 file changed, 108 insertions(+) create mode 100644 content/zh/docs/reference/config-api/apiserver-config.v1.md diff --git a/content/zh/docs/reference/config-api/apiserver-config.v1.md b/content/zh/docs/reference/config-api/apiserver-config.v1.md new file mode 100644 index 0000000000..c57438cda3 --- /dev/null +++ b/content/zh/docs/reference/config-api/apiserver-config.v1.md @@ -0,0 +1,108 @@ +--- +title: kube-apiserver 配置 (v1) +content_type: tool-reference +package: apiserver.config.k8s.io/v1 +auto_generated: true +--- +<!-- +title: kube-apiserver Configuration (v1) +content_type: tool-reference +package: apiserver.config.k8s.io/v1 +auto_generated: true +--> + +v1 包中包含 API 的 v1 版本。 + +<!-- +## Resource Types +--> +## 资源类型 + +- [AdmissionConfiguration](#apiserver-config-k8s-io-v1-AdmissionConfiguration) + +## `AdmissionConfiguration` {#apiserver-config-k8s-io-v1-AdmissionConfiguration} + +<!-- +AdmissionConfiguration provides versioned configuration for admission controllers. +--> +AdmissionConfiguration 为准入控制器提供版本化的配置。 + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.config.k8s.io/v1</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>AdmissionConfiguration</code></td></tr> + +<tr><td><code>plugins</code><br/> +<a href="#apiserver-config-k8s-io-v1-AdmissionPluginConfiguration"><code>[]AdmissionPluginConfiguration</code></a> +</td> +<td> + <!-- + Plugins allows specifying a configuration per admission control plugin. + --> + <code>plugins</code> 字段允许为每个准入控制插件设置配置选项。 +</td> +</tr> + +</tbody> +</table> + +## `AdmissionPluginConfiguration` {#apiserver-config-k8s-io-v1-AdmissionPluginConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [AdmissionConfiguration](#apiserver-config-k8s-io-v1-AdmissionConfiguration) + +<!-- +AdmissionPluginConfiguration provides the configuration for a single plug-in. +--> +AdmissionPluginConfiguration 为某个插件提供配置信息。 + +<table class="table"> +<thead><tr><th width="30%"><!-- Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B>[必需]</B><br/> +<code>string</code> +</td> +<td> + <!-- + Name is the name of the admission controller. +It must match the registered admission plugin name. + --> + <code>name</code> 是准入控制器的名称。它必须与所注册的准入插件名称匹配。 +</td> +</tr> + +<tr><td><code>path</code><br/> +<code>string</code> +</td> +<td> + <!-- + Path is the path to a configuration file that contains the plugin's +configuration + --> + <code>path</code> 是指向包含插件配置信息的配置文件的路径。 +</td> +</tr> + +<tr><td><code>configuration</code><br/> +<a href="https://godoc.org/k8s.io/apimachinery/pkg/runtime#Unknown"><code>k8s.io/apimachinery/pkg/runtime.Unknown</code></a> +</td> +<td> + <!-- + Configuration is an embedded configuration object to be used as the plugin's +configuration. If present, it will be used instead of the path to the configuration file. + --> + <code>configuration</code> 是一个内嵌的配置对象，用来保存插件的配置信息。 + 如果存在，则使用这里的配置信息而不是指向配置文件的路径。 +</td> +</tr> + +</tbody> +</table> + From 65adc59301b69a61632724d1c639e1401e70a82e Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Sun, 27 Feb 2022 19:53:02 +0800 Subject: [PATCH 039/104] [zh] Update i18n data for zh localization --- data/i18n/zh/zh.toml | 68 ++++++++++++++++++++++++++++++++++++++------ 1 file changed, 59 insertions(+), 9 deletions(-) diff --git a/data/i18n/zh/zh.toml b/data/i18n/zh/zh.toml index 55ce241bb0..1c9cec353b 100644 --- a/data/i18n/zh/zh.toml +++ b/data/i18n/zh/zh.toml @@ -49,9 +49,24 @@ other = "我是..." [docs_label_users] other = "用户" +[docs_version_current] +other = "（本文档）" + +[docs_version_latest_heading] +other = "最新版本" + +[docs_version_other_heading] +other = "较老版本" + +[end_of_life] +other = "不再支持：" + [envvars_heading] other = "环境变量" +[error_404_were_you_looking_for] +other = "你是否在搜索：" + [examples_heading] other = "示例" @@ -67,9 +82,19 @@ other = "此页是否对您有帮助？" [feedback_yes] other = "是" +[inline_list_separator] +other = "、" + [input_placeholder_email_address] other = "电子邮件地址" +[javascript_required] +other = "必须[启用](https://www.enable-javascript.com/) JavaScript 才能查看此页内容" + +[latest_release] +other = "最新发行版本：" + + [latest_version] other = "最新版本。" @@ -173,7 +198,11 @@ other = "页面最后一次修改于" other = "了解" [main_read_more] -other = "了解更多" +other = "进一步了解" + +[not_applicable] +# Localization teams: it's OK to use a longer text here +other = "不适用" [note] other = "说明：" @@ -184,12 +213,32 @@ other = "教程目标" [options_heading] other = "选项" +[outdated_blog__message] +other = "Kubernetes 项目认为此文章已经过时，因为该页面已经超过一年未修订。请检查页面中的信息是否从发表以来尚未变得不正确。" + +[outdated_blog__title] +other = "过时的文章" + [post_create_child_page] other = "创建子页面" +[post_create_issue] +other = "登记问题" + [prerequisites_heading] other = "准备开始" +[previous_patches] +other = "补丁版本：" + +[release_date_after] +other = "）" + +# See https://gohugo.io/functions/format/#gos-layout-string +# Use a suitable format for your locale +[release_date_format] +other = "2006-01-02" + [seealso_heading] other = "另请参见" @@ -202,6 +251,15 @@ other = "简介" [thirdparty_message] other = """本部分链接到提供 Kubernetes 所需功能的第三方项目。Kubernetes 项目作者不负责这些项目。此页面遵循<a href="https://github.com/cncf/foundation/blob/master/website-guidelines.md" target="_blank">CNCF 网站指南</a>，按字母顺序列出项目。要将项目添加到此列表中，请在提交更改之前阅读<a href="/docs/contribute/style/content-guide/#third-party-content">内容指南</a>。""" +[thirdparty_message_edit_disclaimer] +other="""第三方内容建议""" + +[thirdparty_message_single_item] +other = """🛇 本条目指向第三方项目或产品，而该项目（产品）不是 Kubernetes 的一部分。<a class="alert-more-info" href="#third-party-content-disclaimer">更多信息</a>""" + +[thirdparty_message_disclaimer] +other = """<p>本页面中的条目引用了第三方产品或项目，这些产品（项目）提供了 Kubernetes 所需的功能。Kubernetes 项目的开发人员不对这些第三方产品（项目）负责。请参阅<a href="https://github.com/cncf/foundation/blob/master/website-guidelines.md" target="_blank">CNCF 网站指南</a>了解更多细节。</p><p>在提交更改建议，向本页添加新的第三方链接之前，你应该先阅读<a href="/zh/docs/contribute/style/content-guide/#third-party-content">内容指南。</p>""" + [ui_search_placeholder] other = "搜索" @@ -223,11 +281,3 @@ other = "警告：" [whatsnext_heading] other = "接下来" -[docs_version_latest_heading] -other = "当前版本" - -[docs_version_other_heading] -other = "往期版本" - -[docs_version_current] -other = "(此文档)" From c1561ebc845d5ffa9e0a52033f66a13c07f5ffdc Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Sun, 27 Feb 2022 21:37:35 +0800 Subject: [PATCH 040/104] [zh] Translate API server encryption config API --- .../config-api/apiserver-encryption.v1.md | 322 ++++++++++++++++++ 1 file changed, 322 insertions(+) create mode 100644 content/zh/docs/reference/config-api/apiserver-encryption.v1.md diff --git a/content/zh/docs/reference/config-api/apiserver-encryption.v1.md b/content/zh/docs/reference/config-api/apiserver-encryption.v1.md new file mode 100644 index 0000000000..a53b3d757d --- /dev/null +++ b/content/zh/docs/reference/config-api/apiserver-encryption.v1.md @@ -0,0 +1,322 @@ +--- +title: kube-apiserver 加密配置 (v1) +content_type: tool-reference +package: apiserver.config.k8s.io/v1 +auto_generated: true +--- + +<!-- +title: kube-apiserver Encryption Configuration (v1) +content_type: tool-reference +package: apiserver.config.k8s.io/v1 +auto_generated: true +--> + +<p><!--Package v1 is the v1 version of the API.--> +包 v1 是 API 的 v1 版本。</p> + +<!-- +## Resource Types +--> +## 资源类型 + +- [EncryptionConfiguration](#apiserver-config-k8s-io-v1-EncryptionConfiguration) + +## `EncryptionConfiguration` {#apiserver-config-k8s-io-v1-EncryptionConfiguration} + +<p><!--EncryptionConfiguration stores the complete configuration for encryption providers.--> +EncryptionConfiguration 为加密驱动保存完整的配置信息。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.config.k8s.io/v1</code></td></tr> +<tr><td><code>kind</code><br/>string</td><td><code>EncryptionConfiguration</code></td></tr> +<tr><td><code>resources</code> <B>[必需]</B><br/> +<a href="#apiserver-config-k8s-io-v1-ResourceConfiguration"><code>[]ResourceConfiguration</code></a> +</td> +<td> + <p><!--resources is a list containing resources, and their corresponding encryption providers.--> + <code>resources</code> 是一个包含资源及其对应的加密驱动的列表。 + </p> +</td> +</tr> +</tbody> +</table> + +## `AESConfiguration` {#apiserver-config-k8s-io-v1-AESConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration) + +<p><!--AESConfiguration contains the API configuration for an AES transformer.--> +AESConfiguration 包含 AES 转换器的 API 配置信息。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>keys</code> <B>[必需]</B><br/> +<a href="#apiserver-config-k8s-io-v1-Key"><code>[]Key</code></a> +</td> +<td> + <p><!--keys is a list of keys to be used for creating the AES transformer. +Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.--> + <code>keys</code> 是一组用于创建 AES 转换器的秘钥。 + 对于 AES-CBC，每个秘钥必须是 32 字节长；对于 AES-GCM，每个秘钥可以是 16、24、32 字节长。 + </p> +</td> +</tr> +</tbody> +</table> + +## `IdentityConfiguration` {#apiserver-config-k8s-io-v1-IdentityConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration) + +<p><!--IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.--> +IdentityConfiguration 是一个空的结构，用来支持在驱动配置中支持标识转换器。 +</p> + +## `KMSConfiguration` {#apiserver-config-k8s-io-v1-KMSConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration) + +<p><!--KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.--> +KMSConfiguration 包含基于 KMS 的封套转换器的名称、缓存大小以及配置文件路径信息。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B>[必需]</B><br/> +<code>string</code> +</td> +<td> + <p><!--name is the name of the KMS plugin to be used.--> + <code>name</code> 是要使用的 KMS 插件名称。 + </p> +</td> +</tr> +<tr><td><code>cachesize</code><br/> +<code>int32</code> +</td> +<td> + <p><!--cachesize is the maximum number of secrets which are cached in memory. The default value is 1000. Set to a negative value to disable caching.--> + <code>cachesize</code> 是可在内存中缓存的 Secret 数量上限。默认值是 1000。将此字段设置为负值会禁用缓存。 + </p> +</td> +</tr> +<tr><td><code>endpoint</code> <B>[必需]</B><br/> +<code>string</code> +</td> +<td> + <p><!--endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".--> + <code>endpoint</code> 是 gRPC 服务器的监听地址，例如 "unix:///var/run/kms-provider.sock"。 + </p> +</td> +</tr> +<tr><td><code>timeout</code><br/> +<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> +</td> +<td> + <p><!--timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.--> + 对 KMS 插件执行 gRPC 调用的超时时长（例如，'5s'）。默认值为 3 秒。 + </p> +</td> +</tr> +</tbody> +</table> + +## `Key` {#apiserver-config-k8s-io-v1-Key} + +<!-- +**Appears in:** +--> +**出现在：** + +- [AESConfiguration](#apiserver-config-k8s-io-v1-AESConfiguration) +- [SecretboxConfiguration](#apiserver-config-k8s-io-v1-SecretboxConfiguration) + +<p><!--Key contains name and secret of the provided key for a transformer.--> +Key 中包含为某转换器所提供的键名和对应的私密数据。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>name</code> <B>[必需]</B><br/> +<code>string</code> +</td> +<td> + <p><!--name is the name of the key to be used while storing data to disk.--> + <code>name</code> 是在向磁盘中存储数据时使用的键名。 + </p> +</td> +</tr> +<tr><td><code>secret</code> <B>[必需]</B><br/> +<code>string</code> +</td> +<td> + <p><!--secret is the actual key, encoded in base64.--> + <code>secret</code> 是实际的秘钥，用 base64 编码。 + </p> +</td> +</tr> +</tbody> +</table> + +## `ProviderConfiguration` {#apiserver-config-k8s-io-v1-ProviderConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ResourceConfiguration](#apiserver-config-k8s-io-v1-ResourceConfiguration) + +<p><!--ProviderConfiguration stores the provided configuration for an encryption provider.--> +ProviderConfiguration 为加密驱动存储配置信息。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>aesgcm</code> <B>[必需]</B><br/> +<a href="#apiserver-config-k8s-io-v1-AESConfiguration"><code>AESConfiguration</code></a> +</td> +<td> + <p><!--aesgcm is the configuration for the AES-GCM transformer.--> + <code>aesgcm</code> 是用于 AES-GCM 转换器的配置。 + </p> +</td> +</tr> +<tr><td><code>aescbc</code> <B>[必需]</B><br/> +<a href="#apiserver-config-k8s-io-v1-AESConfiguration"><code>AESConfiguration</code></a> +</td> +<td> + <p><!--aescbc is the configuration for the AES-CBC transformer.--> + <code>aescbc</code> 是用于 AES-CBC 转换器的配置。 + </p> +</td> +</tr> +<tr><td><code>secretbox</code> <B>[必需]</B><br/> +<a href="#apiserver-config-k8s-io-v1-SecretboxConfiguration"><code>SecretboxConfiguration</code></a> +</td> +<td> + <p><!--secretbox is the configuration for the Secretbox based transformer.--> + <code>secretbox</code> 是用于基于 Secretbox 的转换器的配置。 + </p> +</td> +</tr> +<tr><td><code>identity</code> <B>[必需]</B><br/> +<a href="#apiserver-config-k8s-io-v1-IdentityConfiguration"><code>IdentityConfiguration</code></a> +</td> +<td> + <p><!--identity is the (empty) configuration for the identity transformer.--> + <code>identity</code> 是用于标识转换器的配置（空）。 + </p> +</td> +</tr> +<tr><td><code>kms</code> <B>[必需]</B><br/> +<a href="#apiserver-config-k8s-io-v1-KMSConfiguration"><code>KMSConfiguration</code></a> +</td> +<td> + <p><!--kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.--> + <code>kms</code> 中包含用于基于 KMS 的封套转换器的名称、缓存大小以及配置文件路径信息。 + </p> +</td> +</tr> +</tbody> +</table> + +## `ResourceConfiguration` {#apiserver-config-k8s-io-v1-ResourceConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [EncryptionConfiguration](#apiserver-config-k8s-io-v1-EncryptionConfiguration) + +<p><!--ResourceConfiguration stores per resource configuration.--> +ResourceConfiguration 中保存资源配置。 +</p> + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>resources</code> <B>[必需]</B><br/> +<code>[]string</code> +</td> +<td> + <p><!--resources is a list of kubernetes resources which have to be encrypted.--> + <code>resources</code> 是必需要加密的 Kubernetes 资源的列表。 + </p> +</td> +</tr> +<tr><td><code>providers</code> <B>[必需]</B><br/> +<a href="#apiserver-config-k8s-io-v1-ProviderConfiguration"><code>[]ProviderConfiguration</code></a> +</td> +<td> + <p><!--providers is a list of transformers to be used for reading and writing the resources to disk. eg: aesgcm, aescbc, secretbox, identity.--> + <code>providers</code> 是一个转换器列表，用来将资源写入到磁盘或从磁盘上读出。 + 例如：'aesgcm'、'aescbc'、'secretbox'、'identity'。 + </p> +</td> +</tr> +</tbody> +</table> + +## `SecretboxConfiguration` {#apiserver-config-k8s-io-v1-SecretboxConfiguration} + +<!-- +**Appears in:** +--> +**出现在：** + +- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration) + +<p><!--SecretboxConfiguration contains the API configuration for an Secretbox transformer.--> +SecretboxConfiguration 包含用于某 Secretbox 转换器的 API 配置。 +</p> + + +<table class="table"> +<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead> +<tbody> + +<tr><td><code>keys</code> <B>[必需]</B><br/> +<a href="#apiserver-config-k8s-io-v1-Key"><code>[]Key</code></a> +</td> +<td> + <p><!--keys is a list of keys to be used for creating the Secretbox transformer. +Each key has to be 32 bytes long.--> + <code>keys</code> 是一个秘钥列表，用来创建 Secretbox 转换器。每个秘钥必须是 32 字节长。 + </p> +</td> +</tr> +</tbody> +</table> + From 59689b8dea9fb33e076dc6d15203c47bd46684ec Mon Sep 17 00:00:00 2001 From: PriyanshuAhlawat <priyanshuahlawat009@gmail.com> Date: Mon, 28 Feb 2022 19:00:41 +0530 Subject: [PATCH 041/104] Update kubelet-integration.md --- .../tools/kubeadm/kubelet-integration.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md b/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md index bae9af6bbb..e3ab1395a2 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md @@ -51,7 +51,7 @@ by the kubelet, using the `--cluster-dns` flag. This setting needs to be the sam on every manager and Node in the cluster. The kubelet provides a versioned, structured API object that can configure most parameters in the kubelet and push out this configuration to each running kubelet in the cluster. This object is called -[`KubeletConfiguration`](/docs/reference/config-api/kubelet-config.v1beta1/). +[`KubeletConfiguration`](/docs/reference/config-api/kubelet-config.v1beta1/). The `KubeletConfiguration` allows the user to specify flags such as the cluster DNS IP addresses expressed as a list of values to a camelCased key, illustrated by the following example: @@ -171,8 +171,7 @@ It augments the basic ```none [Service] -Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf ---kubeconfig=/etc/kubernetes/kubelet.conf" +Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf" Environment="KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml" # This is a file that "kubeadm init" and "kubeadm join" generate at runtime, populating the KUBELET_KUBEADM_ARGS variable dynamically @@ -206,5 +205,3 @@ The DEB and RPM packages shipped with the Kubernetes releases are: | `kubelet` | Installs the kubelet binary in `/usr/bin` and CNI binaries in `/opt/cni/bin`. | | `kubectl` | Installs the `/usr/bin/kubectl` binary. | | `cri-tools` | Installs the `/usr/bin/crictl` binary from the [cri-tools git repository](https://github.com/kubernetes-sigs/cri-tools). | - - From bff6d62c450d77ae5cd379c647a44e09d39c7594 Mon Sep 17 00:00:00 2001 From: pangqing <pangqing@uniontech.com> Date: Mon, 28 Feb 2022 23:03:51 +0800 Subject: [PATCH 042/104] Modify the expulsion link initiated by API Signed-off-by: pangqing <pangqing@uniontech.com> --- .../scheduling-eviction/node-pressure-eviction.md | 8 ++++---- .../scheduling-eviction/pod-priority-preemption.md | 4 ++-- content/zh/docs/reference/glossary/eviction.md | 4 ++-- .../zh/docs/reference/glossary/node-pressure-eviction.md | 4 ++-- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md b/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md index 4c40fac8b0..906b604a0a 100644 --- a/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md +++ b/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md @@ -31,7 +31,7 @@ kubelet 可以主动地使节点上一个或者多个 Pod 失效，以回收资 在节点压力驱逐期间，kubelet 将所选 Pod 的 `PodPhase` 设置为 `Failed`。这将终止 Pod。 -节点压力驱逐不同于 [API 发起的驱逐](/zh/docs/concepts/scheduling-eviction/api-eviction/)。 +节点压力驱逐不同于 [API 发起的驱逐](/docs/reference/generated/kubernetes-api/v1.23/)。 <!-- The kubelet does not respect your configured `PodDisruptionBudget` or the pod's @@ -765,14 +765,14 @@ to estimate or measure an optimal memory limit value for that container. ## {{% heading "whatsnext" %}} <!-- -* Learn about [API-initiated Eviction](/docs/concepts/scheduling-eviction/api-eviction/) +* Learn about [API-initiated Eviction](/docs/reference/generated/kubernetes-api/v1.23/) * Learn about [Pod Priority and Preemption](/docs/concepts/scheduling-eviction/pod-priority-preemption/) * Learn about [PodDisruptionBudgets](/docs/tasks/run-application/configure-pdb/) * Learn about [Quality of Service](/docs/tasks/configure-pod-container/quality-service-pod/) (QoS) * Check out the [Eviction API](/docs/reference/generated/kubernetes-api/{{<param "version">}}/#create-eviction-pod-v1-core) --> -* 了解 [API 发起的驱逐](/zh/docs/concepts/scheduling-eviction/api-eviction/) +* 了解 [API 发起的驱逐](/docs/reference/generated/kubernetes-api/v1.23/) * 了解 [Pod 优先级和驱逐](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) * 了解 [PodDisruptionBudgets](/docs/tasks/run-application/configure-pdb/) * 了解[服务质量](/zh/docs/tasks/configure-pod-container/quality-service-pod/)（QoS） -* 查看[驱逐 API](/docs/reference/generated/kubernetes-api/{{<param "version">}}/#create-eviction-pod-v1-core) \ No newline at end of file +* 查看[驱逐 API](/docs/reference/generated/kubernetes-api/{{<param "version">}}/#create-eviction-pod-v1-core) diff --git a/content/zh/docs/concepts/scheduling-eviction/pod-priority-preemption.md b/content/zh/docs/concepts/scheduling-eviction/pod-priority-preemption.md index 33cf14c540..370fd2bbbb 100644 --- a/content/zh/docs/concepts/scheduling-eviction/pod-priority-preemption.md +++ b/content/zh/docs/concepts/scheduling-eviction/pod-priority-preemption.md @@ -657,11 +657,11 @@ kubelet 使用优先级来确定 * Read about using ResourceQuotas in connection with PriorityClasses: [limit Priority Class consumption by default](/docs/concepts/policy/resource-quotas/#limit-priority-class-consumption-by-default) * Learn about [Pod Disruption](/docs/concepts/workloads/pods/disruptions/) -* Learn about [API-initiated Eviction](/docs/concepts/scheduling-eviction/api-eviction/) +* Learn about [API-initiated Eviction](/docs/reference/generated/kubernetes-api/v1.23/) * Learn about [Node-pressure Eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/) --> * 阅读有关将 ResourceQuota 与 PriorityClass 结合使用的信息： [默认限制优先级消费](/zh/docs/concepts/policy/resource-quotas/#limit-priority-class-consumption-by-default) * 了解 [Pod 干扰](/zh/docs/concepts/workloads/pods/disruptions/) -* 了解 [API 发起的驱逐](/zh/docs/concepts/scheduling-eviction/api-eviction/) +* 了解 [API 发起的驱逐](/docs/reference/generated/kubernetes-api/v1.23/) * 了解[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/) diff --git a/content/zh/docs/reference/glossary/eviction.md b/content/zh/docs/reference/glossary/eviction.md index a77fdcfd05..9bdf5049f3 100644 --- a/content/zh/docs/reference/glossary/eviction.md +++ b/content/zh/docs/reference/glossary/eviction.md @@ -30,9 +30,9 @@ Eviction is the process of terminating one or more Pods on Nodes. <!-- There are two kinds of eviction: * [Node-pressure eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/) -* [API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/) +* [API-initiated eviction](/docs/reference/generated/kubernetes-api/v1.23/) --> 驱逐的两种类型 * [节点压力驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/) -* [API 发起的驱逐](/zh/docs/concepts/scheduling-eviction/api-eviction/) +* [API 发起的驱逐](/docs/reference/generated/kubernetes-api/v1.23/) diff --git a/content/zh/docs/reference/glossary/node-pressure-eviction.md b/content/zh/docs/reference/glossary/node-pressure-eviction.md index d1336d57d2..c5faa5f135 100644 --- a/content/zh/docs/reference/glossary/node-pressure-eviction.md +++ b/content/zh/docs/reference/glossary/node-pressure-eviction.md @@ -45,6 +45,6 @@ kubelet 监控集群节点上的 CPU、内存、磁盘空间和文件系统 inod kubelet 可以主动使节点上的一个或多个 Pod 失效，以回收资源并防止饥饿。 <!-- -Node-pressure eviction is not the same as [API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/). +Node-pressure eviction is not the same as [API-initiated eviction](/docs/reference/generated/kubernetes-api/v1.23/). --> -节点压力驱逐不用于 [API 发起的驱逐](/zh/docs/concepts/scheduling-eviction/api-eviction/)。 +节点压力驱逐不用于 [API 发起的驱逐](/docs/reference/generated/kubernetes-api/v1.23/)。 From 7bf583a24201ea8274edd8db51ca70f7f21c8b77 Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" <lubomirivanov@vmware.com> Date: Mon, 28 Feb 2022 19:22:29 +0200 Subject: [PATCH 043/104] kubeadm: fix wrong path in the etcd HA guide (step 7) The guide generates some files on one of three ETCD hosts. It then copies files from host 1 to 2 and 3. Due to that some file paths differ. Update step 7 to reflect that and to match step 6. --- .../tools/kubeadm/setup-ha-etcd-with-kubeadm.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm.md index c21b58d771..0573fb942e 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm.md @@ -267,8 +267,8 @@ on Kubernetes dual-stack support see [Dual-stack support with kubeadm](/docs/set ```sh root@HOST0 $ kubeadm init phase etcd local --config=/tmp/${HOST0}/kubeadmcfg.yaml - root@HOST1 $ kubeadm init phase etcd local --config=/tmp/${HOST1}/kubeadmcfg.yaml - root@HOST2 $ kubeadm init phase etcd local --config=/tmp/${HOST2}/kubeadmcfg.yaml + root@HOST1 $ kubeadm init phase etcd local --config=$HOME/kubeadmcfg.yaml + root@HOST2 $ kubeadm init phase etcd local --config=$HOME/kubeadmcfg.yaml ``` 1. Optional: Check the cluster health From 30abee1696af1b895d9d233a0fafd1e1da3175c3 Mon Sep 17 00:00:00 2001 From: PriyanshuAhlawat <priyanshuahlawat009@gmail.com> Date: Mon, 28 Feb 2022 22:54:45 +0530 Subject: [PATCH 044/104] Update kubelet-integration.md --- .../tools/kubeadm/kubelet-integration.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md b/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md index e3ab1395a2..c11b8cc0a0 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md @@ -161,6 +161,12 @@ Kubeadm deletes the `/etc/kubernetes/bootstrap-kubelet.conf` file after completi `kubeadm` ships with configuration for how systemd should run the kubelet. Note that the kubeadm CLI command never touches this drop-in file. +{{< note >}} +The contents below are just an example. If you don't want to use a package manager +follow the guide outlined in the [Without a package manager](/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#k8s-install-2)) +section. +{{< /note >}} + This configuration file installed by the `kubeadm` [DEB](https://github.com/kubernetes/release/blob/master/cmd/kubepkg/templates/latest/deb/kubeadm/10-kubeadm.conf) or [RPM package](https://github.com/kubernetes/release/blob/master/cmd/kubepkg/templates/latest/rpm/kubeadm/10-kubeadm.conf) is written to From 3d392f1b514c7de2d9e7d312487b937544c67d69 Mon Sep 17 00:00:00 2001 From: PriyanshuAhlawat <priyanshuahlawat009@gmail.com> Date: Mon, 28 Feb 2022 23:03:31 +0530 Subject: [PATCH 045/104] Update kubelet-integration.md --- .../tools/kubeadm/kubelet-integration.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md b/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md index c11b8cc0a0..59477d944f 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md @@ -161,12 +161,6 @@ Kubeadm deletes the `/etc/kubernetes/bootstrap-kubelet.conf` file after completi `kubeadm` ships with configuration for how systemd should run the kubelet. Note that the kubeadm CLI command never touches this drop-in file. -{{< note >}} -The contents below are just an example. If you don't want to use a package manager -follow the guide outlined in the [Without a package manager](/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#k8s-install-2)) -section. -{{< /note >}} - This configuration file installed by the `kubeadm` [DEB](https://github.com/kubernetes/release/blob/master/cmd/kubepkg/templates/latest/deb/kubeadm/10-kubeadm.conf) or [RPM package](https://github.com/kubernetes/release/blob/master/cmd/kubepkg/templates/latest/rpm/kubeadm/10-kubeadm.conf) is written to @@ -175,6 +169,12 @@ It augments the basic [`kubelet.service` for RPM](https://github.com/kubernetes/release/blob/master/cmd/kubepkg/templates/latest/rpm/kubelet/kubelet.service) or [`kubelet.service` for DEB](https://github.com/kubernetes/release/blob/master/cmd/kubepkg/templates/latest/deb/kubelet/lib/systemd/system/kubelet.service): +{{< note >}} +The contents below are just an example. If you don't want to use a package manager +follow the guide outlined in the [Without a package manager](/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#k8s-install-2)) +section. +{{< /note >}} + ```none [Service] Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf" From cfe7176772954f0f032d2c797e5402bc16606c13 Mon Sep 17 00:00:00 2001 From: Arhell <arhell333@gmail.com> Date: Tue, 1 Mar 2022 00:47:42 +0200 Subject: [PATCH 046/104] [de] fix typo in Horizontal Pod Autoscaling --- .../de/docs/tasks/run-application/horizontal-pod-autoscale.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/de/docs/tasks/run-application/horizontal-pod-autoscale.md b/content/de/docs/tasks/run-application/horizontal-pod-autoscale.md index cd120285f1..7814ae55d8 100644 --- a/content/de/docs/tasks/run-application/horizontal-pod-autoscale.md +++ b/content/de/docs/tasks/run-application/horizontal-pod-autoscale.md @@ -100,7 +100,7 @@ Das auflisten der Autoskalierer geschieht über `kubectl get hpa` und eine detai Letzendlich können wir einen Autoskalierer mit `kubectl delete hpa` löschen. Zusätzlich gibt es einen speziellen Befehl `kubectl autoscale` zur einfachen Erstellung eines Horizontal Pod Autoscalers. -Wenn du beispielsweise `kubectl autoscale rs foo --min=2 --max=5 --cpu-percent=80` ausführst, wird ein Autoskalierer für den Replication Set *foo* erstellt, wobei die Ziel-CPU-Auslastung auf `80%` und die Anzahl der Replikate zwischen 2 und 5 gesetzt wird. +Wenn du beispielsweise `kubectl autoscale rs foo --min=2 --max=5 --cpu-percent=80` ausführst, wird ein Autoskalierer für den ReplicaSet *foo* erstellt, wobei die Ziel-CPU-Auslastung auf `80%` und die Anzahl der Replikate zwischen 2 und 5 gesetzt wird. Die Detaildokumentation von `kubectl autoscale` kann [hier](/docs/reference/generated/kubectl/kubectl-commands/#autoscale) gefunden werden. ## Autoskalieren während rollierender Updates From 625ed5e1dd78f2a61cbff576b792578403d74d9f Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Fri, 25 Feb 2022 17:14:55 +0800 Subject: [PATCH 047/104] [zh] Translate change runtime containerd page --- .../change-runtime-containerd.md | 253 ++++++++++++++++++ 1 file changed, 253 insertions(+) create mode 100644 content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd.md diff --git a/content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd.md b/content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd.md new file mode 100644 index 0000000000..0b281a2191 --- /dev/null +++ b/content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd.md @@ -0,0 +1,253 @@ +title: 将节点上的容器运行时从 Docker Engine 改为 containerd +weight: 8 +content_type: task + +<!-- +title: "Changing the Container Runtime on a Node from Docker Engine to containerd" +weight: 8 +content_type: task +--> + +<!-- +This task outlines the steps needed to update your container runtime to containerd from Docker. It is applicable for cluster operators running Kubernetes 1.23 or earlier. Also this covers an example scenario for migrating from dockershim to containerd and alternative container runtimes can be picked from this [page](https://kubernetes.io/docs/setup/production-environment/container-runtimes/). +--> +本任务给出将容器运行时从 Docker 改为 containerd 所需的步骤。 +此任务适用于运行 1.23 或更早版本 Kubernetes 的集群操作人员。 +同时，此任务也涉及从 dockershim 迁移到 containerd 的示例场景， +以及可以从[此页面](/zh/docs/setup/production-environment/container-runtimes/) +获得的其他容器运行时列表。 + +## {{% heading "prerequisites" %}} + +{{% thirdparty-content %}} + +<!-- +Install containerd. For more information see, [containerd's installation documentation](https://containerd.io/docs/getting-started/) and for specific prerequisite follow [this](/docs/setup/production-environment/container-runtimes/#containerd). +--> +安装 containerd。进一步的信息可参见 +[containerd 的安装文档](https://containerd.io/docs/getting-started/)。 +关于一些特定的环境准备工作，请参阅[此页面](/zh/docs/setup/production-environment/container-runtimes/#containerd)。 + +<!-- +## Drain the node + +``` +# replace <node-to-drain> with the name of your node you are draining +kubectl drain <node-to-drain> --ignore-daemonsets +``` +--> +## 腾空节点 {#drain-the-node} + +``` +# 将 <node-to-drain> 替换为你所要腾空的节点的名称 +kubectl drain <node-to-drain> --ignore-daemonsets +``` + +<!-- +## Stop the Docker daemon +--> +## 停止 Docker 守护进程 {#stop-the-docker-daemon} + +```shell +systemctl stop kubelet +systemctl disable docker.service --now +``` + +<!-- +## Install Containerd + +This [page](/docs/setup/production-environment/container-runtimes/#containerd) contains detailed steps to install containerd. +--> +## 安装 Containerd {#install-containerd} + +此[页面](/zh/docs/setup/production-environment/container-runtimes/#containerd) +包含安装 containerd 的详细步骤。 + +{{< tabs name="tab-cri-containerd-installation" >}} +{{% tab name="Linux" %}} + +<!-- +1. Install the `containerd.io` package from the official Docker repositories. +Instructions for setting up the Docker repository for your respective Linux distribution and installing the `containerd.io` package can be found at +[Install Docker Engine](https://docs.docker.com/engine/install/#server). +--> +1. 从官方的 Docker 仓库安装 `containerd.io` 包。关于为你所使用的 Linux 发行版来设置 + Docker 仓库，以及安装 `containerd.io` 包的详细说明，可参见 + [Install Docker Engine](https://docs.docker.com/engine/install/#server)。 + +<!-- +2. Configure containerd: +--> +2. 配置 containerd： + + ```shell + sudo mkdir -p /etc/containerd + containerd config default | sudo tee /etc/containerd/config.toml + ``` + +<!-- +3. Restart containerd: +--> +3. 重启 containerd： + + ```shell + sudo systemctl restart containerd + ``` + +{{% /tab %}} +{{% tab name="Windows (PowerShell)" %}} + +<!-- +Start a Powershell session, set `$Version` to the desired version (ex: `$Version="1.4.3"`), and then run the following commands: +--> +启动一个 Powershell 会话，将 `$Version` 设置为期望的版本（例如：`$Version="1.4.3"`）， +之后运行下面的命令： + +<!-- +1. Download containerd: +--> +1. 下载 containerd： + + ```powershell + curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz + tar.exe xvf .\containerd-windows-amd64.tar.gz + ``` + +<!-- +2. Extract and configure: +--> +2. 解压缩并执行配置： + + ```powershell + Copy-Item -Path ".\bin\" -Destination "$Env:ProgramFiles\containerd" -Recurse -Force + cd $Env:ProgramFiles\containerd\ + .\containerd.exe config default | Out-File config.toml -Encoding ascii + + # 请审查配置信息。取决于你的安装环境，你可能需要调整： + # - the sandbox_image （Kubernetes pause 镜像） + # - cni bin_dir 和 conf_dir 的位置 + Get-Content config.toml + + # （可选步骤，但强烈建议执行）将 containerd 排除在 Windows Defender 扫描之外 + Add-MpPreference -ExclusionProcess "$Env:ProgramFiles\containerd\containerd.exe" + ``` + +<!-- +3. Start containerd: +--> +3. 启动 containerd： + + ```powershell + .\containerd.exe --register-service + Start-Service containerd + ``` + +{{% /tab %}} +{{< /tabs >}} + +<!-- +## Configure the kubelet to use containerd as its container runtime + +Edit the file `/var/lib/kubelet/kubeadm-flags.env` and add the containerd runtime to the flags. `--container-runtime=remote` and `--container-runtime-endpoint=unix:///run/containerd/containerd.sock"` +--> +## 配置 kubelet 使用 containerd 作为其容器运行时 + +编辑文件 `/var/lib/kubelet/kubeadm-flags.env`，将 containerd 运行时添加到标志中： +`--container-runtime=remote` 和 `--container-runtime-endpoint=unix:///run/containerd/containerd.sock"`。 + +<!-- +For users using kubeadm should consider the following: + +The `kubeadm` tool stores the CRI socket for each host as an annotation in the Node object for that host. +--> +对于使用 kubeadm 的用户，可以考虑下面的问题： + +`kubeadm` 工具将每个主机的 CRI 套接字保存在该主机对应的 Node 对象的注解中。 + +<!-- +To change it you must do the following: + +Execute `kubectl edit no <NODE-NAME>` on a machine that has the kubeadm `/etc/kubernetes/admin.conf` file. +--> +要更改这一注解信息，你必须执行下面的操作： + +在一台包含 `/etc/kubernetes/admin.conf` 文件的机器上，执行 +`kubectl edit no <节点名称>`。 + +<!-- +This will start a text editor where you can edit the Node object. + +To choose a text editor you can set the `KUBE_EDITOR` environment variable. + +- Change the value of `kubeadm.alpha.kubernetes.io/cri-socket` from `/var/run/dockershim.sock` + to the CRI socket path of your choice (for example `unix:///run/containerd/containerd.sock`). + + Note that new CRI socket paths must be prefixed with `unix://` ideally. + +- Save the changes in the text editor, which will update the Node object. +--> +这一命令会打开一个文本编辑器，供你在其中编辑 Node 对象。 +要选择不同的文本编辑器，你可以设置 `KUBE_EDITOR` 环境变量。 + +- 更改 `kubeadm.alpha.kubernetes.io/cri-socket` 值，将其从 + `/var/run/dockershim.sock` 改为你所选择的 CRI 套接字路径 + （例如：`unix:///run/containerd/containerd.sock`）。 + + 注意新的 CRI 套接字路径必须带有 `unix://` 前缀。 + +- 保存文本编辑器中所作的修改，这会更新 Node 对象。 + +<!-- +## Restart the kubelet +--> +## 重启 kubelet {#restart-the-kubelet} + +```shell +systemctl start kubelet +``` + +<!-- +## Verify that the node is healthy + +Run `kubectl get nodes -o wide` and containerd appears as the runtime for the node we just changed. + +## Remove Docker Engine +--> +## 验证节点处于健康状态 {#verify-that-the-node-is-healthy} + +运行 `kubectl get nodes -o wide`，containerd 会显示为我们所更改的节点上的运行时。 + +{{% thirdparty-content %}} + +<!-- +Finally if everything goes well remove docker +--> +最后，在一切顺利时删除 Docker。 + +{{< tabs name="tab-remove-docker-enigine" >}} +{{% tab name="CentOS" %}} + +```shell +sudo yum remove docker-ce docker-ce-cli +``` +{{% /tab %}} +{{% tab name="Debian" %}} + +```shell +sudo apt-get purge docker-ce docker-ce-cli +``` +{{% /tab %}} +{{% tab name="Fedora" %}} + +```shell +sudo dnf remove docker-ce docker-ce-cli +``` +{{% /tab %}} +{{% tab name="Ubuntu" %}} + +```shell +sudo apt-get purge docker-ce docker-ce-cli +``` +{{% /tab %}} +{{< /tabs >}} + From cdde38b85aeb9d4cf158912d11d0fc4259711630 Mon Sep 17 00:00:00 2001 From: pangqing <pangqing@uniontech.com> Date: Tue, 1 Mar 2022 10:50:32 +0800 Subject: [PATCH 048/104] Modify node pressure expulsion link Signed-off-by: pangqing <pangqing@uniontech.com> --- .../concepts/scheduling-eviction/_index.md | 2 +- .../pod-priority-preemption.md | 4 +- .../taint-and-toleration.md | 2 +- .../zh/docs/reference/glossary/eviction.md | 2 +- .../reserve-compute-resources.md | 2 +- ！ | 53 +++++++++++++++++++ 6 files changed, 59 insertions(+), 6 deletions(-) create mode 100644 ！ diff --git a/content/zh/docs/concepts/scheduling-eviction/_index.md b/content/zh/docs/concepts/scheduling-eviction/_index.md index 01265f3a05..81274d27aa 100644 --- a/content/zh/docs/concepts/scheduling-eviction/_index.md +++ b/content/zh/docs/concepts/scheduling-eviction/_index.md @@ -49,5 +49,5 @@ of terminating one or more Pods on Nodes. ## Pod 干扰 * [Pod 优先级和抢占](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) -* [节点压力驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/) +* [节点压力驱逐](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) * [API发起的驱逐](/zh/docs/concepts/scheduling-eviction/api-eviction/) diff --git a/content/zh/docs/concepts/scheduling-eviction/pod-priority-preemption.md b/content/zh/docs/concepts/scheduling-eviction/pod-priority-preemption.md index 370fd2bbbb..cf4db83684 100644 --- a/content/zh/docs/concepts/scheduling-eviction/pod-priority-preemption.md +++ b/content/zh/docs/concepts/scheduling-eviction/pod-priority-preemption.md @@ -637,7 +637,7 @@ exceeding its requests, it won't be evicted. Another Pod with higher priority that exceeds its requests may be evicted. --> kubelet 使用优先级来确定 -[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/) Pod 的顺序。 +[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) Pod 的顺序。 你可以使用 QoS 类来估计 Pod 最有可能被驱逐的顺序。kubelet 根据以下因素对 Pod 进行驱逐排名： 1. 对紧俏资源的使用是否超过请求值 @@ -664,4 +664,4 @@ kubelet 使用优先级来确定 [默认限制优先级消费](/zh/docs/concepts/policy/resource-quotas/#limit-priority-class-consumption-by-default) * 了解 [Pod 干扰](/zh/docs/concepts/workloads/pods/disruptions/) * 了解 [API 发起的驱逐](/docs/reference/generated/kubernetes-api/v1.23/) -* 了解[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/) +* 了解[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) diff --git a/content/zh/docs/concepts/scheduling-eviction/taint-and-toleration.md b/content/zh/docs/concepts/scheduling-eviction/taint-and-toleration.md index 9b374d2f87..d1d400217c 100644 --- a/content/zh/docs/concepts/scheduling-eviction/taint-and-toleration.md +++ b/content/zh/docs/concepts/scheduling-eviction/taint-and-toleration.md @@ -545,5 +545,5 @@ arbitrary tolerations to DaemonSets. * Read about [Node-pressure Eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/) and how you can configure it * Read about [Pod Priority](/docs/concepts/scheduling-eviction/pod-priority-preemption/) --> -* 阅读[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/)，以及如何配置其行为 +* 阅读[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/)，以及如何配置其行为 * 阅读 [Pod 优先级](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) diff --git a/content/zh/docs/reference/glossary/eviction.md b/content/zh/docs/reference/glossary/eviction.md index 9bdf5049f3..30666ca2b1 100644 --- a/content/zh/docs/reference/glossary/eviction.md +++ b/content/zh/docs/reference/glossary/eviction.md @@ -33,6 +33,6 @@ There are two kinds of eviction: * [API-initiated eviction](/docs/reference/generated/kubernetes-api/v1.23/) --> 驱逐的两种类型 -* [节点压力驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/) +* [节点压力驱逐](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) * [API 发起的驱逐](/docs/reference/generated/kubernetes-api/v1.23/) diff --git a/content/zh/docs/tasks/administer-cluster/reserve-compute-resources.md b/content/zh/docs/tasks/administer-cluster/reserve-compute-resources.md index e0b2d8a6e8..251de2231e 100644 --- a/content/zh/docs/tasks/administer-cluster/reserve-compute-resources.md +++ b/content/zh/docs/tasks/administer-cluster/reserve-compute-resources.md @@ -340,7 +340,7 @@ respectively. `kubelet` 默认对 Pod 执行 'Allocatable' 约束。 无论何时，如果所有 Pod 的总用量超过了 'Allocatable'，驱逐 Pod 的措施将被执行。 有关驱逐策略的更多细节可以在 -[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/)页找到。 +[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/)页找到。 可通过设置 kubelet `--enforce-node-allocatable` 标志值为 `pods` 控制这个措施。 可选地，通过在同一标志中同时指定 `kube-reserved` 和 `system-reserved` 值， diff --git a/！ b/！ new file mode 100644 index 0000000000..81274d27aa --- /dev/null +++ b/！ @@ -0,0 +1,53 @@ +--- +title: 调度，抢占和驱逐 +weight: 90 +content_type: concept +description: > + 在Kubernetes中，调度 (scheduling) 指的是确保 Pods 匹配到合适的节点， + 以便 kubelet 能够运行它们。抢占 (Preemption) 指的是终止低优先级的 Pods 以便高优先级的 Pods 可以 + 调度运行的过程。驱逐 (Eviction) 是在资源匮乏的节点上，主动让一个或多个 Pods 失效的过程。 +--- + +<!-- +--- +title: "Scheduling, Preemption and Eviction" +weight: 90 +content_type: concept +description: > + In Kubernetes, scheduling refers to making sure that Pods are matched to Nodes + so that the kubelet can run them. Preemption is the process of terminating + Pods with lower Priority so that Pods with higher Priority can schedule on + Nodes. Eviction is the process of proactively terminating one or more Pods on + resource-starved Nodes. +no_list: true +--- +--> + +<!-- +In Kubernetes, scheduling refers to making sure that {{<glossary_tooltip text="Pods" term_id="pod">}} +are matched to {{<glossary_tooltip text="Nodes" term_id="node">}} so that the +{{<glossary_tooltip text="kubelet" term_id="kubelet">}} can run them. Preemption +is the process of terminating Pods with lower {{<glossary_tooltip text="Priority" term_id="pod-priority">}} +so that Pods with higher Priority can schedule on Nodes. Eviction is the process +of terminating one or more Pods on Nodes. +--> + +<!-- ## Scheduling --> + +## 调度 + +* [Kubernetes 调度器](/zh/docs/concepts/scheduling-eviction/kube-scheduler/) +* [将 Pods 指派到节点](/zh/docs/concepts/scheduling-eviction/assign-pod-node/) +* [Pod 开销](/zh/docs/concepts/scheduling-eviction/pod-overhead/) +* [污点和容忍](/zh/docs/concepts/scheduling-eviction/taint-and-toleration/) +* [调度框架](/zh/docs/concepts/scheduling-eviction/scheduling-framework) +* [调度器的性能调试](/zh/docs/concepts/scheduling-eviction/scheduler-perf-tuning/) +* [扩展资源的资源装箱](/zh/docs/concepts/scheduling-eviction/resource-bin-packing/) + +<!-- ## Pod Disruption --> + +## Pod 干扰 + +* [Pod 优先级和抢占](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) +* [节点压力驱逐](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) +* [API发起的驱逐](/zh/docs/concepts/scheduling-eviction/api-eviction/) From a65110dc044514cf8ce82d353b2edecb03d67637 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Tue, 1 Mar 2022 12:59:43 +0800 Subject: [PATCH 049/104] [zh] Add glossary cadvisor --- .../zh/docs/reference/glossary/cadvisor.md | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 content/zh/docs/reference/glossary/cadvisor.md diff --git a/content/zh/docs/reference/glossary/cadvisor.md b/content/zh/docs/reference/glossary/cadvisor.md new file mode 100644 index 0000000000..c2d6a00e80 --- /dev/null +++ b/content/zh/docs/reference/glossary/cadvisor.md @@ -0,0 +1,39 @@ +--- +title: cAdvisor +id: cadvisor +date: 2021-12-09 +full_link: https://github.com/google/cadvisor/ +short_description: > + 帮助理解容器的资源用量与性能特征的工具 + +aka: +tags: +- tool +--- + +<!-- +title: cAdvisor +id: cadvisor +date: 2021-12-09 +full_link: https://github.com/google/cadvisor/ +short_description: > + Tool that provides understanding of the resource usage and perfomance characteristics for containers +aka: +tags: +- tool +--> + +<!-- +cAdvisor (Container Advisor) provides container users an understanding of the resource usage and performance characteristics of their running {{< glossary_tooltip text="containers" term_id="container" >}}. +--> +cAdvisor (Container Advisor) 为容器用户提供对其运行中的{{< glossary_tooltip text="容器" term_id="container" >}} +的资源用量和性能特征的知识。 + +<!--more--> +<!-- +It is a running daemon that collects, aggregates, processes, and exports information about running containers. Specifically, for each container it keeps resource isolation parameters, historical resource usage, histograms of complete historical resource usage and network statistics. This data is exported by container and machine-wide. +--> +cAdvisor 是一个守护进程，负责收集、聚合、处理并输出运行中容器的信息。 +具体而言，针对每个容器，该进程记录容器的资源隔离参数、历史资源用量、 +完整历史资源用量和网络统计的直方图。这些数据可以按容器或按机器层面输出。 + From db95127bc8f047a7d5aef033c68b5880f3eaaea6 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Tue, 1 Mar 2022 13:06:16 +0800 Subject: [PATCH 050/104] [zh] Add glossary userns --- content/zh/docs/reference/glossary/userns.md | 56 ++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 content/zh/docs/reference/glossary/userns.md diff --git a/content/zh/docs/reference/glossary/userns.md b/content/zh/docs/reference/glossary/userns.md new file mode 100644 index 0000000000..6d4168237c --- /dev/null +++ b/content/zh/docs/reference/glossary/userns.md @@ -0,0 +1,56 @@ +--- +title: 用户名字空间 +id: userns +date: 2021-07-13 +full_link: https://man7.org/linux/man-pages/man7/user_namespaces.7.html +short_description: > + 一种为非特权用户模拟超级用户特权的 Linux 内核功能特性。 + +aka: +tags: +- security +--- + +<!-- +title: user namespace +id: userns +date: 2021-07-13 +full_link: https://man7.org/linux/man-pages/man7/user_namespaces.7.html +short_description: > + A Linux kernel feature to emulate superuser privilege for unprivileged users. + +aka: +tags: +- security +--> + +<!-- +A kernel feature to emulate root. Used for "rootless containers". +--> +用来模拟 root 用户的内核功能特性。用来支持“Rootless 容器”。 + +<!--more--> + +<!-- +User namespaces are a Linux kernel feature that allows a non-root user to +emulate superuser ("root") privileges, +for example in order to run containers without being a superuser outside the container. +--> +用户名字空间（User Namespace）是一种 Linux 内核功能特性，允许非 root 用户 +模拟超级用户（"root"）的特权，例如用来运行容器却不必成为容器之外的超级用户。 + +<!-- +User namespace is effective for mitigating damage of potential container break-out attacks. +--> +用户名字空间对于缓解因潜在的容器逃逸攻击而言是有效的。 + +<!-- +In the context of user namespaces, the namespace is a Linux kernel feature, and not a +{{< glossary_tooltip text="namespace" term_id="namespace" >}} in the Kubernetes sense +of the term. +--> +在用户名字空间语境中，名字空间是 Linux 内核的功能特性而不是 Kubernetes 意义上的 +{{< glossary_tooltip text="名字空间" term_id="namespace" >}}概念。 + +<!-- TODO: https://kinvolk.io/blog/2020/12/improving-kubernetes-and-container-security-with-user-namespaces/ --> + From 6ee7f0f3d086217b25b400c4d9d111ac16241048 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Tue, 1 Mar 2022 13:14:42 +0800 Subject: [PATCH 051/104] [zh] Add glossary Event --- content/zh/docs/reference/glossary/event.md | 56 +++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 content/zh/docs/reference/glossary/event.md diff --git a/content/zh/docs/reference/glossary/event.md b/content/zh/docs/reference/glossary/event.md new file mode 100644 index 0000000000..fb8a4401aa --- /dev/null +++ b/content/zh/docs/reference/glossary/event.md @@ -0,0 +1,56 @@ +--- +title: 事件（Event） +id: event +date: 2022-01-16 +full_link: /docs/reference/kubernetes-api/cluster-resources/event-v1/ +short_description: > + 对集群中周处发生的事件的报告。通常用来表述系统中某种状态变更。 +aka: +tags: +- core-object +- fundamental +--- + +<!-- +title: Event +id: event +date: 2022-01-16 +full_link: /docs/reference/kubernetes-api/cluster-resources/event-v1/ +short_description: > + A report of an event somewhere in the cluster. It generally denotes some state change in the system. +aka: +tags: +- core-object +- fundamental +--> + +<!-- +Each Event is a report of an event somewhere in the {{< glossary_tooltip text="cluster" term_id="cluster" >}}. +It generally denotes some state change in the system. +--> +每个 Event 是{{< glossary_tooltip text="集群" term_id="cluster" >}}中某处发生的事件的报告。 +它通常用来表述系统中的某种状态变化。 + +<!--more--> + +<!-- +Events have a limited retention time and triggers and messages may evolve with time. +Event consumers should not rely on the timing of an event with a given reason reflecting a consistent underlying trigger, +or the continued existence of events with that reason. +--> +事件的保留时间有限，随着时间推进，其触发方式和消息都可能发生变化。 +事件用户不应该对带有给定原因（反映下层触发源）的时间特征有任何依赖， +也不要寄希望于对应该原因的事件会一直存在。 + +<!-- +Events should be treated as informative, best-effort, supplemental data. +--> +事件应该被视为一种告知性质的、尽力而为的、补充性质的数据。 + +<!-- +In Kubernetes, [auditing](/docs/tasks/debug-application-cluster/audit/) generates a different kind of +Event record (API group `audit.k8s.io`). +--> +在 Kubernetes 中，[审计](/zh/docs/tasks/debug-application-cluster/audit/) +机制会生成一种不同种类的 Event 记录（API 组为 `audit.k8s.io`）。 + From c8857cd55bd18e125e318607b5864f0902fbd33a Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Sun, 27 Feb 2022 18:17:35 +0800 Subject: [PATCH 052/104] [zh] Translate docker to crictl map page --- .../reference/tools/map-crictl-dockercli.md | 151 ++++++++++++++++++ 1 file changed, 151 insertions(+) create mode 100644 content/zh/docs/reference/tools/map-crictl-dockercli.md diff --git a/content/zh/docs/reference/tools/map-crictl-dockercli.md b/content/zh/docs/reference/tools/map-crictl-dockercli.md new file mode 100644 index 0000000000..470c30b528 --- /dev/null +++ b/content/zh/docs/reference/tools/map-crictl-dockercli.md @@ -0,0 +1,151 @@ +--- +title: 从 Docker 命令行映射到 crictl +content_type: reference +--- + +<!-- +title: Mapping from dockercli to crictl +content_type: reference +--> + +{{% thirdparty-content %}} + +{{<note>}} +<!-- +This page is deprecated and will be removed in Kubernetes 1.27. +--> +此页面已被废弃，将在 Kubernetes 1.27 版本删除。 +{{</note>}} + +<!-- +`crictl` is a command-line interface for {{<glossary_tooltip term_id="cri" text="CRI">}}-compatible container runtimes. +You can use it to inspect and debug container runtimes and applications on a +Kubernetes node. `crictl` and its source are hosted in the +[cri-tools](https://github.com/kubernetes-sigs/cri-tools) repository. +--> +`crictl` 是兼容 {{<glossary_tooltip term_id="cri" text="CRI">}}的容器运行时的一种命令行接口。 +你可以使用它来在 Kubernetes 节点上检视和调试容器运行时和应用。 +`crictl` 及其源代码都托管在 +[cri-tools](https://github.com/kubernetes-sigs/cri-tools) 仓库中。 + +<!-- +This page provides a reference for mapping common commands for the `docker` +command-line tool into the equivalent commands for `crictl`. +--> +本页面提供一份参考资料，用来将 `docker` 命令行工具的常用命令映射到 +`crictl` 的等价命令。 + +<!-- +## Mapping from docker CLI to crictl +--> +## 从 docker 命令行映射到 crictl {#mapping-from-docker-cli-to-crictl} + +<!-- +The exact versions for the mapping table are for `docker` CLI v1.40 and `crictl` +v1.19.0. This list is not exhaustive. For example, it doesn't include +experimental `docker` CLI commands. +--> +映射表格中列举的确切版本是 `docker` 命令行的 v1.40 版本和 `crictl` 的 v1.19.0 版本。 +这一列表不是完备的。例如，其中并未包含实验性质的 `docker` 命令。 + +{{< note >}} +<!-- +The output format of `crictl` is similar to `docker` CLI, despite some missing +columns for some CLI. Make sure to check output for the specific command if your +command output is being parsed programmatically. +--> +`crictl` 的输出格式类似于 `docker` 命令行，只是对于某些命令而言会有部分列缺失。 +如果你的命令输出会被程序解析，请确保你认真查看了对应的命令输出。 +{{< /note >}} + +<!-- +### Retrieve debugging information +--> +### 获得调试信息 {#retrieve-debugging-information} + +{{< table caption="docker 命令行与 crictl 的映射 - 获得调试信息" >}} +<!--docker CLI | crictl | Description | Unsupported Features +-- | -- | -- | -- +`attach` | `attach` | Attach to a running container | `--detach-keys`, `--sig-proxy` +`exec` | `exec` | Run a command in a running container | `--privileged`, `--user`, `--detach-keys` +`images` | `images` | List images |   +`info` | `info` | Display system-wide information |   +`inspect` | `inspect`, `inspecti` | Return low-level information on a container, image or task |   +`logs` | `logs` | Fetch the logs of a container | `--details` +`ps` | `ps` | List containers |   +`stats` | `stats` | Display a live stream of container(s) resource usage statistics | Column: NET/BLOCK I/O, PIDs +`version` | `version` | Show the runtime (Docker, ContainerD, or others) version information |   +--> +docker CLI | crictl | 描述 | 不支持的功能 +-- | -- | -- | -- +`attach` | `attach` | 挂接到某运行中的容器 | `--detach-keys`, `--sig-proxy` +`exec` | `exec` | 在运行中的容器内执行命令 | `--privileged`, `--user`, `--detach-keys` +`images` | `images` | 列举镜像 |   +`info` | `info` | 显示系统范围的信息 |   +`inspect` | `inspect`, `inspecti` | 返回容器、镜像或任务的底层信息 |   +`logs` | `logs` | 取回容器的日志数据 | `--details` +`ps` | `ps` | 列举容器 |   +`stats` | `stats` | 显示容器资源用量统计的动态数据流 | 列：NET/BLOCK I/O、PIDs +`version` | `version` | 显示运行时（Docker、ContainerD 或其他）的版本信息 | +{{< /table >}} + +<!-- +### Perform Changes +--> +### 执行变更 {#perform-changes} + +{{< table caption="docker 命令行与 crictl 的映射 - 执行变更" >}} +<!-- +docker cli | crictl | Description | Unsupported Features +-- | -- | -- | -- +`create` | `create` | Create a new container |   +`kill` | `stop` (timeout = 0) | Kill one or more running container | `--signal` +`pull` | `pull` | Pull an image or a repository from a registry | `--all-tags`, `--disable-content-trust` +`rm` | `rm` | Remove one or more containers |   +`rmi` | `rmi` | Remove one or more images |   +`run` | `run` | Run a command in a new container |   +`start` | `start` | Start one or more stopped containers | `--detach-keys` +`stop` | `stop` | Stop one or more running containers |   +`update` | `update` | Update configuration of one or more containers | `--restart`, `--blkio-weight` and some other resource limit not supported by CRI. +--> +docker CLI | crictl | 描述 | 不支持的功能 +-- | -- | -- | -- +`create` | `create` | 创建一个新容器 |   +`kill` | `stop` (超时值为 0) | 杀死一个或多个运行中的容器 | `--signal` +`pull` | `pull` | 从某镜像库拉取镜像或仓库 | `--all-tags`, `--disable-content-trust` +`rm` | `rm` | 移除一个或者多个容器 |   +`rmi` | `rmi` | 移除一个或者多个镜像 |   +`run` | `run` | 在一个新的容器中执行命令 |   +`start` | `start` | 启动一个或多个已停止的容器 | `--detach-keys` +`stop` | `stop` | 停止一个或多个运行中的容器 |   +`update` | `update` | 更新一个或多个容器的配置 | `--restart`、`--blkio-weight` 以 CRI 所不支持的资源约束 +{{< /table >}} + +<!-- +### Supported only in crictl +--> +### 仅被 crictl 支持的命令 {#supported-only-in-crictl} + +{{< table caption="docker 命令行与 crictl 的映射 - 仅被 crictl 支持的命令" >}} +<!-- +crictl | Description +-- | -- +`imagefsinfo` | Return image filesystem info +`inspectp` | Display the status of one or more pods +`port-forward` | Forward local port to a pod +`pods` | List pods +`runp` | Run a new pod +`rmp` | Remove one or more pods +`stopp` | Stop one or more running pods +--> +crictl | 描述 +-- | -- +`imagefsinfo` | 返回镜像文件系统信息 +`inspectp` | 显示一个或多个 Pod 的状态 +`port-forward` | 将本地端口转发到 Pod +`pods` | 列举 Pod +`runp` | 运行一个新的 Pod +`rmp` | 删除一个或多个 Pod +`stopp` | 停止一个或多个运行中的 Pod +{{< /table >}} + From b6ceda82c9381940b97340737c1bc7e3f8c50407 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Mon, 3 Jan 2022 18:59:25 +0800 Subject: [PATCH 053/104] [zh] Translate projected volume page --- .../concepts/storage/projected-volumes.md | 226 ++++++++++++++++++ ...rojected-secret-downwardapi-configmap.yaml | 35 +++ ...ed-secrets-nondefault-permission-mode.yaml | 27 +++ .../projected-service-account-token.yaml | 21 ++ 4 files changed, 309 insertions(+) create mode 100644 content/zh/docs/concepts/storage/projected-volumes.md create mode 100644 content/zh/examples/pods/storage/projected-secret-downwardapi-configmap.yaml create mode 100644 content/zh/examples/pods/storage/projected-secrets-nondefault-permission-mode.yaml create mode 100644 content/zh/examples/pods/storage/projected-service-account-token.yaml diff --git a/content/zh/docs/concepts/storage/projected-volumes.md b/content/zh/docs/concepts/storage/projected-volumes.md new file mode 100644 index 0000000000..15c01c2719 --- /dev/null +++ b/content/zh/docs/concepts/storage/projected-volumes.md @@ -0,0 +1,226 @@ +--- +title: 投射卷 +content_type: concept +weight: 21 # just after persistent volumes +--- + +<!-- +reviewers: +- marosset +- jsturtevant +- zshihang +title: Projected Volumes +content_type: concept +weight: 21 # just after persistent volumes +--> + +<!-- overview --> + +<!-- +This document describes _projected volumes_ in Kubernetes. Familiarity with [volumes](/docs/concepts/storage/volumes/) is suggested. +--> +本文档描述 Kubernet 中的*投射卷（Projected Volumes）*。 +建议先熟悉[卷](/zh/docs/concepts/storage/volumes/)概念。 + +<!-- body --> + +<!-- +## Introduction + +A `projected` volume maps several existing volume sources into the same directory. + +Currently, the following types of volume sources can be projected: + +* [`secret`](/docs/concepts/storage/volumes/#secret) +* [`downwardAPI`](/docs/concepts/storage/volumes/#downwardapi) +* [`configMap`](/docs/concepts/storage/volumes/#configmap) +* `serviceAccountToken` +--> +## 介绍 {#introduction} + +一个 `projected` 卷可以将若干现有的卷源映射到同一个目录之上。 + +目前，以下类型的卷源可以被投射： + +* [`secret`](/zh/docs/concepts/storage/volumes/#secret) +* [`downwardAPI`](/zh/docs/concepts/storage/volumes/#downwardapi) +* [`configMap`](/zh/docs/concepts/storage/volumes/#configmap) +* `serviceAccountToken` + +<!-- +All sources are required to be in the same namespace as the Pod. For more details, +see the [all-in-one volume design document](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/all-in-one-volume.md). +--> +所有的卷源都要求处于 Pod 所在的同一个名字空间内。进一步的详细信息，可参考 +[一体化卷设计文档](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/all-in-one-volume.md)。 + +<!-- +### Example configuration with a secret, a downwardAPI, and a configMap {#example-configuration-secret-downwardapi-configmap} +--> +### 带有 Secret、DownwardAPI 和 ConfigMap 的配置示例 {#example-configuration-secret-downwardapi-configmap} + +{{< codenew file="pods/storage/projected-secret-downwardapi-configmap.yaml" >}} + +<!-- +### Example configuration: secrets with a non-default permission mode set {#example-configuration-secrets-nondefault-permission-mode} +--> +### 带有非默认权限模式设置的 Secret 的配置示例 {#example-configuration-secrets-nondefault-permission-mode} + +{{< codenew file="pods/storage/projected-secrets-nondefault-permission-mode.yaml" >}} + +<!-- +Each projected volume source is listed in the spec under `sources`. The +parameters are nearly the same with two exceptions: + +* For secrets, the `secretName` field has been changed to `name` to be consistent + with ConfigMap naming. +* The `defaultMode` can only be specified at the projected level and not for each + volume source. However, as illustrated above, you can explicitly set the `mode` + for each individual projection. +--> +每个被投射的卷源都列举在规约中的 `sources` 下面。参数几乎相同，只有两个例外： + +* 对于 Secret，`secretName` 字段被改为 `name` 以便于 ConfigMap 的命名一致； +* `defaultMode` 只能在投射层级设置，不能在卷源层级设置。不过，正如上面所展示的， + 你可以显式地为每个投射单独设置 `mode` 属性。 + +<!