diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e14c07a89c..3dcdc63977 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -34,6 +34,6 @@ Note that code issues should be filed against the main kubernetes repository, wh ### Submitting Documentation Pull Requests -If you're fixing an issue in the existing documentation, you should submit a PR against the master branch. Follow [these instructions to create a documentation pull request against the kubernetes.io repository](http://kubernetes.io/docs/home/contribute/create-pull-request/). +If you're fixing an issue in the existing documentation, you should submit a PR against the main branch. Follow [these instructions to create a documentation pull request against the kubernetes.io repository](http://kubernetes.io/docs/home/contribute/create-pull-request/). For more information, see [contributing to Kubernetes docs](https://kubernetes.io/docs/contribute/). diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index 9763b65c88..6c6558ade1 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -2,10 +2,12 @@ aliases: sig-docs-blog-owners: # Approvers for blog content - onlydole - mrbobbytables + - sftim sig-docs-blog-reviewers: # Reviewers for blog content - mrbobbytables - onlydole - sftim + - nate-double-u sig-docs-de-owners: # Admins for German content - bene2k1 - mkorbi @@ -125,6 +127,7 @@ aliases: - ClaudiaJKang - gochist - ianychoi + - jihoon-seo - seokho-son - ysyukr sig-docs-ko-reviews: # PR reviews for Korean content @@ -242,19 +245,18 @@ aliases: - saschagrunert # SIG Chair release-engineering-approvers: - cpanato # Release Manager - - hasheddan # subproject owner / Release Manager + - palnabarun # Release Manager - puerco # Release Manager - saschagrunert # subproject owner / Release Manager - justaugustus # subproject owner / Release Manager + - Verolop # Release Manager - xmudrii # Release Manager release-engineering-reviewers: - ameukam # Release Manager Associate - jimangel # Release Manager Associate - markyjackson-taulia # Release Manager Associate - mkorbi # Release Manager Associate - - palnabarun # Release Manager Associate - onlydole # Release Manager Associate - sethmccombs # Release Manager Associate - thejoycekung # Release Manager Associate - - verolop # Release Manager Associate - wilsonehusin # Release Manager Associate diff --git a/content/en/blog/_posts/2018-10-01-health-checking-grpc.md b/content/en/blog/_posts/2018-10-01-health-checking-grpc.md index e6e584b274..7fbde70524 100644 --- a/content/en/blog/_posts/2018-10-01-health-checking-grpc.md +++ b/content/en/blog/_posts/2018-10-01-health-checking-grpc.md @@ -4,10 +4,12 @@ title: 'Health checking gRPC servers on Kubernetes' date: 2018-10-01 --- -_Built-in gRPC probes were introduced in Kubernetes 1.23. To learn more, see [Configure Liveness, Readiness and Startup Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-grpc-liveness-probe)._ - **Author**: [Ahmet Alp Balkan](https://twitter.com/ahmetb) (Google) +**Update (December 2021):** _Kubernetes now has built-in gRPC health probes starting in v1.23. +To learn more, see [Configure Liveness, Readiness and Startup Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-grpc-liveness-probe). +This article was originally written about an external tool to achieve the same task._ + [gRPC](https://grpc.io) is on its way to becoming the lingua franca for communication between cloud-native microservices. If you are deploying gRPC applications to Kubernetes today, you may be wondering about the best way to diff --git a/content/en/blog/_posts/2020-12-02-dockershim-faq.md b/content/en/blog/_posts/2020-12-02-dockershim-faq.md index 70e6c9b114..b5f226e926 100644 --- a/content/en/blog/_posts/2020-12-02-dockershim-faq.md +++ b/content/en/blog/_posts/2020-12-02-dockershim-faq.md @@ -12,6 +12,8 @@ on the deprecation of Docker as a container runtime for Kubernetes kubelets, and what that means, check out the blog post [Don't Panic: Kubernetes and Docker](/blog/2020/12/02/dont-panic-kubernetes-and-docker/). +Also, you can read [check whether Dockershim deprecation affects you](/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you/) to check whether it does. + ### Why is dockershim being deprecated? Maintaining dockershim has become a heavy burden on the Kubernetes maintainers. diff --git a/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md b/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md index e578ff4b3e..5b1fe2fe00 100644 --- a/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md +++ b/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md @@ -1,6 +1,6 @@ --- layout: blog -title: 'Pod Security Graduates to Beta' +title: 'Kubernetes 1.23: Pod Security Graduates to Beta' date: 2021-12-09 slug: pod-security-admission-beta --- diff --git a/content/en/blog/_posts/2021-11-18-prevent-persistentvolume-leaks-when-deleting-out-of-order.md