-- +When the `TokenRequestProjection` feature is enabled, you can inject the token +for the current [service account](/docs/reference/access-authn-authz/authentication/#service-account-tokens) +into a Pod at a specified path. For example: +--> +当 `TokenRequestProjection` 特性被启用时，你可以将当前 +[服务账号](/zh/docs/reference/access-authn-authz/authentication/#service-account-tokens) +的令牌注入到 Pod 中特定路径下。例如： + +{{< codenew file="pods/storage/projected-service-account-token.yaml" >}} + +<!-- +The example Pod has a projected volume containing the injected service account +token. This token can be used by a Pod's containers to access the Kubernetes API +server. The `audience` field contains the intended audience of the +token. A recipient of the token must identify itself with an identifier specified +in the audience of the token, and otherwise should reject the token. This field +is optional and it defaults to the identifier of the API server. +--> +示例 Pod 中包含一个投射卷，其中包含注入的服务账号令牌。该令牌可以被 Pod +中的容器用来访问 Kubernetes API 服务器。`audience` 字段包含令牌所针对的受众。 +收到令牌的主体必须使用令牌受众中所指定的某个标识符来标识自身，否则应该拒绝该令牌。 +此字段是可选的，默认值为 API 服务器的标识。 + +<!-- +The `expirationSeconds` is the expected duration of validity of the service account +token. It defaults to 1 hour and must be at least 10 minutes (600 seconds). An administrator +can also limit its maximum value by specifying the `--service-account-max-token-expiration` +option for the API server. The `path` field specifies a relative path to the mount point +of the projected volume. +--> +字段 `expirationSeconds` 是服务账号令牌预期的生命期长度。默认值为 1 小时， +必须至少为 10 分钟（600 秒）。管理员也可以通过设置 API 服务器的命令行参数 +`--service-account-max-token-expiration` 来为其设置最大值上限。`path` 字段给出 +与投射卷挂载点之间的相对路径。 + +{{< note >}} +<!-- +A container using a projected volume source as a [`subPath`](/docs/concepts/storage/volumes/#using-subpath) +volume mount will not receive updates for those volume sources. +--> +以 [`subPath`](/zh/docs/concepts/storage/volumes/#using-subpath) +形式使用投射卷源的容器无法收到对应卷源的更新。 +{{< /note >}} + +<!-- +## SecurityContext interactions +--> +## 与 SecurityContext 间的关系 {#securitycontext-interactions} + +<!-- +The [proposal for file permission handling in projected service account volume](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/2451-service-account-token-volumes#token-volume-projection) +enhancement introduced the projected files having the the correct owner +permissions set. +--> +[关于在投射的服务账号卷中处理文件访问权限的提案](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/2451-service-account-token-volumes#token-volume-projection) +介绍了如何使得所投射的文件具有合适的属主访问权限。 + +### Linux + +<!-- +In Linux pods that have a projected volume and `RunAsUser` set in the Pod +[`SecurityContext`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context), +the projected files have the correct ownership set including container user +ownership. +--> +在包含了投射卷并在 +[`SecurityContext`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) +中设置了 `RunAsUser` 属性的 Linux Pod 中，投射文件具有正确的属主属性设置， +其中包含了容器用户属主。 + +### Windows + +<!-- +In Windows pods that have a projected volume and `RunAsUsername` set in the +Pod `SecurityContext`, the ownership is not enforced due to the way user +accounts are managed in Windows. Windows stores and manages local user and group +accounts in a database file called Security Account Manager (SAM). Each +container maintains its own instance of the SAM database, to which the host has +no visibility into while the container is running. Windows containers are +designed to run the user mode portion of the OS in isolation from the host, +hence the maintenance of a virtual SAM database. As a result, the kubelet running +on the host does not have the ability to dynamically configure host file +ownership for virtualized container accounts. It is recommended that if files on +the host machine are to be shared with the container then they should be placed +into their own volume mount outside of `C:\`. +--> +在包含了投射卷并在 `SecurityContext` 中设置了 `RunAsUsername` 的 Windows Pod 中, +由于 Windows 中用户账号的管理方式问题，文件的属主无法正确设置。 +Windows 在名为安全账号管理器（Security Account Manager，SAM） +的数据库中保存本地用户和组信息。每个容器会维护其自身的 SAM 数据库实例， +宿主系统无法窥视到容器运行期间数据库内容。Windows 容器被设计用来运行操作系统的用户态部分， +与宿主系统之间隔离，因此维护了一个虚拟的 SAM 数据库。 +所以，在宿主系统上运行的 kubelet 无法动态为虚拟的容器账号配置宿主文件的属主。 +如果需要将宿主机器上的文件与容器共享，建议将它们放到挂载于 `C:\` 之外 +的独立卷中。 + +<!-- +By default, the projected files will have the following ownership as shown for +an example projected volume file: +--> +默认情况下，所投射的文件会具有如下例所示的属主属性设置： + +```powershell +PS C:\> Get-Acl C:\var\run\secrets\kubernetes.io\serviceaccount\..2021_08_31_22_22_18.318230061\ca.crt | Format-List + +Path : Microsoft.PowerShell.Core\FileSystem::C:\var\run\secrets\kubernetes.io\serviceaccount\..2021_08_31_22_22_18.318230061\ca.crt +Owner : BUILTIN\Administrators +Group : NT AUTHORITY\SYSTEM +Access : NT AUTHORITY\SYSTEM Allow FullControl + BUILTIN\Administrators Allow FullControl + BUILTIN\Users Allow ReadAndExecute, Synchronize +Audit : +Sddl : O:BAG:SYD:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU) +``` + +<!-- +This implies all administrator users like `ContainerAdministrator` will have +read, write and execute access while, non-administrator users will have read and +execute access. +--> +这意味着，所有类似 `ContainerAdministrator` 的管理员用户都具有读、写和执行访问权限， +而非管理员用户将具有读和执行访问权限。 + +{{< note >}} +<!-- +In general, granting the container access to the host is discouraged as it can +open the door for potential security exploits. + +Creating a Windows Pod with `RunAsUser` in it's `SecurityContext` will result in +the Pod being stuck at `ContainerCreating` forever. So it is advised to not use +the Linux only `RunAsUser` option with Windows Pods. +--> +总体而言，为容器授予访问宿主系统的权限这种做法是不推荐的，因为这样做可能会打开潜在的安全性攻击之门。 + +在创建 Windows Pod 时，如过在其 `SecurityContext` 中设置了 `RunAsUser`， +Pod 会一直阻塞在 `ContainerCreating` 状态。因此，建议不要在 Windows +节点上使用仅针对 Linux 的 `RunAsUser` 选项。 +{{< /note >}} + diff --git a/content/zh/examples/pods/storage/projected-secret-downwardapi-configmap.yaml b/content/zh/examples/pods/storage/projected-secret-downwardapi-configmap.yaml new file mode 100644 index 0000000000..270db99dcd --- /dev/null +++ b/content/zh/examples/pods/storage/projected-secret-downwardapi-configmap.yaml @@ -0,0 +1,35 @@ +apiVersion: v1 +kind: Pod +metadata: + name: volume-test +spec: + containers: + - name: container-test + image: busybox + volumeMounts: + - name: all-in-one + mountPath: "/projected-volume" + readOnly: true + volumes: + - name: all-in-one + projected: + sources: + - secret: + name: mysecret + items: + - key: username + path: my-group/my-username + - downwardAPI: + items: + - path: "labels" + fieldRef: + fieldPath: metadata.labels + - path: "cpu_limit" + resourceFieldRef: + containerName: container-test + resource: limits.cpu + - configMap: + name: myconfigmap + items: + - key: config + path: my-group/my-config diff --git a/content/zh/examples/pods/storage/projected-secrets-nondefault-permission-mode.yaml b/content/zh/examples/pods/storage/projected-secrets-nondefault-permission-mode.yaml new file mode 100644 index 0000000000..f69b43161e --- /dev/null +++ b/content/zh/examples/pods/storage/projected-secrets-nondefault-permission-mode.yaml @@ -0,0 +1,27 @@ +apiVersion: v1 +kind: Pod +metadata: + name: volume-test +spec: + containers: + - name: container-test + image: busybox + volumeMounts: + - name: all-in-one + mountPath: "/projected-volume" + readOnly: true + volumes: + - name: all-in-one + projected: + sources: + - secret: + name: mysecret + items: + - key: username + path: my-group/my-username + - secret: + name: mysecret2 + items: + - key: password + path: my-group/my-password + mode: 511 diff --git a/content/zh/examples/pods/storage/projected-service-account-token.yaml b/content/zh/examples/pods/storage/projected-service-account-token.yaml new file mode 100644 index 0000000000..3ad06b5dc7 --- /dev/null +++ b/content/zh/examples/pods/storage/projected-service-account-token.yaml @@ -0,0 +1,21 @@ +apiVersion: v1 +kind: Pod +metadata: + name: sa-token-test +spec: + containers: + - name: container-test + image: busybox + volumeMounts: + - name: token-vol + mountPath: "/service-account" + readOnly: true + serviceAccountName: default + volumes: + - name: token-vol + projected: + sources: + - serviceAccountToken: + audience: api + expirationSeconds: 3600 + path: token From 4c11f6db87b7ce0f2839607ead2e52b969a33369 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Sat, 26 Feb 2022 10:07:47 +0800 Subject: [PATCH 054/104] [zh] Translate enforcing PSS This PR translates two files missing in zh localization and syncs two related files for consistency. --- .../concepts/policy/pod-security-policy.md | 12 +- .../security/pod-security-admission.md | 327 ++++++++++++++++++ .../security/pod-security-standards.md | 131 +++---- .../enforcing-pod-security-standards.md | 154 +++++++++ 4 files changed, 543 insertions(+), 81 deletions(-) create mode 100644 content/zh/docs/concepts/security/pod-security-admission.md create mode 100644 content/zh/docs/setup/best-practices/enforcing-pod-security-standards.md diff --git a/content/zh/docs/concepts/policy/pod-security-policy.md b/content/zh/docs/concepts/policy/pod-security-policy.md index 813bfce688..7be672cb0b 100644 --- a/content/zh/docs/concepts/policy/pod-security-policy.md +++ b/content/zh/docs/concepts/policy/pod-security-policy.md @@ -14,12 +14,20 @@ weight: 30 {{< feature-state for_k8s_version="v1.21" state="deprecated" >}} +{{< caution >}} <!-- -PodSecurityPolicy is deprecated as of Kubernetes v1.21, and will be removed in v1.25. For more information on the deprecation, +PodSecurityPolicy is deprecated as of Kubernetes v1.21, and **will be removed in v1.25**. We recommend migrating to +[Pod Security Admission](/docs/concepts/security/pod-security-admission/), or a 3rd party admission plugin. +For a migration guide, see [Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller](/docs/tasks/configure-pod-container/migrate-from-psp/). +For more information on the deprecation, see [PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/). --> -PodSecurityPolicy 在 Kubernetes v1.21 版本中被弃用，将在 v1.25 中删除。 +PodSecurityPolicy 在 Kubernetes v1.21 版本中被弃用，**将在 v1.25 中删除**。 +我们建议迁移到 [Pod 安全性准入](/zh/docs/concepts/security/pod-security-admission)， +或者第三方的准入插件。 +若需了解迁移指南，可参阅[从 PodSecurityPolicy 迁移到内置的 PodSecurity 准入控制器](/zh/docs/tasks/configure-pod-container/migrate-from-psp/)。 关于弃用的更多信息，请查阅 [PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/)。 +{{< /caution >}} <!-- Pod Security Policies enable fine-grained authorization of pod creation and diff --git a/content/zh/docs/concepts/security/pod-security-admission.md b/content/zh/docs/concepts/security/pod-security-admission.md new file mode 100644 index 0000000000..d84b7c3c7b --- /dev/null +++ b/content/zh/docs/concepts/security/pod-security-admission.md @@ -0,0 +1,327 @@ +--- +title: Pod 安全性准入 +description: > + 对 Pod 安全性准入控制器的概述，Pod 安全性准入控制器可以实施 Pod 安全性标准。 + +content_type: concept +weight: 20 +min-kubernetes-server-version: v1.22 +--- +<!-- +reviewers: +- tallclair +- liggitt +title: Pod Security Admission +description: > + An overview of the Pod Security Admission Controller, which can enforce the Pod Security + Standards. +content_type: concept +weight: 20 +min-kubernetes-server-version: v1.22 +--> + +<!-- overview --> + +{{< feature-state for_k8s_version="v1.23" state="beta" >}} + +<!-- +The Kubernetes [Pod Security Standards](/docs/concepts/security/pod-security-standards/) define +different isolation levels for Pods. These standards let you define how you want to restrict the +behavior of pods in a clear, consistent fashion. +--> +Kubernetes [Pod 安全性标准（Security Standards）](/zh/docs/concepts/security/pod-security-standards/) +为 Pod 定义不同的隔离级别。这些标准能够让你以一种清晰、一致的方式定义如何限制 Pod 行为。 + +<!-- +As an Beta feature, Kubernetes offers a built-in _Pod Security_ {{< glossary_tooltip +text="admission controller" term_id="admission-controller" >}}, the successor +to [PodSecurityPolicies](/docs/concepts/policy/pod-security-policy/). Pod security restrictions +are applied at the {{< glossary_tooltip text="namespace" term_id="namespace" >}} level when pods +are created. +--> +作为一项 Beta 功能特性，Kubernetes 提供一种内置的 _Pod 安全性_ +{{< glossary_tooltip text="准入控制器" term_id="admission-controller" >}}， +作为 [PodSecurityPolicies](/zh/docs/concepts/policy/pod-security-policy/) +特性的后继演化版本。Pod 安全性限制是在 Pod 被创建时在 +{{< glossary_tooltip text="名字空间" term_id="namespace" >}}层面实施的。 + +{{< note >}} +<!-- +The PodSecurityPolicy API is deprecated and will be +[removed](/docs/reference/using-api/deprecation-guide/#v1-25) from Kubernetes in v1.25. +--> +PodSecurityPolicy API 已经被废弃，会在 Kubernetes v1.25 发行版中 +[移除](/zh/docs/reference/using-api/deprecation-guide/#v1-25)。 +{{< /note >}} + +<!-- body --> + +<!-- +## Enabling the `PodSecurity` admission plugin + +In v1.23, the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) +is a Beta feature and is enabled by default. + +In v1.22, the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) +is an Alpha feature and must be enabled in `kube-apiserver` in order to use the built-in admission plugin. +--> +## 启用 `PodSecurity` 准入插件 {#enabling-the-podsecurity-admission-plugin} + +在 v1.23 中，`PodSecurity` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/) +是一项 Beta 功能特性，默认被启用。 + +在 v1.22 中，`PodSecurity` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/) +是一项 Alpha 功能特性，必须在 `kube-apiserver` 上启用才能使用内置的准入插件。 + +```shell +--feature-gates="...,PodSecurity=true" +``` + +<!-- +## Alternative: installing the `PodSecurity` admission webhook {#webhook} + +For environments where the built-in `PodSecurity` admission plugin cannot be used, +either because the cluster is older than v1.22, or the `PodSecurity` feature cannot be enabled, +the `PodSecurity` admission logic is also available as a Beta [validating admission webhook](https://git.k8s.io/pod-security-admission/webhook). +--> +## 替代方案：安装 `PodSecurity` 准入 Webhook {#webhook} + +对于无法应用内置 `PodSecurity` 准入插件的环境，无论是因为集群版本低于 v1.22， +或者 `PodSecurity` 特性无法被启用，都可以使用 Beta 版本的 +[验证性准入 Webhook](https://git.k8s.io/pod-security-admission/webhook)。 +来使用 `PodSecurity` 准入逻辑。 + +<!-- +A pre-built container image, certificate generation scripts, and example manifests +are available at [https://git.k8s.io/pod-security-admission/webhook](https://git.k8s.io/pod-security-admission/webhook). + +To install: +--> +在 [https://git.k8s.io/pod-security-admission/webhook](https://git.k8s.io/pod-security-admission/webhook) +上可以找到一个预先构建的容器镜像、证书生成脚本以及一些示例性质的清单。 + +```shell +git clone git@github.com:kubernetes/pod-security-admission.git +cd pod-security-admission/webhook +make certs +kubectl apply -k . +``` + +{{< note >}} +<!-- +The generated certificate is valid for 2 years. Before it expires, +regenerate the certificate or remove the webhook in favor of the built-in admission plugin. +--> +所生成的证书合法期限为 2 年。在证书过期之前， +需要重新生成证书或者去掉 Webhook 以使用内置的准入查件。 +{{< /note >}} + +<!-- +## Pod Security levels +--> +## Pod 安全性级别 {#pod-security-levels} + +<!-- +Pod Security admission places requirements on a Pod's [Security +Context](/docs/tasks/configure-pod-container/security-context/) and other related fields according +to the three levels defined by the [Pod Security +Standards](/docs/concepts/security/pod-security-standards): `privileged`, `baseline`, and +`restricted`. Refer to the [Pod Security Standards](/docs/concepts/security/pod-security-standards) +page for an in-depth look at those requirements. +--> +Pod 安全性准入插件对 Pod 的[安全性上下文](/zh/docs/tasks/configure-pod-container/security-context/) +有一定的要求，并且依据 [Pod 安全性标准](/zh/docs/concepts/security/pod-security-standards) +所定义的三个级别（`privileged`、`baseline` 和 `restricted`）对其他字段也有要求。 +关于这些需求的更进一步讨论，请参阅 +[Pod 安全性标准](/zh/docs/concepts/security/pod-security-standards/)页面。 + +<!-- +## Pod Security Admission labels for namespaces + +Once the feature is enabled or the webhook is installed, you can configure namespaces to define the admission +control mode you want to use for pod security in each namespace. Kubernetes defines a set of +{{< glossary_tooltip term_id="label" text="labels" >}} that you can set to define which of the +predefined Pod Security Standard levels you want to use for a namespace. The label you select +defines what action the {{< glossary_tooltip text="control plane" term_id="control-plane" >}} +takes if a potential violation is detected: +--> +## 为名字空间设置 Pod 安全性准入控制标签 + +一旦特性被启用或者安装了 Webhook，你可以配置名字空间以定义每个名字空间中 +Pod 安全性准入控制模式。 +Kubernetes 定义了一组{{< glossary_tooltip term_id="label" text="标签" >}}， +你可以设置这些标签来定义某个名字空间上要使用的预定义的 Pod 安全性标准级别。 +你所选择的标签定义了检测到潜在违例时，{{< glossary_tooltip text="控制面" term_id="control-plane" >}} +要采取什么样的动作。 + +<!-- +{{< table caption="Pod Security Admission modes" >}} +Mode | Description +:---------|:------------ +**enforce** | Policy violations will cause the pod to be rejected. +**audit** | Policy violations will trigger the addition of an audit annotation to the event recorded in the [audit log](/docs/tasks/debug-application-cluster/audit/), but are otherwise allowed. +**warn** | Policy violations will trigger a user-facing warning, but are otherwise allowed. +{{< /table >}} +--> +{{< table caption="Pod 安全准入模式" >}} +模式 | 描述 +:---------|:------------ +**enforce** | 策略违例会导致 Pod 被拒绝 +**audit** | 策略违例会触发[审计日志](/zh/docs/tasks/debug-application-cluster/audit/)中记录新事件时添加审计注解；但是 Pod 仍是被接受的。 +**warn** | 策略违例会触发用户可见的警告信息，但是 Pod 仍是被接受的。 +{{< /table >}} + +<!-- +A namespace can configure any or all modes, or even set a different level for different modes. + +For each mode, there are two labels that determine the policy used: +--> +名字空间可以配置任何一种或者所有模式，或者甚至为不同的模式设置不同的级别。 + +对于每种模式，决定所使用策略的标签有两个： + +<!-- +# The per-mode level label indicates which policy level to apply for the mode. +# +# MODE must be one of `enforce`, `audit`, or `warn`. +# LEVEL must be one of `privileged`, `baseline`, or `restricted`. +pod-security.kubernetes.io/<MODE>: <LEVEL> + +# Optional: per-mode version label that can be used to pin the policy to the +# version that shipped with a given Kubernetes minor version (for example v{{< skew latestVersion >}}). +# +# MODE must be one of `enforce`, `audit`, or `warn`. +# VERSION must be a valid Kubernetes minor version, or `latest`. +pod-security.kubernetes.io/<MODE>-version: <VERSION> +--> +``` +# 针对模式的级别标签用来标示针对该模式所应用的策略级别 +# +# MODE 必须是 `enforce`、`audit` 或 `warn` 之一 +# LEVEL 必须是 `privileged`、baseline` 或 `restricted` 之一 +pod-security.kubernetes.io/<MODE>: <LEVEL> + +# 可选：针对每个模式版本的版本标签可以将策略锁定到 +# 给定 Kubernetes 小版本号所附带的版本（例如 v{{< skew latestVersion >}}） +# +# MODE 必须是 `enforce`、`audit` 或 `warn` 之一 +# VERSION 必须是一个合法的 Kubernetes 小版本号或者 `latest` +pod-security.kubernetes.io/<MODE>-version: <VERSION> +``` + +<!-- +Check out [Enforce Pod Security Standards with Namespace Labels](/docs/tasks/configure-pod-container/enforce-standards-namespace-labels) to see example usage. +--> +关于用法示例，可参阅 +[使用名字空间标签来强制实施 Pod 安全标准](/zh/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/)。 + +<!-- +## Workload resources and Pod templates + +Pods are often created indirectly, by creating a [workload +object](/docs/concepts/workloads/controllers/) such as a {{< glossary_tooltip +term_id="deployment" >}} or {{< glossary_tooltip term_id="job">}}. The workload object defines a +_Pod template_ and a {{< glossary_tooltip term_id="controller" text="controller" >}} for the +workload resource creates Pods based on that template. To help catch violations early, both the +audit and warning modes are applied to the workload resources. However, enforce mode is **not** +applied to workload resources, only to the resulting pod objects. +--> +## 负载资源和 Pod 模板 {#workload-resources-and-pod-templates} + +Pod 通常是通过创建 {{< glossary_tooltip term_id="deployment" >}} 或 +{{< glossary_tooltip term_id="job">}} 这类[工作负载对象](/zh/docs/concepts/workloads/controllers/) +来间接创建的。工作负载对象为工作负载资源定义一个 _Pod 模板_ 和一个对应的 +负责基于该模板来创建 Pod 的{{< glossary_tooltip term_id="controller" text="控制器" >}}。 +为了尽早地捕获违例状况，`audit` 和 `warn` 模式都应用到负载资源。 +不过，`enforce` 模式并 **不** 应用到工作负载资源，仅应用到所生成的 Pod 对象上。 + +<!-- +## Exemptions + +You can define _exemptions_ from pod security enforcement in order allow the creation of pods that +would have otherwise been prohibited due to the policy associated with a given namespace. +Exemptions can be statically configured in the +[Admission Controller configuration](/docs/tasks/configure-pod-container/enforce-standards-admission-controller/#configure-the-admission-controller). +--> +## 豁免 {#exemptions} + +你可以为 Pod 安全性的实施设置 _豁免（Exemptions）_ 规则， +从而允许创建一些本来会被与给定名字空间相关的策略所禁止的 Pod。 +豁免规则可以在[准入控制器配置](/zh/docs/tasks/configure-pod-container/enforce-standards-admission-controller/#configure-the-admission-controller) +中静态配置。 + +<!-- +Exemptions must be explicitly enumerated. Requests meeting exemption criteria are _ignored_ by the +Admission Controller (all `enforce`, `audit` and `warn` behaviors are skipped). Exemption dimensions include: +--> +豁免规则可以显式枚举。满足豁免标准的请求会被准入控制器 _忽略_ +（所有 `enforce`、`audit` 和 `warn` 行为都会被略过）。 +豁免的维度包括： + +<!-- +- **Usernames:** requests from users with an exempt authenticated (or impersonated) username are + ignored. +- **RuntimeClassNames:** pods and [workload resources](#workload-resources-and-pod-templates) specifying an exempt runtime class name are + ignored. +- **Namespaces:** pods and [workload resources](#workload-resources-and-pod-templates) in an exempt namespace are ignored. +--> +- **Username：** 来自用户名已被豁免的、已认证的（或伪装的）的用户的请求会被忽略。 +- **RuntimeClassName：** 指定了已豁免的运行时类名称的 Pod + 和[负载资源](#workload-resources-and-pod-templates)会被忽略。 +- **Namespace：** 位于被豁免的名字空间中的 Pod 和[负载资源](#workload-resources-and-pod-templates) + 会被忽略。 + +{{< caution >}} +<!-- +Most pods are created by a controller in response to a [workload +resource](#workload-resources-and-pod-templates), meaning that exempting an end user will only +exempt them from enforcement when creating pods directly, but not when creating a workload resource. +Controller service accounts (such as `system:serviceaccount:kube-system:replicaset-controller`) +should generally not be exempted, as doing so would implicitly exempt any user that can create the +corresponding workload resource. +--> +大多数 Pod 是作为对[工作负载资源](#workload-resources-and-pod-templates)的响应， +由控制器所创建的，这意味着为某最终用户提供豁免时，只会当该用户直接创建 Pod +时对其实施安全策略的豁免。用户创建工作负载资源时不会被豁免。 +控制器服务账号（例如：`system:serviceaccount:kube-system:replicaset-controller`） +通常不应该被豁免，因为豁免这类服务账号隐含着对所有能够创建对应工作负载资源的用户豁免。 +{{< /caution >}} + +<!-- +Updates to the following pod fields are exempt from policy checks, meaning that if a pod update +request only changes these fields, it will not be denied even if the pod is in violation of the +current policy level: +--> +策略检查时会对以下 Pod 字段的更新操作予以豁免，这意味着如果 Pod +更新请求仅改变这些字段时，即使 Pod 违反了当前的策略级别，请求也不会被拒绝。 + +<!-- +- Any metadata updates **except** changes to the seccomp or AppArmor annotations: + - `seccomp.security.alpha.kubernetes.io/pod` (deprecated) + - `container.seccomp.security.alpha.kubernetes.io/*` (deprecated) + - `container.apparmor.security.beta.kubernetes.io/*` +- Valid updates to `.spec.activeDeadlineSeconds` +- Valid updates to `.spec.tolerations` +--> +- 除了对 seccomp 或 AppArmor 注解之外的所有 meatadata 更新操作： + - `seccomp.security.alpha.kubernetes.io/pod` （已弃用） + - `container.seccomp.security.alpha.kubernetes.io/*` （已弃用） + - `container.apparmor.security.beta.kubernetes.io/*` +- 对 `.spec.activeDeadlineSeconds` 的合法更新 +- 对 `.spec.tolerations` 的合法更新 + +## {{% heading "whatsnext" %}} + +<!-- +- [Pod Security Standards](/docs/concepts/security/pod-security-standards) +- [Enforcing Pod Security Standards](/docs/setup/best-practices/enforcing-pod-security-standards) +- [Enforce Pod Security Standards by Configuring the Built-in Admission Controller](/docs/tasks/configure-pod-container/enforce-standards-admission-controller) +- [Enforce Pod Security Standards with Namespace Labels](/docs/tasks/configure-pod-container/enforce-standards-namespace-labels) +- [Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller](/docs/tasks/configure-pod-container/migrate-from-psp) +--> +- [Pod 安全性标准](/zh/docs/concepts/security/pod-security-standards/) +- [强制实施 Pod 安全性标准](/zh/docs/setup/best-practices/enforcing-pod-security-standards/) +- [通过配置内置的准入控制器强制实施 Pod 安全性标准](/zh/docs/tasks/configure-pod-container/enforce-standards-admission-controller/) +- [使用名字空间标签来实施 Pod 安全性标准](/zh/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/) +- [从 PodSecurityPolicy 迁移到内置的 PodSecurity 准入控制器](/zh/docs/tasks/configure-pod-container/migrate-from-psp/) + diff --git a/content/zh/docs/concepts/security/pod-security-standards.md b/content/zh/docs/concepts/security/pod-security-standards.md index 7a78e66b4c..e1a2ce9bb3 100644 --- a/content/zh/docs/concepts/security/pod-security-standards.md +++ b/content/zh/docs/concepts/security/pod-security-standards.md @@ -46,8 +46,8 @@ Pod 安全性标准定义了三种不同的 _策略（Policy）_，以广泛覆 ### Privileged <!-- -**The _Privileged_ policy is purposely-open, and entirely unrestricted.** This type of policy is typically -aimed at system- and infrastructure-level workloads managed by privileged, trusted users. +**The _Privileged_ policy is purposely-open, and entirely unrestricted.** This type of policy is +typically aimed at system- and infrastructure-level workloads managed by privileged, trusted users. The privileged policy is defined by an absence of restrictions. For allow-by-default enforcement mechanisms (such as gatekeeper), the privileged profile may be an absence of applied constraints @@ -69,17 +69,18 @@ Privileged 策略应该默认允许所有控制（即，禁止所有限制）。 preventing known privilege escalations.** This policy is targeted at application operators and developers of non-critical applications. The following listed controls should be enforced/disallowed: - -In this table, wildcards (`*`) indicate all elements in a list. For example, -`spec.containers[*].securityContext` refers to the Security Context object for _all defined -containers_. If any of the listed containers fails to meet the requirements, the entire pod will -fail validation. --> **_Baseline_ 策略的目标是便于常见的容器化应用采用，同时禁止已知的特权提升。** 此策略针对的是应用运维人员和非关键性应用的开发人员。 下面列举的控制应该被实施（禁止）： {{< note >}} +<!-- +In this table, wildcards (`*`) indicate all elements in a list. For example, +`spec.containers[*].securityContext` refers to the Security Context object for _all defined +containers_. If any of the listed containers fails to meet the requirements, the entire pod will +fail validation. +--> 在下述表格中，通配符（`*`）意味着一个列表中的所有元素。 例如 `spec.containers[*].securityContext` 表示 _所定义的所有容器_ 的安全性上下文对象。 如果所列出的任一容器不能满足要求，整个 Pod 将无法通过校验。 @@ -90,8 +91,8 @@ fail validation. <caption style="display:none">Baseline 策略规范</caption> <tbody> <tr> - <td width="30%"><strong>控制（Control）</strong></td> - <td><strong>策略（Policy）</strong></td> + <td>控制（Control）</td> + <td>策略（Policy）</td> </tr> <tr> <!-- <td style="white-space: nowrap">HostProcess</td> --> @@ -564,31 +565,19 @@ fail validation. <p>In addition to restricting HostPath volumes, the restricted policy limits usage of non-core volume types to those defined through PersistentVolumes.</p> <p><strong>Restricted Fields</strong></p> <ul> - <li><code>spec.volumes[*].hostPath</code></li> - <li><code>spec.volumes[*].gcePersistentDisk</code></li> - <li><code>spec.volumes[*].awsElasticBlockStore</code></li> - <li><code>spec.volumes[*].gitRepo</code></li> - <li><code>spec.volumes[*].nfs</code></li> - <li><code>spec.volumes[*].iscsi</code></li> - <li><code>spec.volumes[*].glusterfs</code></li> - <li><code>spec.volumes[*].rbd</code></li> - <li><code>spec.volumes[*].flexVolume</code></li> - <li><code>spec.volumes[*].cinder</code></li> - <li><code>spec.volumes[*].cephfs</code></li> - <li><code>spec.volumes[*].flocker</code></li> - <li><code>spec.volumes[*].fc</code></li> - <li><code>spec.volumes[*].azureFile</code></li> - <li><code>spec.volumes[*].vsphereVolume</code></li> - <li><code>spec.volumes[*].quobyte</code></li> - <li><code>spec.volumes[*].azureDisk</code></li> - <li><code>spec.volumes[*].portworxVolume</code></li> - <li><code>spec.volumes[*].scaleIO</code></li> - <li><code>spec.volumes[*].storageos</code></li> - <li><code>spec.volumes[*].photonPersistentDisk</code></li> + <li><code>spec.volumes[*]</code></li> </ul> <p><strong>Allowed Values</strong></p> + Every item in the <code>spec.volumes[*]</code> list must set one of the following fields to a non-null value: <ul> - <li>Undefined/nil</li> + <li><code>spec.volumes[*].configMap</code></li> + <li><code>spec.volumes[*].csi</code></li> + <li><code>spec.volumes[*].downwardAPI</code></li> + <li><code>spec.volumes[*].emptyDir</code></li> + <li><code>spec.volumes[*].ephemeral</code></li> + <li><code>spec.volumes[*].persistentVolumeClaim</code></li> + <li><code>spec.volumes[*].projected</code></li> + <li><code>spec.volumes[*].secret</code></li> </ul> </td> --> <td>卷类型</td> @@ -596,31 +585,19 @@ fail validation. <p>除了限制 HostPath 卷之外，此类策略还限制可以通过 PersistentVolumes 定义的非核心卷类型。</p> <p><strong>限制的字段</strong></p> <ul> - <li><code>spec.volumes[*].hostPath</code></li> - <li><code>spec.volumes[*].gcePersistentDisk</code></li> - <li><code>spec.volumes[*].awsElasticBlockStore</code></li> - <li><code>spec.volumes[*].gitRepo</code></li> - <li><code>spec.volumes[*].nfs</code></li> - <li><code>spec.volumes[*].iscsi</code></li> - <li><code>spec.volumes[*].glusterfs</code></li> - <li><code>spec.volumes[*].rbd</code></li> - <li><code>spec.volumes[*].flexVolume</code></li> - <li><code>spec.volumes[*].cinder</code></li> - <li><code>spec.volumes[*].cephfs</code></li> - <li><code>spec.volumes[*].flocker</code></li> - <li><code>spec.volumes[*].fc</code></li> - <li><code>spec.volumes[*].azureFile</code></li> - <li><code>spec.volumes[*].vsphereVolume</code></li> - <li><code>spec.volumes[*].quobyte</code></li> - <li><code>spec.volumes[*].azureDisk</code></li> - <li><code>spec.volumes[*].portworxVolume</code></li> - <li><code>spec.volumes[*].scaleIO</code></li> - <li><code>spec.volumes[*].storageos</code></li> - <li><code>spec.volumes[*].photonPersistentDisk</code></li> + <li><code>spec.volumes[*]</code></li> </ul> <p><strong>允许的值</strong></p> + <code>spec.volumes[*]</code> 列表中的每个条目必须将下面字段之一设置为非空值： <ul> - <li>未定义/nil</li> + <li><code>spec.volumes[*].configMap</code></li> + <li><code>spec.volumes[*].csi</code></li> + <li><code>spec.volumes[*].downwardAPI</code></li> + <li><code>spec.volumes[*].emptyDir</code></li> + <li><code>spec.volumes[*].ephemeral</code></li> + <li><code>spec.volumes[*].persistentVolumeClaim</code></li> + <li><code>spec.volumes[*].projected</code></li> + <li><code>spec.volumes[*].secret</code></li> </ul> </td> </tr> @@ -696,40 +673,36 @@ fail validation. </td> </tr> <tr> - <!-- <td style="white-space: nowrap">Non-root groups <em>(optional)</em></td> --> - <td style="white-space: nowrap">非 root 组<em>（可选）</em></td> + <!-- <td style="white-space: nowrap">Running as Non-root user (v1.23+)</td> --> + <td style="white-space: nowrap">非 root 用户（v1.23+）</td> <td> - <!-- <td> - <p>Containers should be forbidden from running with a root primary or supplementary GID.</p> + <!-- + <p>Containers must not set <tt>runAsUser</tt> to 0</p> <p><strong>Restricted Fields</strong></p> <ul> - <li><code>spec.securityContext.runAsGroup</code></li> - <li><code>spec.securityContext.supplementalGroups[*]</code></li> - <li><code>spec.securityContext.fsGroup</code></li> - <li><code>spec.containers[*].securityContext.runAsGroup</code></li> - <li><code>spec.initContainers[*].securityContext.runAsGroup</code></li> - <li><code>spec.ephemeralContainers[*].securityContext.runAsGroup</code></li> + <li><code>spec.securityContext.runAsUser</code></li> + <li><code>spec.containers[*].securityContext.runAsUser</code></li> + <li><code>spec.initContainers[*].securityContext.runAsUser</code></li> + <li><code>spec.ephemeralContainers[*].securityContext.runAsUser</code></li> </ul> <p><strong>Allowed Values</strong></p> <ul> - <li>Undefined/nil (except for <code>*.runAsGroup</code>)</li> - <li>Non-zero</li> + <li>any non-zero value</li> + <li><code>undefined/null</code></li> </ul> </td> --> - <p>禁止容器使用 root 作为主要或辅助 GID 来运行。</p> + <p>Containers 不可以将 <tt>runAsUser</tt> 设置为 0</p> <p><strong>限制的字段</strong></p> <ul> - <li><code>spec.securityContext.runAsGroup</code></li> - <li><code>spec.securityContext.supplementalGroups[*]</code></li> - <li><code>spec.securityContext.fsGroup</code></li> - <li><code>spec.containers[*].securityContext.runAsGroup</code></li> - <li><code>spec.initContainers[*].securityContext.runAsGroup</code></li> - <li><code>spec.ephemeralContainers[*].securityContext.runAsGroup</code></li> + <li><code>spec.securityContext.runAsUser</code></li> + <li><code>spec.containers[*].securityContext.runAsUser</code></li> + <li><code>spec.initContainers[*].securityContext.runAsUser</code></li> + <li><code>spec.ephemeralContainers[*].securityContext.runAsUser</code></li> </ul> - <p><strong>允许的值</strong></p> + <p><strong>允许的字段</strong></p> <ul> - <li>未定义/nil（<code>*.runAsGroup</code> 除外）</li> - <li>非零值</li> + <li>any non-zero value</li> + <li><code>未定义/空值</code></li> </ul> </td> </tr> @@ -859,11 +832,11 @@ of individual policies are not defined here. [**Pod 安全性准入控制器**](/zh/docs/concepts/security/pod-security-admission/) -- {{< example file="security/podsecurity-privileged.yaml" >}}Privileged namespace{{< /example >}} -- {{< example file="security/podsecurity-baseline.yaml" >}}Baseline namespace{{< /example >}} -- {{< example file="security/podsecurity-restricted.yaml" >}}Restricted namespace{{< /example >}} +- {{< example file="security/podsecurity-privileged.yaml" >}}Privileged 名字空间{{< /example >}} +- {{< example file="security/podsecurity-baseline.yaml" >}}Baseline 名字空间{{< /example >}} +- {{< example file="security/podsecurity-restricted.yaml" >}}Restricted 名字空间{{< /example >}} -[**PodSecurityPolicy**](/zh/docs/concepts/policy/pod-security-policy/) +[**PodSecurityPolicy**](/zh/docs/concepts/policy/pod-security-policy/) （已弃用） - {{< example file="policy/privileged-psp.yaml" >}}Privileged{{< /example >}} - {{< example file="policy/baseline-psp.yaml" >}}Baseline{{< /example >}} diff --git a/content/zh/docs/setup/best-practices/enforcing-pod-security-standards.md b/content/zh/docs/setup/best-practices/enforcing-pod-security-standards.md new file mode 100644 index 0000000000..7326dd5aaa --- /dev/null +++ b/content/zh/docs/setup/best-practices/enforcing-pod-security-standards.md @@ -0,0 +1,154 @@ +--- +title: 强制实施 Pod 安全性标准 +weight: 40 +--- + +<!-- +reviewers: +- tallclair +- liggitt +title: Enforcing Pod Security Standards +weight: 40 +--> + +<!-- overview --> + +<!-- +This page provides an overview of best practices when it comes to enforcing +[Pod Security Standards](/docs/concepts/security/pod-security-standards). +--> +本页提供实施 [Pod 安全标准（Pod Security Standards）](/zh/docs/concepts/security/pod-security-standards) +时的一些最佳实践。 + +<!-- body --> + +<!-- +## Using the built-in Pod Security Admission Controller +--> +## 使用内置的 Pod 安全性准入控制器 + +{{< feature-state for_k8s_version="v1.23" state="beta" >}} + +<!-- +The [Pod Security Admission Controller](/docs/reference/access-authn-authz/admission-controllers/#podsecurity) +intends to replace the deprecated PodSecurityPolicies. +--> +[Pod 安全性准入控制器](/zh/docs/reference/access-authn-authz/admission-controllers/#podsecurity) +尝试替换已被废弃的 PodSecurityPolicies。 + +<!-- +### Configure all cluster namespaces +--> +### 配置所有集群名字空间 {#configure-all-cluster-namespaces} + +<!-- +Namespaces that lack any configuration at all should be considered significant gaps in your cluster +security model. We recommend taking the time to analyze the types of workloads occurring in each +namespace, and by referencing the Pod Security Standards, decide on an appropriate level for +each of them. Unlabeled namespaces should only indicate that they've yet to be evaluated. +--> +完全未经配置的名字空间应该被视为集群安全模型中的重大缺陷。 +我们建议花一些时间来分析在每个名字空间中执行的负载的类型， +并通过引用 Pod 安全性标准来确定每个负载的合适级别。 +未设置标签的名字空间应该视为尚未被评估。 + +<!-- +In the scenario that all workloads in all namespaces have the same security requirements, +we provide an [example](/docs/concepts/security/pod-security-admission/#applying-to-all-namespaces) +that illustrates how the PodSecurity labels can be applied in bulk. +--> +针对所有名字空间中的所有负载都具有相同的安全性需求的场景， +我们提供了一个[示例](/zh/docs/concepts/security/pod-security-admission/#applying-to-all-namespaces) +用来展示如何批量应用 Pod 安全性标签。 + +<!-- +### Embrace the principle of least privilege + +In an ideal world, every pod in every namespace would meet the requirements of the `restricted` +policy. However, this is not possible nor practical, as some workloads will require elevated +privileges for legitimate reasons. +--> +### 拥抱最小特权原则 + +在一个理想环境中，每个名字空间中的每个 Pod 都会满足 `restricted` 策略的需求。 +不过，这既不可能也不现实，某些负载会因为合理的原因而需要特权上的提升。 + +<!-- +- Namespaces allowing `privileged` workloads should establish and enforce appropriate access controls. +- For workloads running in those permissive namespaces, maintain documentation about their unique + security requirements. If at all possible, consider how those requirements could be further + constrained. +--> +- 允许 `privileged` 负载的名字空间需要建立并实施适当的访问控制机制。 +- 对于运行在特权宽松的名字空间中的负载，需要维护其独特安全性需求的文档。 + 如果可能的话，要考虑如何进一步约束这些需求。 + +<!-- +### Adopt a multi-mode strategy + +The `audit` and `warn` modes of the Pod Security Standards admission controller make it easy to +collect important security insights about your pods without breaking existing workloads. +--> +### 采用多种模式的策略 + +Pod 安全性标准准入控制器的 `audit` 和 `warn` 模式（mode） +能够在不影响现有负载的前提下，让该控制器更方便地收集关于 Pod 的重要的安全信息。 + +<!-- +It is good practice to enable these modes for all namespaces, setting them to the _desired_ level +and version you would eventually like to `enforce`. The warnings and audit annotations generated in +this phase can guide you toward that state. If you expect workload authors to make changes to fit +within the desired level, enable the `warn` mode. If you expect to use audit logs to monitor/drive +changes to fit within the desired level, enable the `audit` mode. +--> +针对所有名字空间启用这些模式是一种好的实践，将它们设置为你最终打算 `enforce` 的 + _期望的_ 级别和版本。这一阶段中所生成的警告和审计注解信息可以帮助你到达这一状态。 +如果你期望负载的作者能够作出变更以便适应期望的级别，可以启用 `warn` 模式。 +如果你希望使用审计日志了监控和驱动变更，以便负载能够适应期望的级别，可以启用 `audit` 模式。 + +<!-- +When you have the `enforce` mode set to your desired value, these modes can still be useful in a +few different ways: + +- By setting `warn` to the same level as `enforce`, clients will receive warnings when attempting + to create Pods (or resources that have Pod templates) that do not pass validation. This will help + them update those resources to become compliant. +- In Namespaces that pin `enforce` to a specific non-latest version, setting the `audit` and `warn` + modes to the same level as `enforce`, but to the `latest` version, gives visibility into settings + that were allowed by previous versions but are not allowed per current best practices. +--> +当你将 `enforce` 模式设置为期望的取值时，这些模式在不同的场合下仍然是有用的： + +- 通过将 `warn` 设置为 `enforce` 相同的级别，客户可以在尝试创建无法通过合法检查的 Pod + （或者包含 Pod 模板的资源）时收到警告信息。这些信息会帮助于更新资源使其合规。 +- 在将 `enforce` 锁定到特定的非最新版本的名字空间中，将 `audit` 和 `warn` + 模式设置为 `enforce` 一样的级别而非 `latest` 版本， + 这样可以方便看到之前版本所允许但当前最佳实践中被禁止的设置。 + +<!-- +## Third-party alternatives +--> +## 第三方替代方案 {#third-party-alternatives} + +{{% thirdparty-content %}} + +<!-- +Other alternatives for enforcing security profiles are being developed in the Kubernetes +ecosystem: +--> +Kubernetes 生态系统中也有一些其他强制实施安全设置的替代方案处于开发状态中： + +- [Kubewarden](https://github.com/kubewarden). +- [Kyverno](https://kyverno.io/policies/). +- [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper). + +<!-- +The decision to go with a _built-in_ solution (e.g. PodSecurity admission controller) versus a +third-party tool is entirely dependent on your own situation. When evaluating any solution, +trust of your supply chain is crucial. Ultimately, using _any_ of the aforementioned approaches +will be better than doing nothing. +--> +采用 _内置的_ 方案（例如 PodSecurity 准入控制器）还是第三方工具， +这一决策完全取决于你自己的情况。在评估任何解决方案时，对供应链的信任都是至关重要的。 +最终，使用前述方案中的 _任何_ 一种都好过放任自流。 + From 485cf6bb23e8f4bee7a4617ad235dbd9b6f7f69c Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Sun, 27 Feb 2022 10:00:16 +0800 Subject: [PATCH 055/104] [zh] Translate the migrating from PSP page --- .../migrate-from-psp.md | 669 ++++++++++++++++-- 1 file changed, 622 insertions(+), 47 deletions(-) diff --git a/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md b/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md index db9141bd13..9c0715c99f 100644 --- a/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md +++ b/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md @@ -33,61 +33,636 @@ admission controller. This can be done effectively using a combination of dry-ru --> - 确保 `PodSecurity` [特性门控](/docs/reference/command-line-tools-reference/feature-gates/)被启用。 +<!-- +This page assumes you are already familiar with the basic [Pod Security Admission](/docs/concepts/security/pod-security-admission/) +concepts. +--> +本页面假定你已经熟悉 [Pod 安全性准入](/zh/docs/concepts/security/pod-security-admission/)的基本概念。 + <!-- body --> <!-- -## Steps +## Overall approach + +There are multiple strategies you can take for migrating from PodSecurityPolicy to Pod Security +Admission. The following steps are one possible migration path, with a goal of minimizing both the +risks of a production outage and of a security gap. --> -## 步骤 {#steps} +## 方法概览 {#overall-approach} + +你可以采取多种策略来完成从 PodSecurityPolicy 到 Pod 安全性准入 +（Pod Security Admission）的迁移。 +下面是一种可能的迁移路径，其目标是尽可能降低生产环境不可用的风险， +以及安全性仍然不足的风险。 + +<!-- Keep section header numbering in sync with this list. --> +<!-- +0. Decide whether Pod Security Admission is the right fit for your use case. +1. Review namespace permissions +2. Simplify & standardize PodSecurityPolicies +3. Update namespaces + 1. Identify an appropriate Pod Security level + 2. Verify the Pod Security level + 3. Enforce the Pod Security level + 4. Bypass PodSecurityPolicy +4. Review namespace creation processes +5. Disable PodSecurityPolicy +--> +0. 确定 Pod 安全性准入是否对于你的使用场景而言比较合适。 +1. 审查名字空间访问权限。 +2. 简化、标准化 PodSecurityPolicy。 +3. 更新名字空间： + 1. 确定合适的 Pod 安全性级别； + 2. 验证该 Pod 安全性级别可工作； + 3. 实施该 Pod 安全性级别； + 4. 绕过 PodSecurityPolicy。 +4. 审阅名字空间创建过程。 +5. 禁用 PodSecurityPolicy。 <!-- -- **Eliminate mutating PodSecurityPolicies, if your cluster has any set up.** - - Clone all mutating PSPs into a non-mutating version. - - Update all ClusterRoles authorizing use of those mutating PSPs to also authorize use of the - non-mutating variant. - - Watch for Pods using the mutating PSPs and work with code owners to migrate to valid, - non-mutating resources. - - Delete mutating PSPs. +## 0. Decide whether Pod Security Admission is right for you {#is-psa-right-for-you} --> --- **如果你的集群中配置了变更式的 PodSecurityPolicy，将它们删除。** - - 复制所有变更式 PSP 复制到非变更式版本中。 - - 更新所有授权使用那些变更式 PSP 的 ClusterRole，使之也能为非变更式版本鉴权。 - - 检视使用了变更式 PSP 的 Pod，与拥有该代码的人一起将其迁移到合法的、非变更式的资源。 - - 删除变更式 PSP。 +## 0. 确定是否 Pod 安全性准入适合你 {#is-psa-right-for-you} <!-- -- **Select a compatible policy level for each namespace.** Analyze existing resources in the - namespace to drive this decision. - - Review the requirements of the different [Pod Security Standards](/docs/concepts/security/pod-security-standards). - - Evaluate the difference in privileges that would come from disabling the PSP controller. - - In the event that a PodSecurityPolicy falls between two levels, consider: - - Selecting a _less_ permissive PodSecurity level prioritizes security, and may require adjusting - workloads to fit within the stricter policy. - - Selecting a _more_ permissive PodSecurity level prioritizes avoiding disrupting or - changing workloads, but may allow workload authors in the namespace greater permissions - than desired. +Pod Security Admission was designed to meet the most common security needs out of the box, and to +provide a standard set of security levels across clusters. However, it is less flexible than +PodSecurityPolicy. Notably, the following features are supported by PodSecurityPolicy but not Pod +Security Admission: --> -- **为每个名字空间选择一个兼容的策略级别。** - 要分析名字空间中已有的资源才能作出此决定。 - - 审阅不同 [Pod 安全标准](/zh/docs/concepts/security/pod-security-standards)的需求。 - - 评估禁用 PSP 控制器所带来的特权级变化。 - - 当 PodSecurityPolicy 中的设置介于两种策略级别之间时，考虑： - - 选择一个安全许可*略弱*的 PodSecurity 级别，可能需要调整负载本身， - 使之能够在较严格的策略下工作。 - - 选择一个安全许可*略强*的 PodSecurity 级别，从而避免干扰或变更负载本身。 - 不过这样做可能会让负载的作者在名字空间中拥有超出预期的权限。 -<!-- -- **Apply the selected profiles in `warn` and `audit` mode.** This will give you an idea of how - your Pods will respond to the new policies, without breaking existing workloads. Iterate on your - [Pods' configuration](/docs/concepts/security/pod-security-admission#configuring-pods) until - they are in compliance with the selected profiles. -- Apply the profiles in `enforce` mode. -- Stop including `PodSecurityPolicy` in the `--enable-admission-plugins` flag. ---> -- **在 `warn` 和 `audit` 模式下应用所选的策略。** - 这样做会让你了解 Pod 会如何对新的策略作出反应，同时不会破坏现有负载。 - 反复调试你的[Pod 配置](/zh/docs/concepts/security/pod-security-admission#configuring-pods) - 直到它们与所选的策略匹配。 -- 用 `enforce` 模式下应用策略。 -- 在 `--enable-admission-plugins` 标志中去除 `PodSecurityPolicy`。 +Pod 安全性准入被设计用来直接满足最常见的安全性需求，并提供一组可用于多个集群的安全性级别。 +不过，这一机制比 PodSecurityPolicy 的灵活度要低。 +值得注意的是，PodSecurityPolicy 所支持的以下特性是 Pod 安全性准入所不支持的： + +<!-- +- **Setting default security constraints** - Pod Security Admission is a non-mutating admission + controller, meaning it won't modify pods before validating them. If you were relying on this + aspect of PSP, you will need to either modify your workloads to meet the Pod Security constraints, + or use a [Mutating Admission Webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/) + to make those changes. See [Simplify & Standardize PodSecurityPolicies](#simplify-psps) below for more detail. +--> +- **设置默认的安全性约束** - Pod 安全性准入是一个非变更性质的准入控制器， + 这就意味着它不会在对 Pod 进行合法性检查之前更改其配置。如果你之前依赖于 PSP 的这方面能力， + 你或者需要更改你的负载以满足 Pod 安全性约束，或者需要使用一个 + [变更性质的准入 Webhook](/zh/docs/reference/access-authn-authz/extensible-admission-controllers/) + 来执行相应的变更。进一步的细节可参见后文的[简化和标准化 PodSecurityPolicy](#simplify-psps)。 +<!-- +- **Fine-grained control over policy definition** - Pod Security Admission only supports + [3 standard levels](/docs/concepts/security/pod-security-standards/). + If you require more control over specific constraints, then you will need to use a + [Validating Admission Webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/) + to enforce those policies. +--> +- **对策略定义的细粒度控制** - Pod 安全性准入仅支持 + [三种标准级别](/zh/docs/concepts/security/pod-security-standards/)。 + 如果你需要对特定的约束施加更多的控制，你就需要使用一个 + [验证性质的准入 Webhook](/zh/docs/reference/access-authn-authz/extensible-admission-controllers/) + 以实施这列策略。 +<!-- +- **Sub-namespace policy granularity** - PodSecurityPolicy lets you bind different policies to + different Service Accounts or users, even within a single namespace. This approach has many + pitfalls and is not recommended, but if you require this feature anyway you will + need to use a 3rd party webhook instead. The exception to this is if you only need to completely exempt + specific users or [RuntimeClasses](/docs/concepts/containers/runtime-class/), in which case Pod + Security Admission does expose some + [static configuration for exemptions](/docs/concepts/security/pod-security-admission/#exemptions). +--> +- **粒度小于名字空间的策略** - PodSecurityPolicy 允许你为不同的服务账户或用户绑定不同策略， + 即使这些服务账户或用户隶属于同一个名字空间。这一方法有很多缺陷，不建议使用。 + 不过如果你的确需要这种功能，你就需要使用第三方的 Webhook。 + 唯一的例外是当你只需要完全针对某用户或者 + [RuntimeClasses](/zh/docs/concepts/containers/runtime-class/) 赋予豁免规则时， + Pod 安全性准入的确也为豁免规则暴露一些 + [静态配置](/zh/docs/concepts/security/pod-security-admission/#exemptions)。 + +<!-- +Even if Pod Security Admission does not meet all of your needs it was designed to be _complementary_ +to other policy enforcement mechanisms, and can provide a useful fallback running alongside other +admission webhooks. +--> +即便 Pod 安全性准入无法满足你的所有需求，该机制也是设计用作其他策略实施机制的 +_补充_，因此可以和其他准入 Webhook 一起运行，进而提供一种有用的兜底机制。 + +<!-- +## 1. Review namespace permissions {#review-namespace-permissions} +--> +## 1. 审查名字空间访问权限 {#review-namespace-permissions} + +<!-- +Pod Security Admission is controlled by [labels on +namespaces](/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces). +This means that anyone who can update (or patch or create) a namespace can also modify the Pod +Security level for that namespace, which could be used to bypass a more restrictive policy. Before +proceeding, ensure that only trusted, privileged users have these namespace permissions. It is not +recommended to grant these powerful permissions to users that shouldn't have elevated permissions, +but if you must you will need to use an +[admission webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/) +to place additional restrictions on setting Pod Security labels on Namespace objects. +--> +Pod 安全性准入是通过[名字空间上的标签](/zh/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces) +来控制的。这也就是说，任何能够更新（或通过 patch 部分更新或创建） +名字空间的人都可以更改该名字空间的 Pod 安全性级别，而这可能会被利用来绕过约束性更强的策略。 +在继续执行迁移操作之前，请确保只有被信任的、有特权的用户具有这类名字空间访问权限。 +不建议将这类强大的访问权限授予不应获得权限提升的用户，不过如果你必须这样做， +你需要使用一个 +[准入 Webhook](/zh/docs/reference/access-authn-authz/extensible-admission-controllers/) +来针对为 Namespace 对象设置 Pod 安全性级别设置额外的约束。 + +<!-- +## 2. Simplify & standardize PodSecurityPolicies {#simplify-psps} +--> +## 2. 简化、标准化 PodSecurityPolicy {#simplify-psps} + +<!-- +In this section, you will reduce mutating PodSecurityPolicies and remove options that are outside +the scope of the Pod Security Standards. You should make the changes recommended here to an offline +copy of the original PodSecurityPolicy being modified. The cloned PSP should have a different +name that is alphabetically before the original (for example, prepend a `0` to it). Do not create the +new policies in Kubernetes yet - that will be covered in the [Rollout the updated +policies](#psp-update-rollout) section below. +--> +在本节中，你会削减变更性质的 PodSecurityPolicy，去掉 Pod 安全性标准范畴之外的选项。 +针对要修改的、已存在的 PodSecurityPolicy，你应该将这里所建议的更改写入到其离线副本中。 +所克隆的 PSP 应该与原来的副本名字不同，并且按字母序要排到原副本之前 +（例如，可以向 PSP 名字前加一个 `0`）。 +先不要在 Kubernetes 中创建新的策略 - 这类操作会在后文的[推出更新的策略](#psp-update-rollout) +部分讨论。 + +<!-- +### 2.a. Eliminate purely mutating fields {#eliminate-mutating-fields} +--> +### 2.a. 去掉纯粹变更性质的字段 {#eliminating-mutaging-fields} + +<!-- +If a PodSecurityPolicy is mutating pods, then you could end up with pods that don't meet the Pod +Security level requirements when you finally turn PodSecurityPolicy off. In order to avoid this, you +should eliminate all PSP mutation prior to switching over. Unfortunately PSP does not cleanly +separate mutating & validating fields, so this is not a straightforward migration. +--> +如果某个 PodSecurityPolicy 能够变更字段，你可能会在关掉 PodSecurityPolicy +时发现有些 Pod 无法满足 Pod 安全性级别。为避免这类状况， +你应该在执行切换操作之前去掉所有 PSP 的变更操作。 +不幸的是，PSP 没有对变更性和验证性字段做清晰的区分，所以这一迁移操作也不够简单直接。 + +<!-- +You can start by eliminating the fields that are purely mutating, and don't have any bearing on the +validating policy. These fields (also listed in the +[Mapping PodSecurityPolicies to Pod Security Standards](/docs/reference/access-authn-authz/psp-to-pod-security-standards/) +reference) are: +--> +你可以先去掉那些纯粹变更性质的字段，留下验证策略中的其他内容。 +这些字段（也列举于[将 PodSecurityPolicy 映射到 Pod 安全性标准](/zh/docs/reference/access-authn-authz/psp-to-pod-security-standards/)参考中） +包括： + +<!-- +- `.spec.defaultAllowPrivilegeEscalation` +- `.spec.runtimeClass.defaultRuntimeClassName` +- `.metadata.annotations['seccomp.security.alpha.kubernetes.io/defaultProfileName']` +- `.metadata.annotations['apparmor.security.beta.kubernetes.io/defaultProfileName']` +- `.spec.defaultAddCapabilities` - Although technically a mutating & validating field, these should + be merged into `.spec.allowedCapabilities` which performs the same validation without mutation. +--> +- `.spec.defaultAllowPrivilegeEscalation` +- `.spec.runtimeClass.defaultRuntimeClassName` +- `.metadata.annotations['seccomp.security.alpha.kubernetes.io/defaultProfileName']` +- `.metadata.annotations['apparmor.security.beta.kubernetes.io/defaultProfileName']` +- `.spec.defaultAddCapabilities` - 尽管理论上是一个混合了变更性与验证性功能的字段， + 这里的设置应该被合并到 `.spec.allowedCapabilities` 中，后者会执行相同的验证操作， + 但不会执行任何变更动作。 + +{{< caution >}} +<!-- +Removing these could result in workloads missing required configuration, and cause problems. See +[Rollout the updated policies](#psp-update-rollout) below for advice on how to roll these changes +out safely. +--> +删除这些字段可能导致负载缺少所需的配置信息，进而导致一些问题。 +参见后文[退出更新的策略](#psp-update-rollout)以获得如何安全地将这些变更上线的建议。 +{{< /caution >}} + +<!-- +### 2.b. Eliminate options not covered by the Pod Security Standards {#eliminate-non-standard-options} +--> +### 2.b. 去掉 Pod 安全性标准未涉及的选项 {#eliminate-non-standard-options} + +<!-- +There are several fields in PodSecurityPolicy that are not covered by the Pod Security Standards. If +you must enforce these options, you will need to supplement Pod Security Admission with an +[admission webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/), +which is outside the scope of this guide. +--> +PodSecurityPolicy 中有一些字段未被 Pod 安全性准入机制覆盖。如果你必须使用这些选项， +你需要在 Pod 安全性准入之外部署 +[准入 Webhook](/zh/docs/reference/access-authn-authz/extensible-admission-controllers/) +以补充这一能力，而这类操作不在本指南范围。 + +<!-- +First, you can remove the purely validating fields that the Pod Security Standards do not cover. +These fields (also listed in the +[Mapping PodSecurityPolicies to Pod Security Standards](/docs/reference/access-authn-authz/psp-to-pod-security-standards/) +reference with "no opinion") are: +--> +首先，你可以去掉 Pod 安全性标准所未覆盖的那些验证性字段。这些字段（也列举于 +[将 PodSecurityPolicy 映射到 Pod 安全性标准](/zh/docs/reference/access-authn-authz/psp-to-pod-security-standards/)参考中，标记为“无意见”）有： + +- `.spec.allowedHostPaths` +- `.spec.allowedFlexVolumes` +- `.spec.allowedCSIDrivers` +- `.spec.forbiddenSysctls` +- `.spec.runtimeClass` + +<!-- +You can also remove the following fields, that are related to POSIX / UNIX group controls. +--> +你也可以去掉以下字段，这些字段与 POSIX/UNIX 用户组控制有关。 + +{{< caution >}} +<!-- +If any of these use the `MustRunAs` strategy they may be mutating! Removing these could result in +workloads not setting the required groups, and cause problems. See +[Rollout the updated policies](#psp-update-rollout) below for advice on how to roll these changes +out safely. +--> +如果这些字段中存在使用 `MustRunAs` 策略的情况，则意味着对应字段是变更性质的。 +去掉相应的字段可能导致负载无法设置所需的用户组，进而带来一些问题。 +关于如何安全地将这类变更上线的相关建议，请参阅后文的[推出更新的策略](#psp-update-rollout)部分。 +{{< /caution >}} + +- `.spec.runAsGroup` +- `.spec.supplementalGroups` +- `.spec.fsGroup` + +<!-- +The remaining mutating fields are required to properly support the Pod Security Standards, and will +need to be handled on a case-by-case basis later: +--> +剩下的变更性字段是为了适当支持 Pod 安全性标准所需要的，因而需要逐个处理： + +<!-- +- `.spec.requiredDropCapabilities` - Required to drop `ALL` for the Restricted profile. +- `.spec.seLinux` - (Only mutating with the `MustRunAs` rule) required to enforce the SELinux + requirements of the Baseline & Restricted profiles. +- `.spec.runAsUser` - (Non-mutating with the `RunAsAny` rule) required to enforce `RunAsNonRoot` for + the Restricted profile. +- `.spec.allowPrivilegeEscalation` - (Only mutating if set to `false`) required for the Restricted + profile. +--> +- `.spec.requiredDropCapabilities` - 需要此字段来为 Restricted 配置去掉 `ALL` 设置。 +- `.spec.seLinux` - （仅针对带有 `MustRunAs` 规则的变更性设置）需要此字段来满足 + Baseline 和 Restricted 配置所需要的 SELinux 需求。 +- `.spec.runAsUser` - （仅针对带有 `RunAsAny` 规则的非变更性设置）需要此字段来为 + Restricted 配置保证 `RunAsNonRoot`。 +- `.spec.allowPrivilegeEscalation` - （如果设置为 `false` 则为变更性设置） + 需要此字段来支持 Restricted 配置。 + +<!-- +### 2.c. Rollout the updated PSPs {#psp-update-rollout} +--> +### 2.c. 推出更新的 PSP {#psp-update-rollout} + +<!-- +Next, you can rollout the updated policies to your cluster. You should proceed with caution, as +removing the mutating options may result in workloads missing required configuration. + +For each updated PodSecurityPolicy: +--> +接下来，你可以将更新后的策略推出到你的集群上。在继续操作时，你要非常小心， +因为去掉变更性质的选项可能导致有些工作负载缺少必需的配置。 + +针对更新后的每个 PodSecurityPolicy： + +<!-- +1. Identify pods running under the original PSP. This can be done using the `kubernetes.io/psp` + annotation. For example, using kubectl: + ```sh + PSP_NAME="original" # Set the name of the PSP you're checking for + kubectl get pods --all-namespaces -o jsonpath="{range .items[?(@.metadata.annotations.kubernetes\.io\/psp=='$PSP_NAME')]}{.metadata.namespace} {.metadata.name}{'\n'}{end}" + ``` +--> +1. 识别运行于原 PSP 之下的 Pod。可以通过 `kubernetes.io/psp` 注解来完成。 + 例如，使用 kubectl： + + ```shell + PSP_NAME="original" # 设置你要检查的 PSP 的名称 + kubectl get pods --all-namespaces -o jsonpath="{range .items[?(@.metadata.annotations.kubernetes\.io\/psp=='$PSP_NAME')]}{.metadata.namespace} {.metadata.name}{'\n'}{end}" + ``` + +<!-- +2. Compare these running pods against the original pod spec to determine whether PodSecurityPolicy + has modified the pod. For pods created by a [workload resource](/docs/concepts/workloads/controllers/) + you can compare the pod with the PodTemplate in the controller resource. If any changes are + identified, the original Pod or PodTemplate should be updated with the desired configuration. + The fields to review are: +--> +2. 比较运行中的 Pod 与原来的 Pod 规约，确定 PodSecurityPolicy 是否更改过这些 Pod。 + 对于通过[工作负载资源](/zh/docs/concepts/workloads/controllers/)所创建的 Pod， + 你可以比较 Pod 和控制器资源中的 PodTemplate。如果发现任何变更，则原来的 Pod + 或者 PodTemplate 需要被更新以加上所希望的配置。要审查的字段包括： + + - `.metadata.annotations['container.apparmor.security.beta.kubernetes.io/*']` + （将 `*` 替换为每个容器的名称） + - `.spec.runtimeClassName` + - `.spec.securityContext.fsGroup` + - `.spec.securityContext.seccompProfile` + - `.spec.securityContext.seLinuxOptions` + - `.spec.securityContext.supplementalGroups` + <!-- + - On containers, under `.spec.containers[*]` and `.spec.initContainers[*]`: + --> + - 对于容器，在 `.spec.containers[*]` 和 `.spec.initContainers[*]` 之下，检查下面字段： + - `.securityContext.allowPrivilegeEscalation` + - `.securityContext.capabilities.add` + - `.securityContext.capabilities.drop` + - `.securityContext.readOnlyRootFilesystem` + - `.securityContext.runAsGroup` + - `.securityContext.runAsNonRoot` + - `.securityContext.runAsUser` + - `.securityContext.seccompProfile` + - `.securityContext.seLinuxOptions` +<!-- +3. Create the new PodSecurityPolicies. If any Roles or ClusterRoles are granting `use` on all PSPs + this could cause the new PSPs to be used instead of their mutating counter-parts. +4. Update your authorization to grant access to the new PSPs. In RBAC this means updating any Roles + or ClusterRoles that grant the `use` permision on the original PSP to also grant it to the + updated PSP. +--> +3. 创建新的 PodSecurityPolicy。如果存在 Role 或 ClusterRole 对象为用户授权了在所有 PSP + 上使用 `use` 动词的权限，则所使用的的会是新创建的 PSP 而不是其变更性的副本。 +4. 更新你的鉴权配置，为访问新的 PSP 授权。在 RBAC 机制下，这意味着需要更新所有为原 PSP + 授予 `use` 访问权限的 Role 或 ClusterRole 对象，使之也对更新后的 PSP 授权。 + +<!-- +5. Verify: after some soak time, rerun the command from step 1 to see if any pods are still using + the original PSPs. Note that pods need to be recreated after the new policies have been rolled + out before they can be fully verified. +6. (optional) Once you have verified that the original PSPs are no longer in use, you can delete + them. +--> +5. 验证：经过一段时间后，重新执行步骤 1 中所给的命令，查看是否有 Pod 仍在使用原来的 PSP。 + 注意，在新的策略被推出到集群之后，Pod 需要被重新创建才可以执行全面验证。 +6. （可选）一旦你已经验证原来的 PSP 不再被使用，你就可以删除这些 PSP。 + +<!-- +## 3. Update Namespaces {#update-namespaces} +--> +## 3. 更新名字空间 {#update-namespace} + +<!-- +The following steps will need to be performed on every namespace in the cluster. Commands referenced +in these steps use the `$NAMESPACE` variable to refer to the namespace being updated. +--> +下面的步骤需要在集群中的所有名字空间上执行。所列步骤中的命令使用变量 +`$NAMESPACE` 来引用所更新的名字空间。 + +<!-- +### 3.a. Identify an appropriate Pod Security level {#identify-appropriate-level} +--> +### 3.a. 识别合适的 Pod 安全级别 {#identify-appropriate-level} + +<!-- +Start reviewing the [Pod Security Standards](/docs/concepts/security/pod-security-standards/) and +familiarizing yourself with the 3 different levels. + +There are several ways to choose a Pod Security level for your namespace: +--> +首先请回顾 [Pod 安全性标准](/zh/docs/concepts/security/pod-security-standards/)内容， +并了解三个安全级别。 + +为你的名字空间选择 Pod 安全性级别有几种方法： + +<!-- +1. **By security requirements for the namespace** - If you are familiar with the expected access + level for the namespace, you can choose an appropriate level based on those requirements, similar + to how one might approach this on a new cluster. +--> +1. **根据名字空间的安全性需求来确定** - 如果你熟悉某名字空间的预期访问级别， + 你可以根据这类需求来选择合适的安全级别，就像大家在为新集群确定安全级别一样。 +<!-- +2. **By existing PodSecurityPolicies** - Using the + [Mapping PodSecurityPolicies to Pod Security Standards](/docs/reference/access-authn-authz/psp-to-pod-security-standards/) + reference you can map each + PSP to a Pod Security Standard level. If your PSPs aren't based on the Pod Security Standards, you + may need to decide between choosing a level that is at least as permissive as the PSP, and a + level that is at least as restrictive. You can see which PSPs are in use for pods in a given + namespace with this command: +--> +2. **根据现有的 PodSecurityPolicy 来确定** - 基于 + [将 PodSecurityPolicy 映射到 Pod 安全性标准](/zh/docs/reference/access-authn-authz/psp-to-pod-security-standards/) + 参考资料，你可以将各个 PSP 映射到某个 Pod 安全性标准级别。如果你的 PSP 不是基于 + Pod 安全性标准的，你可能或者需要选择一个至少与该 PSP 一样宽松的级别， + 或者选择一个至少与其一样严格的级别。使用下面的命令你可以查看被 Pod 使用的 PSP 有哪些： + + ```sh + kubectl get pods -n $NAMESPACE -o jsonpath="{.items[*].metadata.annotations.kubernetes\.io\/psp}" | tr " " "\n" | sort -u + ``` +<!-- +3. **By existing pods** - Using the strategies under [Verify the Pod Security level](#verify-pss-level), + you can test out both the Baseline and Restricted levels to see + whether they are sufficiently permissive for existing workloads, and chose the least-privileged + valid level. +--> +3. **根据现有 Pod 来确定** - 使用[检查 Pod 安全性级别](#verify-pss-level)小节所述策略， + 你可以测试 Baseline 和 Restricted 级别，检查它们是否对于现有负载而言足够宽松， + 并选择二者之间特权级较低的合法级别。 + +{{< caution >}} +<!-- +Options 2 & 3 above are based on _existing_ pods, and may miss workloads that aren't currently +running, such as CronJobs, scale-to-zero workloads, or other workloads that haven't rolled out. +--> +上面的第二和第三种方案是基于 _现有_ Pod 的，因此可能错失那些当前未处于运行状态的 +Pod，例如 CronJobs、缩容到零的负载，或者其他尚未全面铺开的负载。 +{{< /caution >}} + +<!-- +### 3.b. Verify the Pod Security level {#verify-pss-level} +--> +### 3.b. 检查 Pod 安全性级别 {#verify-pss-level} + +<!-- +Once you have selected a Pod Security level for the namespace (or if you're trying several), it's a +good idea to test it out first (you can skip this step if using the Privileged level). Pod Security +includes several tools to help test and safely roll out profiles. +--> +一旦你已经为名字空间选择了 Pod 安全性级别（或者你正在尝试多个不同级别）， +先进行测试是个不错的主意（如果使用 Privileged 级别，则可略过此步骤）。 +Pod 安全性包含若干工具可用来测试和安全地推出安全性配置。 + +<!-- +First, you can dry-run the policy, which will evaluate pods currently running in the namespace +against the applied policy, without making the new policy take effect: +--> +首先，你可以试运行新策略，这个过程可以针对所应用的策略评估当前在名字空间中运行的 +Pod，但不会令新策略马上生效： + +```sh +# $LEVEL 是要试运行的级别，可以是 "baseline" 或 "restricted" +kubectl label --dry-run=server --overwrite ns $NAMESPACE pod-security.kubernetes.io/enforce=$LEVEL +``` + +<!-- +This command will return a warning for any _existing_ pods that are not valid under the proposed +level. +--> +此命令会针对在所提议的级别下不再合法的所有 _现存_ Pod 返回警告信息。 + +<!-- +The second option is better for catching workloads that are not currently running: audit mode. When +running under audit-mode (as opposed to enforcing), pods that violate the policy level are recorded +in the audit logs, which can be reviewed later after some soak time, but are not forbidden. Warning +mode works similarly, but returns the warning to the user immediately. You can set the audit level +on a namespace with this command: +--> +第二种办法在抓取当前未运行的负载方面表现的更好：audit 模式。 +运行于 audit 模式（而非 enforcing 模式）下时，违反策略级别的 Pod 会被记录到审计日志中， +经过一段时间后可以在日志中查看到，但这些 Pod 不会被拒绝。 +warning 模式的工作方式与此类似，不过会立即向用户返回告警信息。 +你可以使用下面的命令为名字空间设置 audit 模式的级别： + +```sh +kubectl label --overwrite ns $NAMESPACE pod-security.kubernetes.io/audit=$LEVEL +``` + +<!-- +If either of these approaches yield unexpected violations, you will need to either update the +violating workloads to meet the policy requirements, or relax the namespace Pod Security level. +--> +当以上两种方法输出意料之外的违例状况时，你就需要或者更新发生违例的负载以满足策略需求， +或者放宽名字空间上的 Pod 安全性级别。 + +<!-- +### 3.c. Enforce the Pod Security level {#enforce-pod-security-level} +--> +### 3.c. 实施 Pod 安全性级别 {#enforce-pod-security-level} + +<!-- +When you are satisfied that the chosen level can safely be enforced on the namespace, you can update +the namespace to enforce the desired level: +--> +当你对可以安全地在名字空间上实施的级别比较满意时，你可以更新名字空间来实施所期望的级别： + +```sh +kubectl label --overwrite ns $NAMESPACE pod-security.kubernetes.io/enforce=$LEVEL +``` + +<!-- +### 3.d. Bypass PodSecurityPolicy {#bypass-psp} +--> +### 3.d. 绕过 PodSecurityPolicy {#bypass-psp} + +<!-- +Finally, you can effectively bypass PodSecurityPolicy at the namespace level by binding the fully +{{< example file="policy/privileged-psp.yaml" >}}privileged PSP{{< /example >}} to all service +accounts in the namespace. +--> +最后，你可以通过将 +{{< example file="policy/privileged-psp.yaml" >}}完全特权的 PSP{{< /example >}} +绑定到某名字空间中所有服务账户上，在名字空间层面绕过所有 PodSecurityPolicy。 + +```sh +# 下面集群范围的命令只需要执行一次 +kubectl apply -f privileged-psp.yaml +kubectl create clusterrole privileged-psp --verb use --resource podsecuritypolicies.policy --resource-name privileged + +# 逐个名字空间地禁用 +kubectl create -n $NAMESPACE rolebinding disable-psp --clusterrole privileged-psp --group system:serviceaccounts:$NAMESPACE +``` + +<!-- +Since the privileged PSP is non-mutating, and the PSP admission controller always +prefers non-mutating PSPs, this will ensure that pods in this namespace are no longer being modified +or restricted by PodSecurityPolicy. +--> +由于特权 PSP 是非变更性的，PSP 准入控制器总是优选非变更性的 PSP， +上面的操作会确保对应名字空间中的所有 Pod 不再会被 PodSecurityPolicy +所更改或限制。 + +<!-- +The advantage to disabling PodSecurityPolicy on a per-namespace basis like this is if a problem +arises you can easily roll the change back by deleting the RoleBinding. Just make sure the +pre-existing PodSecurityPolicies are still in place! +--> +按上述操作逐个名字空间地禁用 PodSecurityPolicy 这种做法的好处是， +如果出现问题，你可以很方便地通过删除 RoleBinding 来回滚所作的更改。 +你所要做的只是确保之前存在的 PodSecurityPolicy 还在。 + +```sh +# 撤销 PodSecurityPolicy 的禁用 +kubectl delete -n $NAMESPACE rolebinding disable-psp +``` + +<!-- +## 4. Review namespace creation processes {#review-namespace-creation-process} +--> +## 4. 审阅名字空间创建过程 {#review-namespace-creation-process} + +<!-- +Now that existing namespaces have been updated to enforce Pod Security Admission, you should ensure +that your processes and/or policies for creating new namespaces are updated to ensure that an +appropriate Pod Security profile is applied to new namespaces. +--> +现在，现有的名字空间都已被更新，强制实施 Pod 安全性准入， +你应该确保你用来管控新名字空间创建的流程与/或策略也被更新，这样合适的 Pod +安全性配置会被应用到新的名字空间上。 + +<!-- +You can also statically configure the Pod Security admission controller to set a default enforce, +audit, and/or warn level for unlabeled namespaces. See +[Configure the Admission Controller](docs/tasks/configure-pod-container/enforce-standards-admission-controller/#configure-the-admission-controller) +for more information. +--> +你也可以静态配置 Pod 安全性准入控制器，为尚未打标签的名字空间设置默认的 +enforce、audit 与/或 warn 级别。详细信息可参阅 +[配置准入控制器](/zh/docs/tasks/configure-pod-container/enforce-standards-admission-controller/#configure-the-admission-controller) +页面。 + +<!-- +## 5. Disable PodSecurityPolicy {#disable-psp} +--> +## 5. 禁用 PodSecurityPolicy {#disable-psp} + +<!-- +Finally, you're ready to disable PodSecurityPolicy. To do so, you will need to modify the admission +configuration of the API server: +[How do I turn off an admission controller?](/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-off-an-admission-controller). +--> +最后，你已为禁用 PodSecurityPolicy 做好准备。要禁用 PodSecurityPolicy， +你需要更改 API 服务器上的准入配置： +[我如何关闭某个准入控制器？](/zh/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-off-an-admission-controller) + +<!-- +To verify that the PodSecurityPolicy admission controller is no longer enabled, you can manually run +a test by impersonating a user without access to any PodSecurityPolicies (see the +[PodSecurityPolicy example](/docs/concepts/policy/pod-security-policy/#example)), or by verifying in +the API server logs. At startup, the API server outputs log lines listing the loaded admission +controller plugins: +--> +如果需要验证 PodSecurityPolicy 准入控制器不再被启用，你可以通过扮演某个无法访问任何 +PodSecurityPolicy 的用户来执行测试（参见 +[PodSecurityPolicy 示例](/zh/docs/concepts/policy/pod-security-policy/#example)）， +或者通过检查 API 服务器的日志来进行验证。在启动期间，API +服务器会输出日志行，列举所挂载的准入控制器插件。 + +``` +I0218 00:59:44.903329 13 plugins.go:158] Loaded 16 mutating admission controller(s) successfully in the following order: NamespaceLifecycle,LimitRanger,ServiceAccount,NodeRestriction,TaintNodesByCondition,Priority,DefaultTolerationSeconds,ExtendedResourceToleration,PersistentVolumeLabel,DefaultStorageClass,StorageObjectInUseProtection,RuntimeClass,DefaultIngressClass,MutatingAdmissionWebhook. +I0218 00:59:44.903350 13 plugins.go:161] Loaded 14 validating admission controller(s) successfully in the following order: LimitRanger,ServiceAccount,PodSecurity,Priority,PersistentVolumeClaimResize,RuntimeClass,CertificateApproval,CertificateSigning,CertificateSubjectRestriction,DenyServiceExternalIPs,ValidatingAdmissionWebhook,ResourceQuota. +``` + +<!-- +You should see `PodSecurity` (in the validating admission controllers), and neither list should +contain `PodSecurityPolicy`. +--> +你应该会看到 `PodSecurity`（在 validating admission controllers 列表中）， +并且两个列表中都不应该包含 `PodSecurityPolicy`。 + +<!-- +Once you are certain the PSP admission controller is disabled (and after sufficient soak time to be +confident you won't need to roll back), you are free to delete your PodSecurityPolicies and any +associated Roles, ClusterRoles, RoleBindings and ClusterRoleBindings (just make sure they don't +grant any other unrelated permissions). +--> +一旦你确定 PSP 准入控制器已被禁用（并且这种状况已经持续了一段时间， +这样你才会比较确定不需要回滚），你就可以放心地删除你的 PodSecurityPolicy +以及所关联的所有 Role、ClusterRole、RoleBinding、ClusterRoleBinding 等对象 +（仅需要确保他们不再授予其他不相关的访问权限）。 From a52257aa8b67bc810db881282ba306dbe0190115 Mon Sep 17 00:00:00 2001 From: howieyuen <howieyuen@outlook.com> Date: Fri, 25 Feb 2022 13:39:51 +0800 Subject: [PATCH 056/104] [zh]resync content/zh/docs/reference/command-line-tools-reference/kubelet.md --- .../command-line-tools-reference/kubelet.md | 510 ++++++++++-------- 1 file changed, 288 insertions(+), 222 deletions(-) diff --git a/content/zh/docs/reference/command-line-tools-reference/kubelet.md b/content/zh/docs/reference/command-line-tools-reference/kubelet.md index f542978d01..544f8483b6 100644 --- a/content/zh/docs/reference/command-line-tools-reference/kubelet.md +++ b/content/zh/docs/reference/command-line-tools-reference/kubelet.md @@ -77,7 +77,7 @@ If true, adds the file directory to the header <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The IP address for the Kubelet to serve on (set to `0.0.0.0` for all IPv4 interfaces and `::` for all IPv6 interfaces) (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The IP address for the Kubelet to serve on (set to <code>0.0.0.0</code> for all IPv4 interfaces and <code>::</code> for all IPv6 interfaces) (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> kubelet 用来提供服务的 IP 地址（设置为<code>0.0.0.0</code> 表示使用所有 IPv4 接口， 设置为 <code>::</code> 表示使用所有 IPv6 接口）。已弃用：应在 <code>--config</code> 所给的 @@ -91,11 +91,11 @@ kubelet 用来提供服务的 IP 地址（设置为<code>0.0.0.0</code> 表示 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Comma-separated whitelist of unsafe sysctls or unsafe sysctl patterns (ending in `*`). Use these at your own risk. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Comma-separated whitelist of unsafe sysctls or unsafe sysctl patterns (ending in <code>*</code>). Use these at your own risk. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 用逗号分隔的字符串序列设置允许使用的非安全的 sysctls 或 sysctl 模式（以 <code>*</code> 结尾) 。 使用此参数时风险自担。已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 -（<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>）. +（<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） </td> </tr> @@ -117,7 +117,7 @@ log to standard error as well as files <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Enables anonymous requests to the Kubelet server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of `system:anonymous`, and a group name of `system:unauthenticated`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Enables anonymous requests to the Kubelet server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of <code>system:anonymous</code>, and a group name of <code>system:unauthenticated</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置为 true 表示 kubelet 服务器可以接受匿名请求。未被任何认证组件拒绝的请求将被视为匿名请求。 匿名请求的用户名为 <code>system:anonymous</code>，用户组为 <code>system:unauthenticated</code>。 @@ -160,7 +160,7 @@ The duration to cache responses from the webhook token authenticator. (default 2 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Authorization mode for Kubelet server. Valid options are `AlwaysAllow` or `Webhook`. `Webhook` mode uses the `SubjectAccessReview` API to determine authorization. (default "AlwaysAllow" when `--config` flag is not provided; "Webhook" when `--config` flag presents.) (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Authorization mode for Kubelet server. Valid options are <code>AlwaysAllow</code> or <code>Webhook</code>. <code>Webhook</code> mode uses the <code>SubjectAccessReview</code> API to determine authorization. (default "AlwaysAllow" when <code>--config</code> flag is not provided; "Webhook" when <code>--config</code> flag presents.) (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> kubelet 服务器的鉴权模式。可选值包括：<code>AlwaysAllow</code>、<code>Webhook</code>。<code>Webhook</code> 模式使用 <code>SubjectAccessReview</code> API 鉴权。 当 <code>--config</code> 参数未被设置时，默认值为 <code>AlwaysAllow</code>，当使用了 @@ -176,7 +176,7 @@ kubelet 服务器的鉴权模式。可选值包括：<code>AlwaysAllow</code>、 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The duration to cache 'authorized' responses from the webhook authorizer. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The duration to cache 'authorized' responses from the webhook authorizer. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 对 Webhook 认证组件所返回的 “Authorized（已授权）” 应答的缓存时间。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -185,12 +185,12 @@ The duration to cache 'authorized' responses from the webhook authorizer. (DEPRE </tr> <tr> -<td colspan="2">--authorization-webhook-cache-unauthorized-ttl duration     <!--Default: `30s`-->默认值：<code>30s</code></td> +<td colspan="2">--authorization-webhook-cache-unauthorized-ttl duration     <!--Default: <code>30s</code>-->默认值：<code>30s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The duration to cache 'unauthorized' responses from the webhook authorizer. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The duration to cache 'unauthorized' responses from the webhook authorizer. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 对 Webhook 认证组件所返回的 “Unauthorized（未授权）” 应答的缓存时间。 <code>--config</code> 时，默认值为 <code>Webhook</code>。 @@ -217,7 +217,7 @@ Path to the file container Azure container registry configuration information. <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Path to a kubeconfig file that will be used to get client certificate for kubelet. If the file specified by `--kubeconfig` does not exist, the bootstrap kubeconfig is used to request a client certificate from the API server. On success, a kubeconfig file referencing the generated client certificate and key is written to the path specified by `--kubeconfig`. The client certificate and key file will be stored in the directory pointed by `--cert-dir`. +Path to a kubeconfig file that will be used to get client certificate for kubelet. If the file specified by <code>--kubeconfig</code> does not exist, the bootstrap kubeconfig is used to request a client certificate from the API server. On success, a kubeconfig file referencing the generated client certificate and key is written to the path specified by <code>--kubeconfig</code>. The client certificate and key file will be stored in the directory pointed by <code>--cert-dir</code>. --> 某 kubeconfig 文件的路径，该文件将用于获取 kubelet 的客户端证书。 如果 <code>--kubeconfig</code> 所指定的文件不存在，则使用引导所用 kubeconfig @@ -228,12 +228,12 @@ Path to a kubeconfig file that will be used to get client certificate for kubele </tr> <tr> -<td colspan="2">--cert-dir string     <!--Default: `/var/lib/kubelet/pki`-->默认值：<code>/var/lib/kubelet/pki</code></td> +<td colspan="2">--cert-dir string     <!--Default: <code>/var/lib/kubelet/pki</code>-->默认值：<code>/var/lib/kubelet/pki</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The directory where the TLS certs are located. If `--tls-cert-file` and `--tls-private-key-file` are provided, this flag will be ignored. +The directory where the TLS certs are located. If <code>--tls-cert-file</code> and <code>--tls-private-key-file</code> are provided, this flag will be ignored. --> TLS 证书所在的目录。如果设置了 <code>--tls-cert-file</code> 和 <code>--tls-private-key-file</code>， 则此标志将被忽略。 @@ -241,22 +241,22 @@ TLS 证书所在的目录。如果设置了 <code>--tls-cert-file</code> 和 <co </tr> <tr> -<td colspan="2">--cgroup-driver string     <!-- Default: `cgroupfs`-->默认值：<code>cgroupfs</code></td> +<td colspan="2">--cgroup-driver string     <!-- Default: <code>cgroupfs</code>-->默认值：<code>cgroupfs</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Driver that the kubelet uses to manipulate cgroups on the host. Possible values: `cgroupfs`, `systemd`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Driver that the kubelet uses to manipulate cgroups on the host. Possible values: <code>cgroupfs</code>, <code>systemd</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> kubelet 用来操作本机 cgroup 时使用的驱动程序。支持的选项包括 <code>cgroupfs</code> 和 <code>systemd</code>。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 （<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） -/td> +</td> </tr> <tr> -<td colspan="2">--cgroup-root string     <!--Default: `''`-->默认值：<code>""</code></td> +<td colspan="2">--cgroup-root string     <!--Default: <code>''</code>-->默认值：<code>""</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -271,12 +271,12 @@ Optional root cgroup to use for pods. This is handled by the container runtime o </tr> <tr> -<td colspan="2">--cgroups-per-qos     <!-- Default: `true`-->默认值：<code>true</code></td> +<td colspan="2">--cgroups-per-qos     <!-- Default: <code>true</code>-->默认值：<code>true</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Enable creation of QoS cgroup hierarchy, if true top level QoS and pod cgroups are created. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Enable creation of QoS cgroup hierarchy, if true top level QoS and pod cgroups are created. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 启用创建 QoS cgroup 层次结构。此值为 true 时 kubelet 为 QoS 和 Pod 创建顶级的 cgroup。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -345,7 +345,7 @@ The provider for cloud services. Set to empty string for running with no cloud p <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Comma-separated list of DNS server IP address. This value is used for containers DNS server in case of Pods with "dnsPolicy=ClusterFirst". Note: all DNS servers appearing in the list MUST serve the same set of records otherwise name resolution within the cluster may not work correctly. There is no guarantee as to which DNS server may be contacted for name resolution. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Comma-separated list of DNS server IP address. This value is used for containers DNS server in case of Pods with "dnsPolicy=ClusterFirst". Note: all DNS servers appearing in the list MUST serve the same set of records otherwise name resolution within the cluster may not work correctly. There is no guarantee as to which DNS server may be contacted for name resolution. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> DNS 服务器的 IP 地址，以逗号分隔。此标志值用于 Pod 中设置了 “<code>dnsPolicy=ClusterFirst</code>” 时为容器提供 DNS 服务。注意：列表中出现的所有 DNS 服务器必须包含相同的记录组， @@ -363,7 +363,7 @@ DNS 服务器的 IP 地址，以逗号分隔。此标志值用于 Pod 中设置 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Domain for this cluster. If set, kubelet will configure all containers to search this domain in addition to the host's search domains (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Domain for this cluster. If set, kubelet will configure all containers to search this domain in addition to the host's search domains (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 集群的域名。如果设置了此值，kubelet 除了将主机的搜索域配置到所有容器之外，还会为其 配置所搜这里指定的域名。 @@ -374,12 +374,12 @@ Domain for this cluster. If set, kubelet will configure all containers to search </tr> <tr> -<td colspan="2">--cni-bin-dir string     <!-- Default: `/opt/cni/bin`-->默认值：<code>/opt/cni/bin</code></td> +<td colspan="2">--cni-bin-dir string     <!-- Default: <code>/opt/cni/bin</code>-->默认值：<code>/opt/cni/bin</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -<Warning: Alpha feature> A comma-separated list of full paths of directories in which to search for CNI plugin binaries. This docker-specific flag only works when container-runtime is set to `docker`. +<Warning: Alpha feature> A comma-separated list of full paths of directories in which to search for CNI plugin binaries. This docker-specific flag only works when container-runtime is set to <code>docker</code>. --> <警告：alpha 特性> 此值为以逗号分隔的完整路径列表。 kubelet 将在所指定路径中搜索 CNI 插件的可执行文件。 @@ -388,12 +388,12 @@ kubelet 将在所指定路径中搜索 CNI 插件的可执行文件。 </tr> <tr> -<td colspan="2">--cni-cache-dir string     <!-- Default: `/var/lib/cni/cache`-->默认值：<code>/var/lib/cni/cache</code></td> +<td colspan="2">--cni-cache-dir string     <!-- Default: <code>/var/lib/cni/cache</code>-->默认值：<code>/var/lib/cni/cache</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -<Warning: Alpha feature> The full path of the directory in which CNI should store cache files. This docker-specific flag only works when container-runtime is set to `docker`. +<Warning: Alpha feature> The full path of the directory in which CNI should store cache files. This docker-specific flag only works when container-runtime is set to <code>docker</code>. --> <警告：alpha 特性> 此值为一个目录的全路径名。CNI 将在其中缓存文件。 仅当容器运行环境设置为 <code>docker</code> 时，此特定于 docker 的参数才有效。 @@ -401,12 +401,12 @@ kubelet 将在所指定路径中搜索 CNI 插件的可执行文件。 </tr> <tr> -<td colspan="2">--cni-conf-dir string     <!-- Default: `/etc/cni/net.d`-->默认值：<code>/etc/cni/net.d</code></td> +<td colspan="2">--cni-conf-dir string     <!-- Default: <code>/etc/cni/net.d</code>-->默认值：<code>/etc/cni/net.d</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -<Warning: Alpha feature> The full path of the directory in which to search for CNI config files. This docker-specific flag only works when container-runtime is set to `docker`. +<Warning: Alpha feature> The full path of the directory in which to search for CNI config files. This docker-specific flag only works when container-runtime is set to <code>docker</code>. --> <警告：alpha 特性> 此值为某目录的全路径名。kubelet 将在其中搜索 CNI 配置文件。 仅当容器运行环境设置为 <code>docker</code> 时，此特定于 docker 的参数才有效。 @@ -433,7 +433,7 @@ kubelet 将从此标志所指的文件中加载其初始配置。此路径可以 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Set the maximum number of container log files that can be present for a container. The number must be ≥ 2. This flag can only be used with `--container-runtime=remote`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Set the maximum number of container log files that can be present for a container. The number must be ≥ 2. This flag can only be used with <code>--container-runtime=remote</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置容器的日志文件个数上限。此值必须不小于 2。 此标志只能与 <code>--container-runtime=remote</code> 标志一起使用。 @@ -443,12 +443,12 @@ Set the maximum number of container log files that can be present for a containe </tr> <tr> -<td colspan="2">--container-log-max-size string     <!-- Default: `10Mi`-->默认值：<code>10Mi</code></td> +<td colspan="2">--container-log-max-size string     <!-- Default: <code>10Mi</code>-->默认值：<code>10Mi</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Set the maximum size (e.g. 10Mi) of container log file before it is rotated. This flag can only be used with `--container-runtime=remote`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Set the maximum size (e.g. 10Mi) of container log file before it is rotated. This flag can only be used with <code>--container-runtime=remote</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置容器日志文件在轮换生成新文件时之前的最大值（例如，<code>10Mi</code>）。 此标志只能与 <code>--container-runtime=remote</code> 标志一起使用。 @@ -458,24 +458,24 @@ Set the maximum size (e.g. 10Mi) of container log file before it is rotated. Thi </tr> <tr> -<td colspan="2">--container-runtime string     <!--Default: `docker`-->默认值：<code>docker</code></td> +<td colspan="2">--container-runtime string     <!--Default: <code>docker</code>-->默认值：<code>docker</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The container runtime to use. Possible values: `docker`, `remote`. +The container runtime to use. Possible values: <code>docker</code>, <code>remote</code>. --> 要使用的容器运行时。目前支持 <code>docker<code>、</code>remote</code>。 </td> </tr> <tr> -<td colspan="2">--container-runtime-endpoint string     <!--Default: `unix:///var/run/dockershim.sock`-->默认值：<code>unix:///var/run/dockershim.sock</code></td> +<td colspan="2">--container-runtime-endpoint string     <!--Default: <code>unix:///var/run/dockershim.sock</code>-->默认值：<code>unix:///var/run/dockershim.sock</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -[Experimental] The endpoint of remote runtime service. Currently unix socket endpoint is supported on Linux, while npipe and tcp endpoints are supported on windows. Examples: `unix:///var/run/dockershim.sock`, `npipe:////./pipe/dockershim`. +[Experimental] The endpoint of remote runtime service. Currently unix socket endpoint is supported on Linux, while npipe and tcp endpoints are supported on windows. Examples: <code>unix:///var/run/dockershim.sock</code>, <code>npipe:////./pipe/dockershim</code>. --> [实验性特性] 远程运行时服务的端点。目前支持 Linux 系统上的 UNIX 套接字和 Windows 系统上的 npipe 和 TCP 端点。例如： @@ -499,12 +499,12 @@ Enable lock contention profiling, if profiling is enabled (DEPRECATED: This para </tr> <tr> -<td colspan="2">--cpu-cfs-quota     <!--Default: `true`-->默认值：<code>true</code></td> +<td colspan="2">--cpu-cfs-quota     <!--Default: <code>true</code>-->默认值：<code>true</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Enable CPU CFS quota enforcement for containers that specify CPU limits (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Enable CPU CFS quota enforcement for containers that specify CPU limits (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 为设置了 CPU 限制的容器启用 CPU CFS 配额保障。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -513,12 +513,12 @@ Enable CPU CFS quota enforcement for containers that specify CPU limits (DEPRECA </tr> <tr> -<td colspan="2">--cpu-cfs-quota-period duration     <!--Default: `100ms`-->默认值：<code>100ms</code></td> +<td colspan="2">--cpu-cfs-quota-period duration     <!--Default: <code>100ms</code>-->默认值：<code>100ms</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Sets CPU CFS quota period value, `cpu.cfs_period_us`, defaults to Linux Kernel default. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Sets CPU CFS quota period value, <code>cpu.cfs_period_us</code>, defaults to Linux Kernel default. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置 CPU CFS 配额周期 <code>cpu.cfs_period_us</code>。默认使用 Linux 内核所设置的默认值 。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -541,12 +541,12 @@ CPU Manager policy to use. Possible values: 'none', 'static'. Default: 'none' (d </tr> <tr> -<td colspan="2">--cpu-manager-reconcile-period duration     <!--Default: `10s`-->默认值：<code>10s</code></td> +<td colspan="2">--cpu-manager-reconcile-period duration     <!--Default: <code>10s</code>-->默认值：<code>10s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -<Warning: Alpha feature> CPU Manager reconciliation period. Examples: `10s`, or `1m`. If not supplied, defaults to node status update frequency. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +<Warning: Alpha feature> CPU Manager reconciliation period. Examples: <code>10s</code>, or <code>1m</code>. If not supplied, defaults to node status update frequency. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> <警告：alpha 特性> 设置 CPU 管理器的调和时间。例如：<code>10s</code> 或者 <code>1m</code>。 如果未设置，默认使用节点状态更新频率。 @@ -556,12 +556,12 @@ CPU Manager policy to use. Possible values: 'none', 'static'. Default: 'none' (d </tr> <tr> -<td colspan="2">--docker-endpoint string     <!--Default: `unix:///var/run/docker.sock`-->默认值：<code>unix:///var/run/docker.sock</code></td> +<td colspan="2">--docker-endpoint string     <!--Default: <code>unix:///var/run/docker.sock</code>-->默认值：<code>unix:///var/run/docker.sock</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Use this for the `docker` endpoint to communicate with. This docker-specific flag only works when container-runtime is set to `docker`. +Use this for the <code>docker</code> endpoint to communicate with. This docker-specific flag only works when container-runtime is set to <code>docker</code>. --> 使用这里的端点与 docker 端点通信。 仅当容器运行环境设置为 <code>docker</code> 时，此特定于 docker 的参数才有效。 @@ -574,7 +574,7 @@ Use this for the `docker` endpoint to communicate with. This docker-specific fla <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The Kubelet will use this directory for checkpointing downloaded configurations and tracking configuration health. The Kubelet will create this directory if it does not already exist. The path may be absolute or relative; relative paths start at the Kubelet's current working directory. Providing this flag enables dynamic Kubelet configuration. The `DynamicKubeletConfig` feature gate must be enabled to pass this flag; this gate currently defaults to `true` because the feature is beta. +The Kubelet will use this directory for checkpointing downloaded configurations and tracking configuration health. The Kubelet will create this directory if it does not already exist. The path may be absolute or relative; relative paths start at the Kubelet's current working directory. Providing this flag enables dynamic Kubelet configuration. The <code>DynamicKubeletConfig</code> feature gate must be enabled to pass this flag; this gate currently defaults to <code>true</code> because the feature is beta. --> kubelet 使用此目录来保存所下载的配置，跟踪配置运行状况。 如果目录不存在，则 kubelet 创建该目录。此路径可以是绝对路径，也可以是相对路径。 @@ -586,7 +586,7 @@ kubelet 使用此目录来保存所下载的配置，跟踪配置运行状况。 </tr> <tr> -<td colspan="2">--enable-controller-attach-detach     <!--Default: `true`-->默认值：<code>true</code></td> +<td colspan="2">--enable-controller-attach-detach     <!--Default: <code>true</code>-->默认值：<code>true</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -598,7 +598,7 @@ Enables the Attach/Detach controller to manage attachment/detachment of volumes </tr> <tr> -<td colspan="2">--enable-debugging-handlers     Default: `true`</td> +<td colspan="2">--enable-debugging-handlers     <!--Default: <code>true</code>-->默认值：<code>true</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -612,12 +612,12 @@ Enables server endpoints for log collection and local running of containers and </tr> <tr> -<td colspan="2">--enable-server     <!-- Default: `true`--></td> +<td colspan="2">--enable-server     <!-- Default: <code>true</code>--></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Enable the Kubelet's server. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Enable the Kubelet's server. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 启用 kubelet 服务器。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -626,12 +626,12 @@ Enable the Kubelet's server. (DEPRECATED: This parameter should be set via the c </tr> <tr> -<td colspan="2">--enforce-node-allocatable strings     Default: `pods`</td> +<td colspan="2">--enforce-node-allocatable strings     <!--Default: <code>pods</code>-->默认值：<code>pods</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -A comma separated list of levels of node allocatable enforcement to be enforced by kubelet. Acceptable options are `none`, `pods`, `system-reserved`, and `kube-reserved`. If the latter two options are specified, `--system-reserved-cgroup` and `--kube-reserved-cgroup` must also be set, respectively. If `none` is specified, no additional options should be set. See https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/ for more details. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +A comma separated list of levels of node allocatable enforcement to be enforced by kubelet. Acceptable options are <code>none</code>, <code>pods</code>, <code>system-reserved</code>, and <code>kube-reserved</code>. If the latter two options are specified, <code>--system-reserved-cgroup</code> and <code>--kube-reserved-cgroup</code> must also be set, respectively. If <code>none</code> is specified, no additional options should be set. See https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/ for more details. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 用逗号分隔的列表，包含由 kubelet 强制执行的节点可分配资源级别。 可选配置为：<code>none</code>、<code>pods</code>、<code>system-reserved</code> 和 <code>kube-reserved</code>。 @@ -650,7 +650,7 @@ A comma separated list of levels of node allocatable enforcement to be enforced <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Maximum size of a bursty event records, temporarily allows event records to burst to this number, while still not exceeding `--event-qps`. Only used if `--event-qps` > 0. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Maximum size of a bursty event records, temporarily allows event records to burst to this number, while still not exceeding <code>--event-qps</code>. Only used if <code>--event-qps</code> > 0. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 事件记录的个数的突发峰值上限，在遵从 <code>--event-qps</code> 阈值约束的前提下 临时允许事件记录达到此数目。仅在 <code>--event-qps</code> 大于 0 时使用。 @@ -660,12 +660,12 @@ Maximum size of a bursty event records, temporarily allows event records to burs </tr> <tr> -<td colspan="2">--event-qps int32     Default: 5</td> +<td colspan="2">--event-qps int32     <!--Default: 5-->默认值：5</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If > `0`, limit event creations per second to this value. If `0`, unlimited. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +If > <code>0</code>, limit event creations per second to this value. If <code>0</code>, unlimited. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置大于 0 的值表示限制每秒可生成的事件数量。设置为 0 表示不限制。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -674,12 +674,12 @@ If > `0`, limit event creations per second to this value. If `0`, unlimited. </tr> <tr> -<td colspan="2">--eviction-hard string     <!--Default: `imagefs.available<15%,memory.available<100Mi,nodefs.available<10%`-->默认值：<code>imagefs.available<15%,memory.available<100Mi,nodefs.available<10%</code></td> +<td colspan="2">--eviction-hard string     <!--Default: <code>imagefs.available<15%,memory.available<100Mi,nodefs.available<10%</code>-->默认值：<code>imagefs.available<15%,memory.available<100Mi,nodefs.available<10%</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -A set of eviction thresholds (e.g. `memory.available<1Gi`) that if met would trigger a pod eviction. On a Linux node, the default value also includes `nodefs.inodesFree<5%`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +A set of eviction thresholds (e.g. <code>memory.available<1Gi</code>) that if met would trigger a pod eviction. On a Linux node, the default value also includes <code>nodefs.inodesFree<5%</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 触发 Pod 驱逐操作的一组硬性门限（例如：<code>memory.available<1Gi</code> （内存可用值小于 1 G））设置。在 Linux 节点上，默认值还包括 @@ -695,7 +695,7 @@ A set of eviction thresholds (e.g. `memory.available<1Gi`) that if met would tri <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. If negative, defer to pod specified value. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. If negative, defer to pod specified value. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 响应满足软性驱逐阈值（Soft Eviction Threshold）而终止 Pod 时使用的最长宽限期（以秒为单位）。 如果设置为负数，则遵循 Pod 的指定值。 @@ -710,7 +710,7 @@ Maximum allowed grace period (in seconds) to use when terminating pods in respon <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -A set of minimum reclaims (e.g. `imagefs.available=2Gi`) that describes the minimum amount of resource the kubelet will reclaim when performing a pod eviction if that resource is under pressure. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +A set of minimum reclaims (e.g. <code>imagefs.available=2Gi</code>) that describes the minimum amount of resource the kubelet will reclaim when performing a pod eviction if that resource is under pressure. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 当某资源压力过大时，kubelet 将执行 Pod 驱逐操作。 此参数设置软性驱逐操作需要回收的资源的最小数量（例如：<code>imagefs.available=2Gi</code>）。 @@ -720,12 +720,12 @@ A set of minimum reclaims (e.g. `imagefs.available=2Gi`) that describes the mini </tr> <tr> -<td colspan="2">--eviction-pressure-transition-period duration     <!--Default: `5m0s`-->默认值：<code>5m0s</code></td> +<td colspan="2">--eviction-pressure-transition-period duration     <!--Default: <code>5m0s</code>-->默认值：<code>5m0s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> kubelet 在驱逐压力状况解除之前的最长等待时间。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -739,7 +739,7 @@ kubelet 在驱逐压力状况解除之前的最长等待时间。 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -A set of eviction thresholds (e.g. `memory.available>1.5Gi`) that if met over a corresponding grace period would trigger a pod eviction. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +A set of eviction thresholds (e.g. <code>memory.available>1.5Gi</code>) that if met over a corresponding grace period would trigger a pod eviction. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置一组驱逐阈值（例如：<code>memory.available<1.5Gi</code>）。 如果在相应的宽限期内达到该阈值，则会触发 Pod 驱逐操作。 @@ -754,7 +754,7 @@ A set of eviction thresholds (e.g. `memory.available>1.5Gi`) that if met over a <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -A set of eviction grace periods (e.g. `memory.available=1m30s`) that correspond to how long a soft eviction threshold must hold before triggering a pod eviction. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +A set of eviction grace periods (e.g. <code>memory.available=1m30s</code>) that correspond to how long a soft eviction threshold must hold before triggering a pod eviction. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置一组驱逐宽限期（例如，<code>memory.available=1m30s</code>），对应于触发软性 Pod 驱逐操作之前软性驱逐阈值所需持续的时间长短。 @@ -776,12 +776,12 @@ Whether kubelet should exit upon lock-file contention. </tr> <tr> -<td colspan="2">--experimental-allocatable-ignore-eviction     <!--Default: `false`-->默认值：<code>false</code></td> +<td colspan="2">--experimental-allocatable-ignore-eviction     <!--Default: <code>false</code>-->默认值：<code>false</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -When set to `true`, Hard eviction thresholds will be ignored while calculating node allocatable. See https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/ for more details. (DEPRECATED: will be removed in 1.23) +When set to <code>true</code>, Hard eviction thresholds will be ignored while calculating node allocatable. See https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/ for more details. (DEPRECATED: will be removed in 1.23) --> 设置为 <code>true</code> 表示在计算节点可分配资源数量时忽略硬性逐出阈值设置。 参考<a href="https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/"> @@ -808,7 +808,7 @@ When set to `true`, Hard eviction thresholds will be ignored while calculating n <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -[Experimental] if set to `true`, the kubelet will check the underlying node for required components (binaries, etc.) before performing the mount (DEPRECATED: will be removed in 1.23, in favor of using CSI.) +[Experimental] if set to <code>true</code>, the kubelet will check the underlying node for required components (binaries, etc.) before performing the mount (DEPRECATED: will be removed in 1.23, in favor of using CSI.) --> [实验性特性] 设置为 <code>true</code> 表示 kubelet 在进行挂载卷操作之前要 在本节点上检查所需的组件（如可执行文件等）是否存在。 @@ -822,7 +822,7 @@ When set to `true`, Hard eviction thresholds will be ignored while calculating n <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If enabled, the kubelet will integrate with the kernel memcg notification to determine if memory eviction thresholds are crossed rather than polling. This flag will be removed in 1.23. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +If enabled, the kubelet will integrate with the kernel memcg notification to determine if memory eviction thresholds are crossed rather than polling. This flag will be removed in 1.23. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置为 true 表示 kubelet 将会集成内核的 memcg 通知机制而不是使用轮询机制来 判断是否达到了内存驱逐阈值。 @@ -848,12 +848,12 @@ If enabled, the kubelet will integrate with the kernel memcg notification to det </tr> <tr> -<td colspan="2">--experimental-mounter-path string     <!--Default: `mount`-->默认值：<code>mount</code></td> +<td colspan="2">--experimental-mounter-path string     <!--Default: <code>mount</code>-->默认值：<code>mount</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -[Experimental] Path of mounter binary. Leave empty to use the default `mount`. (DEPRECATED: will be removed in 1.23, in favor of using CSI.) +[Experimental] Path of mounter binary. Leave empty to use the default <code>mount</code>. (DEPRECATED: will be removed in 1.23, in favor of using CSI.) --> [实验性特性] 卷挂载器（mounter）的可执行文件的路径。设置为空表示使用默认挂载器 <code>mount</code>。 已弃用：将在 1.23 版本移除以支持 CSI。 @@ -861,12 +861,12 @@ If enabled, the kubelet will integrate with the kernel memcg notification to det </tr> <tr> -<td colspan="2">--fail-swap-on     <!--Default: `true`-->默认值：<code>true</code></td> +<td colspan="2">--fail-swap-on     <!--Default: <code>true</code>-->默认值：<code>true</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Makes the Kubelet fail to start if swap is enabled on the node. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Makes the Kubelet fail to start if swap is enabled on the node. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置为 true 表示如果主机启用了交换分区，kubelet 将直接失败。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -880,7 +880,7 @@ Makes the Kubelet fail to start if swap is enabled on the node. (DEPRECATED: Thi <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -A set of `key=value` pairs that describe feature gates for alpha/experimental features. Options are:<br/> +A set of <code>key=value</code> pairs that describe feature gates for alpha/experimental features. Options are:<br/> APIListChunking=true|false (BETA - default=true)<br/> APIPriorityAndFairness=true|false (BETA - default=true)<br/> APIResponseCompression=true|false (BETA - default=true)<br/> @@ -953,25 +953,23 @@ RootCAConfigMap=true|false (BETA - default=true)<br/> RotateKubeletServerCertificate=true|false (BETA - default=true)<br/> RunAsGroup=true|false (BETA - default=true)<br/> ServerSideApply=true|false (BETA - default=true)<br/> -ServiceAccountIssuerDiscovery=true|false (BETA - default=true)<br/> -ServiceLBNodePortControl=true|false (ALPHA - default=false)<br/> -ServiceNodeExclusion=true|false (BETA - default=true)<br/> -ServiceTopology=true|false (ALPHA - default=false)<br/> -SetHostnameAsFQDN=true|false (BETA - default=true)<br/> -SizeMemoryBackedVolumes=true|false (ALPHA - default=false)<br/> +SeccompDefault=true|false (ALPHA - default=false)<br/> +ServiceInternalTrafficPolicy=true|false (BETA - default=true)<br/> +ServiceLBNodePortControl=true|false (BETA - default=true)<br/> +ServiceLoadBalancerClass=true|false (BETA - default=true)<br/> +SizeMemoryBackedVolumes=true|false (BETA - default=true)<br/> +StatefulSetAutoDeletePVC=true|false (ALPHA - default=false)<br/> +StatefulSetMinReadySeconds=true|false (BETA - default=true)<br/> StorageVersionAPI=true|false (ALPHA - default=false)<br/> StorageVersionHash=true|false (BETA - default=true)<br/> -Sysctls=true|false (BETA - default=true)<br/> -TTLAfterFinished=true|false (ALPHA - default=false)<br/> TopologyManager=true|false (BETA - default=true)<br/> -ValidateProxyRedirects=true|false (BETA - default=true)<br/> -WarningHeaders=true|false (BETA - default=true)<br/> WinDSR=true|false (ALPHA - default=false)<br/> WinOverlay=true|false (BETA - default=true)<br/> -WindowsEndpointSliceProxying=true|false (ALPHA - default=false)<br/> -(DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +WindowsHostProcessContainers=true|false (BETA - default=true)<br/> +csiMigrationRBD=true|false (ALPHA - default=false)<br/> +(DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)</td> --> -用于 alpha 实验性质的特性开关组，每个开关以 key=value 形式表示。当前可用开关包括： +用于 alpha 实验性特性的特性开关组，每个开关以 key=value 形式表示。当前可用开关包括：</br> APIListChunking=true|false (BETA - 默认值为 true)<br/> APIPriorityAndFairness=true|false (BETA - 默认值为 true)<br/> APIResponseCompression=true|false (BETA - 默认值为 true)<br/> @@ -1043,35 +1041,35 @@ RemoveSelfLink=true|false (BETA - 默认值为 true)<br/> RootCAConfigMap=true|false (BETA - 默认值为 true)<br/> RotateKubeletServerCertificate=true|false (BETA - 默认值为 true)<br/> RunAsGroup=true|false (BETA - 默认值为 true)<br/> -ServerSideApply=true|false (BETA - 默认值为 true)<br/> -ServiceAccountIssuerDiscovery=true|false (BETA - 默认值为 true)<br/> -ServiceLBNodePortControl=true|false (ALPHA - 默认值为 false)<br/> -ServiceNodeExclusion=true|false (BETA - 默认值为 true)<br/> -ServiceTopology=true|false (ALPHA - 默认值为 false)<br/> -SetHostnameAsFQDN=true|false (BETA - 默认值为 true)<br/> -SizeMemoryBackedVolumes=true|false (ALPHA - 默认值为 false)<br/> +SeccompDefault=true|false (ALPHA - 默认值为 false)<br/> +ServiceInternalTrafficPolicy=true|false (BETA - 默认值为 true)<br/> +ServiceLBNodePortControl=true|false (BETA - 默认值为 true)<br/> +ServiceLoadBalancerClass=true|false (BETA - 默认值为 true)<br/> +SizeMemoryBackedVolumes=true|false (BETA - 默认值为 true)<br/> +StatefulSetAutoDeletePVC=true|false (ALPHA - 默认值为 false)<br/> +StatefulSetMinReadySeconds=true|false (BETA - 默认值为 true)<br/> StorageVersionAPI=true|false (ALPHA - 默认值为 false)<br/> StorageVersionHash=true|false (BETA - 默认值为 true)<br/> -Sysctls=true|false (BETA - 默认值为 true)<br/> -TTLAfterFinished=true|false (ALPHA - 默认值为 false)<br/> +SuspendJob=true|false (BETA - 默认值为 true)<br/> +TopologyAwareHints=true|false (BETA - 默认值为 true)<br/> TopologyManager=true|false (BETA - 默认值为 true)<br/> -ValidateProxyRedirects=true|false (BETA - 默认值为 true)<br/> -WarningHeaders=true|false (BETA - 默认值为 true)<br/> +VolumeCapacityPriority=true|false (ALPHA - 默认值为 false)<br/> WinDSR=true|false (ALPHA - 默认值为 false)<br/> WinOverlay=true|false (BETA - 默认值为 true)<br/> -WindowsEndpointSliceProxying=true|false (ALPHA - 默认值为 false)<br/> -已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 -（<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） +WindowsHostProcessContainers=true|false (BETA - 默认值为 true)<br/> +csiMigrationRBD=true|false (ALPHA - 默认值为 false)<br/> +已弃用: 应在 <code>--config</code> 所给的配置文件中进行设置。 +（<a href="https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file">进一步了解</a>） </td> </tr> <tr> -<td colspan="2">--file-check-frequency duration     <!--Default: `20s`-->默认值：<code>20s</code></td> +<td colspan="2">--file-check-frequency duration     <!--Default: <code>20s</code>-->默认值：<code>20s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Duration between checking config files for new data. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Duration between checking config files for new data. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 检查配置文件中新数据的时间间隔。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1080,28 +1078,28 @@ Duration between checking config files for new data. (DEPRECATED: This parameter </tr> <tr> -<td colspan="2">--hairpin-mode string     <!--Default: `promiscuous-bridge`-->默认值：<code>promiscuous-bridge</code></td> +<td colspan="2">--hairpin-mode string     <!--Default: <code>promiscuous-bridge</code>-->默认值：<code>promiscuous-bridge</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -How should the kubelet setup hairpin NAT. This allows endpoints of a Service to load balance back to themselves if they should try to access their own Service. Valid values are `promiscuous-bridge`, `hairpin-veth` and `none`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +How should the kubelet setup hairpin NAT. This allows endpoints of a Service to load balance back to themselves if they should try to access their own Service. Valid values are <code>promiscuous-bridge</code>, <code>hairpin-veth</code> and <code>none</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置 kubelet 执行发夹模式（hairpin）网络地址转译的方式。 该模式允许后端端点对其自身服务的访问能够再次经由负载均衡转发回自身。 -可选项包括 “<code>promiscuous-bridge</code>”、“<code>hairpin-veth</code>” 和 “<code>none</code>”。 +可选项包括 <code>promiscuous-bridge</code>、<code>hairpin-veth</code> 和 <code>none</code>。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 （<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） </td> </tr> <tr> -<td colspan="2">--healthz-bind-address ip     <!--Default: `127.0.0.1`-->默认值：<code>127.0.0.1</code></td> +<td colspan="2">--healthz-bind-address ip     <!--Default: <code>127.0.0.1</code>-->默认值：<code>127.0.0.1</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The IP address for the healthz server to serve on (set to `0.0.0.0` for all IPv4 interfaces and `::` for all IPv6 interfaces). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The IP address for the healthz server to serve on (set to <code>0.0.0.0</code> for all IPv4 interfaces and <code>::</code> for all IPv6 interfaces). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 用于运行 healthz 服务器的 IP 地址（设置为 <code>0.0.0.0</code> 表示使用所有 IPv4 接口， 设置为 <code>::</code> 表示使用所有 IPv6 接口。 @@ -1116,7 +1114,7 @@ The IP address for the healthz server to serve on (set to `0.0.0.0` for all IPv4 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The port of the localhost healthz endpoint (set to `0` to disable). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The port of the localhost healthz endpoint (set to <code>0</code> to disable). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 本地 healthz 端点使用的端口（设置为 0 表示禁用）。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1142,7 +1140,7 @@ kubelet 操作的帮助命令 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If non-empty, will use this string as identification instead of the actual hostname. If `--cloud-provider` is set, the cloud provider determines the name of the node (consult cloud provider documentation to determine if and how the hostname is used). +If non-empty, will use this string as identification instead of the actual hostname. If <code>--cloud-provider</code> is set, the cloud provider determines the name of the node (consult cloud provider documentation to determine if and how the hostname is used). --> 如果为非空，将使用此字符串而不是实际的主机名作为节点标识。如果设置了 <code>--cloud-provider</code>，则云驱动将确定节点的名称 @@ -1151,7 +1149,7 @@ If non-empty, will use this string as identification instead of the actual hostn </tr> <tr> -<td colspan="2">--housekeeping-interval duration     <!--Default: `10s`-->默认值：<code>10s</code></td> +<td colspan="2">--housekeeping-interval duration     <!--Default: <code>10s</code>-->默认值：<code>10s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -1163,12 +1161,12 @@ Interval between container housekeepings (default 10s) </tr> <tr> -<td colspan="2">--http-check-frequency duration     <!--Default: `20s`-->默认值：<code>20s</code></td> +<td colspan="2">--http-check-frequency duration     <!--Default: <code>20s</code>-->默认值：<code>20s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Duration between checking HTTP for new data. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Duration between checking HTTP for new data. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> HTTP 服务以获取新数据的时间间隔。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1205,7 +1203,7 @@ The path to the credential provider plugin config file.</td> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The percent of disk usage after which image garbage collection is always run. Values must be within the range [0, 100], To disable image garbage collection, set to 100. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The percent of disk usage after which image garbage collection is always run. Values must be within the range [0, 100], To disable image garbage collection, set to 100. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 镜像垃圾回收上限。磁盘使用空间达到该百分比时，镜像垃圾回收将持续工作。 值必须在 [0，100] 范围内。要禁用镜像垃圾回收，请设置为 100。 @@ -1220,7 +1218,7 @@ The percent of disk usage after which image garbage collection is always run. Va <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. Values must be within the range [0, 100] and should not be larger than that of `--image-gc-high-threshold`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. Values must be within the range [0, 100] and should not be larger than that of <code>--image-gc-high-threshold</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 镜像垃圾回收下限。磁盘使用空间在达到该百分比之前，镜像垃圾回收操作不会运行。 值必须在 [0，100] 范围内，并且不得大于 <code>--image-gc-high-threshold</code>的值。 @@ -1230,12 +1228,12 @@ The percent of disk usage before which image garbage collection is never run. Lo </tr> <tr> -<td colspan="2">--image-pull-progress-deadline duration     <!--Default: `1m0s`-->默认值：<code>1m0s</code></td> +<td colspan="2">--image-pull-progress-deadline duration     <!--Default: <code>1m0s</code>-->默认值：<code>1m0s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If no pulling progress is made before this deadline, the image pulling will be cancelled. This docker-specific flag only works when container-runtime is set to `docker`. +If no pulling progress is made before this deadline, the image pulling will be cancelled. This docker-specific flag only works when container-runtime is set to <code>docker</code>. --> 如果在该参数值所设置的期限之前没有拉取镜像的进展，镜像拉取操作将被取消。 仅当容器运行环境设置为 <code>docker</code> 时，此特定于 docker 的参数才有效。 @@ -1248,7 +1246,7 @@ If no pulling progress is made before this deadline, the image pulling will be c <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -[Experimental] The endpoint of remote image service. If not specified, it will be the same with `--container-runtime-endpoint` by default. Currently UNIX socket endpoint is supported on Linux, while npipe and TCP endpoints are supported on Windows. Examples: `unix:///var/run/dockershim.sock`, `npipe:////./pipe/dockershim` +[Experimental] The endpoint of remote image service. If not specified, it will be the same with <code>--container-runtime-endpoint</code> by default. Currently UNIX socket endpoint is supported on Linux, while npipe and TCP endpoints are supported on Windows. Examples: <code>unix:///var/run/dockershim.sock</code>, <code>npipe:////./pipe/dockershim</code> --> [实验性特性] 远程镜像服务的端点。若未设定则默认情况下使用 <code>--container-runtime-endpoint</code> 的值。目前支持的类型包括在 Linux 系统上的 UNIX 套接字端点和 Windows 系统上的 npipe 和 TCP 端点。 @@ -1262,7 +1260,7 @@ If no pulling progress is made before this deadline, the image pulling will be c <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The bit of the `fwmark` space to mark packets for dropping. Must be within the range [0, 31]. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The bit of the <code>fwmark</code> space to mark packets for dropping. Must be within the range [0, 31]. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 标记数据包将被丢弃的 fwmark 位设置。必须在 [0，31] 范围内。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1276,7 +1274,7 @@ The bit of the `fwmark` space to mark packets for dropping. Must be within the r <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The bit of the `fwmark` space to mark packets for SNAT. Must be within the range [0, 31]. Please match this parameter with corresponding parameter in `kube-proxy`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The bit of the <code>fwmark</code> space to mark packets for SNAT. Must be within the range [0, 31]. Please match this parameter with corresponding parameter in <code>kube-proxy</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 标记数据包将进行 SNAT 的 fwmark 空间位设置。必须在 [0，31] 范围内。 请将此参数与 <code>kube-proxy</code> 中的相应参数匹配。 @@ -1304,7 +1302,7 @@ Keep terminated pod volumes mounted to the node after the pod terminates. Can be <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If enabled, the kubelet will integrate with the kernel memcg notification to determine if memory eviction thresholds are crossed rather than polling. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +If enabled, the kubelet will integrate with the kernel memcg notification to determine if memory eviction thresholds are crossed rather than polling. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 若启用，则 kubelet 将与内核中的 memcg 通知机制集成，不再使用轮询的方式来判定 是否 Pod 达到内存驱逐阈值。 @@ -1328,7 +1326,7 @@ Burst to use while talking with kubernetes apiserver. (DEPRECATED: This paramete </tr> <tr> -<td colspan="2">--kube-api-content-type string     <!--Default: `application/vnd.kubernetes.protobuf`-->默认值：<code>application/vnd.kubernetes.protobuf</code></td> +<td colspan="2">--kube-api-content-type string     <!--Default: <code>application/vnd.kubernetes.protobuf</code>-->默认值：<code>application/vnd.kubernetes.protobuf</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -1347,9 +1345,11 @@ Content type of requests sent to apiserver. (default "application/vnd.kubernetes <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -QPS to use while talking with kubernetes apiserver. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +QPS to use while talking with kubernetes API server. The number must be >= 0. If 0 will use default QPS (5). Doesn't cover events and node heartbeat apis which rate limiting is controlled by a different set of flags. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 与 apiserver 通信的每秒查询个数（QPS）。 +此值必须 >= 0。如果为 0， 则使用默认 QPS（5）。 +不包含事件和节点心跳 api，它们的速率限制是由一组不同的标志所控制。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 （<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） </td> @@ -1361,7 +1361,7 @@ QPS to use while talking with kubernetes apiserver. (DEPRECATED: This parameter <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -A set of `<resource name>=<resource quantity>` (e.g. `cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100'`) pairs that describe resources reserved for kubernetes system components. Currently `cpu`, `memory` and local `ephemeral-storage` for root file system are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +A set of <code><resource name>=<resource quantity></code> (e.g. <code>cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100'</code>) pairs that describe resources reserved for kubernetes system components. Currently <code>cpu</code>, <code>memory</code> and local <code>ephemeral-storage</code> for root file system are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> kubernetes 系统预留的资源配置，以一组 <code>资源名称=资源数量</code> 格式表示。 （例如：<code>cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100'</code>）。 @@ -1373,12 +1373,12 @@ kubernetes 系统预留的资源配置，以一组 <code>资源名称=资源数 </tr> <tr> -<td colspan="2">--kube-reserved-cgroup string     <!--Default: `''`-->默认值：<code>""</code></td> +<td colspan="2">--kube-reserved-cgroup string     <!--Default: <code>''</code>-->默认值：<code>""</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Absolute name of the top level cgroup that is used to manage kubernetes components for which compute resources were reserved via `--kube-reserved` flag. Ex. `/kube-reserved`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Absolute name of the top level cgroup that is used to manage kubernetes components for which compute resources were reserved via <code>--kube-reserved</code> flag. Ex. <code>/kube-reserved</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 给出某个顶层 cgroup 绝对名称，该 cgroup 用于管理通过标志 <code>--kube-reserved</code> 为 kubernetes 组件所预留的计算资源。例如：<code>"/kube-reserved"</code>。 @@ -1393,7 +1393,7 @@ Absolute name of the top level cgroup that is used to manage kubernetes componen <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Path to a kubeconfig file, specifying how to connect to the API server. Providing `--kubeconfig` enables API server mode, omitting `--kubeconfig` enables standalone mode. +Path to a kubeconfig file, specifying how to connect to the API server. Providing <code>--kubeconfig</code> enables API server mode, omitting <code>--kubeconfig</code> enables standalone mode. --> kubeconfig 配置文件的路径，指定如何连接到 API 服务器。 提供 <code>--kubeconfig</code> 将启用 API 服务器模式，而省略 <code>--kubeconfig</code> 将启用独立模式。 @@ -1427,15 +1427,16 @@ Optional absolute name of cgroups to create and run the Kubelet in. (DEPRECATED: </tr> <tr> -<td colspan="2">--log-backtrace-at traceLocation     <!--Default: `:0`-->默认值：<code>:0</code></td> +<td colspan="2">--log-backtrace-at traceLocation     <!--Default: <code>:0</code>-->默认值：<code>:0</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -When logging hits line `<file>:<N>`, emit a stack trace. +When logging hits line <code><file>:<N></code>, emit a stack trace. (DEPRECATED: will be removed in a future release, see https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components) --> 形式为 <code><file>:<N></code>。 当日志逻辑执行到命中 <file> 的第 <N> 行时，转储调用堆栈。 +（已弃用：将在未来的版本中删除，<a href="https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components">进一步了解</a>） </td> </tr> @@ -1445,9 +1446,10 @@ When logging hits line `<file>:<N>`, emit a stack trace. <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If non-empty, write log files in this directory +If non-empty, write log files in this directory. (DEPRECATED: will be removed in a future release, see https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components) --> 如果此值为非空，则在所指定的目录中写入日志文件。 +（已弃用：将在未来的版本中删除，<a href="https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components">进一步了解</a>） </td> </tr> @@ -1469,14 +1471,15 @@ If non-empty, use this log file <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. +Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. (DEPRECATED: will be removed in a future release, see https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components) --> 设置日志文件的最大值。单位为兆字节（M）。如果值为 0，则表示文件大小无限制。 +（已弃用：将在未来的版本中删除，<a href="https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components">进一步了解</a>） </td> </tr> <tr> -<td colspan="2">--log-flush-frequency duration     <!--Default: `5s`-->默认值：<code>5s</code></td> +<td colspan="2">--log-flush-frequency duration     <!--Default: <code>5s</code>-->默认值：<code>5s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -1488,12 +1491,42 @@ Maximum number of seconds between log flushes </tr> <tr> -<td colspan="2">--logging-format string     <!--Default: `text`-->默认值：<code>"text"</code></td> +<td colspan="2">--log-json-info-buffer-size string     <!--Default: <code>'0'</code>-->默认值：<code>'0'</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Sets the log format. Permitted formats: `text`, `json`.\nNon-default formats don't honor these flags: `--add-dir-header`, `--alsologtostderr`, `--log-backtrace-at`, `--log_dir`, `--log-file`, `--log-file-max-size`, `--logtostderr`, `--skip_headers`, `--skip_log_headers`, `--stderrthreshold`, `--log-flush-frequency`.\nNon-default choices are currently alpha and subject to change without warning. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +[Experimental] In JSON format with split output streams, the info messages can be buffered for a while to increase performance. The default value of zero bytes disables buffering. The size can be specified as number of bytes (512), multiples of 1000 (1K), multiples of 1024 (2Ki), or powers of those (3M, 4G, 5Mi, 6Gi). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +--> +[实验性特性]在具有拆分输出流的 JSON 格式中，可以将信息消息缓冲一段时间以提高性能。 +零字节的默认值禁用缓冲。大小可以指定为字节数（512）、1000 的倍数（1K）、1024 的倍数（2Ki） 或这些（3M、4G、5Mi、6Gi）的幂。 +已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 +（<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） +</td> +</tr> + +<tr> +<td colspan="2">--log-json-split-stream</td> +</tr> +<tr> +<td></td><td style="line-height: 130%; word-wrap: break-word;"> +<!-- +[Experimental] In JSON format, write error messages to stderr and info messages to stdout. The default is to write a single stream to stdout. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +--> +[实验性特性]以 JSON 格式，将错误消息写入 stderr，将 info 消息写入 stdout。 +默认是将单个流写入标准输出。 +已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 +（<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） +</td> +</tr> + +<tr> +<td colspan="2">--logging-format string     <!--Default: <code>text</code>-->默认值：<code>"text"</code></td> +</tr> +<tr> +<td></td><td style="line-height: 130%; word-wrap: break-word;"> +<!-- +Sets the log format. Permitted formats: <code>text</code>, <code>json</code>.<br/>Non-default formats don't honor these flags: <code>--add-dir-header</code>, <code>--alsologtostderr</code>, <code>--log-backtrace-at</code>, <code>--log-dir</code>, <code>--log-file</code>, <code>--log-file-max-size</code>, <code>--logtostderr</code>, <code>--skip_headers</code>, <code>--skip_log_headers</code>, <code>--stderrthreshold</code>, <code>--log-flush-frequency</code>.<br/>Non-default choices are currently alpha and subject to change without warning. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置日志文件格式。可以设置的格式有：<code>"text"</code>、<code>"json"</code>。 非默认的格式不会使用以下标志的配置：<code>--add-dir-header</code>, <code>--alsologtostderr</code>, @@ -1507,24 +1540,26 @@ Sets the log format. Permitted formats: `text`, `json`.\nNon-default formats don </tr> <tr> -<td colspan="2">--logtostderr     <!--Default: `true`-->默认值：<code>true</code></td> +<td colspan="2">--logtostderr     <!--Default: <code>true</code>-->默认值：<code>true</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -log to standard error instead of files (default true) +log to standard error instead of files. (DEPRECATED: will be removed in a future release, see https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components) --> 日志输出到 stderr 而不是文件。 +（已弃用：将会在未来的版本删除， +<a href="https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components">进一步了解</a>） </td> </tr> <tr> -<td colspan="2">--make-iptables-util-chains     <!--Default: `true`-->默认值：<code>true</code></td> +<td colspan="2">--make-iptables-util-chains     <!--Default: <code>true</code>-->默认值：<code>true</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If true, kubelet will ensure `iptables` utility rules are present on host. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +If true, kubelet will ensure <code>iptables</code> utility rules are present on host. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置为 true 表示 kubelet 将确保 <code>iptables</code> 规则在主机上存在。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1538,7 +1573,7 @@ If true, kubelet will ensure `iptables` utility rules are present on host. (DEPR <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -URL for accessing additional Pod specifications to run (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +URL for accessing additional Pod specifications to run (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 用于访问要运行的其他 Pod 规范的 URL。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1552,7 +1587,7 @@ URL for accessing additional Pod specifications to run (DEPRECATED: This paramet <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Comma-separated list of HTTP headers to use when accessing the URL provided to `--manifest-url`. Multiple headers with the same name will be added in the same order provided. This flag can be repeatedly invoked. For example: `--manifest-url-header 'a:hello,b:again,c:world' --manifest-url-header 'b:beautiful'` (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Comma-separated list of HTTP headers to use when accessing the URL provided to <code>--manifest-url</code>. Multiple headers with the same name will be added in the same order provided. This flag can be repeatedly invoked. For example: <code>--manifest-url-header 'a:hello,b:again,c:world' --manifest-url-header 'b:beautiful'</code> (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 取值为由 HTTP 头部组成的逗号分隔列表，在访问 <code>--manifest-url</code> 所给出的 URL 时使用。 名称相同的多个头部将按所列的顺序添加。该参数可以多次使用。例如： @@ -1562,7 +1597,7 @@ Comma-separated list of HTTP headers to use when accessing the URL provided to ` </td> </tr> <tr> -<td colspan="2">--master-service-namespace string     <!--Default: `default`-->默认值：<code>default</code></td> +<td colspan="2">--master-service-namespace string     <!--Default: <code>default</code>-->默认值：<code>default</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -1580,7 +1615,7 @@ kubelet 向 Pod 注入 Kubernetes 主控服务信息时使用的命名空间。 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Number of files that can be opened by Kubelet process. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Number of files that can be opened by Kubelet process. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> kubelet 进程可以打开的最大文件数量。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1594,7 +1629,7 @@ kubelet 进程可以打开的最大文件数量。 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Number of Pods that can run on this Kubelet. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Number of Pods that can run on this Kubelet. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 此 kubelet 能运行的 Pod 最大数量。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1608,7 +1643,7 @@ Number of Pods that can run on this Kubelet. (DEPRECATED: This parameter should <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Maximum number of old instances of containers to retain globally. Each container takes up some disk space. To disable, set to a negative number. (DEPRECATED: Use `--eviction-hard` or `--eviction-soft` instead. Will be removed in a future version.) +Maximum number of old instances of containers to retain globally. Each container takes up some disk space. To disable, set to a negative number. (DEPRECATED: Use <code>--eviction-hard</code> or <code>--eviction-soft</code> instead. Will be removed in a future version.) --> 设置全局可保留的已停止容器实例个数上限。 每个实例会占用一些磁盘空间。要禁用，请设置为负数。 @@ -1631,6 +1666,20 @@ Maximum number of old instances to retain per container. Each container takes up </td> </tr> +<tr> +<td colspan="2">--memory-manager-policy string     <!--Default: <code>None</code>-->默认值：<code>None</code></td> +</tr> +<tr> +<td></td><td style="line-height: 130%; word-wrap: break-word;"> +<!-- +Memory Manager policy to use. Possible values: <code>'None'</code>, <code>'Static'</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +--> +内存管理器策略使用。可选值：<code>'None'</code>, <code>'Static'</code>。 +已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 +（<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） +</td> +</tr> + <tr> <td colspan="2">--minimum-container-ttl-duration duration</td> </tr> @@ -1647,12 +1696,12 @@ Minimum age for a finished container before it is garbage collected. Examples: </tr> <tr> -<td colspan="2">--minimum-image-ttl-duration duration     <!--Default: `2m0s`-->默认值：<code>2m0s</code></td> +<td colspan="2">--minimum-image-ttl-duration duration     <!--Default: <code>2m0s</code>-->默认值：<code>2m0s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Minimum age for an unused image before it is garbage collected. Examples: `300ms`, `10s` or `2h45m`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Minimum age for an unused image before it is garbage collected. Examples: <code>300ms</code>, <code>10s</code> or <code>2h45m</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 不再使用的镜像在被垃圾回收清理之前的最少存活时间。 例如：<code>300ms</code>、<code>10s</code> 或者 <code>2h45m</code>。 @@ -1680,11 +1729,12 @@ Minimum age for an unused image before it is garbage collected. Examples: `300m <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -<Warning: Alpha feature> The MTU to be passed to the network plugin, to override the default. Set to 0 to use the default 1460 MTU. This docker-specific flag only works when container-runtime is set to docker. +<Warning: Alpha feature> The MTU to be passed to the network plugin, to override the default. Set to 0 to use the default 1460 MTU. This docker-specific flag only works when container-runtime is set to docker. (DEPRECATED: will be removed along with dockershim.) --> <警告：alpha 特性> 传递给网络插件的 MTU 值，将覆盖默认值。 设置为 0 则使用默认的 MTU 1460。仅当容器运行环境设置为 <code>docker</code> 时， 此特定于 docker 的参数才有效。 +（已弃用：将会随着 dockershim 一起删除。） </td> </tr> @@ -1694,9 +1744,11 @@ Minimum age for an unused image before it is garbage collected. Examples: `300m <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -IP address of the node. If set, kubelet will use this IP address for the node +IP address (or comma-separated dual-stack IP addresses) of the node. If unset, kubelet will use the node's default IPv4 address, if any, or its default IPv6 address if it has no IPv4 addresses. You can pass <code>'::'</code> to make it prefer the default IPv6 address rather than the default IPv4 address. --> -节点的 IP 地址。如果设置，kubelet 将使用该 IP 地址作为节点的 IP 地址。 +节点的 IP 地址（或逗号分隔的双栈 IP 地址）。 +如果未设置，kubelet 将使用节点的默认 IPv4 地址（如果有）或默认 IPv6 地址（如果它没有 IPv4 地址）。 +你可以传值 <code>'::'</code> 使其偏向于默认的 IPv6 地址而不是默认的 IPv4 地址。 </td> </tr> @@ -1706,7 +1758,7 @@ IP address of the node. If set, kubelet will use this IP address for the node <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -<Warning: Alpha feature>Labels to add when registering the node in the cluster. Labels must be `key=value pairs` separated by `,`. Labels in the `kubernetes.io` namespace must begin with an allowed prefix (`kubelet.kubernetes.io`, `node.kubernetes.io`) or be in the specifically allowed set (`beta.kubernetes.io/arch`, `beta.kubernetes.io/instance-type`, `beta.kubernetes.io/os`, `failure-domain.beta.kubernetes.io/region`, `failure-domain.beta.kubernetes.io/zone`, `kubernetes.io/arch`, `kubernetes.io/hostname`, `kubernetes.io/os`, `node.kubernetes.io/instance-type`, `topology.kubernetes.io/region`, `topology.kubernetes.io/zone`) +<Warning: Alpha feature>Labels to add when registering the node in the cluster. Labels must be <code>key=value pairs</code> separated by <code>','</code>. Labels in the <code>'kubernetes.io'</code> namespace must begin with an allowed prefix (<code>'kubelet.kubernetes.io'</code>, <code>'node.kubernetes.io'</code>) or be in the specifically allowed set (<code>'beta.kubernetes.io/arch'</code>, <code>'beta.kubernetes.io/instance-type'</code>, <code>'beta.kubernetes.io/os'</code>, <code>'failure-domain.beta.kubernetes.io/region'</code>, <code>'failure-domain.beta.kubernetes.io/zone'</code>, <code>'kubernetes.io/arch'</code>, <code>'kubernetes.io/hostname'</code>, <code>'kubernetes.io/os'</code>, <code>'node.kubernetes.io/instance-type'</code>, <code>'topology.kubernetes.io/region'</code>, <code>'topology.kubernetes.io/zone'</code>)) --> <警告：alpha 特性> kubelet 在集群中注册本节点时设置的标签。标签以 <code>key=value</code> 的格式表示，多个标签以逗号分隔。名字空间 <code>kubernetes.io</code> @@ -1727,7 +1779,7 @@ IP address of the node. If set, kubelet will use this IP address for the node <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The maximum number of images to report in `node.status.images`. If `-1` is specified, no cap will be applied. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The maximum number of images to report in <code>node.status.images</code>. If <code>-1</code> is specified, no cap will be applied. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 在 <code>node.status.images</code> 中可以报告的最大镜像数量。如果指定为 -1，则不设上限。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1736,12 +1788,12 @@ The maximum number of images to report in `node.status.images`. If `-1` is speci </tr> <tr> -<td colspan="2">--node-status-update-frequency duration     <!--Default: `10s`-->默认值：<code>10s</code></td> +<td colspan="2">--node-status-update-frequency duration     <!--Default: <code>10s</code>-->默认值：<code>10s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Specifies how often kubelet posts node status to master. Note: be cautious when changing the constant, it must work with nodeMonitorGracePeriod in Node controller. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Specifies how often kubelet posts node status to master. Note: be cautious when changing the constant, it must work with nodeMonitorGracePeriod in Node controller. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 指定 kubelet 向主控节点汇报节点状态的时间间隔。注意：更改此常量时请务必谨慎， 它必须与节点控制器中的 <code>nodeMonitorGracePeriod</code> 一起使用。 @@ -1751,7 +1803,7 @@ Specifies how often kubelet posts node status to master. Note: be cautious when </tr> <tr> -<td colspan="2">--non-masquerade-cidr string     <!--Default: `10.0.0.0/8`-->默认值：<code>10.0.0.0/8</code></td> +<td colspan="2">--non-masquerade-cidr string     <!--Default: <code>10.0.0.0/8</code>-->默认值：<code>10.0.0.0/8</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -1771,10 +1823,12 @@ kubelet 向该 IP 段之外的 IP 地址发送的流量将使用 IP 伪装技术 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If true, only write logs to their native severity level (vs also writing to each lower severity level. +If true, only write logs to their native severity level (vs also writing to each lower severity level. (DEPRECATED: will be removed in a future release, see https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components) --> 如果设置此标志为 <code>true</code>，则仅将日志写入其原来的严重性级别中， 而不是同时将其写入更低严重性级别中。 +已弃用：将在未来的版本中删除， +（<a href="https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components">进一步了解</a>） </td> </tr> @@ -1798,7 +1852,7 @@ kubelet 进程的 oom-score-adj 参数值。有效范围为 <code>[-1000，1000] <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The CIDR to use for pod IP addresses, only used in standalone mode. In cluster mode, this is obtained from the master. For IPv6, the maximum number of IP's allocated is 65536 (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The CIDR to use for pod IP addresses, only used in standalone mode. In cluster mode, this is obtained from the master. For IPv6, the maximum number of IP's allocated is 65536 (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 用于给 Pod 分配 IP 地址的 CIDR 地址池，仅在独立运行模式下使用。 在集群模式下，CIDR 设置是从主服务器获取的。对于 IPv6，分配的 IP 的最大数量为 65536。 @@ -1808,12 +1862,12 @@ The CIDR to use for pod IP addresses, only used in standalone mode. In cluster m </tr> <tr> -<td colspan="2">--pod-infra-container-image string     <!--Default: `k8s.gcr.io/pause:3.2`-->默认值：<code>k8s.gcr.io/pause:3.2</code></td> +<td colspan="2">--pod-infra-container-image string     <!--Default: <code>k8s.gcr.io/pause:3.2</code>-->默认值：<code>k8s.gcr.io/pause:3.2</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- - Specified image will not be pruned by the image garbage collector. When container-runtime is set to `docker`, all containers in each pod will use the network/ipc namespaces from this image. Other CRI implementations have their own configuration to set this image. + Specified image will not be pruned by the image garbage collector. When container-runtime is set to <code>docker</code>, all containers in each pod will use the network/ipc namespaces from this image. Other CRI implementations have their own configuration to set this image. --> 所指定的镜像不会被镜像垃圾收集器删除。 当容器运行环境设置为 <code>docker</code> 时，各个 Pod 中的所有容器都会 @@ -1828,7 +1882,7 @@ The CIDR to use for pod IP addresses, only used in standalone mode. In cluster m <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Path to the directory containing static pod files to run, or the path to a single static pod file. Files starting with dots will be ignored. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Path to the directory containing static pod files to run, or the path to a single static pod file. Files starting with dots will be ignored. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置包含要运行的静态 Pod 的文件的路径，或单个静态 Pod 文件的路径。以点（<code>.</code>） 开头的文件将被忽略。 @@ -1843,7 +1897,7 @@ Path to the directory containing static pod files to run, or the path to a singl <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Set the maximum number of processes per pod. If `-1`, the kubelet defaults to the node allocatable PID capacity. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Set the maximum number of processes per pod. If <code>-1</code>, the kubelet defaults to the node allocatable PID capacity. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置每个 Pod 中的最大进程数目。如果为 -1，则 kubelet 使用节点可分配的 PID 容量作为默认值。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1857,7 +1911,7 @@ Set the maximum number of processes per pod. If `-1`, the kubelet defaults to t <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Number of Pods per core that can run on this Kubelet. The total number of Pods on this Kubelet cannot exceed `--max-pods`, so `--max-pods` will be used if this calculation results in a larger number of Pods allowed on the Kubelet. A value of `0` disables this limit. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Number of Pods per core that can run on this Kubelet. The total number of Pods on this Kubelet cannot exceed <code>--max-pods</code>, so <code>--max-pods</code> will be used if this calculation results in a larger number of Pods allowed on the Kubelet. A value of <code>0</code> disables this limit. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> kubelet 在每个处理器核上可运行的 Pod 数量。此 kubelet 上的 Pod 总数不能超过 <code>--max-pods</code> 标志值。因此，如果此计算结果导致在 kubelet @@ -1902,7 +1956,7 @@ kubelet 默认值不同时，kubelet 都会出错。 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Unique identifier for identifying the node in a machine database, i.e cloud provider. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Unique identifier for identifying the node in a machine database, i.e cloud provider. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置主机数据库（即，云驱动）中用来标识节点的唯一标识。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1916,7 +1970,7 @@ Unique identifier for identifying the node in a machine database, i.e cloud prov <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -<Warning: Alpha feature> A set of `<resource name>=<percentage>` (e.g. `memory=50%`) pairs that describe how pod resource requests are reserved at the QoS level. Currently only memory is supported. Requires the `QOSReserved` feature gate to be enabled. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +<Warning: Alpha feature> A set of <code><resource name>=<percentage></code> (e.g. <code>memory=50%</code>) pairs that describe how pod resource requests are reserved at the QoS level. Currently only memory is supported. Requires the <code>QOSReserved</code> feature gate to be enabled. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> <警告：alpha 特性> 设置在指定的 QoS 级别预留的 Pod 资源请求，以一组 <code>"资源名称=百分比"</code> 的形式进行设置，例如 <code>memory=50%</code>。 @@ -1932,7 +1986,7 @@ Unique identifier for identifying the node in a machine database, i.e cloud prov <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The read-only port for the Kubelet to serve on with no authentication/authorization (set to `0` to disable). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The read-only port for the Kubelet to serve on with no authentication/authorization (set to <code>0</code> to disable). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> kubelet 可以在没有身份验证/鉴权的情况下提供只读服务的端口（设置为 0 表示禁用）。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -1954,43 +2008,27 @@ If true, when panics occur crash. Intended for testing. (DEPRECATED: will be rem </tr> <tr> -<td colspan="2">--redirect-container-streaming</td> +<td colspan="2">--register-node     <!--Default: <code>true</code>-->默认值：<code>true</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Enables container streaming redirect. If false, kubelet will proxy container streaming data between the API server and container runtime; if `true`, kubelet will return an HTTP redirect to the API server, and the API server will access container runtime directly. The proxy approach is more secure, but introduces some overhead. The redirect approach is more performant, but less secure because the connection between apiserver and container runtime may not be authenticated. (DEPRECATED: Container streaming redirection will be removed from the kubelet in v1.20, and this flag will be removed in v1.22. For more details, see http://git.k8s.io/enhancements/keps/sig-node/20191205-container-streaming-requests.md) +Register the node with the API server. If <code>--kubeconfig</code> is not provided, this flag is irrelevant, as the Kubelet won't have an API server to register with. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> -启用容器流数据重定向。如果设置为 false，则 kubelet 将在 apiserver 和容器运行时 -之间转发容器流数据；如果设置为 true，则 kubelet 将返回指向 apiserver 的 HTTP 重定向信息， -而 apiserver 将直接访问容器运行时。代理方法更安全，但会带来一些开销。 -重定向方法性能更高，但安全性较低，因为 apiserver 和容器运行时之间的连接可能未通过身份验证。<br/> -已弃用：容器流数据重定向会在 v1.20 中从 kubelet 中移除，此标志会在 v1.22 -中移除。 -相关信息可参见<a href="http://git.k8s.io/enhancements/keps/sig-node/20191205-container-streaming-requests.md">改进说明</a>。 +向 API 服务器注册节点，如果未提供 <code>--kubeconfig</code>，此标志无关紧要， +因为 Kubelet 没有 API 服务器可注册。 +已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 +（<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） </td> </tr> <tr> -<td colspan="2">--register-node     <!--Default: `true`-->默认值：<code>true</code></td> +<td colspan="2">--register-schedulable     <!--Default: <code>true</code>-->默认值：true</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Register the node with the API server. If `--kubeconfig` is not provided, this flag is irrelevant, as the Kubelet won't have an API server to register with. ---> -将本节点注册到 API 服务器。如果未提供 <code>--kubeconfig</code> 标志设置， -则此参数无关紧要，因为 kubelet 将没有要注册的 API 服务器。 -</td> -</tr> - -<tr> -<td colspan="2">--register-schedulable     <!--Default: `true`-->默认值：true</td> -</tr> -<tr> -<td></td><td style="line-height: 130%; word-wrap: break-word;"> -<!-- -Register the node as schedulable. Won't have any effect if `--register-node` is false. (DEPRECATED: will be removed in a future version) +Register the node as schedulable. Won't have any effect if <code>--register-node</code> is <code>false</code>. (DEPRECATED: will be removed in a future version) --> 注册本节点为可调度的节点。当 <code>--register-node</code>标志为 false 时此设置无效。 已弃用：此参数将在未来的版本中删除。 @@ -2003,7 +2041,7 @@ Register the node as schedulable. Won't have any effect if `--register-node` is <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Register the node with the given list of taints (comma separated `<key>=<value>:<effect>`). No-op if `--register-node` is `false`. (DEPRECATED: will be removed in a future version) +Register the node with the given list of taints (comma separated <code><key>=<value>:<effect></code>). No-op if <code>--register-node</code> is <code>false</code>. (DEPRECATED: will be removed in a future version) --> 设置本节点的污点标记，格式为 <code><key>=<value>:<effect></code>， 以逗号分隔。当 <code>--register-node</code> 为 false 时此标志无效。 @@ -2017,7 +2055,7 @@ Register the node with the given list of taints (comma separated `<key>=<value>: <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Maximum size of a bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding `--registry-qps`. Only used if `--registry-qps > 0`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Maximum size of a bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding <code>--registry-qps</code>. Only used if <code>--registry-qps > 0</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置突发性镜像拉取的个数上限，在不超过 <code>--registration-qps</code> 设置值的前提下 暂时允许此参数所给的镜像拉取个数。仅在 <code>--registry-qps</code> 大于 0 时使用。 @@ -2027,12 +2065,12 @@ Maximum size of a bursty pulls, temporarily allows pulls to burst to this number </tr> <tr> -<td colspan="2">--registry-qps int32     Default: 5</td> +<td colspan="2">--registry-qps int32     <!--Default: 5-->默认值：5</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If > 0, limit registry pull QPS to this value. If `0`, unlimited. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +If > 0, limit registry pull QPS to this value. If <code>0</code>, unlimited. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 如此值大于 0，可用来限制镜像仓库的 QPS 上限。设置为 0，表示不受限制。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -2046,7 +2084,7 @@ If > 0, limit registry pull QPS to this value. If `0`, unlimited. (DEPRECATE <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -A comma-separated list of CPUs or CPU ranges that are reserved for system and kubernetes usage. This specific list will supersede cpu counts in `--system-reserved` and `--kube-reserved`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +A comma-separated list of CPUs or CPU ranges that are reserved for system and kubernetes usage. This specific list will supersede cpu counts in <code>--system-reserved</code> and <code>--kube-reserved</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 用逗号分隔的一组 CPU 或 CPU 范围列表，给出为系统和 Kubernetes 保留使用的 CPU。 此列表所给出的设置优先于通过 <code>--system-reserved</code> 和 @@ -2057,12 +2095,28 @@ A comma-separated list of CPUs or CPU ranges that are reserved for system and ku </tr> <tr> -<td colspan="2">--resolv-conf string     <!--Default: `/etc/resolv.conf`-->默认值：<code>/etc/resolv.conf</code></td> +<td colspan="2">--reserved-memory string</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Resolver configuration file used as the basis for the container DNS resolution configuration. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +A comma-separated list of memory reservations for NUMA nodes. (e.g. <code>--reserved-memory 0:memory=1Gi,hugepages-1M=2Gi --reserved-memory 1:memory=2Gi</code>). The total sum for each memory type should be equal to the sum of <code>--kube-reserved</code>, <code>--system-reserved</code> and <code>--eviction-threshold</code>. See https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/#reserved-memory-flag for more details. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +--> +以逗号分隔的 NUMA 节点内存预留列表。（例如 <code>--reserved-memory 0:memory=1Gi,hugepages-1M=2Gi --reserved-memory 1:memory=2Gi</code>）。 +每种内存类型的总和应该等于<code>--kube-reserved</code>、<code>--system-reserved</code>和<code>--eviction-threshold</之和 代码>。 +<a href="https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/#reserved-memory-flag">了解更多详细信息。</a> +已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 +（<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） +</td> +</tr> + +<tr> +<td colspan="2">--resolv-conf string     <!--Default: <code>/etc/resolv.conf</code>-->默认值：<code>/etc/resolv.conf</code></td> +</tr> +<tr> +<td></td><td style="line-height: 130%; word-wrap: break-word;"> +<!-- +Resolver configuration file used as the basis for the container DNS resolution configuration. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 名字解析服务的配置文件名，用作容器 DNS 解析配置的基础。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -2071,7 +2125,7 @@ Resolver configuration file used as the basis for the container DNS resolution c </tr> <tr> -<td colspan="2">--root-dir string     <!--Default: `/var/lib/kubelet`-->默认值：<code>/var/lib/kubelet</code></td> +<td colspan="2">--root-dir string     <!--Default: <code>/var/lib/kubelet</code>-->默认值：<code>/var/lib/kubelet</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -2088,7 +2142,7 @@ Directory path for managing kubelet files (volume mounts, etc). <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -<Warning: Beta feature> Auto rotate the kubelet client certificates by requesting new certificates from the `kube-apiserver` when the certificate expiration approaches. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +<Warning: Beta feature> Auto rotate the kubelet client certificates by requesting new certificates from the <code>kube-apiserver</code> when the certificate expiration approaches. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> <警告：Beta 特性> 设置当客户端证书即将过期时 kubelet 自动从 <code>kube-apiserver</code> 请求新的证书进行轮换。 @@ -2103,7 +2157,7 @@ Directory path for managing kubelet files (volume mounts, etc). <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Auto-request and rotate the kubelet serving certificates by requesting new certificates from the `kube-apiserver` when the certificate expiration approaches. Requires the `RotateKubeletServerCertificate` feature gate to be enabled, and approval of the submitted `CertificateSigningRequest` objects. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Auto-request and rotate the kubelet serving certificates by requesting new certificates from the <code>kube-apiserver</code> when the certificate expiration approaches. Requires the <code>RotateKubeletServerCertificate</code> feature gate to be enabled, and approval of the submitted <code>CertificateSigningRequest</code> objects. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 当 kubelet 的服务证书即将过期时自动从 kube-apiserver 请求新的证书进行轮换。 要求启用 <code>RotateKubeletServerCertificate</code> 特性门控，以及对提交的 @@ -2119,7 +2173,7 @@ Auto-request and rotate the kubelet serving certificates by requesting new certi <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If `true`, exit after spawning pods from local manifests or remote urls. Exclusive with `--enable-server` (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +If <code>true</code>, exit after spawning pods from local manifests or remote urls. Exclusive with <code>--enable-server</code> (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置为 true 表示从本地清单或远程 URL 创建完 Pod 后立即退出 kubelet 进程。 与 <code>--enable-server</code> 标志互斥。 @@ -2141,12 +2195,12 @@ Optional absolute name of cgroups to create and run the runtime in. </tr> <tr> -<td colspan="2">--runtime-request-timeout duration     <!--Default: `2m0s`-->默认值：<code>2m0s</code></td> +<td colspan="2">--runtime-request-timeout duration     <!--Default: <code>2m0s</code>-->默认值：<code>2m0s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Timeout of all runtime requests except long running request - `pull`, `logs`, `exec` and `attach`. When timeout exceeded, kubelet will cancel the request, throw out an error and retry later. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Timeout of all runtime requests except long running request - <code>pull</code>, <code>logs</code>, <code>exec</code> and <code>attach</code>. When timeout exceeded, kubelet will cancel the request, throw out an error and retry later. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置除了长时间运行的请求（包括 <code>pull</code>、<code>logs</code>、<code>exec</code> 和 <code>attach</code> 等操作）之外的其他运行时请求的超时时间。 @@ -2157,12 +2211,12 @@ Timeout of all runtime requests except long running request - `pull`, `logs`, `e </tr> <tr> -<td colspan="2">--seccomp-profile-root string     <!--Default: `/var/lib/kubelet/seccomp`-->默认值：<code>/var/lib/kubelet/seccomp</code></td> +<td colspan="2">--seccomp-profile-root string     <!--Default: <code>/var/lib/kubelet/seccomp</code>-->默认值：<code>/var/lib/kubelet/seccomp</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -<Warning: Alpha feature> Directory path for seccomp profiles. (DEPRECATED: will be removed in 1.23, in favor of using the `<root-dir>/seccomp` directory) +<Warning: Alpha feature> Directory path for seccomp profiles. (DEPRECATED: will be removed in 1.23, in favor of using the <code><root-dir>/seccomp</code> directory) --> <警告：alpha 特性> seccomp 配置文件目录。 已弃用：将在 1.23 版本中移除，以使用 <code><root-dir>/seccomp</code> 目录。 @@ -2170,12 +2224,12 @@ Timeout of all runtime requests except long running request - `pull`, `logs`, `e </tr> <tr> -<td colspan="2">--serialize-image-pulls     <!--Default: `true`-->默认值：<code>true</code></td> +<td colspan="2">--serialize-image-pulls     <!--Default: <code>true</code>-->默认值：<code>true</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Pull images one at a time. We recommend *not* changing the default value on nodes that run docker daemon with version < 1.9 or an `aufs` storage backend. Issue #10959 has more details. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Pull images one at a time. We recommend *not* changing the default value on nodes that run docker daemon with version < 1.9 or an <code>aufs</code> storage backend. Issue #10959 has more details. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 逐一拉取镜像。建议 *不要* 在 docker 守护进程版本低于 1.9 或启用了 Aufs 存储后端的节点上 更改默认值。 @@ -2190,9 +2244,10 @@ Pull images one at a time. We recommend *not* changing the default value on node <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If true, avoid header prefixes in the log messages +If true, avoid header prefixes in the log messages. (DEPRECATED: will be removed in a future release, see https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components) --> 设置为 true 时在日志消息中去掉标头前缀。 +（已弃用：将在未来的版本中删除，<a href="https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components">进一步了解</a>） </td> </tr> @@ -2202,9 +2257,10 @@ If true, avoid header prefixes in the log messages <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -If true, avoid headers when opening log files +If true, avoid headers when opening log files. (DEPRECATED: will be removed in a future release, see https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components) --> 设置为 true，打开日志文件时去掉标头。 +（已弃用：将在未来的版本中删除，<a href="https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components">进一步了解</a>） </td> </tr> @@ -2214,34 +2270,36 @@ If true, avoid headers when opening log files <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -logs at or above this threshold go to stderr. +logs at or above this threshold go to stderr. (DEPRECATED: will be removed in a future release, see https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components) --> 设置严重程度达到或超过此阈值的日志输出到标准错误输出。 +（已弃用：将在未来的版本中删除，<a href="https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components">进一步了解</a>） </td> </tr> <tr> -<td colspan="2">--streaming-connection-idle-timeout duration     <!--Default: `4h0m0s`-->默认值：<code>4h0m0s</code></td> +<td colspan="2">--streaming-connection-idle-timeout duration     <!--Default: <code>4h0m0s</code>-->默认值：<code>4h0m0s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Maximum time a streaming connection can be idle before the connection is automatically closed. `0` indicates no timeout. Example: `5m`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Maximum time a streaming connection can be idle before the connection is automatically closed. <code>0</code> indicates no timeout. Example: <code>5m</code>. Note: All connections to the kubelet server have a maximum duration of 4 hours. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置流连接在自动关闭之前可以空闲的最长时间。0 表示没有超时限制。 例如：<code>5m</code>。 +注意：与 kubelet 服务器的所有连接最长持续时间为 4 小时。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 （<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） </td> </tr> <tr> -<td colspan="2">--sync-frequency duration     <!--Default: `1m0s`-->默认值：<code>1m0s</code></td> +<td colspan="2">--sync-frequency duration     <!--Default: <code>1m0s</code>-->默认值：<code>1m0s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Max period between synchronizing running containers and config. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Max period between synchronizing running containers and config. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 在运行中的容器与其配置之间执行同步操作的最长时间间隔。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -2255,7 +2313,7 @@ Max period between synchronizing running containers and config. (DEPRECATED: Thi <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Optional absolute name of cgroups in which to place all non-kernel processes that are not already inside a cgroup under `/`. Empty for no container. Rolling back the flag requires a reboot. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Optional absolute name of cgroups in which to place all non-kernel processes that are not already inside a cgroup under <code>/</code>. Empty for no container. Rolling back the flag requires a reboot. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 此标志值为一个 cgroup 的绝对名称，用于所有尚未放置在根目录下某 cgroup 内的非内核进程。 空值表示不指定 cgroup。回滚该参数需要重启机器。 @@ -2270,7 +2328,7 @@ Optional absolute name of cgroups in which to place all non-kernel processes tha <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -A set of `<resource name>=<resource quantity>` (e.g. `cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100'`) pairs that describe resources reserved for non-kubernetes components. Currently only `cpu` and `memory` are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +A set of <code><resource name>=<resource quantity></code> (e.g. <code>cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100'</code>) pairs that describe resources reserved for non-kubernetes components. Currently only <code>cpu</code> and <code>memory</code> are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 系统预留的资源配置，以一组 <code>资源名称=资源数量</code> 的格式表示， （例如：<code>cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100'</code>）。 @@ -2283,12 +2341,12 @@ A set of `<resource name>=<resource quantity>` (e.g. `cpu=200m,memory=500Mi,ephe </tr> <tr> -<td colspan="2">--system-reserved-cgroup string     <!--Default: `''`-->默认值：<code>""</code></td> +<td colspan="2">--system-reserved-cgroup string     <!--Default: <code>''</code>-->默认值：<code>""</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Absolute name of the top level cgroup that is used to manage non-kubernetes components for which compute resources were reserved via `--system-reserved` flag. Ex. `/system-reserved`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Absolute name of the top level cgroup that is used to manage non-kubernetes components for which compute resources were reserved via <code>--system-reserved</code> flag. Ex. <code>/system-reserved</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 此标志给出一个顶层 cgroup 绝对名称，该 cgroup 用于管理非 kubernetes 组件， 这些组件的计算资源通过 <code>--system-reserved</code> 标志进行预留。 @@ -2304,7 +2362,7 @@ Absolute name of the top level cgroup that is used to manage non-kubernetes comp <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -File containing x509 Certificate used for serving HTTPS (with intermediate certs, if any, concatenated after server cert). If `--tls-cert-file` and `--tls-private-key-file` are not provided, a self-signed certificate and key are generated for the public address and saved to the directory passed to `--cert-dir`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +File containing x509 Certificate used for serving HTTPS (with intermediate certs, if any, concatenated after server cert). If <code>--tls-cert-file</code> and <code>--tls-private-key-file</code> are not provided, a self-signed certificate and key are generated for the public address and saved to the directory passed to <code>--cert-dir</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 包含 x509 证书的文件路径，用于 HTTPS 认证。 如果有中间证书，则中间证书要串接在在服务器证书之后。 @@ -2322,10 +2380,18 @@ kubelet 会为公开地址生成自签名证书和密钥，并将其保存到通 <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used. Possible values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_RC4_128_SHA (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.<br/> +Preferred values: +TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384<br/> +Insecure values: +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA. +(DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 服务器端加密算法列表，以逗号分隔。如果不设置，则使用 Go 语言加密包的默认算法列表。<br/> -可选加密算法包括：TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_RC4_128_SHA <br/> +首选算法： +TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384 <br/> +不安全算法： +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 （<a href="https://kubernetes.io/zh/docs/tasks/administer-cluster/kubelet-config-file/">进一步了解</a>） </td> @@ -2337,7 +2403,7 @@ Comma-separated list of cipher suites for the server. If omitted, the default Go <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Minimum TLS version supported. Possible values: `VersionTLS10`, `VersionTLS11`, `VersionTLS12`, `VersionTLS13` (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Minimum TLS version supported. Possible values: <code>VersionTLS10</code>, <code>VersionTLS11</code>, <code>VersionTLS12</code>, <code>VersionTLS13</code> (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置支持的最小 TLS 版本号，可选的版本号包括：<code>VersionTLS10</code>、 <code>VersionTLS11</code>、<code>VersionTLS12</code> 和 <code>VersionTLS13</code>。 @@ -2352,7 +2418,7 @@ Minimum TLS version supported. Possible values: `VersionTLS10`, `VersionTLS11`, <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -File containing x509 private key matching `--tls-cert-file`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +File containing x509 private key matching <code>--tls-cert-file</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 包含与 <code>--tls-cert-file</code> 对应的 x509 私钥文件路径。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -2361,12 +2427,12 @@ File containing x509 private key matching `--tls-cert-file`. (DEPRECATED: This p </tr> <tr> -<td colspan="2">--topology-manager-policy string     <!--Default: `none`-->默认值：<code>none</code></td> +<td colspan="2">--topology-manager-policy string     <!--Default: <code>none</code>-->默认值：<code>none</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Topology Manager policy to use. Possible values: `none`, `best-effort`, `restricted`, `single-numa-node`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Topology Manager policy to use. Possible values: <code>none</code>, <code>best-effort</code>, <code>restricted</code>, <code>single-numa-node</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 设置拓扑管理策略（Topology Manager policy）。可选值包括：<code>none</code>、 <code>best-effort</code>、<code>restricted</code> 和 <code>single-numa-node</code>。 @@ -2376,7 +2442,7 @@ Topology Manager policy to use. Possible values: `none`, `best-effort`, `restric </tr> <tr> -<td colspan="2">--topology-manager-scope string     <!--Default: `container`-->默认值：<code>container</code></td> +<td colspan="2">--topology-manager-scope string     <!--Default: <code>container</code>-->默认值：<code>container</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> @@ -2421,19 +2487,19 @@ Print version information and quit <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Comma-separated list of `pattern=N` settings for file-filtered logging +Comma-separated list of <code>pattern=N</code> settings for file-filtered logging --> 以逗号分隔的 <code>pattern=N</code> 设置列表，用于文件过滤的日志记录 </td> </tr> <tr> -<td colspan="2">--volume-plugin-dir string     <!--Default: `/usr/libexec/kubernetes/kubelet-plugins/volume/exec/`-->默认值：<code>/usr/libexec/kubernetes/kubelet-plugins/volume/exec/</code></td> +<td colspan="2">--volume-plugin-dir string     <!--Default: <code>/usr/libexec/kubernetes/kubelet-plugins/volume/exec/</code>-->默认值：<code>/usr/libexec/kubernetes/kubelet-plugins/volume/exec/</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -The full path of the directory in which to search for additional third party volume plugins. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +The full path of the directory in which to search for additional third party volume plugins. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 用来搜索第三方存储卷插件的目录。 已弃用：应在 <code>--config</code> 所给的配置文件中进行设置。 @@ -2442,12 +2508,12 @@ The full path of the directory in which to search for additional third party vol </tr> <tr> -<td colspan="2">--volume-stats-agg-period duration     <!--Default: `1m0s`-->默认值：<code>1m0s</code></td> +<td colspan="2">--volume-stats-agg-period duration     <!--Default: <code>1m0s</code>-->默认值：<code>1m0s</code></td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"> <!-- -Specifies interval for kubelet to calculate and cache the volume disk usage for all pods and volumes. To disable volume calculations, set to `0`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Specifies interval for kubelet to calculate and cache the volume disk usage for all pods and volumes. To disable volume calculations, set to <code>0</code>. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's <code>--config</code> flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) --> 指定 kubelet 计算和缓存所有 Pod 和卷的磁盘用量总值的时间间隔。要禁用磁盘用量计算， 请设置为 0。 From 1213504003fa0133c74acc90c3d52d3767743766 Mon Sep 17 00:00:00 2001 From: howieyuen <howieyuen@outlook.com> Date: Tue, 1 Mar 2022 17:30:50 +0800 Subject: [PATCH 057/104] [zh]resync content/zh/docs/concepts/workloads/pods/disruptions.md --- content/zh/docs/concepts/workloads/pods/disruptions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/concepts/workloads/pods/disruptions.md b/content/zh/docs/concepts/workloads/pods/disruptions.md index d94bf9121a..6ebb4928ca 100644 --- a/content/zh/docs/concepts/workloads/pods/disruptions.md +++ b/content/zh/docs/concepts/workloads/pods/disruptions.md @@ -404,7 +404,7 @@ Deployment 创建 `pod-b` 的替代 Pod `pod-e`。 | node-1 *drained* | node-2 | node-3 | *no node* | |:--------------------:|:-------------------:|:------------------:|:------------------:| -| | pod-b *available* | pod-c *available* | pod-e *pending* | +| | pod-b *terminating* | pod-c *available* | pod-e *pending* | | | pod-d *available* | pod-y | | <!-- From ed8308a8d3a57406b77fd3526fe2a49cf9a2d7eb Mon Sep 17 00:00:00 2001 From: holten <holten.ko@gmail.com> Date: Tue, 1 Mar 2022 17:35:56 +0800 Subject: [PATCH 058/104] Update mysql-wordpress-persistent-volume.md add some words to avoid ambiguity. --- .../stateful-application/mysql-wordpress-persistent-volume.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md b/content/zh/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md index 81922142af..b386c5ab8b 100644 --- a/content/zh/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md +++ b/content/zh/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md @@ -39,7 +39,7 @@ This tutorial shows you how to deploy a WordPress site and a MySQL database usin This deployment is not suitable for production use cases, as it uses single instance WordPress and MySQL Pods. Consider using [WordPress Helm Chart](https://github.com/kubernetes/charts/tree/master/stable/wordpress) to deploy WordPress in production. --> -deployment 在生产场景中并不适合，它使用单实例 WordPress 和 MySQL Pods。考虑使用 [WordPress Helm Chart](https://github.com/kubernetes/charts/tree/master/stable/wordpress) 在生产场景中部署 WordPress。 +这个 deployment 在生产场景中并不适合，它使用单实例 WordPress 和 MySQL Pods。考虑使用 [WordPress Helm Chart](https://github.com/kubernetes/charts/tree/master/stable/wordpress) 在生产场景中部署 WordPress。 {{< /warning >}} {{< note >}} From b435630d21c1ea9cec66726e16af212814d07b5f Mon Sep 17 00:00:00 2001 From: howieyuen <howieyuen@outlook.com> Date: Tue, 1 Mar 2022 17:20:42 +0800 Subject: [PATCH 059/104] [zh]resync node-pressure-eviction.md and fix hyper link issue --- .../scheduling-eviction/node-pressure-eviction.md | 4 ++-- content/zh/docs/reference/glossary/pod-priority.md | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md b/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md index 4c40fac8b0..f35a64425f 100644 --- a/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md +++ b/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md @@ -449,7 +449,7 @@ QoS 不适用于临时存储（EphemeralStorage）请求， `Guaranteed` pods are guaranteed only when requests and limits are specified for all the containers and they are equal. These pods will never be evicted because of another pod's resource consumption. If a system daemon (such as `kubelet`, -`docker`, and `journald`) is consuming more resources than were reserved via +and `journald`) is consuming more resources than were reserved via `system-reserved` or `kube-reserved` allocations, and the node only has `Guaranteed` or `Burstable` pods using less resources than requests left on it, then the kubelet must choose to evict one of these pods to preserve node stability @@ -458,7 +458,7 @@ will choose to evict pods of lowest Priority first. --> 仅当 `Guaranteed` Pod 中所有容器都被指定了请求和限制并且二者相等时，才保证 Pod 不被驱逐。 这些 Pod 永远不会因为另一个 Pod 的资源消耗而被驱逐。 -如果系统守护进程（例如 `kubelet`、`docker` 和 `journald`） +如果系统守护进程（例如 `kubelet` 和 `journald`） 消耗的资源比通过 `system-reserved` 或 `kube-reserved` 分配保留的资源多， 并且该节点只有 `Guaranteed` 或 `Burstable` Pod 使用的资源少于其上剩余的请求， 那么 kubelet 必须选择驱逐这些 Pod 中的一个以保持节点稳定性并减少资源匮乏对其他 Pod 的影响。 diff --git a/content/zh/docs/reference/glossary/pod-priority.md b/content/zh/docs/reference/glossary/pod-priority.md index 149ac33ee3..d029d0593c 100644 --- a/content/zh/docs/reference/glossary/pod-priority.md +++ b/content/zh/docs/reference/glossary/pod-priority.md @@ -2,7 +2,7 @@ title: Pod 优先级（Pod Priority） id: pod-priority date: 2019-01-31 -full_link: /zh/docs/concepts/configuration/pod-priority-preemption/#pod-priority +full_link: /zh/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority short_description: > Pod 优先级表示一个 Pod 相对于其他 Pod 的重要性。 @@ -15,7 +15,7 @@ tags: title: Pod Priority id: pod-priority date: 2019-01-31 -full_link: /docs/concepts/configuration/pod-priority-preemption/#pod-priority +full_link: /docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority short_description: > Pod Priority indicates the importance of a Pod relative to other Pods. @@ -32,9 +32,9 @@ tags: <!--more--> <!-- -[Pod Priority](/docs/concepts/configuration/pod-priority-preemption/#pod-priority) gives the ability to set scheduling priority of a Pod to be higher and lower than other Pods — an important feature for production clusters workload. +[Pod Priority](/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority) gives the ability to set scheduling priority of a Pod to be higher and lower than other Pods — an important feature for production clusters workload. --> -[Pod 优先级](/zh/docs/concepts/configuration/pod-priority-preemption/#pod-priority) +[Pod 优先级](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority) 允许用户为 Pod 设置高于或低于其他 Pod 的优先级 -- 这对于生产集群 工作负载而言是一个重要的特性。 From c4a79558bf031820aa437c496f094cce2815b845 Mon Sep 17 00:00:00 2001 From: howieyuen <howieyuen@outlook.com> Date: Tue, 1 Mar 2022 17:10:59 +0800 Subject: [PATCH 060/104] [zh]resync api-eviction.md and fix glossary hyper link issue --- .../scheduling-eviction/api-eviction.md | 184 +++++++++++++++++- .../docs/reference/glossary/api-eviction.md | 4 +- 2 files changed, 178 insertions(+), 10 deletions(-) diff --git a/content/zh/docs/concepts/scheduling-eviction/api-eviction.md b/content/zh/docs/concepts/scheduling-eviction/api-eviction.md index ee90cf9dd6..f51af2f678 100644 --- a/content/zh/docs/concepts/scheduling-eviction/api-eviction.md +++ b/content/zh/docs/concepts/scheduling-eviction/api-eviction.md @@ -13,14 +13,20 @@ weight: 70 {{< glossary_definition term_id="api-eviction" length="short" >}} </br> <!-- -You can request eviction by directly calling the Eviction API -using a client of the kube-apiserver, like the `kubectl drain` command. -This creates an `Eviction` object, which causes the API server to terminate the Pod. +You can request eviction by calling the Eviction API directly, or programmatically +using a client of the {{<glossary_tooltip term_id="kube-apiserver" text="API server">}}, like the `kubectl drain` command. This +creates an `Eviction` object, which causes the API server to terminate the Pod. API-initiated evictions respect your configured [`PodDisruptionBudgets`](/docs/tasks/run-application/configure-pdb/) and [`terminationGracePeriodSeconds`](/docs/concepts/workloads/pods/pod-lifecycle#pod-termination). + +Using the API to create an Eviction object for a Pod is like performing a +policy-controlled [`DELETE` operation](/docs/reference/kubernetes-api/workload-resources/pod-v1/#delete-delete-a-pod) +on the Pod. --> -你可以通过 kube-apiserver 的客户端，比如 `kubectl drain` 这样的命令，直接调用 Eviction API 发起驱逐。 +你可以通过直接调用 Eviction API 发起驱逐，也可以通过编程的方式使用 +{{<glossary_tooltip term_id="kube-apiserver" text="API 服务器">}}的客户端来发起驱逐， +比如 `kubectl drain` 命令。 此操作创建一个 `Eviction` 对象，该对象再驱动 API 服务器终止选定的 Pod。 API 发起的驱逐将遵从你的 @@ -28,11 +34,173 @@ API 发起的驱逐将遵从你的 和 [`terminationGracePeriodSeconds`](/zh/docs/concepts/workloads/pods/pod-lifecycle#pod-termination) 配置。 +使用 API 创建 Eviction 对象，就像对 Pod 执行策略控制的 +[`DELETE` 操作](/zh/docs/reference/kubernetes-api/workload-resources/pod-v1/#delete-delete-a-pod) + +<!-- +## Calling the Eviction API + +You can use a [Kubernetes language client](/docs/tasks/administer-cluster/access-cluster-api/#programmatic-access-to-the-api) +to access the Kubernetes API and create an `Eviction` object. To do this, you +POST the attempted operation, similar to the following example: +--> +## 调用 Eviction API + +你可以使用 [Kubernetes 语言客户端](/zh/docs/tasks/administer-cluster/access-cluster-api/#programmatic-access-to-the-api) +来访问 Kubernetes API 并创建 `Eviction` 对象。 +要执行此操作，你应该用 POST 发出要尝试的请求，类似于下面的示例： + +{{< tabs name="Eviction_example" >}} +{{% tab name="policy/v1" %}} +{{< note >}} +<!-- `policy/v1` Eviction is available in v1.22+. Use `policy/v1beta1` with prior releases. --> +`policy/v1` 版本的 Eviction 在 v1.22 以及更高的版本中可用，之前的发行版本使用 `policy/v1beta1` 版本。 +{{< /note >}} + +```json +{ + "apiVersion": "policy/v1", + "kind": "Eviction", + "metadata": { + "name": "quux", + "namespace": "default" + } +} +``` +{{% /tab %}} +{{% tab name="policy/v1beta1" %}} +{{< note >}} +<!-- Deprecated in v1.22 in favor of `policy/v1` --> +在 v1.22 版本废弃以支持 `policy/v1` +{{< /note >}} + +```json +{ + "apiVersion": "policy/v1beta1", + "kind": "Eviction", + "metadata": { + "name": "quux", + "namespace": "default" + } +} +``` +{{% /tab %}} +{{< /tabs >}} + +<!-- +Alternatively, you can attempt an eviction operation by accessing the API using +`curl` or `wget`, similar to the following example: +--> +或者，你可以通过使用 `curl` 或者 `wget` 来访问 API 以尝试驱逐操作，类似于以下示例： + +```bash +curl -v -H 'Content-type: application/json' https://your-cluster-api-endpoint.example/api/v1/namespaces/default/pods/quux/eviction -d @eviction.json +``` + +<!-- +## How API-initiated eviction works + +When you request an eviction using the API, the API server performs admission +checks and responds in one of the following ways: +--> + +## API 发起驱逐的工作原理 + +当你使用 API 来请求驱逐时，API 服务器将执行准入检查，并通过以下方式之一做出响应： + +<!-- +* `200 OK`: the eviction is allowed, the `Eviction` subresource is created, and + the Pod is deleted, similar to sending a `DELETE` request to the Pod URL. +* `429 Too Many Requests`: the eviction is not currently allowed because of the + configured {{<glossary_tooltip term_id="pod-disruption-budget" text="PodDisruptionBudget">}}. + You may be able to attempt the eviction again later. You might also see this + response because of API rate limiting. +* `500 Internal Server Error`: the eviction is not allowed because there is a + misconfiguration, like if multiple PodDisruptionBudgets reference the same Pod. +--> +* `200 OK`：允许驱逐，子资源 `Eviction` 被创建，并且 Pod 被删除， + 类似于发送一个 `DELETE` 请求到 Pod 地址。 +* `429 Too Many Requests`：当前不允许驱逐，因为配置了 {{<glossary_tooltip term_id="pod-disruption-budget" text="PodDisruptionBudget">}}。 + 你可以稍后再尝试驱逐。你也可能因为 API 速率限制而看到这种响应。 +* `500 Internal Server Error`：不允许驱逐，因为存在配置错误， + 例如存在多个 PodDisruptionBudgets 引用同一个 Pod。 + +<!-- +If the Pod you want to evict isn't part of a workload that has a +PodDisruptionBudget, the API server always returns `200 OK` and allows the +eviction. + +If the API server allows the eviction, the Pod is deleted as follows: +--> +如果你想驱逐的 Pod 不属于有 PodDisruptionBudget 的工作负载， +API 服务器总是返回 `200 OK` 并且允许驱逐。 + +如果 API 服务器允许驱逐，Pod 按照如下方式删除： + +<!-- +1. The `Pod` resource in the API server is updated with a deletion timestamp, + after which the API server considers the `Pod` resource to be terminated. The + `Pod` resource is also marked with the configured grace period. +1. The {{<glossary_tooltip term_id="kubelet" text="kubelet">}} on the node where the local Pod is running notices that the `Pod` + resource is marked for termination and starts to gracefully shut down the + local Pod. +1. While the kubelet is shutting the Pod down, the control plane removes the Pod + from {{<glossary_tooltip term_id="endpoint" text="Endpoint">}} and + {{<glossary_tooltip term_id="endpoint-slice" text="EndpointSlice">}} + objects. As a result, controllers no longer consider the Pod as a valid object. +1. After the grace period for the Pod expires, the kubelet forcefully terminates + the local Pod. +1. The kubelet tells the API server to remove the `Pod` resource. +1. The API server deletes the `Pod` resource. +--> +1. API 服务器中的 `Pod` 资源会更新上删除时间戳，之后 API 服务器会认为此 `Pod` 资源将被终止。 + 此 `Pod` 资源还会标记上配置的宽限期。 +1. 本地运行状态的 Pod 所处的节点上的 {{<glossary_tooltip term_id="kubelet" text="kubelet">}} + 注意到 `Pod` 资源被标记为终止，并开始优雅停止本地 Pod。 +1. 当 kubelet 停止 Pod 时，控制面从 {{<glossary_tooltip term_id="endpoint" text="Endpoint">}} + 和 {{<glossary_tooltip term_id="endpoint-slice" text="EndpointSlice">}} + 对象中移除该 Pod。因此，控制器不再将此 Pod 视为有用对象。 +1. Pod 的宽限期到期后，kubelet 强制终止本地 Pod。 +1. kubelet 告诉 API 服务器删除 `Pod` 资源。 +1. API 服务器删除 `Pod` 资源。 + +<!-- +## Troubleshooting stuck evictions + +In some cases, your applications may enter a broken state, where the Eviction +API will only return `429` or `500` responses until you intervene. This can +happen if, for example, a ReplicaSet creates pods for your application but new +pods do not enter a `Ready` state. You may also notice this behavior in cases +where the last evicted Pod had a long termination grace period. +--> +## 解决驱逐被卡住的问题 + +在某些情况下，你的应用可能进入中断状态， +在你干预之前，驱逐 API 总是返回 `429` 或 `500`。 +例如，如果 ReplicaSet 为你的应用程序创建了 Pod， +但新的 Pod 没有进入 `Ready` 状态，就会发生这种情况。 +在最后一个被驱逐的 Pod 有很长的终止宽限期的情况下，你可能也会注意到这种行为。 + +<!-- +If you notice stuck evictions, try one of the following solutions: + +* Abort or pause the automated operation causing the issue. Investigate the stuck + application before you restart the operation. +* Wait a while, then directly delete the Pod from your cluster control plane + instead of using the Eviction API. +--> +如果你注意到驱逐被卡住，请尝试以下解决方案之一： + +* 终止或暂停导致问题的自动化操作，重新启动操作之前，请检查被卡住的应用程序。 +* 等待一段时间后，直接从集群控制平面删除 Pod，而不是使用 Eviction API。 + ## {{% heading "whatsnext" %}} <!-- -* Learn about [Node-pressure Eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/) -* Learn about [Pod Priority and Preemption](/docs/concepts/scheduling-eviction/pod-priority-preemption/) +* Learn how to protect your applications with a [Pod Disruption Budget](/docs/tasks/run-application/configure-pdb/). +* Learn about [Node-pressure Eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/). +* Learn about [Pod Priority and Preemption](/docs/concepts/scheduling-eviction/pod-priority-preemption/). --> -* 了解[节点压力引发的驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/) -* 了解 [Pod 优先级和抢占](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) +* 了解如何使用 [Pod 干扰预算](/zh/docs/tasks/run-application/configure-pdb/) 保护你的应用。 +* 了解[节点压力引发的驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/)。 +* 了解 [Pod 优先级和抢占](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/)。 diff --git a/content/zh/docs/reference/glossary/api-eviction.md b/content/zh/docs/reference/glossary/api-eviction.md index 9ce3069879..fc5c87c33f 100644 --- a/content/zh/docs/reference/glossary/api-eviction.md +++ b/content/zh/docs/reference/glossary/api-eviction.md @@ -28,8 +28,8 @@ API-initiated eviction is the process by which you use the [Eviction API](/docs/ to create an `Eviction` object that triggers graceful pod termination. --> API 发起的驱逐是一个先调用 -[Eviction API](/docs/reference/generated/kubernetes-api/{{<param "version">}}/create-eviction-pod-v1-core) -创建驱逐对象，再由该对象体面地中止 Pod 的过程。 +[Eviction API](/docs/reference/generated/kubernetes-api/{{<param "version">}}/#create-eviction-pod-v1-core) +创建 `Eviction` 对象，再由该对象体面地中止 Pod 的过程。 <!--more--> From 10f95b98aa979ed78889c40ce130a05a70737603 Mon Sep 17 00:00:00 2001 From: holten <holten.ko@gmail.com> Date: Tue, 1 Mar 2022 18:51:31 +0800 Subject: [PATCH 061/104] Update mysql-wordpress-persistent-volume.md --- .../stateful-application/mysql-wordpress-persistent-volume.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md b/content/zh/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md index b386c5ab8b..5d8ae8b190 100644 --- a/content/zh/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md +++ b/content/zh/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md @@ -39,7 +39,7 @@ This tutorial shows you how to deploy a WordPress site and a MySQL database usin This deployment is not suitable for production use cases, as it uses single instance WordPress and MySQL Pods. Consider using [WordPress Helm Chart](https://github.com/kubernetes/charts/tree/master/stable/wordpress) to deploy WordPress in production. --> -这个 deployment 在生产场景中并不适合，它使用单实例 WordPress 和 MySQL Pods。考虑使用 [WordPress Helm Chart](https://github.com/kubernetes/charts/tree/master/stable/wordpress) 在生产场景中部署 WordPress。 +这种部署并不适合生产场景，它使用单实例 WordPress 和 MySQL Pods。考虑使用 [WordPress Helm Chart](https://github.com/kubernetes/charts/tree/master/stable/wordpress) 在生产场景中部署 WordPress。 {{< /warning >}} {{< note >}} From 2198d0f5199fe9d33e63691d03349793ef4b2e2b Mon Sep 17 00:00:00 2001 From: PriyanshuAhlawat <priyanshuahlawat009@gmail.com> Date: Tue, 1 Mar 2022 18:46:53 +0530 Subject: [PATCH 062/104] Update create-cluster-kubeadm.md --- .../tools/kubeadm/create-cluster-kubeadm.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md index e8b0a6d1a7..aa6f99d69c 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md @@ -284,6 +284,15 @@ If your network is not working or CoreDNS is not in the `Running` state, check o [troubleshooting guide](/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/) for `kubeadm`. +### Managed node labels + +By default, kubeadm enables the [NodeRestriction](/docs/reference/access-authn-authz/admission-controllers/#noderestriction) +admission controller that restricts what labels can be self-applied by kubelets on node registration. +The admission controller documentation covers what labels are permitted to be used with the kubelet `--node-labels` option. +The `node-role.kubernetes.io/control-plane` label is such a restricted label and kubeadm manually applies it using +a privileged client after a node has been created. To do that manually you can do the same by using `kubectl label` +and ensure it is using a privileged kubeconfig such as the kubeadm managed `/etc/kubernetes/admin.conf`. + ### Control plane node isolation By default, your cluster will not schedule Pods on the control-plane node for security From 002985c690379f236e97f5436e2baf6d9e5f3ede Mon Sep 17 00:00:00 2001 From: cici37 <cicih@google.com> Date: Tue, 1 Mar 2022 13:01:47 -0800 Subject: [PATCH 063/104] Reduce confusion by fixing field name in samples. --- .../custom-resources/custom-resource-definitions.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md index e4c5e39915..6b30143470 100644 --- a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md +++ b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md @@ -725,7 +725,7 @@ For example: properties: spec: type: object - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "self.minReplicas <= self.replicas" message: "replicas should be greater than or equal to minReplicas." - rule: "self.replicas <= self.maxReplicas" @@ -829,7 +829,7 @@ Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6 ... openAPIV3Schema: type: object - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "self.status.availableReplicas >= self.spec.minReplicas" properties: spec: @@ -856,7 +856,7 @@ Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6 properties: spec: type: object - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "has(self.foo)" properties: ... @@ -874,7 +874,7 @@ Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6 properties: spec: type: object - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "self['xyz'].foo > 0" additionalProperties: ... @@ -894,7 +894,7 @@ Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6 ... foo: type: array - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "size(self) == 1" items: type: string @@ -912,7 +912,7 @@ Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6 ... foo: type: integer - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "self > 0" ``` Examples: From e8c29bad9c916dcb27a289a1c9427159ff5f2672 Mon Sep 17 00:00:00 2001 From: Vedant Koditkar <18693839+KoditkarVedant@users.noreply.github.com> Date: Wed, 2 Mar 2022 08:11:16 +0530 Subject: [PATCH 064/104] [en] Update networking model link (#31390) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Update hyperlinks to point to main branch * Revert changes to post older than a year ⏪ * Update link to point to localize document 📝 * Fix fragement in the link 📝 change "#the-kubernetes-network-model" to "#how-to-implement-the-kubernetes-networking-model" * Revert changes in zh localization pages * Remove changes in files of other localization --- content/en/docs/concepts/cluster-administration/networking.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/cluster-administration/networking.md b/content/en/docs/concepts/cluster-administration/networking.md index 4b94d933e2..9fed36c2fd 100644 --- a/content/en/docs/concepts/cluster-administration/networking.md +++ b/content/en/docs/concepts/cluster-administration/networking.md @@ -79,7 +79,7 @@ addressing, and it can be used in combination with other CNI plugins. ### CNI-Genie from Huawei -[CNI-Genie](https://github.com/cni-genie/CNI-Genie) is a CNI plugin that enables Kubernetes to [simultaneously have access to different implementations](https://github.com/cni-genie/CNI-Genie/blob/master/docs/multiple-cni-plugins/README.md#what-cni-genie-feature-1-multiple-cni-plugins-enables) of the [Kubernetes network model](/docs/concepts/cluster-administration/networking/#the-kubernetes-network-model) in runtime. This includes any implementation that runs as a [CNI plugin](https://github.com/containernetworking/cni#3rd-party-plugins), such as [Flannel](https://github.com/flannel-io/flannel#flannel), [Calico](https://projectcalico.docs.tigera.io/about/about-calico/), [Weave-net](https://www.weave.works/oss/net/). +[CNI-Genie](https://github.com/cni-genie/CNI-Genie) is a CNI plugin that enables Kubernetes to [simultaneously have access to different implementations](https://github.com/cni-genie/CNI-Genie/blob/master/docs/multiple-cni-plugins/README.md#what-cni-genie-feature-1-multiple-cni-plugins-enables) of the [Kubernetes network model](/docs/concepts/cluster-administration/networking/#how-to-implement-the-kubernetes-networking-model) in runtime. This includes any implementation that runs as a [CNI plugin](https://github.com/containernetworking/cni#3rd-party-plugins), such as [Flannel](https://github.com/flannel-io/flannel#flannel), [Calico](https://projectcalico.docs.tigera.io/about/about-calico/), [Weave-net](https://www.weave.works/oss/net/). CNI-Genie also supports [assigning multiple IP addresses to a pod](https://github.com/cni-genie/CNI-Genie/blob/master/docs/multiple-ips/README.md#feature-2-extension-cni-genie-multiple-ip-addresses-per-pod), each from a different CNI plugin. From 7f9869dab873c083ba489017eb42efeb6fa6e95d Mon Sep 17 00:00:00 2001 From: RA489 <rohit.anand@india.nec.com> Date: Wed, 2 Mar 2022 08:20:04 +0530 Subject: [PATCH 065/104] kubeadm-upgrade: add note about verifying the kubelet service status --- .../en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md index aa7a623c42..ec24fca8e8 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md @@ -43,6 +43,7 @@ first drain the node (or nodes) that you are upgrading. In the case of control p they could be running CoreDNS Pods or other critical workloads. For more information see [Draining nodes](/docs/tasks/administer-cluster/safely-drain-node/). - All containers are restarted after upgrade, because the container spec hash value is changed. +- To verify that the kubelet service has successfully restarted after the kubelet has been upgraded, you can execute `systemctl status kubelet` or view the service logs with `journalctl -xeu kubelet`. <!-- steps --> From a9f721921081443f2d4c5e7a3e604eee08e679c8 Mon Sep 17 00:00:00 2001 From: Gerard <Gerarddp@users.noreply.github.com> Date: Wed, 2 Mar 2022 14:43:14 +0100 Subject: [PATCH 066/104] Improve mentions of CS CA in managing-tls-in-a-cluster (#30347) * Improve mentions of CS CA in managing-tls-in-a-cluster * Update content/en/docs/tasks/tls/managing-tls-in-a-cluster.md Co-authored-by: Tim Bannister <tim@scalefactory.com> * Update managing-tls-in-a-cluster.md * Update managing-tls-in-a-cluster.md Co-authored-by: Tim Bannister <tim@scalefactory.com> --- .../tasks/tls/managing-tls-in-a-cluster.md | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md b/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md index 1294ac3daa..f66db84449 100644 --- a/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md +++ b/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md @@ -18,7 +18,7 @@ draft](https://github.com/ietf-wg-acme/acme/). {{< note >}} Certificates created using the `certificates.k8s.io` API are signed by a -dedicated CA. It is possible to configure your cluster to use the cluster root +[dedicated CA](#a-note-to-cluster-administrators). It is possible to configure your cluster to use the cluster root CA for this purpose, but you should never rely on this. Do not assume that these certificates will validate against the cluster root CA. {{< /note >}} @@ -42,16 +42,25 @@ install it via your operating system's software sources, or fetch it from ## Trusting TLS in a cluster -Trusting the custom CA from an application running as a pod usually requires +Trusting the [custom CA](#a-note-to-cluster-administrators) from an application running as a pod usually requires some extra application configuration. You will need to add the CA certificate bundle to the list of CA certificates that the TLS client or server trusts. For example, you would do this with a golang TLS config by parsing the certificate chain and adding the parsed certificates to the `RootCAs` field in the [`tls.Config`](https://godoc.org/crypto/tls#Config) struct. -You can distribute the CA certificate as a -[ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap) that your -pods have access to use. +{{< note >}} +Even though the custom CA certificate may be included in the filesystem (in the +ConfigMap `kube-root-ca.crt`), +you should not use that certificate authority for any purpose other than to verify internal +Kubernetes endpoints. An example of an internal Kubernetes endpoint is the +Service named `kubernetes` in the default namespace. + +If you want to use a custom certificate authority for your workloads, you should generate +that CA separately, and distribute its CA certificate using a +[ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap) that your pods +have access to read. +{{< /note >}} ## Requesting a certificate From 8d43e339b928afd375eb53fd182164df3ad80ba6 Mon Sep 17 00:00:00 2001 From: Alexandru Gheorghe <alghe.global@gmail.com> Date: Thu, 24 Feb 2022 15:46:04 +0000 Subject: [PATCH 067/104] Fix wording for "concepts/overview/working-with-objects/kubernetes-objects/#required-fields" --- .../working-with-objects/kubernetes-objects.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md b/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md index 9d57d9860d..bcfd32ef7d 100644 --- a/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md +++ b/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md @@ -83,10 +83,19 @@ In the `.yaml` file for the Kubernetes object you want to create, you'll need to The precise format of the object `spec` is different for every Kubernetes object, and contains nested fields specific to that object. The [Kubernetes API Reference](https://kubernetes.io/docs/reference/kubernetes-api/) can help you find the spec format for all of the objects you can create using Kubernetes. -For example, the reference for Pod details the [`spec` field](/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec) -for a Pod in the API, and the reference for Deployment details the [`spec` field](/docs/reference/kubernetes-api/workload-resources/deployment-v1/#DeploymentSpec) for Deployments. -In those API reference pages you'll see mention of PodSpec and DeploymentSpec. These names are implementation details of the Golang code that Kubernetes uses to implement its API. - +For example, see the [`spec` field](/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec) +for the Pod API reference. +For each Pod, the `.spec` field specifies the pod and its desired state (such as the container image name for +each container within that pod). +Another example of an object specification is the +[`spec` field](/docs/reference/kubernetes-api/workload-resources/stateful-set-v1/#StatefulSetSpec) +for the StatefulSet API. For StatefulSet, the `.spec` field specifies the StatefulSet and +its desired state. +Within the `.spec` of a StatefulSet is a [template](/docs/concepts/workloads/pods/#pod-templates) +for Pod objects. That template describes Pods that the StatefulSet controller will create in order to +satisfy the StatefulSet specification. +Different kinds of object can also have different `.status`; again, the API reference pages +detail the structure of that `.status` field, and its content for each different type of object. ## {{% heading "whatsnext" %}} From 5c970ca1b0792a3af495e4b26c65ced4a26407e9 Mon Sep 17 00:00:00 2001 From: Tim Bannister <tim@scalefactory.com> Date: Wed, 2 Mar 2022 16:24:18 +0000 Subject: [PATCH 068/104] Fix blog articles using wrong custom URIs Some blog articles with custom URIs have been localized into Chinese without removing the custom URI from the front matter. Update these articles to use appropriate URIs. --- .../blog/_posts/2015-03-00-Kubernetes-Gathering-Videos.md | 2 +- .../2015-03-00-Weekly-Kubernetes-Community-Hangout.md | 2 +- .../zh/blog/_posts/2015-03-00-Welcome-To-Kubernetes-Blog.md | 2 +- .../_posts/2015-04-00-Borg-Predecessor-To-Kubernetes.md | 2 +- .../2015-04-00-Weekly-Kubernetes-Community-Hangout.md | 4 ++-- .../2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md | 2 +- .../2015-04-00-Weekly-Kubernetes-Community-Hangout_29.md | 2 +- .../2015-05-00-Appc-Support-For-Kubernetes-Through-Rkt.md | 4 ++-- .../zh/blog/_posts/2015-05-00-Kubernetes-On-Openstack.md | 2 +- .../2015-05-00-Weekly-Kubernetes-Community-Hangout.md | 2 +- .../_posts/2015-06-00-Slides-Cluster-Management-With.md | 2 +- .../2015-07-00-Announcing-First-Kubernetes-Enterprise.md | 2 +- .../2015-08-00-Weekly-Kubernetes-Community-Hangout.md | 4 ++-- ...nce-Upgrades-Improved-Tooling-And-A-Growing-Community.md | 4 ++-- ...Pods-Services-And-Replication-Controllers-With-Puppet.md | 2 +- .../_posts/2016-01-00-Kubernetes-Community-Meeting-Notes.md | 4 ++-- .../2016-01-00-Simple-Leader-Election-With-Kubernetes.md | 2 +- .../2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md | 2 +- .../2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md | 2 +- .../_posts/2016-02-00-Kubernetes-Community-Meeting-Notes.md | 2 +- .../2016-02-00-State-Of-Container-World-January-2016.md | 4 ++-- .../2016-02-00-kubernetes-community-meeting-notes_23.md | 6 +++--- .../2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md | 4 ++-- .../_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md | 2 +- ...mote-Operability-And-Interoperability-Of-K8S-Clusters.md | 4 ++-- .../2016-05-00-Coreosfest2016-Kubernetes-Community.md | 4 ++-- ...-00-Bringing-End-To-End-Kubernetes-Testing-To-Azure-2.md | 4 ++-- .../_posts/2016-07-00-Citrix-Netscaler-And-Kubernetes.md | 2 +- .../2016-07-00-Dashboard-Web-Interface-For-Kubernetes.md | 2 +- .../zh/blog/_posts/2016-07-00-Oh-The-Places-You-Will-Go.md | 2 +- ...-07-00-stateful-applications-in-containers-kubernetes.md | 4 ++-- ...6-08-00-Stateful-Applications-Using-Kubernetes-Datera.md | 2 +- .../zh/blog/_posts/2017-10-00-Five-Days-Of-Kubernetes-18.md | 2 +- ...ernetes-Community-Steering-Committee-Election-Results.md | 4 ++-- .../zh/blog/_posts/2017-11-00-Autoscaling-In-Kubernetes.md | 2 +- .../2018-01-00-Kubernetes-V19-Beta-Windows-Support.md | 4 ++-- .../_posts/2018-03-00-Principles-Of-Container-App-Design.md | 2 +- 37 files changed, 52 insertions(+), 52 deletions(-) diff --git a/content/zh/blog/_posts/2015-03-00-Kubernetes-Gathering-Videos.md b/content/zh/blog/_posts/2015-03-00-Kubernetes-Gathering-Videos.md index c53ea68585..90dd2a1317 100644 --- a/content/zh/blog/_posts/2015-03-00-Kubernetes-Gathering-Videos.md +++ b/content/zh/blog/_posts/2015-03-00-Kubernetes-Gathering-Videos.md @@ -11,7 +11,7 @@ slug: kubernetes-gathering-videos title: " Kubernetes Gathering Videos " date: 2015-03-23 slug: kubernetes-gathering-videos -url: /blog/2015/03/Kubernetes-Gathering-Videos +url: /zh/blog/2015/03/Kubernetes-Gathering-Videos --- --> diff --git a/content/zh/blog/_posts/2015-03-00-Weekly-Kubernetes-Community-Hangout.md b/content/zh/blog/_posts/2015-03-00-Weekly-Kubernetes-Community-Hangout.md index a2eee74a47..e5420ff74b 100644 --- a/content/zh/blog/_posts/2015-03-00-Weekly-Kubernetes-Community-Hangout.md +++ b/content/zh/blog/_posts/2015-03-00-Weekly-Kubernetes-Community-Hangout.md @@ -9,7 +9,7 @@ slug: weekly-kubernetes-community-hangout title: " Weekly Kubernetes Community Hangout Notes - March 27 2015 " date: 2015-03-28 slug: weekly-kubernetes-community-hangout -url: /blog/2015/03/Weekly-Kubernetes-Community-Hangout +url: /zh/blog/2015/03/Weekly-Kubernetes-Community-Hangout --- --> diff --git a/content/zh/blog/_posts/2015-03-00-Welcome-To-Kubernetes-Blog.md b/content/zh/blog/_posts/2015-03-00-Welcome-To-Kubernetes-Blog.md index 6f05ad7e4b..fd0ea91f10 100644 --- a/content/zh/blog/_posts/2015-03-00-Welcome-To-Kubernetes-Blog.md +++ b/content/zh/blog/_posts/2015-03-00-Welcome-To-Kubernetes-Blog.md @@ -9,7 +9,7 @@ slug: welcome-to-kubernetes-blog title: Welcome to the Kubernetes Blog! date: 2015-03-20 slug: welcome-to-kubernetes-blog -url: /blog/2015/03/Welcome-To-Kubernetes-Blog +url: /zh/blog/2015/03/Welcome-To-Kubernetes-Blog --- --> diff --git a/content/zh/blog/_posts/2015-04-00-Borg-Predecessor-To-Kubernetes.md b/content/zh/blog/_posts/2015-04-00-Borg-Predecessor-To-Kubernetes.md index 5b8f06a76e..41af82357b 100644 --- a/content/zh/blog/_posts/2015-04-00-Borg-Predecessor-To-Kubernetes.md +++ b/content/zh/blog/_posts/2015-04-00-Borg-Predecessor-To-Kubernetes.md @@ -9,7 +9,7 @@ url: /zh/blog/2015/04/Borg-Predecessor-To-Kubernetes title: " Borg: The Predecessor to Kubernetes " date: 2015-04-23 slug: borg-predecessor-to-kubernetes -url: /blog/2015/04/Borg-Predecessor-To-Kubernetes +url: /zh/blog/2015/04/Borg-Predecessor-To-Kubernetes --- --> <!-- diff --git a/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md b/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md index 83e9a5b609..a95a116b49 100644 --- a/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md +++ b/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md @@ -2,14 +2,14 @@ title: " 每周 Kubernetes 社区例会笔记 - 2015年4月3日 " date: 2015-04-04 slug: weekly-kubernetes-community-hangout -url: /blog/2015/04/Weekly-Kubernetes-Community-Hangout +url: /zh/blog/2015/04/Weekly-Kubernetes-Community-Hangout --- <!-- --- title: " Weekly Kubernetes Community Hangout Notes - April 3 2015 " date: 2015-04-04 slug: weekly-kubernetes-community-hangout -url: /blog/2015/04/Weekly-Kubernetes-Community-Hangout +url: /zh/blog/2015/04/Weekly-Kubernetes-Community-Hangout --- --> <!-- diff --git a/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md b/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md index 30ee18e858..e2f66cc576 100644 --- a/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md +++ b/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md @@ -9,7 +9,7 @@ slug: weekly-kubernetes-community-hangout_17 title: " Weekly Kubernetes Community Hangout Notes - April 17 2015 " date: 2015-04-17 slug: weekly-kubernetes-community-hangout_17 -url: /blog/2015/04/Weekly-Kubernetes-Community-Hangout_17 +url: /zh/blog/2015/04/Weekly-Kubernetes-Community-Hangout_17 --- --> diff --git a/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout_29.md b/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout_29.md index 399d926792..2ad1d054bb 100644 --- a/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout_29.md +++ b/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout_29.md @@ -9,7 +9,7 @@ slug: weekly-kubernetes-community-hangout_29 title: " Weekly Kubernetes Community Hangout Notes - April 24 2015 " date: 2015-04-30 slug: weekly-kubernetes-community-hangout_29 -url: /blog/2015/04/Weekly-Kubernetes-Community-Hangout_29 +url: /zh/blog/2015/04/Weekly-Kubernetes-Community-Hangout_29 --- --> diff --git a/content/zh/blog/_posts/2015-05-00-Appc-Support-For-Kubernetes-Through-Rkt.md b/content/zh/blog/_posts/2015-05-00-Appc-Support-For-Kubernetes-Through-Rkt.md index bf9aad4214..275cbead77 100644 --- a/content/zh/blog/_posts/2015-05-00-Appc-Support-For-Kubernetes-Through-Rkt.md +++ b/content/zh/blog/_posts/2015-05-00-Appc-Support-For-Kubernetes-Through-Rkt.md @@ -3,14 +3,14 @@ title: " AppC Support for Kubernetes through RKT " date: 2015-05-04 slug: appc-support-for-kubernetes-through-rkt -url: /blog/2015/05/Appc-Support-For-Kubernetes-Through-Rkt +url: /zh/blog/2015/05/Appc-Support-For-Kubernetes-Through-Rkt --- --> --- title: " 通过 RKT 对 Kubernetes 的 AppC 支持 " date: 2015-05-04 slug: appc-support-for-kubernetes-through-rkt -url: /blog/2015/05/Appc-Support-For-Kubernetes-Through-Rkt +url: /zh/blog/2015/05/Appc-Support-For-Kubernetes-Through-Rkt --- <!-- We very recently accepted a pull request to the Kubernetes project to add appc support for the Kubernetes community.  Appc is a new open container specification that was initiated by CoreOS, and is supported through CoreOS rkt container runtime. diff --git a/content/zh/blog/_posts/2015-05-00-Kubernetes-On-Openstack.md b/content/zh/blog/_posts/2015-05-00-Kubernetes-On-Openstack.md index 940f192c9e..68a50e93c8 100644 --- a/content/zh/blog/_posts/2015-05-00-Kubernetes-On-Openstack.md +++ b/content/zh/blog/_posts/2015-05-00-Kubernetes-On-Openstack.md @@ -9,7 +9,7 @@ slug: kubernetes-on-openstack title: " Kubernetes on OpenStack " date: 2015-05-19 slug: kubernetes-on-openstack -url: /blog/2015/05/Kubernetes-On-Openstack +url: /zh/blog/2015/05/Kubernetes-On-Openstack --- --> diff --git a/content/zh/blog/_posts/2015-05-00-Weekly-Kubernetes-Community-Hangout.md b/content/zh/blog/_posts/2015-05-00-Weekly-Kubernetes-Community-Hangout.md index 0e3b3dec22..e7d01a5a6e 100644 --- a/content/zh/blog/_posts/2015-05-00-Weekly-Kubernetes-Community-Hangout.md +++ b/content/zh/blog/_posts/2015-05-00-Weekly-Kubernetes-Community-Hangout.md @@ -9,7 +9,7 @@ slug: weekly-kubernetes-community-hangout title: " Weekly Kubernetes Community Hangout Notes - May 1 2015 " date: 2015-05-11 slug: weekly-kubernetes-community-hangout -url: /blog/2015/05/Weekly-Kubernetes-Community-Hangout +url: /zh/blog/2015/05/Weekly-Kubernetes-Community-Hangout --- --> diff --git a/content/zh/blog/_posts/2015-06-00-Slides-Cluster-Management-With.md b/content/zh/blog/_posts/2015-06-00-Slides-Cluster-Management-With.md index e2937cd16e..24f7cf35cb 100644 --- a/content/zh/blog/_posts/2015-06-00-Slides-Cluster-Management-With.md +++ b/content/zh/blog/_posts/2015-06-00-Slides-Cluster-Management-With.md @@ -9,7 +9,7 @@ slug: slides-cluster-management-with title: " Slides: Cluster Management with Kubernetes, talk given at the University of Edinburgh " date: 2015-06-26 slug: slides-cluster-management-with -url: /blog/2015/06/Slides-Cluster-Management-With +url: /zh/blog/2015/06/Slides-Cluster-Management-With --- --> diff --git a/content/zh/blog/_posts/2015-07-00-Announcing-First-Kubernetes-Enterprise.md b/content/zh/blog/_posts/2015-07-00-Announcing-First-Kubernetes-Enterprise.md index 0a464805f2..9b0013d0d9 100644 --- a/content/zh/blog/_posts/2015-07-00-Announcing-First-Kubernetes-Enterprise.md +++ b/content/zh/blog/_posts/2015-07-00-Announcing-First-Kubernetes-Enterprise.md @@ -7,7 +7,7 @@ slug: announcing-first-kubernetes-enterprise title: " Announcing the First Kubernetes Enterprise Training Course " date: 2015-07-08 slug: announcing-first-kubernetes-enterprise -url: /blog/2015/07/Announcing-First-Kubernetes-Enterprise +url: /zh/blog/2015/07/Announcing-First-Kubernetes-Enterprise --- --> <!-- At Google we rely on Linux application containers to run our core infrastructure. Everything from Search to Gmail runs in containers.  In fact, we like containers so much that even our Google Compute Engine VMs run in containers!  Because containers are critical to our business, we have been working with the community on many of the basic container technologies (from cgroups to Docker’s LibContainer) and even decided to build the next generation of Google’s container scheduling technology, Kubernetes, in the open. --> diff --git a/content/zh/blog/_posts/2015-08-00-Weekly-Kubernetes-Community-Hangout.md b/content/zh/blog/_posts/2015-08-00-Weekly-Kubernetes-Community-Hangout.md index 02c0930bdd..7e2bc24423 100644 --- a/content/zh/blog/_posts/2015-08-00-Weekly-Kubernetes-Community-Hangout.md +++ b/content/zh/blog/_posts/2015-08-00-Weekly-Kubernetes-Community-Hangout.md @@ -3,7 +3,7 @@ title: " Weekly Kubernetes Community Hangout Notes - July 31 2015 " date: 2015-08-04 slug: weekly-kubernetes-community-hangout -url: /blog/2015/08/Weekly-Kubernetes-Community-Hangout +url: /zh/blog/2015/08/Weekly-Kubernetes-Community-Hangout --- --> @@ -11,7 +11,7 @@ url: /blog/2015/08/Weekly-Kubernetes-Community-Hangout title: " Kubernetes社区每周环聊笔记-2015年7月31日 " date: 2015-08-04 slug: weekly-kubernetes-community-hangout -url: /blog/2015/08/Weekly-Kubernetes-Community-Hangout +url: /zh/blog/2015/08/Weekly-Kubernetes-Community-Hangout --- <!-- diff --git a/content/zh/blog/_posts/2015-11-00-Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community.md b/content/zh/blog/_posts/2015-11-00-Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community.md index 5ce36abee0..b90cdcb7fe 100644 --- a/content/zh/blog/_posts/2015-11-00-Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community.md +++ b/content/zh/blog/_posts/2015-11-00-Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community.md @@ -2,14 +2,14 @@ title: " Kubernetes 1.1 性能升级，工具改进和社区不断壮大 " date: 2015-11-09 slug: kubernetes-1-1-performance-upgrades-improved-tooling-and-a-growing-community -url: /blog/2015/11/Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community +url: /zh/blog/2015/11/Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community --- <!-- --- title: " Kubernetes 1.1 Performance upgrades, improved tooling and a growing community " date: 2015-11-09 slug: kubernetes-1-1-performance-upgrades-improved-tooling-and-a-growing-community -url: /blog/2015/11/Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community +url: /zh/blog/2015/11/Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community --- --> <!-- diff --git a/content/zh/blog/_posts/2015-12-00-Managing-Kubernetes-Pods-Services-And-Replication-Controllers-With-Puppet.md b/content/zh/blog/_posts/2015-12-00-Managing-Kubernetes-Pods-Services-And-Replication-Controllers-With-Puppet.md index 4df4232463..2fb1d70b9f 100644 --- a/content/zh/blog/_posts/2015-12-00-Managing-Kubernetes-Pods-Services-And-Replication-Controllers-With-Puppet.md +++ b/content/zh/blog/_posts/2015-12-00-Managing-Kubernetes-Pods-Services-And-Replication-Controllers-With-Puppet.md @@ -9,7 +9,7 @@ slug: managing-kubernetes-pods-services-and-replication-controllers-with-puppet title: " Managing Kubernetes Pods, Services and Replication Controllers with Puppet " date: 2015-12-17 slug: managing-kubernetes-pods-services-and-replication-controllers-with-puppet -url: /blog/2015/12/Managing-Kubernetes-Pods-Services-And-Replication-Controllers-With-Puppet +url: /zh/blog/2015/12/Managing-Kubernetes-Pods-Services-And-Replication-Controllers-With-Puppet --- --> diff --git a/content/zh/blog/_posts/2016-01-00-Kubernetes-Community-Meeting-Notes.md b/content/zh/blog/_posts/2016-01-00-Kubernetes-Community-Meeting-Notes.md index 5ed529347c..864e668970 100644 --- a/content/zh/blog/_posts/2016-01-00-Kubernetes-Community-Meeting-Notes.md +++ b/content/zh/blog/_posts/2016-01-00-Kubernetes-Community-Meeting-Notes.md @@ -2,14 +2,14 @@ title: " Kubernetes 社区会议记录 - 20160114 " date: 2016-01-28 slug: kubernetes-community-meeting-notes -url: /blog/2016/01/Kubernetes-Community-Meeting-Notes +url: /zh/blog/2016/01/Kubernetes-Community-Meeting-Notes --- <!-- --- title: " Kubernetes Community Meeting Notes - 20160114 " date: 2016-01-28 slug: kubernetes-community-meeting-notes -url: /blog/2016/01/Kubernetes-Community-Meeting-Notes +url: /zh/blog/2016/01/Kubernetes-Community-Meeting-Notes --- --> <!-- diff --git a/content/zh/blog/_posts/2016-01-00-Simple-Leader-Election-With-Kubernetes.md b/content/zh/blog/_posts/2016-01-00-Simple-Leader-Election-With-Kubernetes.md index a1c9bb3c3b..fe29be4795 100644 --- a/content/zh/blog/_posts/2016-01-00-Simple-Leader-Election-With-Kubernetes.md +++ b/content/zh/blog/_posts/2016-01-00-Simple-Leader-Election-With-Kubernetes.md @@ -11,7 +11,7 @@ slug: simple-leader-election-with-kubernetes title: "Kubernetes 和 Docker 简单的 leader election" date: 2016-01-11 slug: simple-leader-election-with-kubernetes -url: /blog/2016/01/Simple-Leader-Election-With-Kubernetes +url: /zh/blog/2016/01/Simple-Leader-Election-With-Kubernetes <!-- Kubernetes simplifies the deployment and operational management of services running on clusters. However, it also simplifies the development of these services. In this post we'll see how you can use Kubernetes to easily perform leader election in your distributed application. Distributed applications usually replicate the tasks of a service for reliability and scalability, but often it is necessary to designate one of the replicas as the leader who is responsible for coordination among all of the replicas. diff --git a/content/zh/blog/_posts/2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md b/content/zh/blog/_posts/2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md index ed0c960fda..ca8dfc8da4 100644 --- a/content/zh/blog/_posts/2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md +++ b/content/zh/blog/_posts/2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md @@ -8,7 +8,7 @@ slug: why-kubernetes-doesnt-use-libnetwork title: " Why Kubernetes doesn’t use libnetwork " date: 2016-01-14 slug: why-kubernetes-doesnt-use-libnetwork -url: /blog/2016/01/Why-Kubernetes-Doesnt-Use-Libnetwork +url: /zh/blog/2016/01/Why-Kubernetes-Doesnt-Use-Libnetwork --- --> <!-- Kubernetes has had a very basic form of network plugins since before version 1.0 was released — around the same time as Docker's [libnetwork](https://github.com/docker/libnetwork) and Container Network Model ([CNM](https://github.com/docker/libnetwork/blob/master/docs/design.md)) was introduced. Unlike libnetwork, the Kubernetes plugin system still retains its "alpha" designation. Now that Docker's network plugin support is released and supported, an obvious question we get is why Kubernetes has not adopted it yet. After all, vendors will almost certainly be writing plugins for Docker — we would all be better off using the same drivers, right? --> diff --git a/content/zh/blog/_posts/2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md b/content/zh/blog/_posts/2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md index 0ac1e9cfed..09b2880192 100644 --- a/content/zh/blog/_posts/2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md +++ b/content/zh/blog/_posts/2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md @@ -9,7 +9,7 @@ slug: kubecon-eu-2016-kubernetes-community-in title: " KubeCon EU 2016: Kubernetes Community in London " date: 2016-02-24 slug: kubecon-eu-2016-kubernetes-community-in -url: /blog/2016/02/Kubecon-Eu-2016-Kubernetes-Community-In +url: /zh/blog/2016/02/Kubecon-Eu-2016-Kubernetes-Community-In --- --> diff --git a/content/zh/blog/_posts/2016-02-00-Kubernetes-Community-Meeting-Notes.md b/content/zh/blog/_posts/2016-02-00-Kubernetes-Community-Meeting-Notes.md index 608a5bbd33..a9e0f10e4e 100644 --- a/content/zh/blog/_posts/2016-02-00-Kubernetes-Community-Meeting-Notes.md +++ b/content/zh/blog/_posts/2016-02-00-Kubernetes-Community-Meeting-Notes.md @@ -8,7 +8,7 @@ slug: kubernetes-community-meeting-notes title: " Kubernetes community meeting notes - 20160204 " date: 2016-02-09 slug: kubernetes-community-meeting-notes -url: /blog/2016/02/Kubernetes-Community-Meeting-Notes +url: /zh/blog/2016/02/Kubernetes-Community-Meeting-Notes --- --> <!-- diff --git a/content/zh/blog/_posts/2016-02-00-State-Of-Container-World-January-2016.md b/content/zh/blog/_posts/2016-02-00-State-Of-Container-World-January-2016.md index a6983a9a8a..1dc62626df 100644 --- a/content/zh/blog/_posts/2016-02-00-State-Of-Container-World-January-2016.md +++ b/content/zh/blog/_posts/2016-02-00-State-Of-Container-World-January-2016.md @@ -2,14 +2,14 @@ title: " 容器世界现状，2016年1月 " date: 2016-02-01 slug: state-of-container-world-january-2016 -url: /blog/2016/02/State-Of-Container-World-January-2016 +url: /zh/blog/2016/02/State-Of-Container-World-January-2016 --- <!-- --- title: " State of the Container World, January 2016 " date: 2016-02-01 slug: state-of-container-world-january-2016 -url: /blog/2016/02/State-Of-Container-World-January-2016 +url: /zh/blog/2016/02/State-Of-Container-World-January-2016 --- --> <!-- diff --git a/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md b/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md index 2c73751c6b..10420cf73f 100644 --- a/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md +++ b/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md @@ -2,7 +2,7 @@ title: "Kubernetes 社区会议记录 - 20160218" date: 2016-02-23 slug: kubernetes-community-meeting-notes_23 -url: /blog/2016/02/kubernetes-community-meeting-notes_23 +url: /zh/blog/2016/02/kubernetes-community-meeting-notes_23 --- <!-- @@ -10,8 +10,8 @@ url: /blog/2016/02/kubernetes-community-meeting-notes_23 title: " Kubernetes Community Meeting Notes - 20160218 " date: 2016-02-23 slug: kubernetes-community-meeting-notes_23 -url: /blog/2016/02/kubernetes-community-meeting-notes_23 -url: /blog/2016/02/kubernetes-community-meeting-notes_23 +url: /zh/blog/2016/02/kubernetes-community-meeting-notes_23 +url: /zh/blog/2016/02/kubernetes-community-meeting-notes_23 --- --> diff --git a/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md b/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md index b46fd0fb3f..c34940bcb2 100644 --- a/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md +++ b/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md @@ -2,14 +2,14 @@ title: " 在 Rancher 中添加对 Kuernetes 的支持 " date: 2016-04-08 slug: adding-support-for-kubernetes-in-rancher -url: /blog/2016/04/Adding-Support-For-Kubernetes-In-Rancher +url: /zh/blog/2016/04/Adding-Support-For-Kubernetes-In-Rancher --- <!-- --- title: " Adding Support for Kubernetes in Rancher " date: 2016-04-08 slug: adding-support-for-kubernetes-in-rancher -url: /blog/2016/04/Adding-Support-For-Kubernetes-In-Rancher +url: /zh/blog/2016/04/Adding-Support-For-Kubernetes-In-Rancher --- --> <!-- diff --git a/content/zh/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md b/content/zh/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md index 8d2cc7e3a1..36eee4a09b 100644 --- a/content/zh/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md +++ b/content/zh/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md @@ -9,7 +9,7 @@ url: /zh/blog/2016/04/Kubernetes-Network-Policy-APIs title: " SIG-Networking: Kubernetes Network Policy APIs Coming in 1.3 " date: 2016-04-18 slug: kubernetes-network-policy-apis -url: /blog/2016/04/Kubernetes-Network-Policy-APIs +url: /zh/blog/2016/04/Kubernetes-Network-Policy-APIs --- --> <!-- diff --git a/content/zh/blog/_posts/2016-04-00-Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters.md b/content/zh/blog/_posts/2016-04-00-Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters.md index e9d09cb84c..0a24f27058 100644 --- a/content/zh/blog/_posts/2016-04-00-Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters.md +++ b/content/zh/blog/_posts/2016-04-00-Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters.md @@ -2,14 +2,14 @@ title: " SIG-ClusterOps: 提升 Kubernetes 集群的可操作性和互操作性 " date: 2016-04-19 slug: sig-clusterops-promote-operability-and-interoperability-of-k8s-clusters -url: /blog/2016/04/Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters +url: /zh/blog/2016/04/Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters --- <!-- --- title: " SIG-ClusterOps: Promote operability and interoperability of Kubernetes clusters " date: 2016-04-19 slug: sig-clusterops-promote-operability-and-interoperability-of-k8s-clusters -url: /blog/2016/04/Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters +url: /zh/blog/2016/04/Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters --- --> <!-- diff --git a/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md b/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md index 891ac55431..4b3b83ebea 100644 --- a/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md +++ b/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md @@ -2,14 +2,14 @@ title: " CoreOS Fest 2016: CoreOS 和 Kubernetes 在柏林（和旧金山）社区见面会 " date: 2016-05-03 slug: coreosfest2016-kubernetes-community -url: /blog/2016/05/Coreosfest2016-Kubernetes-Community +url: /zh/blog/2016/05/Coreosfest2016-Kubernetes-Community --- <!-- --- title: " CoreOS Fest 2016: CoreOS and Kubernetes Community meet in Berlin (& San Francisco) " date: 2016-05-03 slug: coreosfest2016-kubernetes-community -url: /blog/2016/05/Coreosfest2016-Kubernetes-Community +url: /zh/blog/2016/05/Coreosfest2016-Kubernetes-Community --- --> <!-- diff --git a/content/zh/blog/_posts/2016-07-00-Bringing-End-To-End-Kubernetes-Testing-To-Azure-2.md b/content/zh/blog/_posts/2016-07-00-Bringing-End-To-End-Kubernetes-Testing-To-Azure-2.md index e69ce47c33..2231431ccb 100644 --- a/content/zh/blog/_posts/2016-07-00-Bringing-End-To-End-Kubernetes-Testing-To-Azure-2.md +++ b/content/zh/blog/_posts/2016-07-00-Bringing-End-To-End-Kubernetes-Testing-To-Azure-2.md @@ -2,14 +2,14 @@ 题目: " 将端到端的 Kubernetes 测试引入 Azure （第二部分） " 日期: 2016-07-18 slug: bringing-end-to-end-kubernetes-testing-to-azure-2 -url: /blog/2016/07/Bringing-End-To-End-Kubernetes-Testing-To-Azure-2 +url: /zh/blog/2016/07/Bringing-End-To-End-Kubernetes-Testing-To-Azure-2 --- <!-- --- title: " Bringing End-to-End Kubernetes Testing to Azure (Part 2) " date: 2016-07-18 slug: bringing-end-to-end-kubernetes-testing-to-azure-2 -url: /blog/2016/07/Bringing-End-To-End-Kubernetes-Testing-To-Azure-2 +url: /zh/blog/2016/07/Bringing-End-To-End-Kubernetes-Testing-To-Azure-2 --- --> diff --git a/content/zh/blog/_posts/2016-07-00-Citrix-Netscaler-And-Kubernetes.md b/content/zh/blog/_posts/2016-07-00-Citrix-Netscaler-And-Kubernetes.md index 45ab59e3af..caa0bee915 100644 --- a/content/zh/blog/_posts/2016-07-00-Citrix-Netscaler-And-Kubernetes.md +++ b/content/zh/blog/_posts/2016-07-00-Citrix-Netscaler-And-Kubernetes.md @@ -9,7 +9,7 @@ slug: citrix-netscaler-and-kubernetes title: " Citrix + Kubernetes = A Home Run " date: 2016-07-14 slug: citrix-netscaler-and-kubernetes -url: /blog/2016/07/Citrix-Netscaler-And-Kubernetes +url: /zh/blog/2016/07/Citrix-Netscaler-And-Kubernetes --- --> diff --git a/content/zh/blog/_posts/2016-07-00-Dashboard-Web-Interface-For-Kubernetes.md b/content/zh/blog/_posts/2016-07-00-Dashboard-Web-Interface-For-Kubernetes.md index dd0533def3..d92b18bcc2 100644 --- a/content/zh/blog/_posts/2016-07-00-Dashboard-Web-Interface-For-Kubernetes.md +++ b/content/zh/blog/_posts/2016-07-00-Dashboard-Web-Interface-For-Kubernetes.md @@ -9,7 +9,7 @@ slug: dashboard-web-interface-for-kubernetes title: " Dashboard - Full Featured Web Interface for Kubernetes " date: 2016-07-15 slug: dashboard-web-interface-for-kubernetes -url: /blog/2016/07/Dashboard-Web-Interface-For-Kubernetes +url: /zh/blog/2016/07/Dashboard-Web-Interface-For-Kubernetes --- --> diff --git a/content/zh/blog/_posts/2016-07-00-Oh-The-Places-You-Will-Go.md b/content/zh/blog/_posts/2016-07-00-Oh-The-Places-You-Will-Go.md index 791be64329..2b59df1500 100644 --- a/content/zh/blog/_posts/2016-07-00-Oh-The-Places-You-Will-Go.md +++ b/content/zh/blog/_posts/2016-07-00-Oh-The-Places-You-Will-Go.md @@ -9,7 +9,7 @@ slug: oh-the-places-you-will-go title: " Happy Birthday Kubernetes. Oh, the places you’ll go! " date: 2016-07-21 slug: oh-the-places-you-will-go -url: /blog/2016/07/Oh-The-Places-You-Will-Go +url: /zh/blog/2016/07/Oh-The-Places-You-Will-Go --- --> diff --git a/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md b/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md index 027a7c8701..1b425be77b 100644 --- a/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md +++ b/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md @@ -2,14 +2,14 @@ title: "容器中运行有状态的应用！？ Kubernetes 1.3 说 “是！” " date: 2016-07-13 slug: stateful-applications-in-containers-kubernetes -url: /blog/2016/07/stateful-applications-in-containers-kubernetes +url: /zh/blog/2016/07/stateful-applications-in-containers-kubernetes --- <!-- --- title: " Stateful Applications in Containers!? Kubernetes 1.3 Says “Yes!” " date: 2016-07-13 slug: stateful-applications-in-containers-kubernetes -url: /blog/2016/07/stateful-applications-in-containers-kubernetes +url: /zh/blog/2016/07/stateful-applications-in-containers-kubernetes --- --> diff --git a/content/zh/blog/_posts/2016-08-00-Stateful-Applications-Using-Kubernetes-Datera.md b/content/zh/blog/_posts/2016-08-00-Stateful-Applications-Using-Kubernetes-Datera.md index 8941ce5a54..682435db84 100644 --- a/content/zh/blog/_posts/2016-08-00-Stateful-Applications-Using-Kubernetes-Datera.md +++ b/content/zh/blog/_posts/2016-08-00-Stateful-Applications-Using-Kubernetes-Datera.md @@ -9,7 +9,7 @@ url: /zh/blog/2016/08/Stateful-Applications-Using-Kubernetes-Datera title: " Scaling Stateful Applications using Kubernetes Pet Sets and FlexVolumes with Datera Elastic Data Fabric " date: 2016-08-29 slug: stateful-applications-using-kubernetes-datera -url: /blog/2016/08/Stateful-Applications-Using-Kubernetes-Datera +url: /zh/blog/2016/08/Stateful-Applications-Using-Kubernetes-Datera --- ---> diff --git a/content/zh/blog/_posts/2017-10-00-Five-Days-Of-Kubernetes-18.md b/content/zh/blog/_posts/2017-10-00-Five-Days-Of-Kubernetes-18.md index eee16d7a49..64ff3b1b62 100644 --- a/content/zh/blog/_posts/2017-10-00-Five-Days-Of-Kubernetes-18.md +++ b/content/zh/blog/_posts/2017-10-00-Five-Days-Of-Kubernetes-18.md @@ -9,7 +9,7 @@ slug: five-days-of-kubernetes-18 title: " Five Days of Kubernetes 1.8 " date: 2017-10-24 slug: five-days-of-kubernetes-18 -url: /blog/2017/10/Five-Days-Of-Kubernetes-18 +url: /zh/blog/2017/10/Five-Days-Of-Kubernetes-18 --- --> diff --git a/content/zh/blog/_posts/2017-10-00-Kubernetes-Community-Steering-Committee-Election-Results.md b/content/zh/blog/_posts/2017-10-00-Kubernetes-Community-Steering-Committee-Election-Results.md index 0411d844fe..971f775d32 100644 --- a/content/zh/blog/_posts/2017-10-00-Kubernetes-Community-Steering-Committee-Election-Results.md +++ b/content/zh/blog/_posts/2017-10-00-Kubernetes-Community-Steering-Committee-Election-Results.md @@ -2,14 +2,14 @@ title: " Kubernetes 社区指导委员会选举结果 " date: 2017-10-05 slug: kubernetes-community-steering-committee-election-results -url: /blog/2017/10/Kubernetes-Community-Steering-Committee-Election-Results +url: /zh/blog/2017/10/Kubernetes-Community-Steering-Committee-Election-Results --- <!-- --- title: " Kubernetes Community Steering Committee Election Results " date: 2017-10-05 slug: kubernetes-community-steering-committee-election-results -url: /blog/2017/10/Kubernetes-Community-Steering-Committee-Election-Results +url: /zh/blog/2017/10/Kubernetes-Community-Steering-Committee-Election-Results --- --> <!-- diff --git a/content/zh/blog/_posts/2017-11-00-Autoscaling-In-Kubernetes.md b/content/zh/blog/_posts/2017-11-00-Autoscaling-In-Kubernetes.md index d598d30d83..cab6c2b331 100644 --- a/content/zh/blog/_posts/2017-11-00-Autoscaling-In-Kubernetes.md +++ b/content/zh/blog/_posts/2017-11-00-Autoscaling-In-Kubernetes.md @@ -9,7 +9,7 @@ slug: autoscaling-in-kubernetes title: " Autoscaling in Kubernetes " date: 2017-11-17 slug: autoscaling-in-kubernetes -url: /blog/2017/11/Autoscaling-In-Kubernetes +url: /zh/blog/2017/11/Autoscaling-In-Kubernetes --- --> diff --git a/content/zh/blog/_posts/2018-01-00-Kubernetes-V19-Beta-Windows-Support.md b/content/zh/blog/_posts/2018-01-00-Kubernetes-V19-Beta-Windows-Support.md index 3567bb17f2..d581584659 100644 --- a/content/zh/blog/_posts/2018-01-00-Kubernetes-V19-Beta-Windows-Support.md +++ b/content/zh/blog/_posts/2018-01-00-Kubernetes-V19-Beta-Windows-Support.md @@ -2,14 +2,14 @@ title: Kubernetes 1.9 对 Windows Server 容器提供 Beta 版本支持 date: 2018-01-09 slug: kubernetes-v19-beta-windows-support -url: /blog/2018/01/Kubernetes-V19-Beta-Windows-Support +url: /zh/blog/2018/01/Kubernetes-V19-Beta-Windows-Support --- <!-- --- title: Kubernetes v1.9 releases beta support for Windows Server Containers date: 2018-01-09 slug: kubernetes-v19-beta-windows-support -url: /blog/2018/01/Kubernetes-V19-Beta-Windows-Support +url: /zh/blog/2018/01/Kubernetes-V19-Beta-Windows-Support --- ---> diff --git a/content/zh/blog/_posts/2018-03-00-Principles-Of-Container-App-Design.md b/content/zh/blog/_posts/2018-03-00-Principles-Of-Container-App-Design.md index 779fa7111c..524fdb684c 100644 --- a/content/zh/blog/_posts/2018-03-00-Principles-Of-Container-App-Design.md +++ b/content/zh/blog/_posts/2018-03-00-Principles-Of-Container-App-Design.md @@ -9,7 +9,7 @@ url: /zh/blog/2018/03/Principles-Of-Container-App-Design title: "Principles of Container-based Application Design" date: 2018-03-15 slug: principles-of-container-app-design -url: /blog/2018/03/Principles-Of-Container-App-Design +url: /zh/blog/2018/03/Principles-Of-Container-App-Design --- --> From cc64e7cc981aafc693204b6e6f124ba036a837d2 Mon Sep 17 00:00:00 2001 From: mtardy <mahe5397@hotmail.fr> Date: Wed, 2 Mar 2022 20:14:14 +0100 Subject: [PATCH 069/104] Add a separate subpage for audit annotations and add reference to it on the main page --- .../_index.md} | 182 ++++++------------ .../audit-annotations.md | 59 ++++++ 2 files changed, 122 insertions(+), 119 deletions(-) rename content/en/docs/reference/{labels-annotations-taints.md => labels-annotations-taints/_index.md} (77%) create mode 100644 content/en/docs/reference/labels-annotations-taints/audit-annotations.md diff --git a/content/en/docs/reference/labels-annotations-taints.md b/content/en/docs/reference/labels-annotations-taints/_index.md similarity index 77% rename from content/en/docs/reference/labels-annotations-taints.md rename to content/en/docs/reference/labels-annotations-taints/_index.md index 18e599e12e..9d4b342ed6 100644 --- a/content/en/docs/reference/labels-annotations-taints.md +++ b/content/en/docs/reference/labels-annotations-taints/_index.md @@ -2,6 +2,7 @@ title: Well-Known Labels, Annotations and Taints content_type: concept weight: 20 +no_list: true --- <!-- overview --> @@ -10,11 +11,11 @@ Kubernetes reserves all labels and annotations in the kubernetes.io namespace. This document serves both as a reference to the values and as a coordination point for assigning values. - - <!-- body --> -## kubernetes.io/arch +## Labels, annotations and taints used on API objects + +### kubernetes.io/arch Example: `kubernetes.io/arch=amd64` @@ -22,7 +23,7 @@ Used on: Node The Kubelet populates this with `runtime.GOARCH` as defined by Go. This can be handy if you are mixing arm and x86 nodes. -## kubernetes.io/os +### kubernetes.io/os Example: `kubernetes.io/os=linux` @@ -30,7 +31,7 @@ Used on: Node The Kubelet populates this with `runtime.GOOS` as defined by Go. This can be handy if you are mixing operating systems in your cluster (for example: mixing Linux and Windows nodes). -## kubernetes.io/metadata.name +### kubernetes.io/metadata.name Example: `kubernetes.io/metadata.name=mynamespace` @@ -43,15 +44,15 @@ to the name of the namespace. You can't change this label's value. This is useful if you want to target a specific namespace with a label {{< glossary_tooltip text="selector" term_id="selector" >}}. -## beta.kubernetes.io/arch (deprecated) +### beta.kubernetes.io/arch (deprecated) This label has been deprecated. Please use `kubernetes.io/arch` instead. -## beta.kubernetes.io/os (deprecated) +### beta.kubernetes.io/os (deprecated) This label has been deprecated. Please use `kubernetes.io/os` instead. -## kubernetes.io/hostname {#kubernetesiohostname} +### kubernetes.io/hostname {#kubernetesiohostname} Example: `kubernetes.io/hostname=ip-172-20-114-199.ec2.internal` @@ -62,7 +63,7 @@ The Kubelet populates this label with the hostname. Note that the hostname can b This label is also used as part of the topology hierarchy. See [topology.kubernetes.io/zone](#topologykubernetesiozone) for more information. -## kubernetes.io/change-cause {#change-cause} +### kubernetes.io/change-cause {#change-cause} Example: `kubernetes.io/change-cause=kubectl edit --record deployment foo` @@ -72,7 +73,7 @@ This annotation is a best guess at why something was changed. It is populated when adding `--record` to a `kubectl` command that may change an object. -## kubernetes.io/description {#description} +### kubernetes.io/description {#description} Example: `kubernetes.io/description: "Description of K8s object."