b/content/en/blog/_posts/2021-12-15-prevent-persistentvolume-leaks-when-deleting-out-of-order.md similarity index 99% rename from content/en/blog/_posts/2021-11-18-prevent-persistentvolume-leaks-when-deleting-out-of-order.md rename to content/en/blog/_posts/2021-12-15-prevent-persistentvolume-leaks-when-deleting-out-of-order.md index 2d55cb4b77..c57296026f 100644 --- a/content/en/blog/_posts/2021-11-18-prevent-persistentvolume-leaks-when-deleting-out-of-order.md +++ b/content/en/blog/_posts/2021-12-15-prevent-persistentvolume-leaks-when-deleting-out-of-order.md @@ -1,6 +1,6 @@ --- layout: blog -title: "Kubernetes 1.23 Prevent PersistentVolume leaks when deleting out of order" +title: "Kubernetes 1.23: Prevent PersistentVolume leaks when deleting out of order" date: 2021-12-15T10:00:00-08:00 slug: kubernetes-1-23-prevent-persistentvolume-leaks-when-deleting-out-of-order --- diff --git a/content/en/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md b/content/en/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md new file mode 100644 index 0000000000..56e0df7416 --- /dev/null +++ b/content/en/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md @@ -0,0 +1,103 @@ +--- +layout: blog +title: 'Kubernetes 1.23: StatefulSet PVC Auto-Deletion (alpha)' +date: 2021-12-16 +slug: kubernetes-1-23-statefulset-pvc-auto-deletion +--- + +**Author:** Matthew Cary (Google) + +Kubernetes v1.23 introduced a new, alpha-level policy for +[StatefulSets](docs/concepts/workloads/controllers/statefulset/) that controls the lifetime of +[PersistentVolumeClaims](docs/concepts/storage/persistent-volumes/) (PVCs) generated from the +StatefulSet spec template for cases when they should be deleted automatically when the StatefulSet +is deleted or pods in the StatefulSet are scaled down. + +## What problem does this solve? +A StatefulSet spec can include Pod and PVC templates. When a replica is first created, the +Kubernetes control plane creates a PVC for that replica if one does not already exist. The behavior +before Kubernetes v1.23 was that the control plane never cleaned up the PVCs created for +StatefulSets - this was left up to the cluster administrator, or to some add-on automation that +you’d have to find, check suitability, and deploy. The common pattern for managing PVCs, either +manually or through tools such as Helm, is that the PVCs are tracked by the tool that manages them, +with explicit lifecycle. Workflows that use StatefulSets must determine on their own what PVCs are +created by a StatefulSet and what their lifecycle should be. + +Before this new feature, when a StatefulSet-managed replica disappears, either because the +StatefulSet is reducing its replica count, or because its StatefulSet is deleted, the PVC and its +backing volume remains and must be manually deleted. While this behavior is appropriate when the +data is critical, in many cases the persistent data in these PVCs is either temporary, or can be +reconstructed from another source. In those cases, PVCs and their backing volumes remaining after +their StatefulSet or replicas have been deleted are not necessary, incur cost, and require manual +cleanup. + +## The new StatefulSet PVC retention policy + +If you enable the alpha feature, a StatefulSet spec includes a PersistentVolumeClaim retention +policy. This is used to control if and when PVCs created from a StatefulSet’s `volumeClaimTemplate` +are deleted. This first iteration of the retention policy contains two situations where PVCs may be +deleted. + +The first situation is when the StatefulSet resource is deleted (which implies that all replicas are +also deleted). This is controlled by the `whenDeleted` policy. The second situation, controlled by +`whenScaled` is when the StatefulSet is scaled down, which removes some but not all of the replicas +in a StatefulSet. In both cases the policy can either be `Retain`, where the corresponding PVCs are +not touched, or `Delete`, which means that PVCs are deleted. The deletion is done with a normal +[object deletion](/docs/concepts/architecture/garbage-collection/), so that, for example, all +retention policies for the underlying PV are respected. + +This policy forms a matrix with four cases. I’ll walk through and give an example for each one. + + * **`whenDeleted` and `whenScaled` are both `Retain`.** This matches the existing behavior for + StatefulSets, where no PVCs are deleted. This is also the default retention policy. It’s + appropriate to use when data on StatefulSet volumes may be irreplaceable and should only be + deleted manually. + + * **`whenDeleted` is `Delete` and `whenScaled` is `Retain`.** In this case, PVCs are deleted only when + the entire StatefulSet is deleted. If the StatefulSet is scaled down, PVCs are not touched, + meaning they are available to be reattached if a scale-up occurs with any data from the previous + replica. This might be used for a temporary StatefulSet, such as in a CI instance or ETL + pipeline, where the data on the StatefulSet is needed only during the lifetime of the + StatefulSet lifetime, but while the task is running the data is not easily reconstructible. Any + retained state is needed for any replicas that scale down and then up. + + * **`whenDeleted` and `whenScaled` are both `Delete`.** PVCs are deleted immediately when their + replica is no longer needed. Note this does not include when a Pod is deleted and a new version + rescheduled, for example when a node is drained and Pods need to migrate elsewhere. The PVC is + deleted only when the replica is no longer needed as signified by a scale-down or StatefulSet + deletion. This use case is for when data does not need to live beyond the life of its + replica. Perhaps the data is easily reconstructable and the cost savings of deleting unused PVCs + is more important than quick scale-up, or perhaps that when a new replica is created, any data + from a previous replica is not usable and must be reconstructed anyway. + + * **`whenDeleted` is `Retain` and `whenScaled` is `Delete`.** This is similar to the previous case, + when there is little benefit to keeping PVCs for fast reuse during scale-up. An example of a + situation where you might use this is an Elasticsearch cluster. Typically you would scale that + workload up and down to match demand, whilst ensuring a minimum number of replicas (for example: + 3). When scaling down, data is migrated away from removed replicas and there is no benefit to + retaining those PVCs. However, it can be useful to bring the entire Elasticsearch cluster down + temporarily for maintenance. If you need to take the Elasticsearch system offline, you can do + this by temporarily deleting the StatefulSet, and then bringing the Elasticsearch cluster back + by recreating the StatefulSet. The PVCs holding the Elasticsearch data will still exist and the + new replicas will automatically use them. + +Visit the +[documentation](docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-policies) to +see all the details. + +## What’s next? + +Enable the feature and try it out! Enable the `StatefulSetAutoDeletePVC` feature gate on a cluster, +then create a StatefulSet using the new policy. Test it out and tell us what you think! + +I'm very curious to see if this owner reference mechanism works well in practice. For example, we +realized there is no mechanism in Kubernetes for knowing who set a reference, so it’s possible that +the StatefulSet controller may fight with custom controllers that set their own +references. Fortunately, maintaining the existing retention behavior does not involve any new owner +references, so default behavior will be compatible. + +Please tag any issues you report with the label `sig/apps` and assign them to Matthew Cary +([@mattcary](https://github.com/mattcary) at GitHub). + +Enjoy! + diff --git a/content/en/blog/_posts/2021-12-17-security-profiles-operator-v0.4.0/index.md b/content/en/blog/_posts/2021-12-17-security-profiles-operator-v0.4.0/index.md new file mode 100644 index 0000000000..39dfb8cb52 --- /dev/null +++ b/content/en/blog/_posts/2021-12-17-security-profiles-operator-v0.4.0/index.md @@ -0,0 +1,148 @@ +--- +layout: blog +title: "What's new in Security Profiles Operator v0.4.0" +date: 2021-12-17 +slug: security-profiles-operator +--- + +**Authors:** Jakub Hrozek, Juan Antonio Osorio, Paulo Gomes, Sascha Grunert + +--- + +The [Security Profiles Operator (SPO)](https://sigs.k8s.io/security-profiles-operator) +is an out-of-tree Kubernetes enhancement to make the management of +[seccomp](https://en.wikipedia.org/wiki/Seccomp), +[SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) and +[AppArmor](https://en.wikipedia.org/wiki/AppArmor) profiles easier and more +convenient. We're happy to announce that we recently [released +v0.4.0](https://github.com/kubernetes-sigs/security-profiles-operator/releases/tag/v0.4.0) +of the operator, which contains a ton of new features, fixes and usability +improvements. + +## What's new + +It has been a while since the last +[v0.3.0](https://github.com/kubernetes-sigs/security-profiles-operator/releases/tag/v0.3.0) +release of the operator. We added new features, fine-tuned existing ones and +reworked our documentation in 290 commits over the past half year. + +One of the highlights is that we're now able to record seccomp and SELinux +profiles using the operators [log enricher](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#log-enricher-based-recording). +This allows us to reduce the dependencies required for profile recording to have +[auditd](https://linux.die.net/man/8/auditd) or +[syslog](https://en.wikipedia.org/wiki/Syslog) (as fallback) running on the +nodes. All profile recordings in the operator work in the same way by using the +`ProfileRecording` CRD as well as their corresponding [label +selectors](/docs/concepts/overview/working-with-objects/labels). The log +enricher