` @@ -80,7 +81,7 @@ Used on: All Objects This annotation is used for describing specific behaviour of given object. -## kubernetes.io/enforce-mountable-secrets {#enforce-mountable-secrets} +### kubernetes.io/enforce-mountable-secrets {#enforce-mountable-secrets} Example: `kubernetes.io/enforce-mountable-secrets: "true"` @@ -88,7 +89,7 @@ Used on: ServiceAccount The value for this annotation must be **true** to take effect. This annotation indicates that pods running as this service account may only reference Secret API objects specified in the service account's `secrets` field. -## controller.kubernetes.io/pod-deletion-cost {#pod-deletion-cost} +### controller.kubernetes.io/pod-deletion-cost {#pod-deletion-cost} Example: `controller.kubernetes.io/pod-deletion-cost=10` @@ -97,11 +98,11 @@ Used on: Pod This annotation is used to set [Pod Deletion Cost](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost) which allows users to influence ReplicaSet downscaling order. The annotation parses into an `int32` type. -## beta.kubernetes.io/instance-type (deprecated) +### beta.kubernetes.io/instance-type (deprecated) {{< note >}} Starting in v1.17, this label is deprecated in favor of [node.kubernetes.io/instance-type](#nodekubernetesioinstance-type). {{< /note >}} -## node.kubernetes.io/instance-type {#nodekubernetesioinstance-type} +### node.kubernetes.io/instance-type {#nodekubernetesioinstance-type} Example: `node.kubernetes.io/instance-type=m3.medium` @@ -112,19 +113,19 @@ This will be set only if you are using a `cloudprovider`. This setting is handy if you want to target certain workloads to certain instance types, but typically you want to rely on the Kubernetes scheduler to perform resource-based scheduling. You should aim to schedule based on properties rather than on instance types (for example: require a GPU, instead of requiring a `g2.2xlarge`). -## failure-domain.beta.kubernetes.io/region (deprecated) {#failure-domainbetakubernetesioregion} +### failure-domain.beta.kubernetes.io/region (deprecated) {#failure-domainbetakubernetesioregion} See [topology.kubernetes.io/region](#topologykubernetesioregion). {{< note >}} Starting in v1.17, this label is deprecated in favor of [topology.kubernetes.io/region](#topologykubernetesioregion). {{< /note >}} -## failure-domain.beta.kubernetes.io/zone (deprecated) {#failure-domainbetakubernetesiozone} +### failure-domain.beta.kubernetes.io/zone (deprecated) {#failure-domainbetakubernetesiozone} See [topology.kubernetes.io/zone](#topologykubernetesiozone). {{< note >}} Starting in v1.17, this label is deprecated in favor of [topology.kubernetes.io/zone](#topologykubernetesiozone). {{< /note >}} -## statefulset.kubernetes.io/pod-name {#statefulsetkubernetesiopod-name} +### statefulset.kubernetes.io/pod-name {#statefulsetkubernetesiopod-name} Example: @@ -136,7 +137,7 @@ sets this label on that Pod. The value of the label is the name of the Pod being See [Pod Name Label](/docs/concepts/workloads/controllers/statefulset/#pod-name-label) in the StatefulSet topic for more details. -## topology.kubernetes.io/region {#topologykubernetesioregion} +### topology.kubernetes.io/region {#topologykubernetesioregion} Example: @@ -144,7 +145,7 @@ Example: See [topology.kubernetes.io/zone](#topologykubernetesiozone). -## topology.kubernetes.io/zone {#topologykubernetesiozone} +### topology.kubernetes.io/zone {#topologykubernetesiozone} Example: @@ -175,7 +176,7 @@ The scheduler (through the _VolumeZonePredicate_ predicate) also will ensure tha If `PersistentVolumeLabel` does not support automatic labeling of your PersistentVolumes, you should consider adding the labels manually (or adding support for `PersistentVolumeLabel`). With `PersistentVolumeLabel`, the scheduler prevents Pods from mounting volumes in a different zone. If your infrastructure doesn't have this constraint, you don't need to add the zone labels to the volumes at all. -## volume.beta.kubernetes.io/storage-provisioner (deprecated) +### volume.beta.kubernetes.io/storage-provisioner (deprecated) Example: `volume.beta.kubernetes.io/storage-provisioner: k8s.io/minikube-hostpath` @@ -183,13 +184,13 @@ Used on: PersistentVolumeClaim This annotation has been deprecated. -## volume.kubernetes.io/storage-provisioner +### volume.kubernetes.io/storage-provisioner Used on: PersistentVolumeClaim This annotation will be added to dynamic provisioning required PVC. -## node.kubernetes.io/windows-build {#nodekubernetesiowindows-build} +### node.kubernetes.io/windows-build {#nodekubernetesiowindows-build} Example: `node.kubernetes.io/windows-build=10.0.17763` @@ -199,7 +200,7 @@ When the kubelet is running on Microsoft Windows, it automatically labels its no The label's value is in the format "MajorVersion.MinorVersion.BuildNumber". -## service.kubernetes.io/headless {#servicekubernetesioheadless} +### service.kubernetes.io/headless {#servicekubernetesioheadless} Example: `service.kubernetes.io/headless=""` @@ -207,7 +208,7 @@ Used on: Service The control plane adds this label to an Endpoints object when the owning Service is headless. -## kubernetes.io/service-name {#kubernetesioservice-name} +### kubernetes.io/service-name {#kubernetesioservice-name} Example: `kubernetes.io/service-name="nginx"` @@ -215,7 +216,7 @@ Used on: Service Kubernetes uses this label to differentiate multiple Services. Used currently for `ELB`(Elastic Load Balancer) only. -## endpointslice.kubernetes.io/managed-by {#endpointslicekubernetesiomanaged-by} +### endpointslice.kubernetes.io/managed-by {#endpointslicekubernetesiomanaged-by} Example: `endpointslice.kubernetes.io/managed-by="controller"` @@ -223,7 +224,7 @@ Used on: EndpointSlices The label is used to indicate the controller or entity that manages an EndpointSlice. This label aims to enable different EndpointSlice objects to be managed by different controllers or entities within the same cluster. -## endpointslice.kubernetes.io/skip-mirror {#endpointslicekubernetesioskip-mirror} +### endpointslice.kubernetes.io/skip-mirror {#endpointslicekubernetesioskip-mirror} Example: `endpointslice.kubernetes.io/skip-mirror="true"` @@ -231,7 +232,7 @@ Used on: Endpoints The label can be set to `"true"` on an Endpoints resource to indicate that the EndpointSliceMirroring controller should not mirror this resource with EndpointSlices. -## service.kubernetes.io/service-proxy-name {#servicekubernetesioservice-proxy-name} +### service.kubernetes.io/service-proxy-name {#servicekubernetesioservice-proxy-name} Example: `service.kubernetes.io/service-proxy-name="foo-bar"` @@ -239,7 +240,7 @@ Used on: Service The kube-proxy has this label for custom proxy, which delegates service control to custom proxy. -## experimental.windows.kubernetes.io/isolation-type (deprecated) {#experimental-windows-kubernetes-io-isolation-type} +### experimental.windows.kubernetes.io/isolation-type (deprecated) {#experimental-windows-kubernetes-io-isolation-type} Example: `experimental.windows.kubernetes.io/isolation-type: "hyperv"` @@ -252,7 +253,7 @@ You can only set this annotation on Pods that have a single container. Starting from v1.20, this annotation is deprecated. Experimental Hyper-V support was removed in 1.21. {{< /note >}} -## ingressclass.kubernetes.io/is-default-class +### ingressclass.kubernetes.io/is-default-class Example: `ingressclass.kubernetes.io/is-default-class: "true"` @@ -260,13 +261,13 @@ Used on: IngressClass When a single IngressClass resource has this annotation set to `"true"`, new Ingress resource without a class specified will be assigned this default class. -## kubernetes.io/ingress.class (deprecated) +### kubernetes.io/ingress.class (deprecated) {{< note >}} Starting in v1.18, this annotation is deprecated in favor of `spec.ingressClassName`. {{< /note >}} -## storageclass.kubernetes.io/is-default-class +### storageclass.kubernetes.io/is-default-class Example: `storageclass.kubernetes.io/is-default-class=true` @@ -275,7 +276,7 @@ Used on: StorageClass When a single StorageClass resource has this annotation set to `"true"`, new PersistentVolumeClaim resource without a class specified will be assigned this default class. -## alpha.kubernetes.io/provided-node-ip +### alpha.kubernetes.io/provided-node-ip Example: `alpha.kubernetes.io/provided-node-ip: "10.0.0.1"` @@ -285,7 +286,7 @@ The kubelet can set this annotation on a Node to denote its configured IPv4 addr When kubelet is started with the "external" cloud provider, it sets this annotation on the Node to denote an IP address set from the command line flag (`--node-ip`). This IP is verified with the cloud provider as valid by the cloud-controller-manager. -## batch.kubernetes.io/job-completion-index +### batch.kubernetes.io/job-completion-index Example: `batch.kubernetes.io/job-completion-index: "3"` @@ -294,13 +295,13 @@ Used on: Pod The Job controller in the kube-controller-manager sets this annotation for Pods created with Indexed [completion mode](/docs/concepts/workloads/controllers/job/#completion-mode). -## kubectl.kubernetes.io/default-container +### kubectl.kubernetes.io/default-container Example: `kubectl.kubernetes.io/default-container: "front-end-app"` The value of the annotation is the container name that is default for this Pod. For example, `kubectl logs` or `kubectl exec` without `-c` or `--container` flag will use this default container. -## endpoints.kubernetes.io/over-capacity +### endpoints.kubernetes.io/over-capacity Example: `endpoints.kubernetes.io/over-capacity:truncated` @@ -308,7 +309,7 @@ Used on: Endpoints In Kubernetes clusters v1.22 (or later), the Endpoints controller adds this annotation to an Endpoints resource if it has more than 1000 endpoints. The annotation indicates that the Endpoints resource is over capacity and the number of endpoints has been truncated to 1000. -## batch.kubernetes.io/job-tracking +### batch.kubernetes.io/job-tracking Example: `batch.kubernetes.io/job-tracking: ""` @@ -318,7 +319,7 @@ The presence of this annotation on a Job indicates that the control plane is [tracking the Job status using finalizers](/docs/concepts/workloads/controllers/job/#job-tracking-with-finalizers). You should **not** manually add or remove this annotation. -## scheduler.alpha.kubernetes.io/preferAvoidPods (deprecated) {#scheduleralphakubernetesio-preferavoidpods} +### scheduler.alpha.kubernetes.io/preferAvoidPods (deprecated) {#scheduleralphakubernetesio-preferavoidpods} Used on: Nodes @@ -328,61 +329,61 @@ Use [Taints and Tolerations](/docs/concepts/scheduling-eviction/taint-and-tolera **The taints listed below are always used on Nodes** -## node.kubernetes.io/not-ready +### node.kubernetes.io/not-ready Example: `node.kubernetes.io/not-ready:NoExecute` The node controller detects whether a node is ready by monitoring its health and adds or removes this taint accordingly. -## node.kubernetes.io/unreachable +### node.kubernetes.io/unreachable Example: `node.kubernetes.io/unreachable:NoExecute` The node controller adds the taint to a node corresponding to the [NodeCondition](/docs/concepts/architecture/nodes/#condition) `Ready` being `Unknown`. -## node.kubernetes.io/unschedulable +### node.kubernetes.io/unschedulable Example: `node.kubernetes.io/unschedulable:NoSchedule` The taint will be added to a node when initializing the node to avoid race condition. -## node.kubernetes.io/memory-pressure +### node.kubernetes.io/memory-pressure Example: `node.kubernetes.io/memory-pressure:NoSchedule` The kubelet detects memory pressure based on `memory.available` and `allocatableMemory.available` observed on a Node. The observed values are then compared to the corresponding thresholds that can be set on the kubelet to determine if the Node condition and taint should be added/removed. -## node.kubernetes.io/disk-pressure +### node.kubernetes.io/disk-pressure Example: `node.kubernetes.io/disk-pressure:NoSchedule` The kubelet detects disk pressure based on `imagefs.available`, `imagefs.inodesFree`, `nodefs.available` and `nodefs.inodesFree`(Linux only) observed on a Node. The observed values are then compared to the corresponding thresholds that can be set on the kubelet to determine if the Node condition and taint should be added/removed. -## node.kubernetes.io/network-unavailable +### node.kubernetes.io/network-unavailable Example: `node.kubernetes.io/network-unavailable:NoSchedule` This is initially set by the kubelet when the cloud provider used indicates a requirement for additional network configuration. Only when the route on the cloud is configured properly will the taint be removed by the cloud provider. -## node.kubernetes.io/pid-pressure +### node.kubernetes.io/pid-pressure Example: `node.kubernetes.io/pid-pressure:NoSchedule` The kubelet checks D-value of the size of `/proc/sys/kernel/pid_max` and the PIDs consumed by Kubernetes on a node to get the number of available PIDs that referred to as the `pid.available` metric. The metric is then compared to the corresponding threshold that can be set on the kubelet to determine if the node condition and taint should be added/removed. -## node.cloudprovider.kubernetes.io/uninitialized +### node.cloudprovider.kubernetes.io/uninitialized Example: `node.cloudprovider.kubernetes.io/uninitialized:NoSchedule` Sets this taint on a node to mark it as unusable, when kubelet is started with the "external" cloud provider, until a controller from the cloud-controller-manager initializes this node, and then removes the taint. -## node.cloudprovider.kubernetes.io/shutdown +### node.cloudprovider.kubernetes.io/shutdown Example: `node.cloudprovider.kubernetes.io/shutdown:NoSchedule` If a Node is in a cloud provider specified shutdown state, the Node gets tainted accordingly with `node.cloudprovider.kubernetes.io/shutdown` and the taint effect of `NoSchedule`. -## pod-security.kubernetes.io/enforce +### pod-security.kubernetes.io/enforce Example: `pod-security.kubernetes.io/enforce: baseline` @@ -396,7 +397,7 @@ the requirements outlined in the indicated level. See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/enforce-version +### pod-security.kubernetes.io/enforce-version Example: `pod-security.kubernetes.io/enforce-version: {{< skew latestVersion >}}` @@ -409,7 +410,7 @@ policies to apply when validating a submitted Pod. See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/audit +### pod-security.kubernetes.io/audit Example: `pod-security.kubernetes.io/audit: baseline` @@ -423,7 +424,7 @@ the requirements outlined in the indicated level, but adds an audit annotation t See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/audit-version +### pod-security.kubernetes.io/audit-version Example: `pod-security.kubernetes.io/audit-version: {{< skew latestVersion >}}` @@ -436,7 +437,7 @@ policies to apply when validating a submitted Pod. See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/warn +### pod-security.kubernetes.io/warn Example: `pod-security.kubernetes.io/warn: baseline` @@ -452,7 +453,7 @@ such as Deployments, Jobs, StatefulSets, etc. See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/warn-version +### pod-security.kubernetes.io/warn-version Example: `pod-security.kubernetes.io/warn-version: {{< skew latestVersion >}}` @@ -466,72 +467,7 @@ or updating objects that contain Pod templates, such as Deployments, Jobs, State See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/exempt - - -Example: `pod-security.kubernetes.io/exempt: namespace` - -Value **must** be one of `user`, `namespace`, or `runtimeClass` which correspond to -[Pod Security Exemption](/docs/concepts/security/pod-security-admission/#exemptions) -dimensions. This annotation indicates on which dimension was based the exemption -from the PodSecurity enforcement. - -{{< note >}} -This annotation is not used within the Kubernetes API. When you -[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, -audit event data is written using `Event` from API group `audit.k8s.io`. -The annotation applies to audit events. Audit events are different from objects in the -[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group -`events.k8s.io`). -{{< /note >}} - -## pod-security.kubernetes.io/enforce-policy - -Example: `pod-security.kubernetes.io/enforce-policy: restricted:latest` - -Value **must** be `privileged:<version>`, `baseline:<version>`, -`restricted:<version>` which correspond to [Pod Security -Standard](/docs/concepts/security/pod-security-standards) levels accompanied by -a version which **must** be `latest` or a valid Kubernetes version in the format -`v<MAJOR>.<MINOR>`. This annotations informs about the enforcement level that -allowed or denied the pod during PodSecurity admission. - -See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) -for more information. - -{{< note >}} -This annotation is not used within the Kubernetes API. When you -[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, -audit event data is written using `Event` from API group `audit.k8s.io`. -The annotation applies to audit events. Audit events are different from objects in the -[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group -`events.k8s.io`). -{{< /note >}} - -## pod-security.kubernetes.io/audit-violations - -Example: `pod-security.kubernetes.io/audit-violations: would violate -PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container -"example" must set securityContext.allowPrivilegeEscalation=false), ...` - -Value details an audit policy violation, it contains the -[Pod Security Standard](/docs/concepts/security/pod-security-standards/) level -that was transgressed as well as the specific policies on the fields that were -violated from the PodSecurity enforcement. - -See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) -for more information. - -{{< note >}} -This annotation is not used within the Kubernetes API. When you -[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, -audit event data is written using `Event` from API group `audit.k8s.io`. -The annotation applies to audit events. Audit events are different from objects in the -[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group -`events.k8s.io`). -{{< /note >}} - -## seccomp.security.alpha.kubernetes.io/pod (deprecated) {#seccomp-security-alpha-kubernetes-io-pod} +### seccomp.security.alpha.kubernetes.io/pod (deprecated) {#seccomp-security-alpha-kubernetes-io-pod} This annotation has been deprecated since Kubernetes v1.19 and will become non-functional in v1.25. To specify security settings for a Pod, include the `securityContext` field in the Pod specification. @@ -539,10 +475,18 @@ The [`securityContext`](/docs/reference/kubernetes-api/workload-resources/pod-v1 When you [specify the security context for a Pod](/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod), the settings you specify apply to all containers in that Pod. -## container.seccomp.security.alpha.kubernetes.io/[NAME] {#container-seccomp-security-alpha-kubernetes-io} +### container.seccomp.security.alpha.kubernetes.io/[NAME] {#container-seccomp-security-alpha-kubernetes-io} This annotation has been deprecated since Kubernetes v1.19 and will become non-functional in v1.25. The tutorial [Restrict a Container's Syscalls with seccomp](/docs/tutorials/clusters/seccomp/) takes you through the steps you follow to apply a seccomp profile to a Pod or to one of its containers. That tutorial covers the supported mechanism for configuring seccomp in Kubernetes, based on setting `securityContext` within the Pod's `.spec`. + +## Annotations used for audit + +- [`pod-security.kubernetes.io/exempt`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-exempt) +- [`pod-security.kubernetes.io/enforce-policy`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy) +- [`pod-security.kubernetes.io/audit-violations`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-audit-violations) + +See more details on the [Audit Annotations](/docs/reference/labels-annotations-taints/audit-annotations/) page. \ No newline at end of file diff --git a/content/en/docs/reference/labels-annotations-taints/audit-annotations.md b/content/en/docs/reference/labels-annotations-taints/audit-annotations.md new file mode 100644 index 0000000000..5dabbcbdb1 --- /dev/null +++ b/content/en/docs/reference/labels-annotations-taints/audit-annotations.md @@ -0,0 +1,59 @@ +--- +title: "Audit Annotations" +weight: 1 +--- + +<!-- overview --> + +This page serves as a reference for the audit annotations of the kubernetes.io +namespace. These annotations apply to `Event` object from API group +`audit.k8s.io`. + +{{< note >}} +The following annotations are not used within the Kubernetes API. When you +[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, +audit event data is written using `Event` from API group `audit.k8s.io`. +The annotations apply to audit events. Audit events are different from objects in the +[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group +`events.k8s.io`). +{{< /note >}} + +<!-- body --> + +## pod-security.kubernetes.io/exempt + +Example: `pod-security.kubernetes.io/exempt: namespace` + +Value **must** be one of `user`, `namespace`, or `runtimeClass` which correspond to +[Pod Security Exemption](/docs/concepts/security/pod-security-admission/#exemptions) +dimensions. This annotation indicates on which dimension was based the exemption +from the PodSecurity enforcement. + + +## pod-security.kubernetes.io/enforce-policy + +Example: `pod-security.kubernetes.io/enforce-policy: restricted:latest` + +Value **must** be `privileged:<version>`, `baseline:<version>`, +`restricted:<version>` which correspond to [Pod Security +Standard](/docs/concepts/security/pod-security-standards) levels accompanied by +a version which **must** be `latest` or a valid Kubernetes version in the format +`v<MAJOR>.<MINOR>`. This annotations informs about the enforcement level that +allowed or denied the pod during PodSecurity admission. + +See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) +for more information. + +## pod-security.kubernetes.io/audit-violations + +Example: `pod-security.kubernetes.io/audit-violations: would violate +PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container +"example" must set securityContext.allowPrivilegeEscalation=false), ...` + +Value details an audit policy violation, it contains the +[Pod Security Standard](/docs/concepts/security/pod-security-standards/) level +that was transgressed as well as the specific policies on the fields that were +violated from the PodSecurity enforcement. + +See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) +for more information. \ No newline at end of file From 8ca3492e515dd69cd3716a653bb91523a0665b0e Mon Sep 17 00:00:00 2001 From: Chris Negus <striker57@gmail.com> Date: Wed, 2 Mar 2022 21:48:48 -0500 Subject: [PATCH 070/104] Moved blog guidance from SIG page to docs (#31920) * Moved blog guidance from SIG page to docs * Fixed text from review comments --- .../new-content/blogs-case-studies.md | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/content/en/docs/contribute/new-content/blogs-case-studies.md b/content/en/docs/contribute/new-content/blogs-case-studies.md index 2b0d9f0cdd..83b950105c 100644 --- a/content/en/docs/contribute/new-content/blogs-case-studies.md +++ b/content/en/docs/contribute/new-content/blogs-case-studies.md @@ -22,6 +22,34 @@ Most of the blog's content is about things happening in the core project, but we Anyone can write a blog post and submit it for review. +### Submit a Post + +Blog posts should not be commercial in nature and should consist of original content that applies broadly to the Kubernetes community. +Appropriate blog content includes: + +- New Kubernetes capabilities +- Kubernetes projects updates +- Updates from Special Interest Groups +- Tutorials and walkthroughs +- Thought leadership around Kubernetes +- Kubernetes Partner OSS integration +- **Original content only** + +Unsuitable content includes: + +- Vendor product pitches +- Partner updates without an integration and customer story +- Syndicated posts (language translations ok) + +To submit a blog post, follow these steps: + +1. [Sign the CLA](https://kubernetes.io/docs/contribute/start/#sign-the-cla) if you have not yet done so. +1. Have a look at the Markdown format for existing blog posts in the [website repository](https://github.com/kubernetes/website/tree/master/content/en/blog/_posts). +1. Write out your blog post in a text editor of your choice. +1. On the same link from step 2, click the Create new file button. Paste your content into the editor. Name the file to match the proposed title of the blog post, but don’t put the date in the file name. The blog reviewers will work with you on the final file name and the date the blog will be published. +1. When you save the file, GitHub will walk you through the pull request process. +1. A blog post reviewer will review your submission and work with you on feedback and final details. When the blog post is approved, the blog will be scheduled for publication. + ### Guidelines and expectations - Blog posts should not be vendor pitches. From 11c068d6acea20e0766b65a2953ccc7a96063c6f Mon Sep 17 00:00:00 2001 From: FOWind <fzq96417@163.com> Date: Thu, 3 Mar 2022 03:06:37 +0000 Subject: [PATCH 071/104] (fix: antrea-network-policy) fix display error --- .../network-policy-provider/antrea-network-policy.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/network-policy-provider/antrea-network-policy.md b/content/zh/docs/tasks/administer-cluster/network-policy-provider/antrea-network-policy.md index d8dbecfcce..b6a296aa71 100644 --- a/content/zh/docs/tasks/administer-cluster/network-policy-provider/antrea-network-policy.md +++ b/content/zh/docs/tasks/administer-cluster/network-policy-provider/antrea-network-policy.md @@ -1,3 +1,8 @@ +--- +title: 使用 Antrea 提供 NetworkPolicy +content_type: task +weight: 10 +--- <!-- --- title: Use Antrea for NetworkPolicy @@ -5,11 +10,6 @@ content_type: task weight: 10 --- --> ---- -title: 使用 Antrea 提供 NetworkPolicy -content_type: task -weight: 10 ---- <!-- overview --> <!-- From 7055c9565723b24496879046fa28c58d120d5d8c Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Thu, 3 Mar 2022 11:07:51 +0800 Subject: [PATCH 072/104] [zh] Tweak some translations on the Quota API page --- .../zh/docs/tasks/administer-cluster/quota-api-object.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/quota-api-object.md b/content/zh/docs/tasks/administer-cluster/quota-api-object.md index f868d3bc5f..f1b5050523 100644 --- a/content/zh/docs/tasks/administer-cluster/quota-api-object.md +++ b/content/zh/docs/tasks/administer-cluster/quota-api-object.md @@ -172,7 +172,7 @@ by quotas: 下面这些字符串可被用来标识那些能被配额限制的 API 资源： <table> -<tr><th>String</th><th>API Object</th></tr> +<tr><th>字符串</th><th>API 对象</th></tr> <tr><td>"pods"</td><td>Pod</td></tr> <tr><td>"services"</td><td>Service</td></tr> <tr><td>"replicationcontrollers"</td><td>ReplicationController</td></tr> @@ -180,8 +180,8 @@ by quotas: <tr><td>"secrets"</td><td>Secret</td></tr> <tr><td>"configmaps"</td><td>ConfigMap</td></tr> <tr><td>"persistentvolumeclaims"</td><td>PersistentVolumeClaim</td></tr> -<tr><td>"services.nodeports"</td><td>Service of type NodePort</td></tr> -<tr><td>"services.loadbalancers"</td><td>Service of type LoadBalancer</td></tr> +<tr><td>"services.nodeports"</td><td>NodePort 类型的 Service</td></tr> +<tr><td>"services.loadbalancers"</td><td>LoadBalancer 类型的 Service</td></tr> </table> <!-- From bf6709241e34cd5dec50c896e76992053bbd4ca1 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Thu, 3 Mar 2022 14:15:10 +0800 Subject: [PATCH 073/104] [zh] Fix some nits in the volume health page --- .../storage/volume-health-monitoring.md | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/content/zh/docs/concepts/storage/volume-health-monitoring.md b/content/zh/docs/concepts/storage/volume-health-monitoring.md index 4684d4353f..1caadf0fb2 100644 --- a/content/zh/docs/concepts/storage/volume-health-monitoring.md +++ b/content/zh/docs/concepts/storage/volume-health-monitoring.md @@ -3,7 +3,6 @@ title: 卷健康监测 content_type: concept --- <!-- ---- reviewers: - jsafrane - saad-ali @@ -11,7 +10,6 @@ reviewers: - xing-yang title: Volume Health Monitoring content_type: concept ---- --> <!-- overview --> @@ -21,7 +19,9 @@ content_type: concept <!-- {{< glossary_tooltip text="CSI" term_id="csi" >}} volume health monitoring allows CSI Drivers to detect abnormal volume conditions from the underlying storage systems and report them as events on {{< glossary_tooltip text="PVCs" term_id="persistent-volume-claim" >}} or {{< glossary_tooltip text="Pods" term_id="pod" >}}. --> -{{< glossary_tooltip text="CSI" term_id="csi" >}} 卷健康监测支持 CSI 驱动从底层的存储系统着手，探测异常的卷状态，并以事件的形式上报到 {{< glossary_tooltip text="PVCs" term_id="persistent-volume-claim" >}} 或 {{< glossary_tooltip text="Pods" term_id="pod" >}}. +{{< glossary_tooltip text="CSI" term_id="csi" >}} 卷健康监测支持 CSI 驱动从底层的存储系统着手， +探测异常的卷状态，并以事件的形式上报到 {{< glossary_tooltip text="PVCs" term_id="persistent-volume-claim" >}} +或 {{< glossary_tooltip text="Pods" term_id="pod" >}}. <!-- body --> @@ -42,24 +42,26 @@ Kubernetes _卷健康监测_ 是 Kubernetes 容器存储接口（CSI）实现的 {{< glossary_tooltip text="PersistentVolumeClaim" term_id="persistent-volume-claim" >}} (PVC) 中上报一个事件。 -<!-- The External Health Monitor {{< glossary_tooltip text="controller" term_id="controller" >}} also watches for node failure events. You can enable node failure monitoring by setting the `enable-node-watcher` flag to true. When the external health monitor detects a node failure event, the controller reports an Event will be reported on the PVC to indicate that pods using this PVC are on a failed node. +<!-- +The External Health Monitor {{< glossary_tooltip text="controller" term_id="controller" >}} also watches for node failure events. You can enable node failure monitoring by setting the `enable-node-watcher` flag to true. When the external health monitor detects a node failure event, the controller reports an Event will be reported on the PVC to indicate that pods using this PVC are on a failed node. If a CSI Driver supports Volume Health Monitoring feature from the node side, an Event will be reported on every Pod using the PVC when an abnormal volume condition is detected on a CSI volume. --> -外部健康监测 {{< glossary_tooltip text="控制器" term_id="controller" >}} 也会监测节点失效事件。 +外部健康监测{{< glossary_tooltip text="控制器" term_id="controller" >}}也会监测节点失效事件。 如果要启动节点失效监测功能，你可以设置标志 `enable-node-watcher` 为 `true`。 -当外部健康监测器检测到一个节点失效事件，控制器会报送一个事件，该事件会在 PVC 上继续上报， +当外部健康监测器检测到节点失效事件，控制器会报送一个事件，该事件会在 PVC 上继续上报， 以表明使用此 PVC 的 Pod 正位于一个失效的节点上。 -如果 CSI 驱动程序支持节点测的卷健康检测，那当在 CSI 卷上检测到异常卷时，会在使用该 PVC 的每个Pod 上触发一个事件。 +如果 CSI 驱动程序支持节点测的卷健康检测，那当在 CSI 卷上检测到异常卷时， +会在使用该 PVC 的每个Pod 上触发一个事件。 <!-- You need to enable the `CSIVolumeHealth` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) to use this feature from the node side. --> {{< note >}} -你需要启用 -`CSIVolumeHealth` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/) -，才能从节点测使用此特性。 +你需要启用 `CSIVolumeHealth` +[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)， +才能在节点上使用此特性。 {{< /note >}} ## {{% heading "whatsnext" %}} @@ -68,4 +70,5 @@ You need to enable the `CSIVolumeHealth` [feature gate](/docs/reference/command- See the [CSI driver documentation](https://kubernetes-csi.github.io/docs/drivers.html) to find out which CSI drivers have implemented this feature. --> 参阅 [CSI 驱动程序文档](https://kubernetes-csi.github.io/docs/drivers.html)， -可以找出有那些 CSI 驱动程序已实现了此特性。 \ No newline at end of file +可以找出有哪些 CSI 驱动程序实现了此特性。 + From 95dd95982f5f6f6e4643fe3d09e65a9ecd75a824 Mon Sep 17 00:00:00 2001 From: cpanato <ctadeu@gmail.com> Date: Thu, 3 Mar 2022 10:18:12 +0100 Subject: [PATCH 074/104] update patch release for march cycle and remove 1.20 release due to eol Signed-off-by: cpanato <ctadeu@gmail.com> --- content/en/releases/patch-releases.md | 32 ++--------- data/releases/schedule.yaml | 82 ++++++--------------------- 2 files changed, 23 insertions(+), 91 deletions(-) diff --git a/content/en/releases/patch-releases.md b/content/en/releases/patch-releases.md index 72c0e9e300..e956012593 100644 --- a/content/en/releases/patch-releases.md +++ b/content/en/releases/patch-releases.md @@ -78,10 +78,10 @@ releases may also occur in between these. | Monthly Patch Release | Cherry Pick Deadline | Target date | | --------------------- | -------------------- | ----------- | -| February 2022 | 2022-02-11 | 2022-02-16 | | March 2022 | 2022-03-11 | 2022-03-16 | | April 2022 | 2022-04-08 | 2022-04-13 | | May 2022 | 2022-05-13 | 2022-05-18 | +| June 2022 | 2022-06-10 | 2022-06-15 | ## Detailed Release History for Active Branches @@ -93,6 +93,7 @@ End of Life for **1.23** is **2023-02-28**. | Patch Release | Cherry Pick Deadline | Target Date | Note | |---------------|----------------------|-------------|------| +| 1.23.5 | 2022-03-11 | 2022-03-16 | | | 1.23.4 | 2022-02-11 | 2022-02-16 | | | 1.23.3 | 2022-01-24 | 2022-01-25 | [Out-of-Band Release](https://groups.google.com/u/2/a/kubernetes.io/g/dev/c/Xl1sm-CItaY) | | 1.23.2 | 2022-01-14 | 2022-01-19 | | @@ -106,6 +107,7 @@ End of Life for **1.22** is **2022-10-28** | Patch Release | Cherry Pick Deadline | Target Date | Note | |---------------|----------------------|-------------|------| +| 1.22.8 | 2022-03-11 | 2022-03-16 | | | 1.22.7 | 2022-02-11 | 2022-02-16 | | | 1.22.6 | 2022-01-14 | 2022-01-19 | | | 1.22.5 | 2021-12-10 | 2021-12-15 | | @@ -122,6 +124,7 @@ End of Life for **1.21** is **2022-06-28** | Patch Release | Cherry Pick Deadline | Target Date | Note | | ------------- | -------------------- | ----------- | ---------------------------------------------------------------------- | +| 1.21.11 | 2022-03-11 | 2022-03-16 | | | 1.21.10 | 2022-02-11 | 2022-02-16 | | | 1.21.9 | 2022-01-14 | 2022-01-19 | | | 1.21.8 | 2021-12-10 | 2021-12-15 | | @@ -133,38 +136,13 @@ End of Life for **1.21** is **2022-06-28** | 1.21.2 | 2021-06-12 | 2021-06-16 | | | 1.21.1 | 2021-05-07 | 2021-05-12 | [Regression](https://groups.google.com/g/kubernetes-dev/c/KuF8s2zueFs) | -### 1.20 - -**1.20** enters maintenance mode on **2021-12-28** - -End of Life for **1.20** is **2022-02-28** - -| Patch Release | Cherry Pick Deadline | Target Date | Note | -| ------------- | -------------------- | ----------- | ----------------------------------------------------------------------------------- | -| 1.20.16 | 2022-02-11 | 2022-02-16 | If there is critical/blocker patches to be released | -| 1.20.15 | 2022-01-14 | 2022-01-19 | | -| 1.20.14 | 2021-12-10 | 2021-12-15 | | -| 1.20.13 | 2021-11-12 | 2021-11-17 | | -| 1.20.12 | 2021-10-22 | 2021-10-27 | | -| 1.20.11 | 2021-09-10 | 2021-09-15 | | -| 1.20.10 | 2021-08-07 | 2021-08-11 | | -| 1.20.9 | 2021-07-10 | 2021-07-14 | | -| 1.20.8 | 2021-06-12 | 2021-06-16 | | -| 1.20.7 | 2021-05-07 | 2021-05-12 | [Regression](https://groups.google.com/g/kubernetes-dev/c/KuF8s2zueFs) | -| 1.20.6 | 2021-04-09 | 2021-04-14 | | -| 1.20.5 | 2021-03-12 | 2021-03-17 | | -| 1.20.4 | 2021-02-12 | 2021-02-18 | | -| 1.20.3 | 2021-02-12 | 2021-02-17 | [Conformance Tests Issue](https://groups.google.com/g/kubernetes-dev/c/oUpY9vWgzJo) | -| 1.20.2 | 2021-01-08 | 2021-01-13 | | -| 1.20.1 | 2020-12-11 | 2020-12-18 | [Tagging Issue](https://groups.google.com/g/kubernetes-dev/c/dNH2yknlCBA) | - - ## Non-Active Branch History These releases are no longer supported. | Minor Version | Final Patch Release | EOL Date | Note | | ------------- | ------------------- | ---------- | ---------------------------------------------------------------------- | +| 1.20 | 1.20.15 | 2022-02-28 | | | 1.19 | 1.19.16 | 2021-10-28 | | | 1.18 | 1.18.20 | 2021-06-18 | Created to resolve regression introduced in 1.18.19 | | 1.18 | 1.18.19 | 2021-05-12 | [Regression](https://groups.google.com/g/kubernetes-dev/c/KuF8s2zueFs) | diff --git a/data/releases/schedule.yaml b/data/releases/schedule.yaml index e6649c5b0d..94f3d0d821 100644 --- a/data/releases/schedule.yaml +++ b/data/releases/schedule.yaml @@ -1,11 +1,14 @@ schedules: - release: 1.23 releaseDate: 2021-12-07 - next: 1.23.4 - cherryPickDeadline: 2022-02-11 - targetDate: 2022-02-16 + next: 1.23.5 + cherryPickDeadline: 2022-03-11 + targetDate: 2022-03-16 endOfLifeDate: 2023-02-28 previousPatches: + - release: 1.23.4 + cherryPickDeadline: 2022-02-11 + targetDate: 2022-02-16 - release: 1.23.3 cherryPickDeadLine: 2022-01-24 targetDate: 2022-01-25 @@ -18,11 +21,14 @@ schedules: targetDate: 2021-12-16 - release: 1.22 releaseDate: 2021-08-04 - next: 1.22.7 - cherryPickDeadline: 2022-02-11 - targetDate: 2022-02-16 + next: 1.22.8 + cherryPickDeadline: 2022-03-11 + targetDate: 2022-03-16 endOfLifeDate: 2022-10-28 previousPatches: + - release: 1.22.7 + cherryPickDeadline: 2022-02-11 + targetDate: 2022-02-16 - release: 1.22.6 cherryPickDeadline: 2022-01-14 targetDate: 2022-01-19 @@ -43,11 +49,14 @@ schedules: targetDate: 2021-08-19 - release: 1.21 releaseDate: 2021-04-08 - next: 1.21.10 - cherryPickDeadline: 2022-02-11 - targetDate: 2022-02-16 + next: 1.21.11 + cherryPickDeadline: 2022-03-11 + targetDate: 2022-03-16 endOfLifeDate: 2022-06-28 previousPatches: + - release: 1.21.10 + cherryPickDeadline: 2022-02-11 + targetDate: 2022-02-16 - release: 1.21.9 cherryPickDeadline: 2022-01-14 targetDate: 2022-01-19 @@ -76,58 +85,3 @@ schedules: cherryPickDeadline: 2021-05-07 targetDate: 2021-05-12 note: Regression https://groups.google.com/g/kubernetes-dev/c/KuF8s2zueFs -- release: 1.20 - releaseDate: 2020-12-08 - next: 1.20.16 - cherryPickDeadline: 2022-02-11 - targetDate: 2022-02-16 - endOfLifeDate: 2022-02-28 - previousPatches: - - release: 1.20.15 - cherryPickDeadline: 2022-01-14 - targetDate: 2022-01-19 - - release: 1.20.14 - cherryPickDeadline: 2021-12-10 - targetDate: 2021-12-15 - - release: 1.20.13 - cherryPickDeadline: 2021-11-12 - targetDate: 2021-11-17 - - release: 1.20.12 - cherryPickDeadline: 2021-10-22 - targetDate: 2021-10-27 - - release: 1.20.11 - cherryPickDeadline: 2021-09-10 - targetDate: 2021-09-15 - - release: 1.20.10 - cherryPickDeadline: 2021-08-07 - targetDate: 2021-08-11 - - release: 1.20.9 - cherryPickDeadline: 2021-07-10 - targetDate: 2021-07-14 - - release: 1.20.8 - cherryPickDeadline: 2021-06-12 - targetDate: 2021-06-16 - - release: 1.20.7 - cherryPickDeadline: 2021-05-07 - targetDate: 2021-05-12 - note: Regression https://groups.google.com/g/kubernetes-dev/c/KuF8s2zueFs - - release: 1.20.6 - cherryPickDeadline: 2021-04-09 - targetDate: 2021-04-14 - - release: 1.20.5 - cherryPickDeadline: 2021-03-12 - targetDate: 2021-03-17 - - release: 1.20.4 - cherryPickDeadline: 2021-02-12 - targetDate: 2021-02-18 - - release: 1.20.3 - cherryPickDeadline: 2021-02-12 - targetDate: 2021-02-17 - note: "Conformance Tests Issue https://groups.google.com/g/kubernetes-dev/c/oUpY9vWgzJo" - - release: 1.20.2 - cherryPickDeadline: 2021-01-08 - targetDate: 2021-01-13 - - release: 1.20.1 - cherryPickDeadline: 2020-12-11 - targetDate: 2020-12-18 - note: "Tagging Issue https://groups.google.com/g/kubernetes-dev/c/dNH2yknlCBA" From 0823b3ead112ac0cb92e34b3e2b4be1e20251fa3 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Thu, 3 Mar 2022 17:25:50 +0800 Subject: [PATCH 075/104] [zh] Fix shceduling-eviction index The `no_list: true` directive is important. We should not remove it when translating an index page. --- content/zh/docs/concepts/scheduling-eviction/_index.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/zh/docs/concepts/scheduling-eviction/_index.md b/content/zh/docs/concepts/scheduling-eviction/_index.md index 01265f3a05..1b517ba79a 100644 --- a/content/zh/docs/concepts/scheduling-eviction/_index.md +++ b/content/zh/docs/concepts/scheduling-eviction/_index.md @@ -6,10 +6,10 @@ description: > 在Kubernetes中，调度 (scheduling) 指的是确保 Pods 匹配到合适的节点， 以便 kubelet 能够运行它们。抢占 (Preemption) 指的是终止低优先级的 Pods 以便高优先级的 Pods 可以 调度运行的过程。驱逐 (Eviction) 是在资源匮乏的节点上，主动让一个或多个 Pods 失效的过程。 +no_list: true --- <!-- ---- title: "Scheduling, Preemption and Eviction" weight: 90 content_type: concept @@ -20,7 +20,6 @@ description: > Nodes. Eviction is the process of proactively terminating one or more Pods on resource-starved Nodes. no_list: true ---- --> <!-- From 73cd38cdc6765f8a4dcde27fd7623f3cadbea494 Mon Sep 17 00:00:00 2001 From: Tim Bannister <tim@scalefactory.com> Date: Tue, 28 Sep 2021 15:43:38 +0100 Subject: [PATCH 076/104] Move kubectl overview to be section index Also: - use glossary definition in page introduction - tidy broken link in What's Next section - update links to refer to moved page --- .../manage-deployment.md | 2 +- .../api-extension/custom-resources.md | 2 +- .../docs/concepts/overview/kubernetes-api.md | 2 +- content/en/docs/reference/_index.md | 2 +- content/en/docs/reference/glossary/kubectl.md | 11 +- content/en/docs/reference/kubectl/_index.md | 547 ++++++++++++++++- .../en/docs/reference/kubectl/cheatsheet.md | 4 +- content/en/docs/reference/kubectl/overview.md | 548 ------------------ .../production-environment/tools/kops.md | 2 +- .../tools/kubeadm/create-cluster-kubeadm.md | 2 +- .../windows/user-guide-windows-containers.md | 2 +- .../access-cluster.md | 4 +- .../administer-cluster/access-cluster-api.md | 2 +- .../troubleshooting.md | 2 +- .../custom-resource-definitions.md | 2 +- content/en/docs/tutorials/hello-minikube.md | 2 +- static/_redirects | 3 +- 17 files changed, 570 insertions(+), 569 deletions(-) delete mode 100644 content/en/docs/reference/kubectl/overview.md diff --git a/content/en/docs/concepts/cluster-administration/manage-deployment.md b/content/en/docs/concepts/cluster-administration/manage-deployment.md index 4d98cf820c..c09e59f1df 100644 --- a/content/en/docs/concepts/cluster-administration/manage-deployment.md +++ b/content/en/docs/concepts/cluster-administration/manage-deployment.md @@ -154,7 +154,7 @@ deployment.apps/my-deployment created persistentvolumeclaim/my-pvc created ``` -If you're interested in learning more about `kubectl`, go ahead and read [kubectl Overview](/docs/reference/kubectl/overview/). +If you're interested in learning more about `kubectl`, go ahead and read [Command line tool (kubectl)](/docs/reference/kubectl/). ## Using labels effectively diff --git a/content/en/docs/concepts/extend-kubernetes/api-extension/custom-resources.md b/content/en/docs/concepts/extend-kubernetes/api-extension/custom-resources.md index 365590e657..258014a432 100644 --- a/content/en/docs/concepts/extend-kubernetes/api-extension/custom-resources.md +++ b/content/en/docs/concepts/extend-kubernetes/api-extension/custom-resources.md @@ -26,7 +26,7 @@ many core Kubernetes functions are now built using custom resources, making Kube Custom resources can appear and disappear in a running cluster through dynamic registration, and cluster admins can update custom resources independently of the cluster itself. Once a custom resource is installed, users can create and access its objects using -[kubectl](/docs/reference/kubectl/overview/), just as they do for built-in resources like +[kubectl](/docs/reference/kubectl/), just as they do for built-in resources like *Pods*. ## Custom controllers diff --git a/content/en/docs/concepts/overview/kubernetes-api.md b/content/en/docs/concepts/overview/kubernetes-api.md index e1ddda4267..ed873bf352 100644 --- a/content/en/docs/concepts/overview/kubernetes-api.md +++ b/content/en/docs/concepts/overview/kubernetes-api.md @@ -23,7 +23,7 @@ The Kubernetes API lets you query and manipulate the state of API objects in Kub (for example: Pods, Namespaces, ConfigMaps, and Events). Most operations can be performed through the -[kubectl](/docs/reference/kubectl/overview/) command-line interface or other +[kubectl](/docs/reference/kubectl/) command-line interface or other command-line tools, such as [kubeadm](/docs/reference/setup-tools/kubeadm/), which in turn use the API. However, you can also access the API directly using REST calls. diff --git a/content/en/docs/reference/_index.md b/content/en/docs/reference/_index.md index 021d2f840d..c41d20bdbb 100644 --- a/content/en/docs/reference/_index.md +++ b/content/en/docs/reference/_index.md @@ -43,7 +43,7 @@ client libraries: ## CLI -* [kubectl](/docs/reference/kubectl/overview/) - Main CLI tool for running commands and managing Kubernetes clusters. +* [kubectl](/docs/reference/kubectl/) - Main CLI tool for running commands and managing Kubernetes clusters. * [JSONPath](/docs/reference/kubectl/jsonpath/) - Syntax guide for using [JSONPath expressions](https://goessner.net/articles/JsonPath/) with kubectl. * [kubeadm](/docs/reference/setup-tools/kubeadm/) - CLI tool to easily provision a secure Kubernetes cluster. diff --git a/content/en/docs/reference/glossary/kubectl.md b/content/en/docs/reference/glossary/kubectl.md index 665fffcf98..61f93b9cf6 100644 --- a/content/en/docs/reference/glossary/kubectl.md +++ b/content/en/docs/reference/glossary/kubectl.md @@ -4,16 +4,19 @@ id: kubectl date: 2018-04-12 full_link: /docs/user-guide/kubectl-overview/ short_description: > - A command line tool for communicating with a Kubernetes API server. + A command line tool for communicating with a Kubernetes cluster. -aka: +aka: +- kubectl tags: - tool - fundamental --- - A command line tool for communicating with a {{< glossary_tooltip text="Kubernetes API" term_id="kubernetes-api" >}} server. +Command line tool for communicating with a Kubernetes cluster's +{{< glossary_tooltip text="control plane" term_id="control-plane" >}}, +using the Kubernetes API. <!--more--> -You can use kubectl to create, inspect, update, and delete Kubernetes objects. +You can use `kubectl` to create, inspect, update, and delete Kubernetes objects. diff --git a/content/en/docs/reference/kubectl/_index.md b/content/en/docs/reference/kubectl/_index.md index 765adb6fe8..ba53c66598 100644 --- a/content/en/docs/reference/kubectl/_index.md +++ b/content/en/docs/reference/kubectl/_index.md @@ -1,5 +1,550 @@ --- -title: "kubectl" +title: Command line tool (kubectl) +content_type: reference weight: 60 +card: + name: reference + weight: 20 --- +<!-- overview --> +{{< glossary_definition prepend="Kubernetes provides a" term_id="kubectl" length="short" >}} + +This tool is named `kubectl`. + +For configuration, `kubectl` looks for a file named `config` in the `$HOME/.kube` directory. +You can specify other [kubeconfig](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) +files by setting the `KUBECONFIG` environment variable or by setting the +[`--kubeconfig`](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) flag. + +This overview covers `kubectl` syntax, describes the command operations, and provides common examples. +For details about each command, including all the supported flags and subcommands, see the +[kubectl](/docs/reference/generated/kubectl/kubectl-commands/) reference documentation. + +For installation instructions, see [Installing kubectl](/docs/tasks/tools/#kubectl). + +<!-- body --> + +## Syntax + +Use the following syntax to run `kubectl` commands from your terminal window: + +```shell +kubectl [command] [TYPE] [NAME] [flags] +``` + +where `command`, `TYPE`, `NAME`, and `flags` are: + +* `command`: Specifies the operation that you want to perform on one or more resources, +for example `create`, `get`, `describe`, `delete`. + +* `TYPE`: Specifies the [resource type](#resource-types). Resource types are case-insensitive and + you can specify the singular, plural, or abbreviated forms. + For example, the following commands produce the same output: + + ```shell + kubectl get pod pod1 + kubectl get pods pod1 + kubectl get po pod1 + ``` + +* `NAME`: Specifies the name of the resource. Names are case-sensitive. If the name is omitted, details for all resources are displayed, for example `kubectl get pods`. + + When performing an operation on multiple resources, you can specify each resource by type and name or specify one or more files: + + * To specify resources by type and name: + + * To group resources if they are all the same type: `TYPE1 name1 name2 name<#>`.<br/> + Example: `kubectl get pod example-pod1 example-pod2` + + * To specify multiple resource types individually: `TYPE1/name1 TYPE1/name2 TYPE2/name3 TYPE<#>/name<#>`.<br/> + Example: `kubectl get pod/example-pod1 replicationcontroller/example-rc1` + + * To specify resources with one or more files: `-f file1 -f file2 -f file<#>` + + * [Use YAML rather than JSON](/docs/concepts/configuration/overview/#general-configuration-tips) since YAML tends to be more user-friendly, especially for configuration files.<br/> + Example: `kubectl get -f ./pod.yaml` + +* `flags`: Specifies optional flags. For example, you can use the `-s` or `--server` flags to specify the address and port of the Kubernetes API server.<br/> + +{{< caution >}} +Flags that you specify from the command line override default values and any corresponding environment variables. +{{< /caution >}} + +If you need help, run `kubectl help` from the terminal window. + +## In-cluster authentication and namespace overrides + +By default `kubectl` will first determine if it is running within a pod, and thus in a cluster. It starts by checking for the `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` environment variables and the existence of a service account token file at `/var/run/secrets/kubernetes.io/serviceaccount/token`. If all three are found in-cluster authentication is assumed. + +To maintain backwards compatibility, if the `POD_NAMESPACE` environment variable is set during in-cluster authentication it will override the default namespace from the service account token. Any manifests or tools relying on namespace defaulting will be affected by this. + +**`POD_NAMESPACE` environment variable** + +If the `POD_NAMESPACE` environment variable is set, cli operations on namespaced resources will default to the variable value. For example, if the variable is set to `seattle`, `kubectl get pods` would return pods in the `seattle` namespace. This is because pods are a namespaced resource, and no namespace was provided in the command. Review the output of `kubectl api-resources` to determine if a resource is namespaced. + +Explicit use of `--namespace <value>` overrides this behavior. + +**How kubectl handles ServiceAccount tokens** + +If: +* there is Kubernetes service account token file mounted at + `/var/run/secrets/kubernetes.io/serviceaccount/token`, and +* the `KUBERNETES_SERVICE_HOST` environment variable is set, and +* the `KUBERNETES_SERVICE_PORT` environment variable is set, and +* you don't explicitly specify a namespace on the kubectl command line + +then kubectl assumes it is running in your cluster. The kubectl tool looks up the +namespace of that ServiceAccount (this is the same as the namespace of the Pod) +and acts against that namespace. This is different from what happens outside of a +cluster; when kubectl runs outside a cluster and you don't specify a namespace, +the kubectl command acts against the `default` namespace. + +## Operations + +The following table includes short descriptions and the general syntax for all of the `kubectl` operations: + +Operation | Syntax | Description +-------------------- | -------------------- | -------------------- +`alpha` | `kubectl alpha SUBCOMMAND [flags]` | List the available commands that correspond to alpha features, which are not enabled in Kubernetes clusters by default. +`annotate` | <code>kubectl annotate (-f FILENAME | TYPE NAME | TYPE/NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--overwrite] [--all] [--resource-version=version] [flags]</code> | Add or update the annotations of one or more resources. +`api-resources` | `kubectl api-resources [flags]` | List the API resources that are available. +`api-versions` | `kubectl api-versions [flags]` | List the API versions that are available. +`apply` | `kubectl apply -f FILENAME [flags]`| Apply a configuration change to a resource from a file or stdin. +`attach` | `kubectl attach POD -c CONTAINER [-i] [-t] [flags]` | Attach to a running container either to view the output stream or interact with the container (stdin). +`auth` | `kubectl auth [flags] [options]` | Inspect authorization. +`autoscale` | <code>kubectl autoscale (-f FILENAME | TYPE NAME | TYPE/NAME) [--min=MINPODS] --max=MAXPODS [--cpu-percent=CPU] [flags]</code> | Automatically scale the set of pods that are managed by a replication controller. +`certificate` | `kubectl certificate SUBCOMMAND [options]` | Modify certificate resources. +`cluster-info` | `kubectl cluster-info [flags]` | Display endpoint information about the master and services in the cluster. +`completion` | `kubectl completion SHELL [options]` | Output shell completion code for the specified shell (bash or zsh). +`config` | `kubectl config SUBCOMMAND [flags]` | Modifies kubeconfig files. See the individual subcommands for details. +`convert` | `kubectl convert -f FILENAME [options]` | Convert config files between different API versions. Both YAML and JSON formats are accepted. Note - requires `kubectl-convert` plugin to be installed. +`cordon` | `kubectl cordon NODE [options]` | Mark node as unschedulable. +`cp` | `kubectl cp <file-spec-src> <file-spec-dest> [options]` | Copy files and directories to and from containers. +`create` | `kubectl create -f FILENAME [flags]` | Create one or more resources from a file or stdin. +`delete` | <code>kubectl delete (-f FILENAME | TYPE [NAME | /NAME | -l label | --all]) [flags]</code> | Delete resources either from a file, stdin, or specifying label selectors, names, resource selectors, or resources. +`describe` | <code>kubectl describe (-f FILENAME | TYPE [NAME_PREFIX | /NAME | -l label]) [flags]</code> | Display the detailed state of one or more resources. +`diff` | `kubectl diff -f FILENAME [flags]`| Diff file or stdin against live configuration. +`drain` | `kubectl drain NODE [options]` | Drain node in preparation for maintenance. +`edit` | <code>kubectl edit (-f FILENAME | TYPE NAME | TYPE/NAME) [flags]</code> | Edit and update the definition of one or more resources on the server by using the default editor. +`exec` | `kubectl exec POD [-c CONTAINER] [-i] [-t] [flags] [-- COMMAND [args...]]` | Execute a command against a container in a pod. +`explain` | `kubectl explain [--recursive=false] [flags]` | Get documentation of various resources. For instance pods, nodes, services, etc. +`expose` | <code>kubectl expose (-f FILENAME | TYPE NAME | TYPE/NAME) [--port=port] [--protocol=TCP|UDP] [--target-port=number-or-name] [--name=name] [--external-ip=external-ip-of-service] [--type=type] [flags]</code> | Expose a replication controller, service, or pod as a new Kubernetes service. +`get` | <code>kubectl get (-f FILENAME | TYPE [NAME | /NAME | -l label]) [--watch] [--sort-by=FIELD] [[-o | --output]=OUTPUT_FORMAT] [flags]</code> | List one or more resources. +`kustomize` | `kubectl kustomize <dir> [flags] [options]` | List a set of API resources generated from instructions in a kustomization.yaml file. The argument must be the path to the directory containing the file, or a git repository URL with a path suffix specifying same with respect to the repository root. +`label` | <code>kubectl label (-f FILENAME | TYPE NAME | TYPE/NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--overwrite] [--all] [--resource-version=version] [flags]</code> | Add or update the labels of one or more resources. +`logs` | `kubectl logs POD [-c CONTAINER] [--follow] [flags]` | Print the logs for a container in a pod. +`options` | `kubectl options` | List of global command-line options, which apply to all commands. +`patch` | <code>kubectl patch (-f FILENAME | TYPE NAME | TYPE/NAME) --patch PATCH [flags]</code> | Update one or more fields of a resource by using the strategic merge patch process. +`plugin` | `kubectl plugin [flags] [options]` | Provides utilities for interacting with plugins. +`port-forward` | `kubectl port-forward POD [LOCAL_PORT:]REMOTE_PORT [...