itself can be also used to gather meaningful insights about seccomp and +SELinux messages of a node. Checkout the [official +documentation](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#using-the-log-enricher) +to learn more about it. + +### seccomp related improvements + +Beside the log enricher based recording we now offer an alternative to record +seccomp profiles by utilizing [ebpf](https://ebpf.io). This optional feature can +be enabled by setting `enableBpfRecorder` to `true`. This results in running a +dedicated container, which ships a custom bpf module on every node to collect +the syscalls for containers. It even supports older Kernel versions which do not +expose the [BPF Type Format (BTF)](https://www.kernel.org/doc/html/latest/bpf/btf.html) per +default as well as the `amd64` and `arm64` architectures. Checkout +[our documentation](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#ebpf-based-recording) +to see it in action. By the way, we now add the seccomp profile architecture of +the recorder host to the recorded profile as well. + +We also graduated the seccomp profile API from `v1alpha1` to `v1beta1`. This +aligns with our overall goal to stabilize the CRD APIs over time. The only thing +which has changed is that the seccomp profile type `Architectures` now points to +`[]Arch` instead of `[]*Arch`. + +### SELinux enhancements + +Managing SELinux policies (an equivalent to using `semodule` that +you would normally call on a single server) is not done by SPO +itself, but by another container called selinuxd to provide better +isolation. This release switched to using selinuxd containers from +a personal repository to images located under [our team's quay.io +repository](https://quay.io/organization/security-profiles-operator). +The selinuxd repository has moved as well to [the containers GitHub +organization](https://github.com/containers/selinuxd). + +Please note that selinuxd links dynamically to `libsemanage` and mounts the +SELinux directories from the nodes, which means that the selinuxd container +must be running the same distribution as the cluster nodes. SPO defaults +to using CentOS-8 based containers, but we also build Fedora based ones. +If you are using another distribution and would like us to add support for +it, please file [an issue against selinuxd](https://github.com/containers/selinuxd/issues). + +#### Profile Recording + +This release adds support for recording of SELinux profiles. +The recording itself is managed via an instance of a `ProfileRecording` Custom +Resource as seen in an +[example](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/profilerecording-selinux-logs.yaml) +in our repository. From the user's point of view it works pretty much the same +as recording of seccomp profiles. + +Under the hood, to know what the workload is doing SPO installs a special +permissive policy called [selinuxrecording](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/deploy/base/profiles/selinuxrecording.cil) +on startup which allows everything and logs all AVCs to `audit.log`. +These AVC messages are scraped by the log enricher component and when +the recorded workload exits, the policy is created. + +#### `SELinuxProfile` CRD graduation + +An `v1alpha2` version of the `SelinuxProfile` object has been introduced. This +removes the raw Common Intermediate Language (CIL) from the object itself and +instead adds a simple policy language to ease the writing and parsing +experience. + +Alongside, a `RawSelinuxProfile` object was also introduced. This contains a +wrapped and raw representation of the policy. This was intended for folks to be +able to take their existing policies into use as soon as possible. However, on +validations are done here. + +### AppArmor support + +This version introduces the initial support for AppArmor, allowing users to load and +unload AppArmor profiles into cluster nodes by using the new [AppArmorProfile](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/deploy/base/crds/apparmorprofile.yaml) CRD. + +To enable AppArmor support use the [enableAppArmor feature gate](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/config.yaml#L10) switch of your SPO configuration. +Then use our [apparmor example](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/apparmorprofile.yaml) to deploy your first profile across your cluster. + +### Metrics + +The operator now exposes metrics, which are described in detail in +our new [metrics documentation](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#using-metrics). +We decided to secure the metrics retrieval process by using +[kube-rbac-proxy](https://github.com/brancz/kube-rbac-proxy), while we ship an +additional `spo-metrics-client` cluster role (and binding) to retrieve the +metrics from within the cluster. If you're using +[OpenShift](https://www.redhat.com/en/technologies/cloud-computing/openshift), +then we provide an out of the box working +[`ServiceMonitor`](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#automatic-servicemonitor-deployment) +to access the metrics. + +#### Debuggability and robustness + +Beside all those new features, we decided to restructure parts of the Security +Profiles Operator internally to make it better to debug and more robust. For +example, we now maintain an internal [gRPC](https://grpc.io) API to communicate +within the operator across different features. We also improved the performance +of the log enricher, which now caches results for faster retrieval of the log +data. The operator can be put into a more [verbose log mode](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#set-logging-verbosity) +by setting `verbosity` from `0` to `1`. + +We also print the used `libseccomp` and `libbpf` versions on startup, as well as +expose CPU and memory profiling endpoints for each container via the +[`enableProfiling` option](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#enable-cpu-and-memory-profiling). +Dedicated liveness and startup probes inside of the operator daemon will now +additionally improve the life cycle of the operator. + +## Conclusion + +Thank you for reading this update. We're looking forward to future enhancements +of the operator and would love to get your feedback about the latest release. +Feel free to reach out to us via the Kubernetes slack +[#security-profiles-operator](https://kubernetes.slack.com/messages/security-profiles-operator) +for any feedback or question. diff --git a/content/en/blog/_posts/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm.md b/content/en/blog/_posts/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm.md new file mode 100644 index 0000000000..12eaaf3ff4 --- /dev/null +++ b/content/en/blog/_posts/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm.md @@ -0,0 +1,201 @@ +--- +layout: blog +title: "Kubernetes-in-Kubernetes and the WEDOS PXE bootable server farm" +slug: kubernetes-in-kubernetes-and-pxe-bootable-server-farm +date: 2021-12-22 +--- + +**Author**: Andrei Kvapil (WEDOS) + + +When you own two data centers, thousands of physical servers, virtual machines and hosting for hundreds of thousands sites, Kubernetes can actually simplify the management of all these things. As practice has shown, by using Kubernetes, you can declaratively describe and manage not only applications, but also the infrastructure itself. I work for the largest Czech hosting provider **WEDOS Internet a.s** and today I'll show you two of my projects — [Kubernetes-in-Kubernetes](https://github.com/kvaps/kubernetes-in-kubernetes) and [Kubefarm](https://github.com/kvaps/kubefarm). + +With their help you can deploy a fully working Kubernetes cluster inside another Kubernetes using Helm in just a couple of commands. How and why? + +Let me introduce you to how our infrastructure works. All our physical servers can be divided into two groups: **control-plane** and **compute** nodes. Control plane nodes are usually set up manually, have a stable OS installed, and designed to run all cluster services including Kubernetes control-plane. The main task of these nodes is to ensure the smooth operation of the cluster itself. Compute nodes do not have any operating system installed by default, instead they are booting the OS image over the network directly from the control plane nodes. Their work is to carry out the workload. + +{{< figure src="/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme01.svg" alt="Kubernetes cluster layout" >}} + +Once nodes have downloaded their image, they can continue to work without keeping connection to the PXE server. That is, a PXE server is just keeping rootfs image and does not hold any other complex logic. After our nodes have booted, we can safely restart the PXE server, nothing critical will happen to them. + +{{< figure src="/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme02.svg" alt="Kubernetes cluster after bootstrapping" >}} + +After booting, the first thing our nodes do is join to the existing Kubernetes cluster, namely, execute the **kubeadm join** command so that kube-scheduler could schedule some pods on them and launch various workloads afterwards. From the beginning we used the scheme when nodes were joined into the same cluster used for the control-plane nodes. + +{{< figure src="/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme03.svg" alt="Kubernetes scheduling containers to the compute nodes" >}} + +This scheme worked stably for over two years. However later we decided to add containerized Kubernetes to it. And now we can spawn new Kubernetes-clusters very easily right on our control-plane nodes which are now member special admin-clusters. Now, compute nodes can be joined directly to their own clusters - depending on the configuration. + +{{< figure src="/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme04.svg" alt="Multiple clusters