[LOCAL_PORT_N:]REMOTE_PORT_N] [flags]` | Forward one or more local ports to a pod. +`proxy` | `kubectl proxy [--port=PORT] [--www=static-dir] [--www-prefix=prefix] [--api-prefix=prefix] [flags]` | Run a proxy to the Kubernetes API server. +`replace` | `kubectl replace -f FILENAME` | Replace a resource from a file or stdin. +`rollout` | `kubectl rollout SUBCOMMAND [options]` | Manage the rollout of a resource. Valid resource types include: deployments, daemonsets and statefulsets. +`run` | <code>kubectl run NAME --image=image [--env="key=value"] [--port=port] [--dry-run=server|client|none] [--overrides=inline-json] [flags]</code> | Run a specified image on the cluster. +`scale` | <code>kubectl scale (-f FILENAME | TYPE NAME | TYPE/NAME) --replicas=COUNT [--resource-version=version] [--current-replicas=count] [flags]</code> | Update the size of the specified replication controller. +`set` | `kubectl set SUBCOMMAND [options]` | Configure application resources. +`taint` | `kubectl taint NODE NAME KEY_1=VAL_1:TAINT_EFFECT_1 ... KEY_N=VAL_N:TAINT_EFFECT_N [options]` | Update the taints on one or more nodes. +`top` | `kubectl top [flags] [options]` | Display Resource (CPU/Memory/Storage) usage. +`uncordon` | `kubectl uncordon NODE [options]` | Mark node as schedulable. +`version` | `kubectl version [--client] [flags]` | Display the Kubernetes version running on the client and server. +`wait` | <code>kubectl wait ([-f FILENAME] | resource.group/resource.name | resource.group [(-l label | --all)]) [--for=delete|--for condition=available] [options]</code> | Experimental: Wait for a specific condition on one or many resources. + +To learn more about command operations, see the [kubectl](/docs/reference/kubectl/kubectl/) reference documentation. + +## Resource types + +The following table includes a list of all the supported resource types and their abbreviated aliases. + +(This output can be retrieved from `kubectl api-resources`, and was accurate as of Kubernetes 1.19.1.) + +| NAME | SHORTNAMES | APIGROUP | NAMESPACED | KIND | +|---|---|---|---|---| +| `bindings` | | | true | Binding | +| `componentstatuses` | `cs` | | false | ComponentStatus | +| `configmaps` | `cm` | | true | ConfigMap | +| `endpoints` | `ep` | | true | Endpoints | +| `events` | `ev` | | true | Event | +| `limitranges` | `limits` | | true | LimitRange | +| `namespaces` | `ns` | | false | Namespace | +| `nodes` | `no` | | false | Node | +| `persistentvolumeclaims` | `pvc` | | true | PersistentVolumeClaim | +| `persistentvolumes` | `pv` | | false | PersistentVolume | +| `pods` | `po` | | true | Pod | +| `podtemplates` | | | true | PodTemplate | +| `replicationcontrollers` | `rc` | | true | ReplicationController | +| `resourcequotas` | `quota` | | true | ResourceQuota | +| `secrets` | | | true | Secret | +| `serviceaccounts` | `sa` | | true | ServiceAccount | +| `services` | `svc` | | true | Service | +| `mutatingwebhookconfigurations` | | admissionregistration.k8s.io | false | MutatingWebhookConfiguration | +| `validatingwebhookconfigurations` | | admissionregistration.k8s.io | false | ValidatingWebhookConfiguration | +| `customresourcedefinitions` | `crd,crds` | apiextensions.k8s.io | false | CustomResourceDefinition | +| `apiservices` | | apiregistration.k8s.io | false | APIService | +| `controllerrevisions` | | apps | true | ControllerRevision | +| `daemonsets` | `ds` | apps | true | DaemonSet | +| `deployments` | `deploy` | apps | true | Deployment | +| `replicasets` | `rs` | apps | true | ReplicaSet | +| `statefulsets` | `sts` | apps | true | StatefulSet | +| `tokenreviews` | | authentication.k8s.io | false | TokenReview | +| `localsubjectaccessreviews` | | authorization.k8s.io | true | LocalSubjectAccessReview | +| `selfsubjectaccessreviews` | | authorization.k8s.io | false | SelfSubjectAccessReview | +| `selfsubjectrulesreviews` | | authorization.k8s.io | false | SelfSubjectRulesReview | +| `subjectaccessreviews` | | authorization.k8s.io | false | SubjectAccessReview | +| `horizontalpodautoscalers` | `hpa` | autoscaling | true | HorizontalPodAutoscaler | +| `cronjobs` | `cj` | batch | true | CronJob | +| `jobs` | | batch | true | Job | +| `certificatesigningrequests` | `csr` | certificates.k8s.io | false | CertificateSigningRequest | +| `leases` | | coordination.k8s.io | true | Lease | +| `endpointslices` | | discovery.k8s.io | true | EndpointSlice | +| `events` | `ev` | events.k8s.io | true | Event | +| `ingresses` | `ing` | extensions | true | Ingress | +| `flowschemas` | | flowcontrol.apiserver.k8s.io | false | FlowSchema | +| `prioritylevelconfigurations` | | flowcontrol.apiserver.k8s.io | false | PriorityLevelConfiguration | +| `ingressclasses` | | networking.k8s.io | false | IngressClass | +| `ingresses` | `ing` | networking.k8s.io | true | Ingress | +| `networkpolicies` | `netpol` | networking.k8s.io | true | NetworkPolicy | +| `runtimeclasses` | | node.k8s.io | false | RuntimeClass | +| `poddisruptionbudgets` | `pdb` | policy | true | PodDisruptionBudget | +| `podsecuritypolicies` | `psp` | policy | false | PodSecurityPolicy | +| `clusterrolebindings` | | rbac.authorization.k8s.io | false | ClusterRoleBinding | +| `clusterroles` | | rbac.authorization.k8s.io | false | ClusterRole | +| `rolebindings` | | rbac.authorization.k8s.io | true | RoleBinding | +| `roles` | | rbac.authorization.k8s.io | true | Role | +| `priorityclasses` | `pc` | scheduling.k8s.io | false | PriorityClass | +| `csidrivers` | | storage.k8s.io | false | CSIDriver | +| `csinodes` | | storage.k8s.io | false | CSINode | +| `storageclasses` | `sc` | storage.k8s.io | false | StorageClass | +| `volumeattachments` | | storage.k8s.io | false | VolumeAttachment | + +## Output options + +Use the following sections for information about how you can format or sort the output of certain commands. For details about which commands support the various output options, see the [kubectl](/docs/reference/kubectl/kubectl/) reference documentation. + +### Formatting output + +The default output format for all `kubectl` commands is the human readable plain-text format. To output details to your terminal window in a specific format, you can add either the `-o` or `--output` flags to a supported `kubectl` command. + +#### Syntax + +```shell +kubectl [command] [TYPE] [NAME] -o <output_format> +``` + +Depending on the `kubectl` operation, the following output formats are supported: + +Output format | Description +--------------| ----------- +`-o custom-columns=<spec>` | Print a table using a comma separated list of [custom columns](#custom-columns). +`-o custom-columns-file=<filename>` | Print a table using the [custom columns](#custom-columns) template in the `<filename>` file. +`-o json` | Output a JSON formatted API object. +`-o jsonpath=<template>` | Print the fields defined in a [jsonpath](/docs/reference/kubectl/jsonpath/) expression. +`-o jsonpath-file=<filename>` | Print the fields defined by the [jsonpath](/docs/reference/kubectl/jsonpath/) expression in the `<filename>` file. +`-o name` | Print only the resource name and nothing else. +`-o wide` | Output in the plain-text format with any additional information. For pods, the node name is included. +`-o yaml` | Output a YAML formatted API object. + +##### Example + +In this example, the following command outputs the details for a single pod as a YAML formatted object: + +```shell +kubectl get pod web-pod-13je7 -o yaml +``` + +Remember: See the [kubectl](/docs/reference/kubectl/kubectl/) reference documentation +for details about which output format is supported by each command. + +#### Custom columns + +To define custom columns and output only the details that you want into a table, you can use the `custom-columns` option. +You can choose to define the custom columns inline or use a template file: `-o custom-columns=<spec>` or `-o custom-columns-file=<filename>`. + +##### Examples + +Inline: + +```shell +kubectl get pods <pod-name> -o custom-columns=NAME:.metadata.name,RSRC:.metadata.resourceVersion +``` + +Template file: + +```shell +kubectl get pods <pod-name> -o custom-columns-file=template.txt +``` + +where the `template.txt` file contains: + +``` +NAME RSRC +metadata.name metadata.resourceVersion +``` +The result of running either command is similar to: + +``` +NAME RSRC +submit-queue 610995 +``` + +#### Server-side columns + +`kubectl` supports receiving specific column information from the server about objects. +This means that for any given resource, the server will return columns and rows relevant to that resource, for the client to print. +This allows for consistent human-readable output across clients used against the same cluster, by having the server encapsulate the details of printing. + +This feature is enabled by default. To disable it, add the +`--server-print=false` flag to the `kubectl get` command. + +##### Examples + +To print information about the status of a pod, use a command like the following: + +```shell +kubectl get pods <pod-name> --server-print=false +``` + +The output is similar to: + +``` +NAME AGE +pod-name 1m +``` + +### Sorting list objects + +To output objects to a sorted list in your terminal window, you can add the `--sort-by` flag to a supported `kubectl` command. Sort your objects by specifying any numeric or string field with the `--sort-by` flag. To specify a field, use a [jsonpath](/docs/reference/kubectl/jsonpath/) expression. + +#### Syntax + +```shell +kubectl [command] [TYPE] [NAME] --sort-by=<jsonpath_exp> +``` + +##### Example + +To print a list of pods sorted by name, you run: + +```shell +kubectl get pods --sort-by=.metadata.name +``` + +## Examples: Common operations + +Use the following set of examples to help you familiarize yourself with running the commonly used `kubectl` operations: + +`kubectl apply` - Apply or Update a resource from a file or stdin. + +```shell +# Create a service using the definition in example-service.yaml. +kubectl apply -f example-service.yaml + +# Create a replication controller using the definition in example-controller.yaml. +kubectl apply -f example-controller.yaml + +# Create the objects that are defined in any .yaml, .yml, or .json file within the <directory> directory. +kubectl apply -f <directory> +``` + +`kubectl get` - List one or more resources. + +```shell +# List all pods in plain-text output format. +kubectl get pods + +# List all pods in plain-text output format and include additional information (such as node name). +kubectl get pods -o wide + +# List the replication controller with the specified name in plain-text output format. Tip: You can shorten and replace the 'replicationcontroller' resource type with the alias 'rc'. +kubectl get replicationcontroller <rc-name> + +# List all replication controllers and services together in plain-text output format. +kubectl get rc,services + +# List all daemon sets in plain-text output format. +kubectl get ds + +# List all pods running on node server01 +kubectl get pods --field-selector=spec.nodeName=server01 +``` + +`kubectl describe` - Display detailed state of one or more resources, including the uninitialized ones by default. + +```shell +# Display the details of the node with name <node-name>. +kubectl describe nodes <node-name> + +# Display the details of the pod with name <pod-name>. +kubectl describe pods/<pod-name> + +# Display the details of all the pods that are managed by the replication controller named <rc-name>. +# Remember: Any pods that are created by the replication controller get prefixed with the name of the replication controller. +kubectl describe pods <rc-name> + +# Describe all pods +kubectl describe pods +``` + +{{< note >}} +The `kubectl get` command is usually used for retrieving one or more +resources of the same resource type. It features a rich set of flags that allows +you to customize the output format using the `-o` or `--output` flag, for example. +You can specify the `-w` or `--watch` flag to start watching updates to a particular +object. The `kubectl describe` command is more focused on describing the many +related aspects of a specified resource. It may invoke several API calls to the +API server to build a view for the user. For example, the `kubectl describe node` +command retrieves not only the information about the node, but also a summary of +the pods running on it, the events generated for the node etc. +{{< /note >}} + +`kubectl delete` - Delete resources either from a file, stdin, or specifying label selectors, names, resource selectors, or resources. + +```shell +# Delete a pod using the type and name specified in the pod.yaml file. +kubectl delete -f pod.yaml + +# Delete all the pods and services that have the label '<label-key>=<label-value>'. +kubectl delete pods,services -l <label-key>=<label-value> + +# Delete all pods, including uninitialized ones. +kubectl delete pods --all +``` + +`kubectl exec` - Execute a command against a container in a pod. + +```shell +# Get output from running 'date' from pod <pod-name>. By default, output is from the first container. +kubectl exec <pod-name> -- date + +# Get output from running 'date' in container <container-name> of pod <pod-name>. +kubectl exec <pod-name> -c <container-name> -- date + +# Get an interactive TTY and run /bin/bash from pod <pod-name>. By default, output is from the first container. +kubectl exec -ti <pod-name> -- /bin/bash +``` + +`kubectl logs` - Print the logs for a container in a pod. + +```shell +# Return a snapshot of the logs from pod <pod-name>. +kubectl logs <pod-name> + +# Start streaming the logs from pod <pod-name>. This is similar to the 'tail -f' Linux command. +kubectl logs -f <pod-name> +``` + +`kubectl diff` - View a diff of the proposed updates to a cluster. + +```shell +# Diff resources included in "pod.json". +kubectl diff -f pod.json + +# Diff file read from stdin. +cat service.yaml | kubectl diff -f - +``` + +## Examples: Creating and using plugins + +Use the following set of examples to help you familiarize yourself with writing and using `kubectl` plugins: + +```shell +# create a simple plugin in any language and name the resulting executable file +# so that it begins with the prefix "kubectl-" +cat ./kubectl-hello +``` +```shell +#!/bin/sh + +# this plugin prints the words "hello world" +echo "hello world" +``` +With a plugin written, let's make it executable: +```bash +chmod a+x ./kubectl-hello + +# and move it to a location in our PATH +sudo mv ./kubectl-hello /usr/local/bin +sudo chown root:root /usr/local/bin + +# You have now created and "installed" a kubectl plugin. +# You can begin using this plugin by invoking it from kubectl as if it were a regular command +kubectl hello +``` +``` +hello world +``` + +```shell +# You can "uninstall" a plugin, by removing it from the folder in your +# $PATH where you placed it +sudo rm /usr/local/bin/kubectl-hello +``` + +In order to view all of the plugins that are available to `kubectl`, use +the `kubectl plugin list` subcommand: + +```shell +kubectl plugin list +``` +The output is similar to: +``` +The following kubectl-compatible plugins are available: + +/usr/local/bin/kubectl-hello +/usr/local/bin/kubectl-foo +/usr/local/bin/kubectl-bar +``` + +`kubectl plugin list` also warns you about plugins that are not +executable, or that are shadowed by other plugins; for example: +```shell +sudo chmod -x /usr/local/bin/kubectl-foo # remove execute permission +kubectl plugin list +``` +``` +The following kubectl-compatible plugins are available: + +/usr/local/bin/kubectl-hello +/usr/local/bin/kubectl-foo + - warning: /usr/local/bin/kubectl-foo identified as a plugin, but it is not executable +/usr/local/bin/kubectl-bar + +error: one plugin warning was found +``` + +You can think of plugins as a means to build more complex functionality on top +of the existing kubectl commands: + +```shell +cat ./kubectl-whoami +``` +The next few examples assume that you already made `kubectl-whoami` have +the following contents: +```shell +#!/bin/bash + +# this plugin makes use of the `kubectl config` command in order to output +# information about the current user, based on the currently selected context +kubectl config view --template='{{ range .contexts }}{{ if eq .name "'$(kubectl config current-context)'" }}Current user: {{ printf "%s\n" .context.user }}{{ end }}{{ end }}' +``` + +Running the above command gives you an output containing the user for the +current context in your KUBECONFIG file: + +```shell +# make the file executable +sudo chmod +x ./kubectl-whoami + +# and move it into your PATH +sudo mv ./kubectl-whoami /usr/local/bin + +kubectl whoami +Current user: plugins-user +``` + +## {{% heading "whatsnext" %}} + +* Read the `kubectl` [command reference](/docs/reference/kubectl/kubectl/). +* Read the `kubectl` [command line arguments](/docs/reference/kubectl/kubectl/) reference. +* Read about how to [extend kubectl with plugins](/docs/tasks/extend-kubectl/kubectl-plugins). + * To find out more about plugins, take a look at the [example CLI plugin](https://github.com/kubernetes/sample-cli-plugin). diff --git a/content/en/docs/reference/kubectl/cheatsheet.md b/content/en/docs/reference/kubectl/cheatsheet.md index b3c3536b31..52addfb9d2 100644 --- a/content/en/docs/reference/kubectl/cheatsheet.md +++ b/content/en/docs/reference/kubectl/cheatsheet.md @@ -423,7 +423,7 @@ kubectl get pods -A -o=custom-columns='DATA:spec.containers[?(@.image!="k8s.gcr. kubectl get pods -A -o=custom-columns='DATA:metadata.*' ``` -More examples in the kubectl [reference documentation](/docs/reference/kubectl/overview/#custom-columns). +More examples in the kubectl [reference documentation](/docs/reference/kubectl/#custom-columns). ### Kubectl output verbosity and debugging @@ -444,7 +444,7 @@ Verbosity | Description ## {{% heading "whatsnext" %}} -* Read the [kubectl overview](/docs/reference/kubectl/overview/) and learn about [JsonPath](/docs/reference/kubectl/jsonpath). +* Read the [kubectl overview](/docs/reference/kubectl/) and learn about [JsonPath](/docs/reference/kubectl/jsonpath). * See [kubectl](/docs/reference/kubectl/kubectl/) options. diff --git a/content/en/docs/reference/kubectl/overview.md b/content/en/docs/reference/kubectl/overview.md deleted file mode 100644 index 53d3305ed9..0000000000 --- a/content/en/docs/reference/kubectl/overview.md +++ /dev/null @@ -1,548 +0,0 @@ ---- -reviewers: -- hw-qiaolei -title: Overview of kubectl -content_type: concept -weight: 20 -card: - name: reference - weight: 20 ---- - -<!-- overview --> -The kubectl command line tool lets you control Kubernetes clusters. -For configuration, `kubectl` looks for a file named `config` in the `$HOME/.kube` directory. -You can specify other [kubeconfig](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) -files by setting the KUBECONFIG environment variable or by setting the -[`--kubeconfig`](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) flag. - -This overview covers `kubectl` syntax, describes the command operations, and provides common examples. -For details about each command, including all the supported flags and subcommands, see the -[kubectl](/docs/reference/generated/kubectl/kubectl-commands/) reference documentation. -For installation instructions see [installing kubectl](/docs/tasks/tools/). - -<!-- body --> - -## Syntax - -Use the following syntax to run `kubectl` commands from your terminal window: - -```shell -kubectl [command] [TYPE] [NAME] [flags] -``` - -where `command`, `TYPE`, `NAME`, and `flags` are: - -* `command`: Specifies the operation that you want to perform on one or more resources, -for example `create`, `get`, `describe`, `delete`. - -* `TYPE`: Specifies the [resource type](#resource-types). Resource types are case-insensitive and - you can specify the singular, plural, or abbreviated forms. - For example, the following commands produce the same output: - - ```shell - kubectl get pod pod1 - kubectl get pods pod1 - kubectl get po pod1 - ``` - -* `NAME`: Specifies the name of the resource. Names are case-sensitive. If the name is omitted, details for all resources are displayed, for example `kubectl get pods`. - - When performing an operation on multiple resources, you can specify each resource by type and name or specify one or more files: - - * To specify resources by type and name: - - * To group resources if they are all the same type: `TYPE1 name1 name2 name<#>`.<br/> - Example: `kubectl get pod example-pod1 example-pod2` - - * To specify multiple resource types individually: `TYPE1/name1 TYPE1/name2 TYPE2/name3 TYPE<#>/name<#>`.<br/> - Example: `kubectl get pod/example-pod1 replicationcontroller/example-rc1` - - * To specify resources with one or more files: `-f file1 -f file2 -f file<#>` - - * [Use YAML rather than JSON](/docs/concepts/configuration/overview/#general-configuration-tips) since YAML tends to be more user-friendly, especially for configuration files.<br/> - Example: `kubectl get -f ./pod.yaml` - -* `flags`: Specifies optional flags. For example, you can use the `-s` or `--server` flags to specify the address and port of the Kubernetes API server.<br/> - -{{< caution >}} -Flags that you specify from the command line override default values and any corresponding environment variables. -{{< /caution >}} - -If you need help, run `kubectl help` from the terminal window. - -## In-cluster authentication and namespace overrides - -By default `kubectl` will first determine if it is running within a pod, and thus in a cluster. It starts by checking for the `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` environment variables and the existence of a service account token file at `/var/run/secrets/kubernetes.io/serviceaccount/token`. If all three are found in-cluster authentication is assumed. - -To maintain backwards compatibility, if the `POD_NAMESPACE` environment variable is set during in-cluster authentication it will override the default namespace from the service account token. Any manifests or tools relying on namespace defaulting will be affected by this. - -**`POD_NAMESPACE` environment variable** - -If the `POD_NAMESPACE` environment variable is set, cli operations on namespaced resources will default to the variable value. For example, if the variable is set to `seattle`, `kubectl get pods` would return pods in the `seattle` namespace. This is because pods are a namespaced resource, and no namespace was provided in the command. Review the output of `kubectl api-resources` to determine if a resource is namespaced. - -Explicit use of `--namespace <value>` overrides this behavior. - -**How kubectl handles ServiceAccount tokens** - -If: -* there is Kubernetes service account token file mounted at - `/var/run/secrets/kubernetes.io/serviceaccount/token`, and -* the `KUBERNETES_SERVICE_HOST` environment variable is set, and -* the `KUBERNETES_SERVICE_PORT` environment variable is set, and -* you don't explicitly specify a namespace on the kubectl command line - -then kubectl assumes it is running in your cluster. The kubectl tool looks up the -namespace of that ServiceAccount (this is the same as the namespace of the Pod) -and acts against that namespace. This is different from what happens outside of a -cluster; when kubectl runs outside a cluster and you don't specify a namespace, -the kubectl command acts against the `default` namespace. - -## Operations - -The following table includes short descriptions and the general syntax for all of the `kubectl` operations: - -Operation | Syntax | Description --------------------- | -------------------- | -------------------- -`alpha` | `kubectl alpha SUBCOMMAND [flags]` | List the available commands that correspond to alpha features, which are not enabled in Kubernetes clusters by default. -`annotate` | <code>kubectl annotate (-f FILENAME | TYPE NAME | TYPE/NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--overwrite] [--all] [--resource-version=version] [flags]</code> | Add or update the annotations of one or more resources. -`api-resources` | `kubectl api-resources [flags]` | List the API resources that are available. -`api-versions` | `kubectl api-versions [flags]` | List the API versions that are available. -`apply` | `kubectl apply -f FILENAME [flags]`| Apply a configuration change to a resource from a file or stdin. -`attach` | `kubectl attach POD -c CONTAINER [-i] [-t] [flags]` | Attach to a running container either to view the output stream or interact with the container (stdin). -`auth` | `kubectl auth [flags] [options]` | Inspect authorization. -`autoscale` | <code>kubectl autoscale (-f FILENAME | TYPE NAME | TYPE/NAME) [--min=MINPODS] --max=MAXPODS [--cpu-percent=CPU] [flags]</code> | Automatically scale the set of pods that are managed by a replication controller. -`certificate` | `kubectl certificate SUBCOMMAND [options]` | Modify certificate resources. -`cluster-info` | `kubectl cluster-info [flags]` | Display endpoint information about the master and services in the cluster. -`completion` | `kubectl completion SHELL [options]` | Output shell completion code for the specified shell (bash or zsh). -`config` | `kubectl config SUBCOMMAND [flags]` | Modifies kubeconfig files. See the individual subcommands for details. -`convert` | `kubectl convert -f FILENAME [options]` | Convert config files between different API versions. Both YAML and JSON formats are accepted. Note - requires `kubectl-convert` plugin to be installed. -`cordon` | `kubectl cordon NODE [options]` | Mark node as unschedulable. -`cp` | `kubectl cp <file-spec-src> <file-spec-dest> [options]` | Copy files and directories to and from containers. -`create` | `kubectl create -f FILENAME [flags]` | Create one or more resources from a file or stdin. -`delete` | <code>kubectl delete (-f FILENAME | TYPE [NAME | /NAME | -l label | --all]) [flags]</code> | Delete resources either from a file, stdin, or specifying label selectors, names, resource selectors, or resources. -`describe` | <code>kubectl describe (-f FILENAME | TYPE [NAME_PREFIX | /NAME | -l label]) [flags]</code> | Display the detailed state of one or more resources. -`diff` | `kubectl diff -f FILENAME [flags]`| Diff file or stdin against live configuration. -`drain` | `kubectl drain NODE [options]` | Drain node in preparation for maintenance. -`edit` | <code>kubectl edit (-f FILENAME | TYPE NAME | TYPE/NAME) [flags]</code> | Edit and update the definition of one or more resources on the server by using the default editor. -`exec` | `kubectl exec POD [-c CONTAINER] [-i] [-t] [flags] [-- COMMAND [args...]]` | Execute a command against a container in a pod. -`explain` | `kubectl explain [--recursive=false] [flags]` | Get documentation of various resources. For instance pods, nodes, services, etc. -`expose` | <code>kubectl expose (-f FILENAME | TYPE NAME | TYPE/NAME) [--port=port] [--protocol=TCP|UDP] [--target-port=number-or-name] [--name=name] [--external-ip=external-ip-of-service] [--type=type] [flags]</code> | Expose a replication controller, service, or pod as a new Kubernetes service. -`get` | <code>kubectl get (-f FILENAME | TYPE [NAME | /NAME | -l label]) [--watch] [--sort-by=FIELD] [[-o | --output]=OUTPUT_FORMAT] [flags]</code> | List one or more resources. -`kustomize` | `kubectl kustomize <dir> [flags] [options]` | List a set of API resources generated from instructions in a kustomization.yaml file. The argument must be the path to the directory containing the file, or a git repository URL with a path suffix specifying same with respect to the repository root. -`label` | <code>kubectl label (-f FILENAME | TYPE NAME | TYPE/NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--overwrite] [--all] [--resource-version=version] [flags]</code> | Add or update the labels of one or more resources. -`logs` | `kubectl logs POD [-c CONTAINER] [--follow] [flags]` | Print the logs for a container in a pod. -`options` | `kubectl options` | List of global command-line options, which apply to all commands. -`patch` | <code>kubectl patch (-f FILENAME | TYPE NAME | TYPE/NAME) --patch PATCH [flags]</code> | Update one or more fields of a resource by using the strategic merge patch process. -`plugin` | `kubectl plugin [flags] [options]` | Provides utilities for interacting with plugins. -`port-forward` | `kubectl port-forward POD [LOCAL_PORT:]REMOTE_PORT [...[LOCAL_PORT_N:]REMOTE_PORT_N] [flags]` | Forward one or more local ports to a pod. -`proxy` | `kubectl proxy [--port=PORT] [--www=static-dir] [--www-prefix=prefix] [--api-prefix=prefix] [flags]` | Run a proxy to the Kubernetes API server. -`replace` | `kubectl replace -f FILENAME` | Replace a resource from a file or stdin. -`rollout` | `kubectl rollout SUBCOMMAND [options]` | Manage the rollout of a resource. Valid resource types include: deployments, daemonsets and statefulsets. -`run` | <code>kubectl run NAME --image=image [--env="key=value"] [--port=port] [--dry-run=server|client|none] [--overrides=inline-json] [flags]</code> | Run a specified image on the cluster. -`scale` | <code>kubectl scale (-f FILENAME | TYPE NAME | TYPE/NAME) --replicas=COUNT [--resource-version=version] [--current-replicas=count] [flags]</code> | Update the size of the specified replication controller. -`set` | `kubectl set SUBCOMMAND [options]` | Configure application resources. -`taint` | `kubectl taint NODE NAME KEY_1=VAL_1:TAINT_EFFECT_1 ... KEY_N=VAL_N:TAINT_EFFECT_N [options]` | Update the taints on one or more nodes. -`top` | `kubectl top [flags] [options]` | Display Resource (CPU/Memory/Storage) usage. -`uncordon` | `kubectl uncordon NODE [options]` | Mark node as schedulable. -`version` | `kubectl version [--client] [flags]` | Display the Kubernetes version running on the client and server. -`wait` | <code>kubectl wait ([-f FILENAME] | resource.group/resource.name | resource.group [(-l label | --all)]) [--for=delete|--for condition=available] [options]</code> | Experimental: Wait for a specific condition on one or many resources. - -To learn more about command operations, see the [kubectl](/docs/reference/kubectl/kubectl/) reference documentation. - -## Resource types - -The following table includes a list of all the supported resource types and their abbreviated aliases. - -(This output can be retrieved from `kubectl api-resources`, and was accurate as of Kubernetes 1.19.1.) - -| NAME | SHORTNAMES | APIGROUP | NAMESPACED | KIND | -|---|---|---|---|---| -| `bindings` | | | true | Binding | -| `componentstatuses` | `cs` | | false | ComponentStatus | -| `configmaps` | `cm` | | true | ConfigMap | -| `endpoints` | `ep` | | true | Endpoints | -| `events` | `ev` | | true | Event | -| `limitranges` | `limits` | | true | LimitRange | -| `namespaces` | `ns` | | false | Namespace | -| `nodes` | `no` | | false | Node | -| `persistentvolumeclaims` | `pvc` | | true | PersistentVolumeClaim | -| `persistentvolumes` | `pv` | | false | PersistentVolume | -| `pods` | `po` | | true | Pod | -| `podtemplates` | | | true | PodTemplate | -| `replicationcontrollers` | `rc` | | true | ReplicationController | -| `resourcequotas` | `quota` | | true | ResourceQuota | -| `secrets` | | | true | Secret | -| `serviceaccounts` | `sa` | | true | ServiceAccount | -| `services` | `svc` | | true | Service | -| `mutatingwebhookconfigurations` | | admissionregistration.k8s.io | false | MutatingWebhookConfiguration | -| `validatingwebhookconfigurations` | | admissionregistration.k8s.io | false | ValidatingWebhookConfiguration | -| `customresourcedefinitions` | `crd,crds` | apiextensions.k8s.io | false | CustomResourceDefinition | -| `apiservices` | | apiregistration.k8s.io | false | APIService | -| `controllerrevisions` | | apps | true | ControllerRevision | -| `daemonsets` | `ds` | apps | true | DaemonSet | -| `deployments` | `deploy` | apps | true | Deployment | -| `replicasets` | `rs` | apps | true | ReplicaSet | -| `statefulsets` | `sts` | apps | true | StatefulSet | -| `tokenreviews` | | authentication.k8s.io | false | TokenReview | -| `localsubjectaccessreviews` | | authorization.k8s.io | true | LocalSubjectAccessReview | -| `selfsubjectaccessreviews` | | authorization.k8s.io | false | SelfSubjectAccessReview | -| `selfsubjectrulesreviews` | | authorization.k8s.io | false | SelfSubjectRulesReview | -| `subjectaccessreviews` | | authorization.k8s.io | false | SubjectAccessReview | -| `horizontalpodautoscalers` | `hpa` | autoscaling | true | HorizontalPodAutoscaler | -| `cronjobs` | `cj` | batch | true | CronJob | -| `jobs` | | batch | true | Job | -| `certificatesigningrequests` | `csr` | certificates.k8s.io | false | CertificateSigningRequest | -| `leases` | | coordination.k8s.io | true | Lease | -| `endpointslices` | | discovery.k8s.io | true | EndpointSlice | -| `events` | `ev` | events.k8s.io | true | Event | -| `ingresses` | `ing` | extensions | true | Ingress | -| `flowschemas` | | flowcontrol.apiserver.k8s.io | false | FlowSchema | -| `prioritylevelconfigurations` | | flowcontrol.apiserver.k8s.io | false | PriorityLevelConfiguration | -| `ingressclasses` | | networking.k8s.io | false | IngressClass | -| `ingresses` | `ing` | networking.k8s.io | true | Ingress | -| `networkpolicies` | `netpol` | networking.k8s.io | true | NetworkPolicy | -| `runtimeclasses` | | node.k8s.io | false | RuntimeClass | -| `poddisruptionbudgets` | `pdb` | policy | true | PodDisruptionBudget | -| `podsecuritypolicies` | `psp` | policy | false | PodSecurityPolicy | -| `clusterrolebindings` | | rbac.authorization.k8s.io | false | ClusterRoleBinding | -| `clusterroles` | | rbac.authorization.k8s.io | false | ClusterRole | -| `rolebindings` | | rbac.authorization.k8s.io | true | RoleBinding | -| `roles` | | rbac.authorization.k8s.io | true | Role | -| `priorityclasses` | `pc` | scheduling.k8s.io | false | PriorityClass | -| `csidrivers` | | storage.k8s.io | false | CSIDriver | -| `csinodes` | | storage.k8s.io | false | CSINode | -| `storageclasses` | `sc` | storage.k8s.io | false | StorageClass | -| `volumeattachments` | | storage.k8s.io | false | VolumeAttachment | - -## Output options - -Use the following sections for information about how you can format or sort the output of certain commands. For details about which commands support the various output options, see the [kubectl](/docs/reference/kubectl/kubectl/) reference documentation. - -### Formatting output - -The default output format for all `kubectl` commands is the human readable plain-text format. To output details to your terminal window in a specific format, you can add either the `-o` or `--output` flags to a supported `kubectl` command. - -#### Syntax - -```shell -kubectl [command] [TYPE] [NAME] -o <output_format> -``` - -Depending on the `kubectl` operation, the following output formats are supported: - -Output format | Description ---------------| ----------- -`-o custom-columns=<spec>` | Print a table using a comma separated list of [custom columns](#custom-columns). -`-o custom-columns-file=<filename>` | Print a table using the [custom columns](#custom-columns) template in the `<filename>` file. -`-o json` | Output a JSON formatted API object. -`-o jsonpath=<template>` | Print the fields defined in a [jsonpath](/docs/reference/kubectl/jsonpath/) expression. -`-o jsonpath-file=<filename>` | Print the fields defined by the [jsonpath](/docs/reference/kubectl/jsonpath/) expression in the `<filename>` file. -`-o name` | Print only the resource name and nothing else. -`-o wide` | Output in the plain-text format with any additional information. For pods, the node name is included. -`-o yaml` | Output a YAML formatted API object. - -##### Example - -In this example, the following command outputs the details for a single pod as a YAML formatted object: - -```shell -kubectl get pod web-pod-13je7 -o yaml -``` - -Remember: See the [kubectl](/docs/reference/kubectl/kubectl/) reference documentation -for details about which output format is supported by each command. - -#### Custom columns - -To define custom columns and output only the details that you want into a table, you can use the `custom-columns` option. -You can choose to define the custom columns inline or use a template file: `-o custom-columns=<spec>` or `-o custom-columns-file=<filename>`. - -##### Examples - -Inline: - -```shell -kubectl get pods <pod-name> -o custom-columns=NAME:.metadata.name,RSRC:.metadata.resourceVersion -``` - -Template file: - -```shell -kubectl get pods <pod-name> -o custom-columns-file=template.txt -``` - -where the `template.txt` file contains: - -``` -NAME RSRC -metadata.name metadata.resourceVersion -``` -The result of running either command is similar to: - -``` -NAME RSRC -submit-queue 610995 -``` - -#### Server-side columns - -`kubectl` supports receiving specific column information from the server about objects. -This means that for any given resource, the server will return columns and rows relevant to that resource, for the client to print. -This allows for consistent human-readable output across clients used against the same cluster, by having the server encapsulate the details of printing. - -This feature is enabled by default. To disable it, add the -`--server-print=false` flag to the `kubectl get` command. - -##### Examples - -To print information about the status of a pod, use a command like the following: - -```shell -kubectl get pods <pod-name> --server-print=false -``` - -The output is similar to: - -``` -NAME AGE -pod-name 1m -``` - -### Sorting list objects - -To output objects to a sorted list in your terminal window, you can add the `--sort-by` flag to a supported `kubectl` command. Sort your objects by specifying any numeric or string field with the `--sort-by` flag. To specify a field, use a [jsonpath](/docs/reference/kubectl/jsonpath/) expression. - -#### Syntax - -```shell -kubectl [command] [TYPE] [NAME] --sort-by=<jsonpath_exp> -``` - -##### Example - -To print a list of pods sorted by name, you run: - -```shell -kubectl get pods --sort-by=.metadata.name -``` - -## Examples: Common operations - -Use the following set of examples to help you familiarize yourself with running the commonly used `kubectl` operations: - -`kubectl apply` - Apply or Update a resource from a file or stdin. - -```shell -# Create a service using the definition in example-service.yaml. -kubectl apply -f example-service.yaml - -# Create a replication controller using the definition in example-controller.yaml. -kubectl apply -f example-controller.yaml - -# Create the objects that are defined in any .yaml, .yml, or .json file within the <directory> directory. -kubectl apply -f <directory> -``` - -`kubectl get` - List one or more resources. - -```shell -# List all pods in plain-text output format. -kubectl get pods - -# List all pods in plain-text output format and include additional information (such as node name). -kubectl get pods -o wide - -# List the replication controller with the specified name in plain-text output format. Tip: You can shorten and replace the 'replicationcontroller' resource type with the alias 'rc'. -kubectl get replicationcontroller <rc-name> - -# List all replication controllers and services together in plain-text output format. -kubectl get rc,services - -# List all daemon sets in plain-text output format. -kubectl get ds - -# List all pods running on node server01 -kubectl get pods --field-selector=spec.nodeName=server01 -``` - -`kubectl describe` - Display detailed state of one or more resources, including the uninitialized ones by default. - -```shell -# Display the details of the node with name <node-name>. -kubectl describe nodes <node-name> - -# Display the details of the pod with name <pod-name>. -kubectl describe pods/<pod-name> - -# Display the details of all the pods that are managed by the replication controller named <rc-name>. -# Remember: Any pods that are created by the replication controller get prefixed with the name of the replication controller. -kubectl describe pods <rc-name> - -# Describe all pods -kubectl describe pods -``` - -{{< note >}} -The `kubectl get` command is usually used for retrieving one or more -resources of the same resource type. It features a rich set of flags that allows -you to customize the output format using the `-o` or `--output` flag, for example. -You can specify the `-w` or `--watch` flag to start watching updates to a particular -object. The `kubectl describe` command is more focused on describing the many -related aspects of a specified resource. It may invoke several API calls to the -API server to build a view for the user. For example, the `kubectl describe node` -command retrieves not only the information about the node, but also a summary of -the pods running on it, the events generated for the node etc. -{{< /note >}} - -`kubectl delete` - Delete resources either from a file, stdin, or specifying label selectors, names, resource selectors, or resources. - -```shell -# Delete a pod using the type and name specified in the pod.yaml file. -kubectl delete -f pod.yaml - -# Delete all the pods and services that have the label '<label-key>=<label-value>'. -kubectl delete pods,services -l <label-key>=<label-value> - -# Delete all pods, including uninitialized ones. -kubectl delete pods --all -``` - -`kubectl exec` - Execute a command against a container in a pod. - -```shell -# Get output from running 'date' from pod <pod-name>. By default, output is from the first container. -kubectl exec <pod-name> -- date - -# Get output from running 'date' in container <container-name> of pod <pod-name>. -kubectl exec <pod-name> -c <container-name> -- date - -# Get an interactive TTY and run /bin/bash from pod <pod-name>. By default, output is from the first container. -kubectl exec -ti <pod-name> -- /bin/bash -``` - -`kubectl logs` - Print the logs for a container in a pod. - -```shell -# Return a snapshot of the logs from pod <pod-name>. -kubectl logs <pod-name> - -# Start streaming the logs from pod <pod-name>. This is similar to the 'tail -f' Linux command. -kubectl logs -f <pod-name> -``` - -`kubectl diff` - View a diff of the proposed updates to a cluster. - -```shell -# Diff resources included in "pod.json". -kubectl diff -f pod.json - -# Diff file read from stdin. -cat service.yaml | kubectl diff -f - -``` - -## Examples: Creating and using plugins - -Use the following set of examples to help you familiarize yourself with writing and using `kubectl` plugins: - -```shell -# create a simple plugin in any language and name the resulting executable file -# so that it begins with the prefix "kubectl-" -cat ./kubectl-hello -``` -```shell -#!/bin/sh - -# this plugin prints the words "hello world" -echo "hello world" -``` -With a plugin written, let's make it executable: -```bash -chmod a+x ./kubectl-hello - -# and move it to a location in our PATH -sudo mv ./kubectl-hello /usr/local/bin -sudo chown root:root /usr/local/bin - -# You have now created and "installed" a kubectl plugin. -# You can begin using this plugin by invoking it from kubectl as if it were a regular command -kubectl hello -``` -``` -hello world -``` - -```shell -# You can "uninstall" a plugin, by removing it from the folder in your -# $PATH where you placed it -sudo rm /usr/local/bin/kubectl-hello -``` - -In order to view all of the plugins that are available to `kubectl`, use -the `kubectl plugin list` subcommand: - -```shell -kubectl plugin list -``` -The output is similar to: -``` -The following kubectl-compatible plugins are available: - -/usr/local/bin/kubectl-hello -/usr/local/bin/kubectl-foo -/usr/local/bin/kubectl-bar -``` - -`kubectl plugin list` also warns you about plugins that are not -executable, or that are shadowed by other plugins; for example: -```shell -sudo chmod -x /usr/local/bin/kubectl-foo # remove execute permission -kubectl plugin list -``` -``` -The following kubectl-compatible plugins are available: - -/usr/local/bin/kubectl-hello -/usr/local/bin/kubectl-foo - - warning: /usr/local/bin/kubectl-foo identified as a plugin, but it is not executable -/usr/local/bin/kubectl-bar - -error: one plugin warning was found -``` - -You can think of plugins as a means to build more complex functionality on top -of the existing kubectl commands: - -```shell -cat ./kubectl-whoami -``` -The next few examples assume that you already made `kubectl-whoami` have -the following contents: -```shell -#!/bin/bash - -# this plugin makes use of the `kubectl config` command in order to output -# information about the current user, based on the currently selected context -kubectl config view --template='{{ range .contexts }}{{ if eq .name "'$(kubectl config current-context)'" }}Current user: {{ printf "%s\n" .context.user }}{{ end }}{{ end }}' -``` - -Running the above command gives you an output containing the user for the -current context in your KUBECONFIG file: - -```shell -# make the file executable -sudo chmod +x ./kubectl-whoami - -# and move it into your PATH -sudo mv ./kubectl-whoami /usr/local/bin - -kubectl whoami -Current user: plugins-user -``` - -## {{% heading "whatsnext" %}} - -* Start using the [kubectl](/docs/reference/generated/kubectl/kubectl-commands/) commands. - -* To find out more about plugins, take a look at the [example cli plugin](https://github.com/kubernetes/sample-cli-plugin). - diff --git a/content/en/docs/setup/production-environment/tools/kops.md b/content/en/docs/setup/production-environment/tools/kops.md index cf5333a92d..0575986ebd 100644 --- a/content/en/docs/setup/production-environment/tools/kops.md +++ b/content/en/docs/setup/production-environment/tools/kops.md @@ -231,7 +231,7 @@ See the [list of add-ons](/docs/concepts/cluster-administration/addons/) to expl ## {{% heading "whatsnext" %}} -* Learn more about Kubernetes [concepts](/docs/concepts/) and [`kubectl`](/docs/reference/kubectl/overview/). +* Learn more about Kubernetes [concepts](/docs/concepts/) and [`kubectl`](/docs/reference/kubectl/). * Learn more about `kops` [advanced usage](https://kops.sigs.k8s.io/) for tutorials, best practices and advanced configuration options. * Follow `kops` community discussions on Slack: [community discussions](https://github.com/kubernetes/kops#other-ways-to-communicate-with-the-contributors) * Contribute to `kops` by addressing or raising an issue [GitHub Issues](https://github.com/kubernetes/kops/issues) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md index aa6f99d69c..e9b423e279 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md @@ -500,7 +500,7 @@ options. * <a id="lifecycle" />See [Upgrading kubeadm clusters](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) for details about upgrading your cluster using `kubeadm`. * Learn about advanced `kubeadm` usage in the [kubeadm reference documentation](/docs/reference/setup-tools/kubeadm/kubeadm) -* Learn more about Kubernetes [concepts](/docs/concepts/) and [`kubectl`](/docs/reference/kubectl/overview/). +* Learn more about Kubernetes [concepts](/docs/concepts/) and [`kubectl`](/docs/reference/kubectl/). * See the [Cluster Networking](/docs/concepts/cluster-administration/networking/) page for a bigger list of Pod network add-ons. * <a id="other-addons" />See the [list of add-ons](/docs/concepts/cluster-administration/addons/) to diff --git a/content/en/docs/setup/production-environment/windows/user-guide-windows-containers.md b/content/en/docs/setup/production-environment/windows/user-guide-windows-containers.md index 177f7623f6..cf3fafd784 100644 --- a/content/en/docs/setup/production-environment/windows/user-guide-windows-containers.md +++ b/content/en/docs/setup/production-environment/windows/user-guide-windows-containers.md @@ -29,7 +29,7 @@ This guide walks you through the steps to configure and deploy a Windows contain control plane and a [worker node running Windows Server](/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes/) * It is important to note that creating and deploying services and workloads on Kubernetes behaves in much the same way for Linux and Windows containers. -[Kubectl commands](/docs/reference/kubectl/overview/) to interface with the cluster are identical. +[Kubectl commands](/docs/reference/kubectl/) to interface with the cluster are identical. The example in the section below is provided to jumpstart your experience with Windows containers. ## Getting Started: Deploying a Windows container diff --git a/content/en/docs/tasks/access-application-cluster/access-cluster.md b/content/en/docs/tasks/access-application-cluster/access-cluster.md index c70fde47e6..3bd994f80b 100644 --- a/content/en/docs/tasks/access-application-cluster/access-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/access-cluster.md @@ -27,8 +27,8 @@ kubectl config view ``` Many of the [examples](/docs/reference/kubectl/cheatsheet/) provide an introduction to using -kubectl and complete documentation is found in the -[kubectl manual](/docs/reference/kubectl/overview/). +`kubectl`, and complete documentation is found in the +[kubectl reference](/docs/reference/kubectl/). ## Directly accessing the REST API diff --git a/content/en/docs/tasks/administer-cluster/access-cluster-api.md b/content/en/docs/tasks/administer-cluster/access-cluster-api.md index e8c37aa613..9abdd1c3a3 100644 --- a/content/en/docs/tasks/administer-cluster/access-cluster-api.md +++ b/content/en/docs/tasks/administer-cluster/access-cluster-api.md @@ -31,7 +31,7 @@ kubectl config view ``` Many of the [examples](https://github.com/kubernetes/examples/tree/master/) provide an introduction to using -kubectl. Complete documentation is found in the [kubectl manual](/docs/reference/kubectl/overview/). +kubectl. Complete documentation is found in the [kubectl manual](/docs/reference/kubectl/). ### Directly accessing the REST API diff --git a/content/en/docs/tasks/debug-application-cluster/troubleshooting.md b/content/en/docs/tasks/debug-application-cluster/troubleshooting.md index 4bfa053bd5..f000d019e8 100644 --- a/content/en/docs/tasks/debug-application-cluster/troubleshooting.md +++ b/content/en/docs/tasks/debug-application-cluster/troubleshooting.md @@ -36,7 +36,7 @@ accomplish commonly used tasks, and [Tutorials](/docs/tutorials/) are more comprehensive walkthroughs of real-world, industry-specific, or end-to-end development scenarios. The [Reference](/docs/reference/) section provides detailed documentation on the [Kubernetes API](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/) -and command-line interfaces (CLIs), such as [`kubectl`](/docs/reference/kubectl/overview/). +and command-line interfaces (CLIs), such as [`kubectl`](/docs/reference/kubectl/). ## Help! My question isn't covered! I need help now! diff --git a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md index 6b30143470..df66a99281 100644 --- a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md +++ b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md @@ -1125,7 +1125,7 @@ with `foo` pruned and defaulted because the field is non-nullable, `bar` maintai CustomResourceDefinition [OpenAPI v3 validation schemas](#validation) which are [structural](#specifying-a-structural-schema) and [enable pruning](#field-pruning) are published as part of the [OpenAPI v2 spec](/docs/concepts/overview/kubernetes-api/#openapi-and-swagger-definitions) from Kubernetes API server. -The [kubectl](/docs/reference/kubectl/overview) command-line tool consumes the published schema to perform client-side validation (`kubectl create` and `kubectl apply`), schema explanation (`kubectl explain`) on custom resources. The published schema can be consumed for other purposes as well, like client generation or documentation. +The [kubectl](/docs/reference/kubectl/) command-line tool consumes the published schema to perform client-side validation (`kubectl create` and `kubectl apply`), schema explanation (`kubectl explain`) on custom resources. The published schema can be consumed for other purposes as well, like client generation or documentation. The OpenAPI v3 validation schema is converted to OpenAPI v2 schema, and show up in `definitions` and `paths` fields in the [OpenAPI v2 spec](/docs/concepts/overview/kubernetes-api/#openapi-and-swagger-definitions). diff --git a/content/en/docs/tutorials/hello-minikube.md b/content/en/docs/tutorials/hello-minikube.md index e6398d7c72..f43c63eae9 100644 --- a/content/en/docs/tutorials/hello-minikube.md +++ b/content/en/docs/tutorials/hello-minikube.md @@ -136,7 +136,7 @@ Pod runs a Container based on the provided Docker image. ``` {{< note >}} -For more information about `kubectl` commands, see the [kubectl overview](/docs/reference/kubectl/overview/). +For more information about `kubectl` commands, see the [kubectl overview](/docs/reference/kubectl/). {{< /note >}} ## Create a Service diff --git a/static/_redirects b/static/_redirects index 10e81668ee..ab0fdb5f55 100644 --- a/static/_redirects +++ b/static/_redirects @@ -214,6 +214,7 @@ /docs/reference/glossary/maintainer/ /docs/reference/glossary/approver/ 301 +/docs/reference/kubectl/overview/ /docs/reference/kubectl/ 301 /docs/reference/kubectl/kubectl-cmds/ /docs/reference/generated/kubectl/kubectl-commands/ 301! /docs/reference/kubectl/kubectl/kubectl_* /docs/reference/generated/kubectl/kubectl-commands#:splat 301 /docs/reference/scheduling/profiles/ /docs/reference/scheduling/config/#profiles 301 @@ -400,7 +401,7 @@ /docs/user-guide/jobs/work-queue-1/ /docs/tasks/job/coarse-parallel-processing-work-queue/ 301 /docs/user-guide/jobs/work-queue-2/ /docs/tasks/job/fine-parallel-processing-work-queue/ 301 /docs/user-guide/kubeconfig-file/ /docs/tasks/access-application-cluster/authenticate-across-clusters-kubeconfig/ 301 -/docs/user-guide/kubectl-overview/ /docs/reference/kubectl/overview/ +/docs/user-guide/kubectl-overview/ /docs/reference/kubectl/ 301 /docs/user-guide/kubectl/ /docs/reference/generated/kubectl/kubectl-options/ /docs/user-guide/kubectl-conventions/ /docs/reference/kubectl/conventions/ /docs/user-guide/kubectl-cheatsheet/ /docs/reference/kubectl/cheatsheet/ From e0d4b37070b160f8c6e8fd73fa7a8d254b62ae4d Mon Sep 17 00:00:00 2001 From: Tim Bannister <tim@scalefactory.com> Date: Sun, 5 Dec 2021 23:04:29 +0000 Subject: [PATCH 077/104] Highlight link to kubectl cheat sheet Also, reorder the section overall. --- content/en/docs/reference/kubectl/_index.md | 3 ++- content/en/docs/reference/kubectl/cheatsheet.md | 1 + content/en/docs/reference/kubectl/jsonpath.md | 1 - content/en/docs/reference/kubectl/kubectl-cmds.md | 1 + 4 files changed, 4 insertions(+), 2 deletions(-) diff --git a/content/en/docs/reference/kubectl/_index.md b/content/en/docs/reference/kubectl/_index.md index ba53c66598..26f16a3abe 100644 --- a/content/en/docs/reference/kubectl/_index.md +++ b/content/en/docs/reference/kubectl/_index.md @@ -21,7 +21,8 @@ This overview covers `kubectl` syntax, describes the command operations, and pro For details about each command, including all the supported flags and subcommands, see the [kubectl](/docs/reference/generated/kubectl/kubectl-commands/) reference documentation. -For installation instructions, see [Installing kubectl](/docs/tasks/tools/#kubectl). +For installation instructions, see [Installing kubectl](/docs/tasks/tools/#kubectl); +for a quick guide, see the [cheat sheet](/docs/reference/kubectl/cheatsheet/). <!-- body --> diff --git a/content/en/docs/reference/kubectl/cheatsheet.md b/content/en/docs/reference/kubectl/cheatsheet.md index 52addfb9d2..8d995efb49 100644 --- a/content/en/docs/reference/kubectl/cheatsheet.md +++ b/content/en/docs/reference/kubectl/cheatsheet.md @@ -5,6 +5,7 @@ reviewers: - krousey - clove content_type: concept +weight: 10 # highlight it card: name: reference weight: 30 diff --git a/content/en/docs/reference/kubectl/jsonpath.md b/content/en/docs/reference/kubectl/jsonpath.md index d26c110cee..36e29e6350 100644 --- a/content/en/docs/reference/kubectl/jsonpath.md +++ b/content/en/docs/reference/kubectl/jsonpath.md @@ -1,7 +1,6 @@ --- title: JSONPath Support content_type: concept -weight: 25 --- <!-- overview --> diff --git a/content/en/docs/reference/kubectl/kubectl-cmds.md b/content/en/docs/reference/kubectl/kubectl-cmds.md index 0c37ed2fd1..ecb8b87c3b 100644 --- a/content/en/docs/reference/kubectl/kubectl-cmds.md +++ b/content/en/docs/reference/kubectl/kubectl-cmds.md @@ -1,5 +1,6 @@ --- title: kubectl Commands +weight: 20 --- [kubectl Command Reference](/docs/reference/generated/kubectl/kubectl-commands/) From 77a598cb33a616c627c71e4e71d5234fbba7a5e9 Mon Sep 17 00:00:00 2001 From: Tim Bannister <tim@scalefactory.com> Date: Thu, 3 Mar 2022 10:02:36 +0000 Subject: [PATCH 078/104] =?UTF-8?q?Use=20in-page=20=E2=80=9Cwhat's=20next?= =?UTF-8?q?=E2=80=9D=20list=20for=20kubectl?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- content/en/docs/reference/kubectl/_index.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/content/en/docs/reference/kubectl/_index.md b/content/en/docs/reference/kubectl/_index.md index 26f16a3abe..cdbfca809e 100644 --- a/content/en/docs/reference/kubectl/_index.md +++ b/content/en/docs/reference/kubectl/_index.md @@ -2,6 +2,7 @@ title: Command line tool (kubectl) content_type: reference weight: 60 +no_list: true card: name: reference weight: 20 @@ -23,6 +24,7 @@ For details about each command, including all the supported flags and subcommand For installation instructions, see [Installing kubectl](/docs/tasks/tools/#kubectl); for a quick guide, see the [cheat sheet](/docs/reference/kubectl/cheatsheet/). +If you're used to using the `docker` command-line tool, [`kubectl` for Docker Users](/docs/reference/kubectl/docker-cli-to-kubectl/) explains some equivalent commands for Kubernetes. <!-- body --> @@ -545,7 +547,10 @@ Current user: plugins-user ## {{% heading "whatsnext" %}} -* Read the `kubectl` [command reference](/docs/reference/kubectl/kubectl/). -* Read the `kubectl` [command line arguments](/docs/reference/kubectl/kubectl/) reference. -* Read about how to [extend kubectl with plugins](/docs/tasks/extend-kubectl/kubectl-plugins). +* Read the `kubectl` reference documentation: + * the kubectl [command reference](/docs/reference/kubectl/kubectl/) + * the [command line arguments](/docs/reference/generated/kubectl/kubectl-commands/) reference +* Learn about [`kubectl` usage conventions](/docs/reference/kubectl/conventions/) +* Read about [JSONPath support](/docs/reference/kubectl/jsonpath/) in kubectl +* Read about how to [extend kubectl with plugins](/docs/tasks/extend-kubectl/kubectl-plugins) * To find out more about plugins, take a look at the [example CLI plugin](https://github.com/kubernetes/sample-cli-plugin). From 80fc5e84e58bb2093bca71915e0dad58d6858d3a Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Thu, 3 Mar 2022 18:00:39 +0800 Subject: [PATCH 079/104] [zh] tweak scheduling framework page 1. Sync the diagram property "diagram-class" 1. Avoid translating the stages of the scheduling context. These translations are not necessary and they may cause confusion when read along with the diagram. --- .../scheduling-framework.md | 65 ++++++++++--------- 1 file changed, 33 insertions(+), 32 deletions(-) diff --git a/content/zh/docs/concepts/scheduling-eviction/scheduling-framework.md b/content/zh/docs/concepts/scheduling-eviction/scheduling-framework.md index 303b707a2f..9e0fee45ac 100644 --- a/content/zh/docs/concepts/scheduling-eviction/scheduling-framework.md +++ b/content/zh/docs/concepts/scheduling-eviction/scheduling-framework.md @@ -99,9 +99,9 @@ stateful tasks. 一个插件可以在多个扩展点处注册，以执行更复杂或有状态的任务。 <!-- -{{< figure src="/images/docs/scheduling-framework-extensions.png" title="scheduling framework extension points" >}} +{{< figure src="/images/docs/scheduling-framework-extensions.png" title="scheduling framework extension points" class="diagram-large">}} --> -{{< figure src="/images/docs/scheduling-framework-extensions.png" title="调度框架扩展点" >}} +{{< figure src="/images/docs/scheduling-framework-extensions.png" title="调度框架扩展点" class="diagram-large">}} <!-- ### QueueSort {#queue-sort} @@ -113,27 +113,27 @@ These plugins are used to sort Pods in the scheduling queue. A queue sort plugin essentially provides a `less(Pod1, Pod2)` function. Only one queue sort plugin may be enabled at a time. --> -队列排序插件用于对调度队列中的 Pod 进行排序。 +这些插件用于对调度队列中的 Pod 进行排序。 队列排序插件本质上提供 `less(Pod1, Pod2)` 函数。 一次只能启动一个队列插件。 <!-- ### PreFilter {#pre-filter} --> -### 前置过滤 {#pre-filter} +### PreFilter {#pre-filter} <!-- These plugins are used to pre-process info about the Pod, or to check certain conditions that the cluster or the Pod must meet. If a PreFilter plugin returns an error, the scheduling cycle is aborted. --> -前置过滤插件用于预处理 Pod 的相关信息，或者检查集群或 Pod 必须满足的某些条件。 +这些插件用于预处理 Pod 的相关信息，或者检查集群或 Pod 必须满足的某些条件。 如果 PreFilter 插件返回错误，则调度周期将终止。 <!-- ### Filter --> -### 过滤 +### Filter <!-- These plugins are used to filter out nodes that cannot run the Pod. For each @@ -141,14 +141,14 @@ node, the scheduler will call filter plugins in their configured order. If any filter plugin marks the node as infeasible, the remaining plugins will not be called for that node. Nodes may be evaluated concurrently. --> -过滤插件用于过滤出不能运行该 Pod 的节点。对于每个节点， +这些插件用于过滤出不能运行该 Pod 的节点。对于每个节点， 调度器将按照其配置顺序调用这些过滤插件。如果任何过滤插件将节点标记为不可行， 则不会为该节点调用剩下的过滤插件。节点可以被同时进行评估。 <!-- ### PostFilter {#post-filter} --> -### 后置过滤 {#post-filter} +### PostFilter {#post-filter} <!-- These plugins are called after Filter phase, but only when no feasible nodes @@ -157,29 +157,28 @@ any postFilter plugin marks the node as `Schedulable`, the remaining plugins will not be called. A typical PostFilter implementation is preemption, which tries to make the pod schedulable by preempting other Pods. --> - -这些插件在筛选阶段后调用，但仅在该 Pod 没有可行的节点时调用。 -插件按其配置的顺序调用。如果任何后过滤器插件标记节点为“可调度”， -则其余的插件不会调用。典型的后筛选实现是抢占，试图通过抢占其他 Pod +这些插件在 Filter 阶段后调用，但仅在该 Pod 没有可行的节点时调用。 +插件按其配置的顺序调用。如果任何 PostFilter 插件标记节点为“Schedulable”， +则其余的插件不会调用。典型的 PostFilter 实现是抢占，试图通过抢占其他 Pod 的资源使该 Pod 可以调度。 <!-- ### PreScore {#pre-score} --> -### 前置评分 {#pre-score} +### PreScore {#pre-score} <!-- These plugins are used to perform "pre-scoring" work, which generates a sharable state for Score plugins to use. If a PreScore plugin returns an error, the scheduling cycle is aborted. --> -前置评分插件用于执行 “前置评分” 工作，即生成一个可共享状态供评分插件使用。 +这些插件用于执行 “前置评分（pre-scoring）” 工作，即生成一个可共享状态供 Score 插件使用。 如果 PreScore 插件返回错误，则调度周期将终止。 <!-- ### Score {#scoring} --> -### 评分 {#scoring} +### Score {#scoring} <!-- These plugins are used to rank nodes that have passed the filtering phase. The @@ -188,7 +187,7 @@ defined range of integers representing the minimum and maximum scores. After the [NormalizeScore](#normalize-scoring) phase, the scheduler will combine node scores from all plugins according to the configured plugin weights. --> -评分插件用于对通过过滤阶段的节点进行排名。调度器将为每个节点调用每个评分插件。 +这些插件用于对通过过滤阶段的节点进行排序。调度器将为每个节点调用每个评分插件。 将有一个定义明确的整数范围，代表最小和最大分数。 在[标准化评分](#normalize-scoring)阶段之后，调度器将根据配置的插件权重 合并所有插件的节点分数。 @@ -196,7 +195,7 @@ scores from all plugins according to the configured plugin weights. <!-- ### NormalizeScore {#normalize-scoring} --> -### 标准化评分 {#normalize-scoring} +### NormalizeScore {#normalize-scoring} <!-- These plugins are used to modify scores before the scheduler computes a final @@ -204,8 +203,8 @@ ranking of Nodes. A plugin that registers for this extension point will be called with the [Score](#scoring) results from the same plugin. This is called once per plugin per scheduling cycle. --> -标准化评分插件用于在调度器计算节点的排名之前修改分数。 -在此扩展点注册的插件将使用同一插件的[评分](#scoring) 结果被调用。 +这些插件用于在调度器计算 Node 排名之前修改分数。 +在此扩展点注册的插件被调用时会使用同一插件的 [Score](#scoring) 结果。 每个插件在每个调度周期调用一次。 <!-- @@ -278,8 +277,8 @@ state, it will either trigger [Unreserve](#unreserve) plugins (on failure) or [PostBind](#post-bind) plugins (on success) at the end of the binding cycle. --> 这个是调度周期的最后一步。 -一旦 Pod 处于保留状态，它将在绑定周期结束时触发[不保留](#unreserve) 插件 -（失败时）或 [绑定后](#post-bind) 插件（成功时）。 +一旦 Pod 处于保留状态，它将在绑定周期结束时触发 [Unreserve](#unreserve) 插件 +（失败时）或 [PostBind](#post-bind) 插件（成功时）。 <!-- ### Permit @@ -335,28 +334,28 @@ is approved, it is sent to the [PreBind](#pre-bind) phase. 尽管任何插件可以访问 “等待中” 状态的 Pod 列表并批准它们 (查看 [`FrameworkHandle`](https://git.k8s.io/enhancements/keps/sig-scheduling/624-scheduling-framework#frameworkhandle))。 我们期望只有允许插件可以批准处于 “等待中” 状态的预留 Pod 的绑定。 -一旦 Pod 被批准了，它将发送到[预绑定](#pre-bind) 阶段。 +一旦 Pod 被批准了，它将发送到 [PreBind](#pre-bind) 阶段。 {{< /note >}} <!-- ### Pre-bind {#pre-bind} --> -### 预绑定 {#pre-bind} +### PreBind {#pre-bind} <!-- These plugins are used to perform any work required before a Pod is bound. For example, a pre-bind plugin may provision a network volume and mount it on the target node before allowing the Pod to run there. --> -预绑定插件用于执行 Pod 绑定前所需的任何工作。 -例如，一个预绑定插件可能需要提供网络卷并且在允许 Pod 运行在该节点之前 +这些插件用于执行 Pod 绑定前所需的所有工作。 +例如，一个 PreBind 插件可能需要制备网络卷并且在允许 Pod 运行在该节点之前 将其挂载到目标节点上。 <!-- If any PreBind plugin returns an error, the Pod is [rejected](#unreserve) and returned to the scheduling queue. --> -如果任何 PreBind 插件返回错误，则 Pod 将被[拒绝](#unreserve) 并且 +如果任何 PreBind 插件返回错误，则 Pod 将被 [拒绝](#unreserve) 并且 退回到调度队列中。 <!-- @@ -372,13 +371,13 @@ Pod. If a bind plugin chooses to handle a Pod, **the remaining bind plugins are skipped**. --> Bind 插件用于将 Pod 绑定到节点上。直到所有的 PreBind 插件都完成，Bind 插件才会被调用。 -各绑定插件按照配置顺序被调用。绑定插件可以选择是否处理指定的 Pod。 -如果绑定插件选择处理 Pod，**剩余的绑定插件将被跳过**。 +各 Bind 插件按照配置顺序被调用。Bind 插件可以选择是否处理指定的 Pod。 +如果某 Bind 插件选择处理某 Pod，**剩余的 Bind 插件将被跳过**。 <!-- ### PostBind {#post-bind} --> -### 绑定后 {#post-bind} +### PostBind {#post-bind} <!-- This is an informational extension point. Post-bind plugins are called after a @@ -386,7 +385,7 @@ Pod is successfully bound. This is the end of a binding cycle, and can be used to clean up associated resources. --> 这是个信息性的扩展点。 -绑定后插件在 Pod 成功绑定后被调用。这是绑定周期的结尾，可用于清理相关的资源。 +PostBind 插件在 Pod 成功绑定后被调用。这是绑定周期的结尾，可用于清理相关的资源。 <!-- ### Unreserve @@ -406,7 +405,7 @@ Unreserve 插件应该清楚保留 Pod 的相关状态。 Plugins that use this extension point usually should also use [Reserve](#reserve). --> -使用此扩展点的插件通常也使用[Reserve](#reserve)。 +使用此扩展点的插件通常也使用 [Reserve](#reserve)。 <!-- ## Plugin API @@ -461,7 +460,7 @@ plugins and get them configured along with default plugins. You can visit [scheduler-plugins](https://github.com/kubernetes-sigs/scheduler-plugins) for more details. --> 除了默认的插件，你还可以实现自己的调度插件并且将它们与默认插件一起配置。 -你可以访问[scheduler-plugins](https://github.com/kubernetes-sigs/scheduler-plugins) +你可以访问 [scheduler-plugins](https://github.com/kubernetes-sigs/scheduler-plugins) 了解更多信息。 <!-- @@ -472,3 +471,5 @@ Learn more at [multiple profiles](/docs/reference/scheduling/config/#multiple-pr 如果你正在使用 Kubernetes v1.18 或更高版本，你可以将一组插件设置为 一个调度器配置文件，然后定义不同的配置文件来满足各类工作负载。 了解更多关于[多配置文件](/zh/docs/reference/scheduling/config/#multiple-profiles)。 + + From b76366329de77b330cafc8ae146195fe240aac8f Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Thu, 3 Mar 2022 20:08:38 +0800 Subject: [PATCH 080/104] Update scheduler configuration sample version This PR updates the scheduler configuration YAML snippets to use the 'v1beta3' version API. 'v1beta1' is gone and not recommended. We don't have config API reference for 'v1beta1' now. --- .../en/docs/concepts/scheduling-eviction/assign-pod-node.md | 2 +- .../docs/concepts/scheduling-eviction/resource-bin-packing.md | 2 +- .../workloads/pods/pod-topology-spread-constraints.md | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/concepts/scheduling-eviction/assign-pod-node.md b/content/en/docs/concepts/scheduling-eviction/assign-pod-node.md index 9216ec2ff9..462428800c 100644 --- a/content/en/docs/concepts/scheduling-eviction/assign-pod-node.md +++ b/content/en/docs/concepts/scheduling-eviction/assign-pod-node.md @@ -167,7 +167,7 @@ To do so, add an `addedAffinity` to the args of the [`NodeAffinity` plugin](/doc in the [scheduler configuration](/docs/reference/scheduling/config/). For example: ```yaml -apiVersion: kubescheduler.config.k8s.io/v1beta1 +apiVersion: kubescheduler.config.k8s.io/v1beta3 kind: KubeSchedulerConfiguration profiles: diff --git a/content/en/docs/concepts/scheduling-eviction/resource-bin-packing.md b/content/en/docs/concepts/scheduling-eviction/resource-bin-packing.md index 17a426e35b..a81d9904ac 100644 --- a/content/en/docs/concepts/scheduling-eviction/resource-bin-packing.md +++ b/content/en/docs/concepts/scheduling-eviction/resource-bin-packing.md @@ -38,7 +38,7 @@ Below is an example configuration that sets resources `intel.com/foo` and `intel.com/bar`. ```yaml -apiVersion: kubescheduler.config.k8s.io/v1beta1 +apiVersion: kubescheduler.config.k8s.io/v1beta3 kind: KubeSchedulerConfiguration profiles: # ... diff --git a/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md b/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md index 25e1059abb..4823cd26f5 100644 --- a/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md +++ b/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md @@ -306,7 +306,7 @@ replication controllers, replica sets or stateful sets that the Pod belongs to. An example configuration might look like follows: ```yaml -apiVersion: kubescheduler.config.k8s.io/v1beta1 +apiVersion: kubescheduler.config.k8s.io/v1beta3 kind: KubeSchedulerConfiguration profiles: @@ -366,7 +366,7 @@ you can disable those defaults by setting `defaultingType` to `List` and leaving empty `defaultConstraints` in the `PodTopologySpread` plugin configuration: ```yaml -apiVersion: kubescheduler.config.k8s.io/v1beta1 +apiVersion: kubescheduler.config.k8s.io/v1beta3 kind: KubeSchedulerConfiguration profiles: From 2268f317c6189dfb99de2148a7a0d56e0c276dbb Mon Sep 17 00:00:00 2001 From: Benedikt Rollik <brollik@online.net> Date: Thu, 3 Mar 2022 14:49:51 +0100 Subject: [PATCH 081/104] fix: typo --- content/de/docs/concepts/overview/what-is-kubernetes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/de/docs/concepts/overview/what-is-kubernetes.md b/content/de/docs/concepts/overview/what-is-kubernetes.md index 66b79d6928..fcd529407c 100644 --- a/content/de/docs/concepts/overview/what-is-kubernetes.md +++ b/content/de/docs/concepts/overview/what-is-kubernetes.md @@ -15,7 +15,7 @@ Diese Seite ist eine Übersicht über Kubernetes. Kubernetes ist eine portable, erweiterbare Open-Source-Plattform zur Verwaltung von containerisierten Arbeitslasten und Services, die sowohl die deklarative Konfiguration als auch die Automatisierung erleichtert. -Es hat einen großes, schnell wachsendes Ökosystem. Kubernetes Dienstleistungen, Support und Tools sind weit verbreitet. +Es hat ein großes, schnell wachsendes Ökosystem. Kubernetes Dienstleistungen, Support und Tools sind weit verbreitet. Google hat das Kubernetes-Projekt 2014 als Open-Source-Projekt zur Verfügung gestellt. Kubernetes baut auf anderthalb Jahrzehnten Erfahrung auf, die Google mit der Ausführung von Produktions-Workloads in großem Maßstab hat, kombiniert mit den besten Ideen und Praktiken der Community. From 0240ba9a8a18dbd04943e7d6f73e6ebac0c4d7a4 Mon Sep 17 00:00:00 2001 From: FOWind <fzq96417@163.com> Date: Thu, 3 Mar 2022 15:19:05 +0000 Subject: [PATCH 082/104] [zh]sync developing-cloud-controller-manager --- .../developing-cloud-controller-manager.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/developing-cloud-controller-manager.md b/content/zh/docs/tasks/administer-cluster/developing-cloud-controller-manager.md index 0a9dae2eb4..96cb157012 100644 --- a/content/zh/docs/tasks/administer-cluster/developing-cloud-controller-manager.md +++ b/content/zh/docs/tasks/administer-cluster/developing-cloud-controller-manager.md @@ -54,17 +54,17 @@ To build an out-of-tree cloud-controller-manager for your cloud, follow these st 要为你的云环境构建一个 out-of-tree 云控制器管理器： <!-- -1. Create a go package with an implementation that satisfies [cloudprovider.Interface](https://git.k8s.io/kubernetes/pkg/cloudprovider/cloud.go). +1. Create a go package with an implementation that satisfies [cloudprovider.Interface](https://github.com/kubernetes/cloud-provider/blob/master/cloud.go). 2. Use [main.go in cloud-controller-manager](https://github.com/kubernetes/kubernetes/blob/master/cmd/cloud-controller-manager/main.go) from Kubernetes core as a template for your main.go. As mentioned above, the only difference should be the cloud package that will be imported. -3. Import your cloud package in `main.go`, ensure your package has an `init` block to run [cloudprovider.RegisterCloudProvider](https://github.com/kubernetes/kubernetes/blob/master/pkg/cloudprovider/plugins.go#L42-L52). +3. Import your cloud package in `main.go`, ensure your package has an `init` block to run [cloudprovider.RegisterCloudProvider](https://github.com/kubernetes/cloud-provider/blob/master/plugins.go). --> -1. 使用满足 [cloudprovider.Interface](https://git.k8s.io/kubernetes/pkg/cloudprovider/cloud.go) +1. 使用满足 [cloudprovider.Interface](https://github.com/kubernetes/cloud-provider/blob/master/cloud.go) 的实现创建一个 Go 语言包。 2. 使用来自 Kubernetes 核心代码库的 [cloud-controller-manager 中的 main.go](https://github.com/kubernetes/kubernetes/blob/master/cmd/cloud-controller-manager/main.go) 作为 main.go 的模板。如上所述，唯一的区别应该是将导入的云包。 3. 在 `main.go` 中导入你的云包，确保你的包有一个 `init` 块来运行 - [cloudprovider.RegisterCloudProvider](https://github.com/kubernetes/kubernetes/blob/master/pkg/cloudprovider/plugins.go#L42-L52)。 + [cloudprovider.RegisterCloudProvider](https://github.com/kubernetes/cloud-provider/blob/master/plugins.go)。 <!-- Many cloud providers publish their controller manager code as open source. If you are creating From 3f8ac40b0e1a74778caa2ad1909b0a83174b08c1 Mon Sep 17 00:00:00 2001 From: pangqing <pangqing@uniontech.com> Date: Fri, 4 Mar 2022 13:40:33 +0800 Subject: [PATCH 083/104] Modify the expulsion link initiated by API Signed-off-by: pangqing <pangqing@uniontech.com> --- .../node-pressure-eviction.md | 2 +- ！ | 53 ------------------- 2 files changed, 1 insertion(+), 54 deletions(-) delete mode 100644 ！ diff --git a/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md b/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md index 906b604a0a..fcecf74a10 100644 --- a/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md +++ b/content/zh/docs/concepts/scheduling-eviction/node-pressure-eviction.md @@ -22,7 +22,7 @@ During a node-pressure eviction, the kubelet sets the `PodPhase` for the selected pods to `Failed`. This terminates the pods. Node-pressure eviction is not the same as -[API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/). +[API-initiated eviction](/docs/reference/generated/kubernetes-api/v1.23/). --> {{<glossary_tooltip term_id="kubelet" text="kubelet">}} 监控集群节点的 CPU、内存、磁盘空间和文件系统的 inode 等资源。 diff --git a/！ b/！ deleted file mode 100644 index 81274d27aa..0000000000 --- a/！ +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: 调度，抢占和驱逐 -weight: 90 -content_type: concept -description: > - 在Kubernetes中，调度 (scheduling) 指的是确保 Pods 匹配到合适的节点， - 以便 kubelet 能够运行它们。抢占 (Preemption) 指的是终止低优先级的 Pods 以便高优先级的 Pods 可以 - 调度运行的过程。驱逐 (Eviction) 是在资源匮乏的节点上，主动让一个或多个 Pods 失效的过程。 ---- - -<!-- ---- -title: "Scheduling, Preemption and Eviction" -weight: 90 -content_type: concept -description: > - In Kubernetes, scheduling refers to making sure that Pods are matched to Nodes - so that the kubelet can run them. Preemption is the process of terminating - Pods with lower Priority so that Pods with higher Priority can schedule on - Nodes. Eviction is the process of proactively terminating one or more Pods on - resource-starved Nodes. -no_list: true ---- ---> - -<!-- -In Kubernetes, scheduling refers to making sure that {{<glossary_tooltip text="Pods" term_id="pod">}} -are matched to {{<glossary_tooltip text="Nodes" term_id="node">}} so that the -{{<glossary_tooltip text="kubelet" term_id="kubelet">}} can run them. Preemption -is the process of terminating Pods with lower {{<glossary_tooltip text="Priority" term_id="pod-priority">}} -so that Pods with higher Priority can schedule on Nodes. Eviction is the process -of terminating one or more Pods on Nodes. ---> - -<!-- ## Scheduling --> - -## 调度 - -* [Kubernetes 调度器](/zh/docs/concepts/scheduling-eviction/kube-scheduler/) -* [将 Pods 指派到节点](/zh/docs/concepts/scheduling-eviction/assign-pod-node/) -* [Pod 开销](/zh/docs/concepts/scheduling-eviction/pod-overhead/) -* [污点和容忍](/zh/docs/concepts/scheduling-eviction/taint-and-toleration/) -* [调度框架](/zh/docs/concepts/scheduling-eviction/scheduling-framework) -* [调度器的性能调试](/zh/docs/concepts/scheduling-eviction/scheduler-perf-tuning/) -* [扩展资源的资源装箱](/zh/docs/concepts/scheduling-eviction/resource-bin-packing/) - -<!-- ## Pod Disruption --> - -## Pod 干扰 - -* [Pod 优先级和抢占](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) -* [节点压力驱逐](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) -* [API发起的驱逐](/zh/docs/concepts/scheduling-eviction/api-eviction/) From 56526806c79b37dd92968fffc2034155f79b2b6d Mon Sep 17 00:00:00 2001 From: Wang <ooocamel@icloud.com> Date: Fri, 4 Mar 2022 15:14:52 +0900 Subject: [PATCH 084/104] [ja] Translate tasks/debug-application-cluster/local-debugging into Japanese (#30981) * done * add reviewer * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: Ryota Yamada <42636694+riita10069@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: Ryota Yamada <42636694+riita10069@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: Ryota Yamada <42636694+riita10069@users.noreply.github.com> * Update local-debugging.md * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> * Update content/ja/docs/tasks/debug-application-cluster/local-debugging.md Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> Co-authored-by: nasa9084 <nasa9084@users.noreply.github.com> Co-authored-by: Ryota Yamada <42636694+riita10069@users.noreply.github.com> --- .../local-debugging.md | 60 +++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 content/ja/docs/tasks/debug-application-cluster/local-debugging.md diff --git a/content/ja/docs/tasks/debug-application-cluster/local-debugging.md b/content/ja/docs/tasks/debug-application-cluster/local-debugging.md new file mode 100644 index 0000000000..3edc646bb5 --- /dev/null +++ b/content/ja/docs/tasks/debug-application-cluster/local-debugging.md @@ -0,0 +1,60 @@ +--- +title: ローカルでのサービス開発・デバッグ +content_type: task +--- + +<!-- overview --> + +Kubernetesアプリケーションは通常、複数の独立したサービスから構成され、それぞれが独自のコンテナで動作しています。これらのサービスをリモートのKubernetesクラスター上で開発・デバッグするには、[get a shell on a running container](/docs/task/debug-application-cluster/get-shell-running-container/)してリモートシェル内でツールを実行しなければならず面倒な場合があります。 + +`telepresence`は、リモートKubernetesクラスターにサービスをプロキシーしながら、ローカルでサービスを開発・デバッグするプロセスを容易にするためのツールです。 +`telepresence` を使用すると、デバッガーやIDEなどのカスタムツールをローカルサービスで使用でき、ConfigMapやsecret、リモートクラスター上で動作しているサービスへのフルアクセスをサービスに提供します。 + +このドキュメントでは、リモートクラスタ上で動作しているサービスをローカルで開発・デバッグするために`telepresence`を使用する方法を説明します。 + +## {{% heading "prerequisites" %}} + +* Kubernetesクラスターがインストールされていること +* クラスターと通信するために `kubectl` が設定されていること +* [telepresence](https://www.telepresence.io/reference/install)がインストールされていること + +<!-- steps --> + +## リモートクラスター上でシェルの取得 + +ターミナルを開いて、引数なしで`telepresence`を実行すると、`telepresence`シェルが表示されます。 +このシェルはローカルで動作し、ローカルのファイルシステムに完全にアクセスすることができます。 + +この`telepresence`シェルは様々な方法で使用することができます。 +例えば、ラップトップでシェルスクリプトを書いて、それをシェルから直接リアルタイムで実行することができます。これはリモートシェルでもできますが、好みのコードエディターが使えないかもしれませんし、コンテナが終了するとスクリプトは削除されます。 + +終了してシェルを閉じるには`exit`と入力してください。 + +## 既存サービスの開発・デバッグ + +Kubernetes上でアプリケーションを開発する場合、通常は1つのサービスをプログラミングまたはデバッグすることになります。 +そのサービスは、テストやデバッグのために他のサービスへのアクセスを必要とする場合があります。 +継続的なデプロイメントパイプラインを使用することも一つの選択肢ですが、最速のデプロイメントパイプラインでさえ、プログラムやデバッグサイクルに遅延が発生します。 + +既存のデプロイメントとtelepresenceプロキシーを交換するには、`--swap-deployment` オプションを使用します。 +スワップすることで、ローカルでサービスを実行し、リモートのKubernetesクラスターに接続することができます。 +リモートクラスター内のサービスは、ローカルで実行されているインスタンスにアクセスできるようになりました。 + +telepresenceを「--swap-deployment」で実行するには、次のように入力します。 + +`telepresence --swap-deployment $DEPLOYMENT_NAME` + +ここで、$DEPLOYMENT_NAMEは既存のDeploymentの名前です。 + +このコマンドを実行すると、シェルが起動します。そのシェルで、サービスを起動します。 +そして、ローカルでソースコードの編集を行い、保存すると、すぐに変更が反映されるのを確認できます。 +また、デバッガーやその他のローカルな開発ツールでサービスを実行することもできます。 + +## {{% heading "whatsnext" %}} + +もしハンズオンのチュートリアルに興味があるなら、Google Kubernetes Engine上でGuestbookアプリケーションをローカルに開発する手順を説明した[こちらのチュートリアル](https://cloud.google.com/community/tutorials/developing-services-with-k8s)をチェックしてみてください。 + +telepresenceには、状況に応じて[numerous proxying options](https://www.telepresence.io/reference/methods)があります。 + +さらに詳しい情報は、[telepresence website](https://www.telepresence.io)をご覧ください。 + From 15a047d4a88d5a1115a4c2ea1409c2c38c84bf14 Mon Sep 17 00:00:00 2001 From: Arhell <arhell333@gmail.com> Date: Fri, 4 Mar 2022 08:51:25 +0200 Subject: [PATCH 085/104] [es] fix link of XFS project quotas --- .../docs/concepts/configuration/manage-resources-containers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/es/docs/concepts/configuration/manage-resources-containers.md b/content/es/docs/concepts/configuration/manage-resources-containers.md index 919f1c515b..55e17c405f 100644 --- a/content/es/docs/concepts/configuration/manage-resources-containers.md +++ b/content/es/docs/concepts/configuration/manage-resources-containers.md @@ -763,4 +763,4 @@ Puedes ver que el Contenedor fué terminado a causa de `reason:OOM Killed`, dond * Lee [ResourceRequirements](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#resourcerequirements-v1-core) referencia de API -* Lee sobre [project quotas](https://xfs.org/docs/xfsdocs-xml-dev/XFS_User_Guide/tmp/en-US/html/xfs-quotas.html) en XFS +* Lee sobre [cuotas de proyecto](https://xfs.org/index.php/XFS_FAQ#Q:_Quota:_Do_quotas_work_on_XFS.3F) en XFS From a8e8c9b44c1b6afe0ad663b45feba39c5c982575 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Fri, 4 Mar 2022 18:41:56 +0800 Subject: [PATCH 086/104] Update cron-jobs.md Compared with the English document, there is one less description explaining the automatic cleaning task. --- content/zh/docs/concepts/workloads/controllers/cron-jobs.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/zh/docs/concepts/workloads/controllers/cron-jobs.md b/content/zh/docs/concepts/workloads/controllers/cron-jobs.md index c4239d1e82..7380cd6146 100644 --- a/content/zh/docs/concepts/workloads/controllers/cron-jobs.md +++ b/content/zh/docs/concepts/workloads/controllers/cron-jobs.md @@ -285,6 +285,7 @@ and set this flag to `false`. For example: * 阅读 CronJob `.spec.schedule` 字段的[格式](https://pkg.go.dev/github.com/robfig/cron/v3#hdr-CRON_Expression_Format)。 * 有关创建和使用 CronJob 的说明及示例规约文件，请参见 [使用 CronJob 运行自动化任务](/zh/docs/tasks/job/automated-tasks-with-cron-jobs/)。 +* 有关自动清理失败或完成作业的说明，请参阅[自动清理作业](/docs/concepts/workloads/controllers/job/#clean-up-finished-jobs-automatically) * `CronJob` 是 Kubernetes REST API 的一部分， 阅读 {{< api-reference page="workload-resources/cron-job-v1" >}} 对象定义以了解关于该资源的 API。 From 3b2dee6b4e6dde9484e629d912730f96e7a89241 Mon Sep 17 00:00:00 2001 From: Tim Bannister <tim@scalefactory.com> Date: Fri, 4 Mar 2022 16:20:43 +0000 Subject: [PATCH 087/104] =?UTF-8?q?Mark=20=E2=80=9CRemembering=20Dan=20Koh?= =?UTF-8?q?n=E2=80=9D=20article=20evergreen?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- content/en/blog/_posts/2020-11-02-remembering-dan-kohn.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/blog/_posts/2020-11-02-remembering-dan-kohn.md b/content/en/blog/_posts/2020-11-02-remembering-dan-kohn.md index b8ffb8686a..579567750a 100644 --- a/content/en/blog/_posts/2020-11-02-remembering-dan-kohn.md +++ b/content/en/blog/_posts/2020-11-02-remembering-dan-kohn.md @@ -3,6 +3,7 @@ layout: blog title: "Remembering Dan Kohn" date: 2020-11-02 slug: remembering-dan-kohn +evergreen: true --- **Author**: The Kubernetes Steering Committee From 0f60e93b403ddf5df8f5f6e4bc3aa247837d14b7 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sat, 5 Mar 2022 11:58:57 +0800 Subject: [PATCH 088/104] Update cron-jobs.md Add original comment --- content/zh/docs/concepts/workloads/controllers/cron-jobs.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/zh/docs/concepts/workloads/controllers/cron-jobs.md b/content/zh/docs/concepts/workloads/controllers/cron-jobs.md index 7380cd6146..acbde8bf08 100644 --- a/content/zh/docs/concepts/workloads/controllers/cron-jobs.md +++ b/content/zh/docs/concepts/workloads/controllers/cron-jobs.md @@ -276,6 +276,8 @@ and set this flag to `false`. For example: * For instructions on creating and working with CronJobs, and for an example of a CronJob manifest, see [Running automated tasks with CronJobs](/docs/tasks/job/automated-tasks-with-cron-jobs/). +* For instructions to clean up failed or completed jobs automatically, + see [Clean up Jobs automatically](/docs/concepts/workloads/controllers/job/#clean-up-finished-jobs-automatically) * `CronJob` is part of the Kubernetes REST API. Read the {{< api-reference page="workload-resources/cron-job-v1" >}} object definition to understand the API for Kubernetes cron jobs. @@ -285,7 +287,7 @@ and set this flag to `false`. For example: * 阅读 CronJob `.spec.schedule` 字段的[格式](https://pkg.go.dev/github.com/robfig/cron/v3#hdr-CRON_Expression_Format)。 * 有关创建和使用 CronJob 的说明及示例规约文件，请参见 [使用 CronJob 运行自动化任务](/zh/docs/tasks/job/automated-tasks-with-cron-jobs/)。 -* 有关自动清理失败或完成作业的说明，请参阅[自动清理作业](/docs/concepts/workloads/controllers/job/#clean-up-finished-jobs-automatically) +* 有关自动清理失败或完成作业的说明，请参阅[自动清理作业](/zh/docs/concepts/workloads/controllers/job/#clean-up-finished-jobs-automatically) * `CronJob` 是 Kubernetes REST API 的一部分， 阅读 {{< api-reference page="workload-resources/cron-job-v1" >}} 对象定义以了解关于该资源的 API。 From eec15923242e0025e872f706472f225ea9bcca58 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sat, 5 Mar 2022 13:36:03 +0800 Subject: [PATCH 089/104] Update replicaset.md Original code comment adjustment --- content/zh/docs/concepts/workloads/controllers/replicaset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/concepts/workloads/controllers/replicaset.md b/content/zh/docs/concepts/workloads/controllers/replicaset.md index 98efbc3c38..45572eaacc 100644 --- a/content/zh/docs/concepts/workloads/controllers/replicaset.md +++ b/content/zh/docs/concepts/workloads/controllers/replicaset.md @@ -540,7 +540,7 @@ prioritize scaling down pods based on the following general algorithm: <!-- 1. Pending (and unschedulable) pods are scaled down first - 2. If controller.kubernetes.io/pod-deletion-cost annotation is set, then + 2. If `controller.kubernetes.io/pod-deletion-cost` annotation is set, then the pod with the lower value will come first. 3. Pods on nodes with more replicas come before pods on nodes with fewer replicas. 4. If the pods' creation times differ, the pod that was created more recently From 927cd0518134e5c957a5a8ad5756dfe902a07bd6 Mon Sep 17 00:00:00 2001 From: koolwithk <alokmauryaa@gmail.com> Date: Sat, 5 Mar 2022 14:55:49 +0530 Subject: [PATCH 090/104] Docs - Fixed double quotes issue with feature-gates Double quotes was giving error as below, may be need to update the code to accept the double quotes. Error: invalid argument "\"GracefulNodeShutdown=true\"" for "--feature-gates" flag: invalid value of "GracefulNodeShutdown=true", err: strconv.ParseBool: parsing "true\"": invalid syntax --- .../reference/command-line-tools-reference/feature-gates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 0c8ee404c3..9880598642 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -29,7 +29,7 @@ To set feature gates for a component, such as kubelet, use the `--feature-gates` flag assigned to a list of feature pairs: ```shell ---feature-gates="...,GracefulNodeShutdown=true" +--feature-gates=...,GracefulNodeShutdown=true ``` The following tables are a summary of the feature gates that you can set on From d9c1c7c8ce559c2dce4591acff7f05349fe53d15 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sat, 5 Mar 2022 19:55:23 +0800 Subject: [PATCH 091/104] Update storage-classes.md Synchronize English documentation about storageclass --- .../zh/docs/concepts/storage/storage-classes.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/zh/docs/concepts/storage/storage-classes.md b/content/zh/docs/concepts/storage/storage-classes.md index 97a4af0f16..753cd37e74 100644 --- a/content/zh/docs/concepts/storage/storage-classes.md +++ b/content/zh/docs/concepts/storage/storage-classes.md @@ -83,7 +83,7 @@ metadata: name: standard provisioner: kubernetes.io/aws-ebs parameters: - type: gp2 + type: gp3 reclaimPolicy: Retain allowVolumeExpansion: true mountOptions: @@ -430,9 +430,9 @@ parameters: ``` <!-- -* `type`: `io1`, `gp2`, `sc1`, `st1`. See +* `type`: `io1`, `gp2`, `gp2`, `sc1`, `st1`. See [AWS docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html) - for details. Default: `gp2`. + for details. Default: `gp3`. * `zone` (Deprecated): AWS zone. If neither `zone` nor `zones` is specified, volumes are generally round-robin-ed across all active zones where Kubernetes cluster has a node. `zone` and `zones` parameters must not be used at the same time. @@ -453,8 +453,8 @@ parameters: encrypting the volume. If none is supplied but `encrypted` is true, a key is generated by AWS. See AWS docs for valid ARN value. --> -* `type`：`io1`，`gp2`，`sc1`，`st1`。详细信息参见 - [AWS 文档](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html)。默认值：`gp2`。 +* `type`：`io1`，`gp2`，`gp3`，`sc1`，`st1`。详细信息参见 + [AWS 文档](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html)。默认值：`gp3`。 * `zone`(弃用)：AWS 区域。如果没有指定 `zone` 和 `zones`， 通常卷会在 Kubernetes 集群节点所在的活动区域中轮询调度分配。 `zone` 和 `zones` 参数不能同时使用。 @@ -695,7 +695,7 @@ provisioner: example.com/external-nfs parameters: server: nfs-server.example.com path: /share - readOnly: false + readOnly: "false" ``` <!-- @@ -1293,7 +1293,7 @@ parameters: storagePool: sp1 storageMode: ThinProvisioned secretRef: sio-secret - readOnly: false + readOnly: "false" fsType: xfs ``` From f490705eddafe5ceedfb4eb6308a3b690a64f769 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sat, 5 Mar 2022 20:14:29 +0800 Subject: [PATCH 092/104] Update volume-snapshot-classes.md Sync documentation about Volume Snapshot Classes --- .../docs/concepts/storage/volume-snapshot-classes.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/content/zh/docs/concepts/storage/volume-snapshot-classes.md b/content/zh/docs/concepts/storage/volume-snapshot-classes.md index 55da18425f..8739de2d04 100644 --- a/content/zh/docs/concepts/storage/volume-snapshot-classes.md +++ b/content/zh/docs/concepts/storage/volume-snapshot-classes.md @@ -41,6 +41,11 @@ The name of a VolumeSnapshotClass object is significant, and is how users can request a particular class. Administrators set the name and other parameters of a class when first creating VolumeSnapshotClass objects, and the objects cannot be updated once they are created. + +{{< note >}} +Installation of the CRDs is the responsibility of the Kubernetes distribution. Without the required CRDs present, the creation of a VolumeSnapshotClass fails. +{{< /note >}} + --> ## VolumeSnapshotClass 资源 {#the-volumesnapshortclass-resource} @@ -51,6 +56,10 @@ VolumeSnapshotClass 对象的名称很重要，是用户可以请求特定类的 管理员在首次创建 VolumeSnapshotClass 对象时设置类的名称和其他参数， 对象一旦创建就无法更新。 +{{< note >}} +CRD 的安装是 Kubernetes 发行版的责任。 如果不存在所需的 CRD，则 VolumeSnapshotClass 的创建将失败。 +{{< /note >}} + ```yaml apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass @@ -119,4 +128,3 @@ the volume snapshot class. Different parameters may be accepted depending on the ## 参数 {#parameters} 卷快照类具有描述属于该卷快照类的卷快照的参数，可根据 `driver` 接受不同的参数。 - From b6ecca10ebaea063f835c81d9ae102b2ed387e92 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sat, 5 Mar 2022 20:44:00 +0800 Subject: [PATCH 093/104] Update resource-bin-packing.md Sync the English documentation about Resource Bin Packing for Extended Resources --- .../resource-bin-packing.md | 75 +++++++++++-------- 1 file changed, 42 insertions(+), 33 deletions(-) diff --git a/content/zh/docs/concepts/scheduling-eviction/resource-bin-packing.md b/content/zh/docs/concepts/scheduling-eviction/resource-bin-packing.md index 08eb73003a..46442f5868 100644 --- a/content/zh/docs/concepts/scheduling-eviction/resource-bin-packing.md +++ b/content/zh/docs/concepts/scheduling-eviction/resource-bin-packing.md @@ -112,8 +112,11 @@ scheduler. `shape` 用于指定 `RequestedToCapacityRatioPriority` 函数的行为。 ```yaml - {"utilization": 0, "score": 0}, - {"utilization": 100, "score": 10} +shape: + - utilization: 0 + score: 0 + - utilization: 100 + score: 10 ``` <!-- @@ -125,8 +128,11 @@ The above arguments give the node a score of 0 if utilization is 0% and 10 for u 要启用最少请求（least requested）模式，必须按如下方式反转得分值。 ```yaml - {"utilization": 0, "score": 10}, - {"utilization": 100, "score": 0} + shape: + - utilization: 0 + score: 10 + - utilization: 100 + score: 0 ``` <!-- @@ -135,10 +141,11 @@ The above arguments give the node a score of 0 if utilization is 0% and 10 for u `resources` 是一个可选参数，默认情况下设置为： ``` yaml -"resources": [ - {"name": "CPU", "weight": 1}, - {"name": "Memory", "weight": 1} -] +resources: + - name: cpu + weight: 1 + - name: memory + weight: 1 ``` <!-- @@ -147,11 +154,13 @@ It can be used to add extended resources as follows: 它可以用来添加扩展资源，如下所示： ```yaml -"resources": [ - {"name": "intel.com/foo", "weight": 5}, - {"name": "CPU", "weight": 3}, - {"name": "Memory", "weight": 1} -] +resources: + - name: intel.com/foo + weight: 5 + - name: cpu + weight: 3 + - name: memory + weight: 1 ``` <!-- @@ -161,14 +170,14 @@ weight 参数是可选的，如果未指定，则设置为 1。 同时，weight 不能设置为负值。 <!-- -### How the RequestedToCapacityRatioResourceAllocation Priority Function Scores Nodes +### Node scoring for capacity allocation This section is intended for those who want to understand the internal details of this feature. Below is an example of how the node score is calculated for a given set of values. --> -### RequestedToCapacityRatioResourceAllocation 优先级函数如何对节点评分 +### 节点容量分配的评分 本节适用于希望了解此功能的内部细节的人员。 以下是如何针对给定的一组值来计算节点得分的示例。 @@ -176,15 +185,15 @@ Below is an example of how the node score is calculated for a given set of value ``` 请求的资源 -intel.com/foo: 2 -Memory: 256MB -CPU: 2 +intel.com/foo : 2 +memory: 256MB +cpu: 2 资源权重 -intel.com/foo: 5 -Memory: 1 -CPU: 3 +intel.com/foo : 5 +memory: 1 +cpu: 3 FunctionShapePoint {{0, 0}, {100, 10}} @@ -192,13 +201,13 @@ FunctionShapePoint {{0, 0}, {100, 10}} 可用： intel.com/foo : 4 - Memory : 1 GB - CPU: 8 + memory : 1 GB + cpu: 8 已用： intel.com/foo: 1 - Memory: 256MB - CPU: 1 + memory: 256MB + cpu: 1 节点得分： @@ -209,13 +218,13 @@ intel.com/foo = resourceScoringFunction((2+1),4) = rawScoringFunction(75) = 7 -Memory = resourceScoringFunction((256+256),1024) +memory = resourceScoringFunction((256+256),1024) = (100 -((1024-512)*100/1024)) = 50 = rawScoringFunction(50) = 5 -CPU = resourceScoringFunction((2+1),8) +cpu = resourceScoringFunction((2+1),8) = (100 -((8-3)*100/8)) = 37.5 = rawScoringFunction(37.5) @@ -229,13 +238,13 @@ NodeScore = (7 * 5) + (5 * 1) + (3 * 3) / (5 + 1 + 3) 可用： intel.com/foo: 8 - Memory: 1GB - CPU: 8 + memory: 1GB + cpu: 8 已用： intel.com/foo: 2 - Memory: 512MB - CPU: 6 + memory: 512MB + cpu: 6 节点得分： @@ -246,13 +255,13 @@ intel.com/foo = resourceScoringFunction((2+2),8) = rawScoringFunction(50) = 5 -Memory = resourceScoringFunction((256+512),1024) +memory = resourceScoringFunction((256+512),1024) = (100 -((1024-768)*100/1024)) = 75 = rawScoringFunction(75) = 7 -CPU = resourceScoringFunction((2+6),8) +cpu = resourceScoringFunction((2+6),8) = (100 -((8-8)*100/8)) = 100 = rawScoringFunction(100) From c8e181b4bb34b4bdd72f10db8a5a136c05a1850c Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sat, 5 Mar 2022 20:53:37 +0800 Subject: [PATCH 094/104] Update scheduler-perf-tuning.md Sync English documentation about Scheduler Performance Tuning --- .../concepts/scheduling-eviction/scheduler-perf-tuning.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/zh/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md b/content/zh/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md index 398a06f18d..dd6e1da395 100644 --- a/content/zh/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md +++ b/content/zh/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md @@ -85,7 +85,7 @@ To change the value, edit the and then restart the scheduler. In many cases, the configuration file can be found at `/etc/kubernetes/config/kube-scheduler.yaml` --> -要修改这个值，先编辑 [kube-scheduler 的配置文件](/zh/docs/reference/config-api/kube-scheduler-config.v1beta2/) +要修改这个值，先编辑 [kube-scheduler 的配置文件](/zh/docs/reference/config-api/kube-scheduler-config.v1beta3/) 然后重启调度器。 大多数情况下，这个配置文件是 `/etc/kubernetes/config/kube-scheduler.yaml`。 @@ -298,6 +298,6 @@ After going over all the Nodes, it goes back to Node 1. ## {{% heading "whatsnext" %}} -<!-- * Check the [kube-scheduler configuration reference (v1beta1)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) --> +<!-- * Check the [kube-scheduler configuration reference (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) --> -* 参见 [kube-scheduler 配置参考 (v1beta1)](/zh/docs/reference/config-api/kube-scheduler-config.v1beta2/) +* 参见 [kube-scheduler 配置参考 (v1beta3)](/zh/docs/reference/config-api/kube-scheduler-config.v1beta3/) From 2862054aa0dc054ce49af4036f957ea5926e7075 Mon Sep 17 00:00:00 2001 From: FOWind <fzq96417@163.com> Date: Sat, 5 Mar 2022 14:41:40 +0000 Subject: [PATCH 095/104] [zh]fix namespaces-walkthrough, title format error --- .../zh/docs/tasks/administer-cluster/namespaces-walkthrough.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/namespaces-walkthrough.md b/content/zh/docs/tasks/administer-cluster/namespaces-walkthrough.md index 3d0e911688..c28a918db0 100644 --- a/content/zh/docs/tasks/administer-cluster/namespaces-walkthrough.md +++ b/content/zh/docs/tasks/administer-cluster/namespaces-walkthrough.md @@ -68,7 +68,7 @@ This example assumes the following: By default, a Kubernetes cluster will instantiate a default namespace when provisioning the cluster to hold the default set of Pods, Services, and Deployments used by the cluster. --> -1. 理解默认名字空间 +## 理解默认名字空间 默认情况下，Kubernetes 集群会在配置集群时实例化一个默认名字空间，用以存放集群所使用的默认 Pod、Service 和 Deployment 集合。 From d884ce7ce04c9865e6acf47e5dda26f7dbbb64e9 Mon Sep 17 00:00:00 2001 From: Yuvraj Shekhawat <56301121+yuvraj9@users.noreply.github.com> Date: Sun, 6 Mar 2022 02:49:14 +0530 Subject: [PATCH 096/104] Fixing typo error --- .../migrating-telemetry-and-security-agents.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/migrating-telemetry-and-security-agents.md b/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/migrating-telemetry-and-security-agents.md index 87ab93b1fc..13219bfd6d 100644 --- a/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/migrating-telemetry-and-security-agents.md +++ b/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/migrating-telemetry-and-security-agents.md @@ -22,7 +22,7 @@ Historically, Kubernetes was written to work specifically with Docker Engine. Kubernetes took care of networking and scheduling, relying on Docker Engine for launching and running containers (within Pods) on a node. Some information that is relevant to telemetry, such as a pod name, is only available from Kubernetes components. Other data, such as container -metrics, is not the responsibility of the container runtime. Early yelemetry agents needed to query the +metrics, is not the responsibility of the container runtime. Early telemetry agents needed to query the container runtime **and** Kubernetes to report an accurate picture. Over time, Kubernetes gained the ability to support multiple runtimes, and now supports any runtime that is compatible with the container runtime interface. From e11a116a3495344cdcae08e1d195ce23d6db9247 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sun, 6 Mar 2022 11:50:48 +0800 Subject: [PATCH 097/104] Update replicationcontroller.md Modify statement --- .../concepts/workloads/controllers/replicationcontroller.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/workloads/controllers/replicationcontroller.md b/content/en/docs/concepts/workloads/controllers/replicationcontroller.md index 063fc46267..6a40442dc6 100644 --- a/content/en/docs/concepts/workloads/controllers/replicationcontroller.md +++ b/content/en/docs/concepts/workloads/controllers/replicationcontroller.md @@ -266,7 +266,7 @@ Note that we recommend using Deployments instead of directly using Replica Sets, ### Deployment (Recommended) -[`Deployment`](/docs/concepts/workloads/controllers/deployment/) is a higher-level API object that updates its underlying Replica Sets and their Pods. Deployments are recommended if you want the rolling update functionality because, they are declarative, server-side, and have additional features. +[`Deployment`](/docs/concepts/workloads/controllers/deployment/) is a higher-level API object that updates its underlying Replica Sets and their Pods. Deployments are recommended if you want the rolling update functionality, because they are declarative, server-side, and have additional features. ### Bare Pods From d95e296a17c1369d17a1cca9cf85ada0b3aa4e33 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sun, 6 Mar 2022 12:31:34 +0800 Subject: [PATCH 098/104] Update service-traffic-policy.md Sync the en document about Service Internal Traffic Policy --- .../services-networking/service-traffic-policy.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/zh/docs/concepts/services-networking/service-traffic-policy.md b/content/zh/docs/concepts/services-networking/service-traffic-policy.md index 7fbbad454e..dad9dcc79b 100644 --- a/content/zh/docs/concepts/services-networking/service-traffic-policy.md +++ b/content/zh/docs/concepts/services-networking/service-traffic-policy.md @@ -15,7 +15,7 @@ weight: 45 <!-- overview --> -{{< feature-state for_k8s_version="v1.21" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} <!-- _Service Internal Traffic Policy_ enables internal traffic restrictions to only route @@ -35,16 +35,16 @@ _服务内部流量策略_ 开启了内部流量限制，只路由内部流量 ## 使用服务内部流量策略 {#using-service-internal-traffic-policy} <!-- -Once you have enabled the `ServiceInternalTrafficPolicy` -[feature gate](/docs/reference/command-line-tools-reference/feature-gates/), -you can enable an internal-only traffic policy for a +The `ServiceInternalTrafficPolicy` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) +is a Beta feature and enabled by default. +When the feature is enabled, you can enable the internal-only traffic policy for a {{< glossary_tooltip text="Services" term_id="service" >}}, by setting its `.spec.internalTrafficPolicy` to `Local`. This tells kube-proxy to only use node local endpoints for cluster internal traffic. --> -一旦你启用了 `ServiceInternalTrafficPolicy` 这个 -[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/), -你就可以通过将 {{< glossary_tooltip text="Services" term_id="service" >}} 的 +`ServiceInternalTrafficPolicy` +[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/) 是 Beta 功能，默认启用。 +启用该功能后，你就可以通过将 {{< glossary_tooltip text="Services" term_id="service" >}} 的 `.spec.internalTrafficPolicy` 项设置为 `Local`， 来为它指定一个内部专用的流量策略。 此设置就相当于告诉 kube-proxy 对于集群内部流量只能使用本地的服务端口。 From c4c2288084baeecf915e4b63db6a2c9c6b17cf14 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sun, 6 Mar 2022 12:49:16 +0800 Subject: [PATCH 099/104] Update system-traces.md Sync doc about Traces For Kubernetes System Components --- .../docs/concepts/cluster-administration/system-traces.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/concepts/cluster-administration/system-traces.md b/content/zh/docs/concepts/cluster-administration/system-traces.md index 9916b403b0..71ede2f3e7 100644 --- a/content/zh/docs/concepts/cluster-administration/system-traces.md +++ b/content/zh/docs/concepts/cluster-administration/system-traces.md @@ -119,7 +119,7 @@ spans for 1 in 10000 requests, and uses the default OpenTelemetry endpoint: 下面是一个示例配置，它为万分之一的请求记录 spans，并使用了默认的 OpenTelemetry 端口。 ```yaml -apiVersion: apiserver.config.k8s.io/v1beta1 +apiVersion: apiserver.config.k8s.io/v1alpha1 kind: TracingConfiguration # default value #endpoint: localhost:4317 @@ -128,11 +128,11 @@ samplingRatePerMillion: 100 <!-- For more information about the `TracingConfiguration` struct, see -[API server config API (v1beta1)](/docs/reference/config-api/apiserver-config.v1beta1/#apiserver-k8s-io-v1beta1-TracingConfiguration). +[API server config API (v1alpha1)](/docs/reference/config-api/apiserver-config.v1alpha1/#apiserver-k8s-io-v1alpha1-TracingConfiguration). --> 有关 TracingConfiguration 结构体的更多信息，请参阅 -[API 服务器配置 API (v1beta1)](/docs/reference/config-api/apiserver-config.v1beta1/#apiserver-k8s-io-v1beta1-TracingConfiguration)。 +[API 服务器配置 API (v1alpha1)](/zh/docs/reference/config-api/apiserver-config.v1alpha1/#apiserver-k8s-io-v1alpha1-TracingConfiguration)。 <!-- ## Stability @@ -154,4 +154,4 @@ there are no guarantees of backwards compatibility for tracing instrumentation. <!-- * Read about [Getting Started with the OpenTelemetry Collector](https://opentelemetry.io/docs/collector/getting-started/) --> -* 阅读[Getting Started with the OpenTelemetry Collector](https://opentelemetry.io/docs/collector/getting-started/) \ No newline at end of file +* 阅读[Getting Started with the OpenTelemetry Collector](https://opentelemetry.io/docs/collector/getting-started/) From 9e216c6f6bc000c48a2037e7588f9897dc801c98 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sun, 6 Mar 2022 13:14:22 +0800 Subject: [PATCH 100/104] Update networking.md Sync document about Cluster Networking --- .../cluster-administration/networking.md | 35 ++++++++++++------- 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/content/zh/docs/concepts/cluster-administration/networking.md b/content/zh/docs/concepts/cluster-administration/networking.md index e7c0ab9321..6175dc5395 100644 --- a/content/zh/docs/concepts/cluster-administration/networking.md +++ b/content/zh/docs/concepts/cluster-administration/networking.md @@ -142,11 +142,11 @@ Azure CNI 可以在 <!-- ### Calico -[Calico](https://docs.projectcalico.org/) is an open source networking and network security solution for containers, virtual machines, and native host-based workloads. Calico supports multiple data planes including: a pure Linux eBPF dataplane, a standard Linux networking dataplane, and a Windows HNS dataplane. Calico provides a full networking stack but can also be used in conjunction with [cloud provider CNIs](https://docs.projectcalico.org/networking/determine-best-networking#calico-compatible-cni-plugins-and-cloud-provider-integrations) to provide network policy enforcement. +[Calico](https://projectcalico.docs.tigera.io/about/about-calico/) is an open source networking and network security solution for containers, virtual machines, and native host-based workloads. Calico supports multiple data planes including: a pure Linux eBPF dataplane, a standard Linux networking dataplane, and a Windows HNS dataplane. Calico provides a full networking stack but can also be used in conjunction with [cloud provider CNIs](https://docs.projectcalico.org/networking/determine-best-networking#calico-compatible-cni-plugins-and-cloud-provider-integrations) to provide network policy enforcement. --> ### Calico -[Calico](https://docs.projectcalico.org/) 是一个开源的联网及网络安全方案， +[Calico](https://projectcalico.docs.tigera.io/about/about-calico/) 是一个开源的联网及网络安全方案， 用于基于容器、虚拟机和本地主机的工作负载。 Calico 支持多个数据面，包括：纯 Linux eBPF 的数据面、标准的 Linux 联网数据面 以及 Windows HNS 数据面。Calico 在提供完整的联网堆栈的同时，还可与 @@ -170,22 +170,22 @@ Cilium 支持 L7/HTTP，可以在 L3-L7 上通过使用与网络分离的基于 <!-- ### CNI-Genie from Huawei -[CNI-Genie](https://github.com/Huawei-PaaS/CNI-Genie) is a CNI plugin that enables Kubernetes to [simultaneously have access to different implementations](https://github.com/Huawei-PaaS/CNI-Genie/blob/master/docs/multiple-cni-plugins/README.md#what-cni-genie-feature-1-multiple-cni-plugins-enables) of the [Kubernetes network model](/docs/concepts/cluster-administration/networking/#the-kubernetes-network-model) in runtime. This includes any implementation that runs as a [CNI plugin](https://github.com/containernetworking/cni#3rd-party-plugins), such as [Flannel](https://github.com/coreos/flannel#flannel), [Calico](https://docs.projectcalico.org/), [Weave-net](https://www.weave.works/products/weave-net/). +[CNI-Genie](https://github.com/cni-genie/CNI-Genie) is a CNI plugin that enables Kubernetes to [simultaneously have access to different implementations](https://github.com/cni-genie/CNI-Genie/blob/master/docs/multiple-cni-plugins/README.md#what-cni-genie-feature-1-multiple-cni-plugins-enables) of the [Kubernetes network model](/docs/concepts/cluster-administration/networking/#how-to-implement-the-kubernetes-networking-model) in runtime. This includes any implementation that runs as a [CNI plugin](https://github.com/containernetworking/cni#3rd-party-plugins), such as [Flannel](https://github.com/coreos/flannel#flannel), [Calico](https://projectcalico.docs.tigera.io/about/about-calico/), [Weave-net](https://www.weave.works/oss/net/). -CNI-Genie also supports [assigning multiple IP addresses to a pod](https://github.com/Huawei-PaaS/CNI-Genie/blob/master/docs/multiple-ips/README.md#feature-2-extension-cni-genie-multiple-ip-addresses-per-pod), each from a different CNI plugin. +CNI-Genie also supports [assigning multiple IP addresses to a pod](https://github.com/cni-genie/CNI-Genie/blob/master/docs/multiple-ips/README.md#feature-2-extension-cni-genie-multiple-ip-addresses-per-pod), each from a different CNI plugin. --> ### 华为的 CNI-Genie -[CNI-Genie](https://github.com/Huawei-PaaS/CNI-Genie) 是一个 CNI 插件， +[CNI-Genie](https://github.com/cni-genie/CNI-Genie) 是一个 CNI 插件， 可以让 Kubernetes 在运行时使用不同的[网络模型](#the-kubernetes-network-model)的 -[实现同时被访问](https://github.com/Huawei-PaaS/CNI-Genie/blob/master/docs/multiple-cni-plugins/README.md#what-cni-genie-feature-1-multiple-cni-plugins-enables)。 +[实现同时被访问](https://github.com/cni-genie/CNI-Genie/blob/master/docs/multiple-cni-plugins/README.md#what-cni-genie-feature-1-multiple-cni-plugins-enables)。 这包括以 [CNI 插件](https://github.com/containernetworking/cni#3rd-party-plugins)运行的任何实现，比如 [Flannel](https://github.com/coreos/flannel#flannel)、 -[Calico](https://docs.projectcalico.org/)、 -[Weave-net](https://www.weave.works/products/weave-net/)。 +[Calico](https://projectcalico.docs.tigera.io/about/about-calico/)、 +[Weave-net](https://www.weave.works/oss/net/)。 -CNI-Genie 还支持[将多个 IP 地址分配给 Pod](https://github.com/Huawei-PaaS/CNI-Genie/blob/master/docs/multiple-ips/README.md#feature-2-extension-cni-genie-multi-ip-addresses-per-pod)， +CNI-Genie 还支持[将多个 IP 地址分配给 Pod](https://github.com/cni-genie/CNI-Genie/blob/master/docs/multiple-ips/README.md#feature-2-extension-cni-genie-multiple-ip-addresses-per-pod)， 每个都来自不同的 CNI 插件。 <!-- @@ -231,6 +231,15 @@ Coil operates with a low overhead compared to bare metal, and allows you to defi [Coil](https://github.com/cybozu-go/coil) 是一个为易于集成、提供灵活的出站流量网络而设计的 CNI 插件。 与裸机相比，Coil 的额外操作开销低，并允许针对外部网络的出站流量任意定义 NAT 网关。 +<!-- +### Contiv-VPP + +[Contiv-VPP](https://contivpp.io/) is a user-space, performance-oriented network plugin for +Kubernetes, using the [fd.io](https://fd.io/) data plane. +--> +### Contiv-VPP +[Contiv-VPP](https://contivpp.io/) 是用于 Kubernetes 的用户空间、面向性能的网络插件，使用 [fd.io](https://fd.io/) 数据平面。 + <!-- ### Contrail/Tungsten Fabric @@ -272,13 +281,13 @@ With this toolset DANM is able to provide multiple separated network interfaces, <!-- ### Flannel -[Flannel](https://github.com/coreos/flannel#flannel) is a very simple overlay +[Flannel](https://github.com/flannel-io/flannel#flannel) is a very simple overlay network that satisfies the Kubernetes requirements. Many people have reported success with Flannel and Kubernetes. --> ### Flannel -[Flannel](https://github.com/coreos/flannel#flannel) 是一个非常简单的能够满足 +[Flannel](https://github.com/flannel-io/flannel#flannel) 是一个非常简单的能够满足 Kubernetes 所需要的覆盖网络。已经有许多人报告了使用 Flannel 和 Kubernetes 的成功案例。 <!-- @@ -429,7 +438,7 @@ OVN 是一个由 Open vSwitch 社区开发的开源的网络虚拟化解决方 <!-- ### Weave Net from Weaveworks -[Weave Net](https://www.weave.works/products/weave-net/) is a +[Weave Net](https://www.weave.works/oss/net/) is a resilient and simple to use network for Kubernetes and its hosted applications. Weave Net runs as a [CNI plug-in](https://www.weave.works/docs/net/latest/cni-plugin/) or stand-alone. In either version, it doesn't require any configuration or extra code @@ -437,7 +446,7 @@ to run, and in both cases, the network provides one IP address per pod - as is s --> ### Weaveworks 的 Weave Net -[Weave Net](https://www.weave.works/products/weave-net/) 是 Kubernetes 及其 +[Weave Net](https://www.weave.works/oss/net/) 是 Kubernetes 及其 托管应用程序的弹性且易于使用的网络系统。 Weave Net 可以作为 [CNI 插件](https://www.weave.works/docs/net/latest/cni-plugin/) 运行或者独立运行。 在这两种运行方式里，都不需要任何配置或额外的代码即可运行，并且在两种情况下， From 6d01a88215f11b3cf53fcbfbb7268d515e9c73a3 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Sun, 6 Mar 2022 16:22:59 +0800 Subject: [PATCH 101/104] Update container-environment.md Sync doc about container-environment --- .../zh/docs/concepts/containers/container-environment.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/concepts/containers/container-environment.md b/content/zh/docs/concepts/containers/container-environment.md index 7e9a12be1b..362e9d4c1b 100644 --- a/content/zh/docs/concepts/containers/container-environment.md +++ b/content/zh/docs/concepts/containers/container-environment.md @@ -51,7 +51,7 @@ The Pod name and namespace are available as environment variables through the [downward API](/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/). User defined environment variables from the Pod definition are also available to the Container, -as are any environment variables specified statically in the Docker image. +as are any environment variables specified statically in the container image. --> ### 容器信息 @@ -62,14 +62,13 @@ Pod 名称和命名空间可以通过 [下行 API](/zh/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/) 转换为环境变量。 -Pod 定义中的用户所定义的环境变量也可在容器中使用，就像在 Docker 镜像中静态指定的任何环境变量一样。 +Pod 定义中的用户所定义的环境变量也可在容器中使用，就像在 container 镜像中静态指定的任何环境变量一样。 <!-- ### Cluster information A list of all services that were running when a Container was created is available to that Container as environment variables. This list is limited to services within the same namespace as the new Container's Pod and Kubernetes control plane services. -Those environment variables match the syntax of Docker links. For a service named *foo* that maps to a Container named *bar*, the following variables are defined: @@ -78,7 +77,6 @@ the following variables are defined: 创建容器时正在运行的所有服务都可用作该容器的环境变量。 这里的服务仅限于新容器的 Pod 所在的名字空间中的服务，以及 Kubernetes 控制面的服务。 -这些环境变量与 Docker 链接的语法相同。 对于名为 *foo* 的服务，当映射到名为 *bar* 的容器时，以下变量是被定义了的： From 8311f4324ccfd706956cfe9e21885b69d7af3b40 Mon Sep 17 00:00:00 2001 From: Qiming Teng <tengqm@outlook.com> Date: Thu, 3 Mar 2022 18:47:11 +0800 Subject: [PATCH 102/104] Make FEATURE STATE localizable Add i18n string for FEATURE STATE, for ease of localization. --- data/i18n/en/en.toml | 5 ++++- layouts/shortcodes/feature-state.html | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/data/i18n/en/en.toml b/data/i18n/en/en.toml index a4b0125e67..1cf54e6a09 100644 --- a/data/i18n/en/en.toml +++ b/data/i18n/en/en.toml @@ -69,6 +69,9 @@ other = "Were you looking for:" [examples_heading] other = "Examples" +[feature_state] +other = "FEATURE STATE:" + [feedback_heading] other = "Feedback" @@ -269,4 +272,4 @@ other = "Versions" other = "Warning:" [whatsnext_heading] -other = "What's next" \ No newline at end of file +other = "What's next" diff --git a/layouts/shortcodes/feature-state.html b/layouts/shortcodes/feature-state.html index a9cf606384..828241f50e 100644 --- a/layouts/shortcodes/feature-state.html +++ b/layouts/shortcodes/feature-state.html @@ -6,6 +6,6 @@ {{ errorf "%q is not a valid feature-state, use one of %q" $state $valid_states }} {{ else }} <div style="margin-top: 10px; margin-bottom: 10px;"> -<b>FEATURE STATE:</b> <code>Kubernetes {{ $for_k8s_version }} [{{ $state }}]</code> + <b>{{ T "feature_state" }}</b> <code>Kubernetes {{ $for_k8s_version }} [{{ $state }}]</code> </div> {{ end }} From b9f0844c2ab16f534cff0f7ed0e87424f47da483 Mon Sep 17 00:00:00 2001 From: my-git9 <76980726+my-git9@users.noreply.github.com> Date: Mon, 7 Mar 2022 15:09:28 +0800 Subject: [PATCH 103/104] Update runtime-class.md fix Sync doc about Runtime Class Signed-off-by: LIXIN <xin.li@daocloud.io> --- content/zh/docs/concepts/containers/runtime-class.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/content/zh/docs/concepts/containers/runtime-class.md b/content/zh/docs/concepts/containers/runtime-class.md index a2cee358c1..a56c163090 100644 --- a/content/zh/docs/concepts/containers/runtime-class.md +++ b/content/zh/docs/concepts/containers/runtime-class.md @@ -183,6 +183,15 @@ For more details on setting up CRI runtimes, see [CRI installation](/docs/setup/ #### dockershim +<!-- +{{< feature-state for_k8s_version="v1.20" state="deprecated" >}} + +Dockershim is deprecated as of Kubernetes v1.20, and will be removed in v1.24. For more information on the deprecation, +see [dockershim deprecation](/blog/2020/12/08/kubernetes-1-20-release-announcement/#dockershim-deprecation) +--> +Dockershim 自 Kubernetes v1.20 起已弃用，并将在 v1.24 中删除。 +有关弃用的更多信息查看 [dockershim 弃用](/blog/2020/12/08/kubernetes-1-20-release-announcement/#dockershim-deprecation)。 + <!-- RuntimeClasses with dockershim must set the runtime handler to `docker`. Dockershim does not support custom configurable runtime handlers. From 73ac0a7c0dd0bd7eb6377b17e7ee543fb4c9e3c9 Mon Sep 17 00:00:00 2001 From: chrismetz09 <cymetz@gmail.com> Date: Mon, 7 Feb 2022 14:58:33 -0800 Subject: [PATCH 104/104] Add figure <number> to text/caption in docs/contribute/ _index.md --- content/en/docs/contribute/_index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/contribute/_index.md b/content/en/docs/contribute/_index.md index 9c48566ccd..61a4e0a118 100644 --- a/content/en/docs/contribute/_index.md +++ b/content/en/docs/contribute/_index.md @@ -95,9 +95,9 @@ class A,B,C,D,E,F,G,H,M,Q,N,O,P,V grey class S,T,U spacewhite class first,second,third white {{</ mermaid >}} -***Figure - Getting started for a new contributor*** +Figure 1. Getting started for a new contributor. -The figure above outlines a roadmap for new contributors. You can follow some or all of the steps for `Sign up` and `Review`. Now you are ready to open PRs that achieve your contribution objectives with some listed under `Open PR`. Again, questions are always welcome! +Figure 1 outlines a roadmap for new contributors. You can follow some or all of the steps for `Sign up` and `Review`. Now you are ready to open PRs that achieve your contribution objectives with some listed under `Open PR`. Again, questions are always welcome! Some tasks require more trust and more access in the Kubernetes organization. See [Participating in SIG Docs](/docs/contribute/participate/) for more details about @@ -105,7 +105,7 @@ roles and permissions. ## Your first contribution -You can prepare for your first contribution by reviewing several steps beforehand. The figure below outlines the steps and the details follow. +You can prepare for your first contribution by reviewing several steps beforehand. Figure 2 outlines the steps and the details follow. <!-- See https://github.com/kubernetes/website/issues/28808 for live-editor URL to this figure --> <!-- You can also cut/paste the mermaid code into the live editor at https://mermaid-js.github.io/mermaid-live-editor to play around with it --> @@ -136,7 +136,7 @@ class A,B,D,E,F,G grey class S,T spacewhite class first,second white {{</ mermaid >}} -***Figure - Preparation for your first contribution*** +Figure 2. Preparation for your first contribution. - Read the [Contribution overview](/docs/contribute/new-content/overview/) to learn about the different ways you can contribute.