are running in single Kubernetes, compute nodes joined to them" >}} + +## Kubefarm + +This project came with the goal of enabling anyone to deploy such an infrastructure in just a couple of commands using Helm and get about the same in the end. + +At this time, we moved away from the idea of a monocluster. Because it turned out to be not very convenient for managing work of several development teams in the same cluster. The fact is that Kubernetes was never designed as a multi-tenant solution and at the moment it does not provide sufficient means of isolation between projects. Therefore, running separate clusters for each team turned out to be a good idea. However, there should not be too many clusters, to let them be convenient to manage. Nor is it too small to have sufficient independence between development teams. + +The scalability of our clusters became noticeably better after that change. The more clusters you have per number of nodes, the smaller the failure domain and the more stable they work. And as a bonus, we got a fully declaratively described infrastructure. Thus, now you can deploy a new Kubernetes cluster in the same way as deploying any other application in Kubernetes. + +It uses [Kubernetes-in-Kubernetes](http://github.com/kvaps/kubernetes-in-kubernetes) as a basis, [LTSP](https://github.com/ltsp/ltsp/) as PXE-server from which the nodes are booted, and automates the DHCP server configuration using [dnsmasq-controller](https://github.com/kvaps/dnsmasq-controller): + + +{{< figure src="/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/kubefarm.png" alt="Kubefarm" >}} + +## How it works + +Now let's see how it works. In general, if you look at Kubernetes as from an application perspective, you can note that it follows all the principles of [The Twelve-Factor App](https://12factor.net/), and is actually written very well. Thus, it means running Kubernetes as an app in a different Kubernetes shouldn't be a big deal. + +### Running Kubernetes in Kubernetes + +Now let's take a look at the [Kubernetes-in-Kubernetes](https://github.com/kvaps/kubernetes-in-kubernetes) project, which provides a ready-made Helm chart for running Kubernetes in Kubernetes. + +Here is the parameters that you can pass to Helm in the values file: + +* [**kubernetes/values.yaml**](https://github.com/kvaps/kubernetes-in-kubernetes/tree/v0.13.1/deploy/helm/kubernetes) + +Kubernetes is just five binaries + +Beside **persistence** (storage parameters for the cluster), the Kubernetes control-plane components are described here: namely: **etcd cluster**, **apiserver**, **controller-manager** and **scheduler**. These are pretty much standard Kubernetes components. There is a light-hearted saying that “Kubernetes is just five binaries”. So here is where the configuration for these binaries is located. + +If you ever tried to bootstrap a cluster using kubeadm, then this config will remind you it's configuration. But in addition to Kubernetes entities, you also have an admin container. In fact, it is a container which holds two binaries inside: **kubectl** and **kubeadm**. They are used to generate kubeconfig for the above components and to perform the initial configuration for the cluster. Also, in an emergency, you can always exec into it to check and manage your cluster. + +After the release [has been deployed](https://asciinema.org/a/407280), you can see a list of pods: **admin-container**, **apiserver** in two replicas, **controller-manager**, **etcd-cluster**, **scheduller** and the initial job that initializes the cluster. In the end you have a command, which allows you to get shell into the admin container, you can use it to see what is happening inside: + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot01.svg)](https://asciinema.org/a/407280?autoplay=1) + +Also, let's take look at the certificates. If you've ever installed Kubernetes, then you know that it has a _scary_ directory `/etc/kubernetes/pki` with a bunch of some certificates. In case of Kubernetes-in-Kubernetes, you have fully automated management of them with cert-manager. Thus, it is enough to pass all certificates parameters to Helm during installation, and all the certificates will automatically be generated for your cluster. + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot02.svg)](https://asciinema.org/a/407280?t=15&autoplay=1) + +Looking at one of the certificates, eg. apiserver, you can see that it has a list of DNS names and IP addresses. If you want to make this cluster accessible outside, then just describe the additional DNS names in the values file and update the release. This will update the certificate resource, and cert-manager will regenerate the certificate. You'll no longer need to think about this. If kubeadm certificates need to be renewed at least once a year, here the cert-manager will take care and automatically renew them. + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot03.svg)](https://asciinema.org/a/407280?t=25&autoplay=1) + +Now let's log into the admin container and look at the cluster and nodes. Of course, there are no nodes, yet, because at the moment you have deployed just the blank control-plane for Kubernetes. But in kube-system namespace you can see some coredns pods waiting for scheduling and configmaps already appeared. That is, you can conclude that the cluster is working: + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot04.svg)](https://asciinema.org/a/407280?t=30&autoplay=1) + +Here is the [diagram of the deployed cluster](https://kvaps.github.io/images/posts/Kubernetes-in-Kubernetes-and-PXE-bootable-servers-farm/Argo_CD_kink_network.html). You can see services for all Kubernetes components: **apiserver**, **controller-manager**, **etcd-cluster** and **scheduler**. And the pods on right side to which they forward traffic. + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/argocd01.png)](https://kvaps.github.io/images/posts/Kubernetes-in-Kubernetes-and-PXE-bootable-servers-farm/Argo_CD_kink_network.html) + +*By the way, the diagram, is drawn in [ArgoCD](https://argoproj.github.io/argo-cd/) — the GitOps tool we use to manage our clusters, and cool diagrams are one of its features.* + +### Orchestrating physical servers + +OK, now you can see the way how is our Kubernetes control-plane deployed, but what about worker nodes, how are we adding them? As I already said, all our servers are bare metal. We do not use virtualization to run Kubernetes, but we orchestrate all physical servers by ourselves. + +Also, we do use Linux network boot feature very actively. Moreover, this is exactly the booting, not some kind of automation of the installation. When the nodes are booting, they just run a ready-made system image for them. That is, to update any node, we just need to reboot it - and it will download a new image. It is very easy, simple and convenient. + +For this, the [Kubefarm](https://github.com/kvaps/kubefarm) project was created, which allows you to automate this. The most commonly used examples can be found in the [examples](https://github.com/kvaps/kubefarm/tree/v0.13.1/examples) directory. The most standard of them named [generic](https://github.com/kvaps/kubefarm/tree/v0.13.1/examples/generic). Let's take a look at values.yaml: + +* [**generic/values.yaml**](https://github.com/kvaps/kubefarm/blob/v0.13.1/examples/generic/values.yaml) + +Here you can specify the parameters which are passed into the upstream Kubernetes-in-Kubernetes chart. In order for you control-plane to be accessible from the outside, it is enough to specify the IP address here, but if you wish, you can specify some DNS name here. + +In the PXE server configuration you can specify a timezone. You can also add an SSH key for logging in without a password (but you can also specify a password), as well as kernel modules and parameters that should be applied during booting the system. + +Next comes the **nodePools** configuration, i.e. the nodes themselves. If you've ever used a terraform module for gke, then this logic will remind you of it. Here you statically describe all nodes with a set of parameters: + +- **Name** (hostname); + +- **MAC-addresses** — we have nodes with two network cards, and each one can boot from any of the MAC addresses specified here. + +- **IP-address**, which the DHCP server should issue to this node. + + +In this example, you have two pools: the first has five nodes, the second has only one, the second pool has also two tags assigned. Tags are the way to describe configuration for specific nodes. For example, you can add specific DHCP options for some pools, options for the PXE server for booting (e.g. here is debug option enabled) and set of **kubernetesLabels** and **kubernetesTaints** options. What does that mean? + +For example, in this configuration you have a second nodePool with one node. The pool has **debug** and **foo** tags assigned. Now see the options for **foo** tag in **kubernetesLabels**. This means that the m1c43 node will boot with these two labels and taint assigned. Everything seems to be simple. Now [let's try](https://asciinema.org/a/407282) this in practice. + +### Demo + +Go to [examples](https://github.com/kvaps/kubefarm/tree/v0.13.1/examples) and update previously deployed chart to Kubefarm. Just use the [generic](https://github.com/kvaps/kubefarm/tree/v0.13.1/examples/generic) parameters and look at the pods. You can see that a PXE server and one more job were added. This job essentially goes to the deployed Kubernetes cluster and creates a new token. Now it will run repeatedly every 12 hours to generate a new token, so that the nodes can connect to your cluster. + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot05.svg)](https://asciinema.org/a/407282?autoplay=1) + +In a [graphical representation](https://kvaps.github.io/images/posts/Kubernetes-in-Kubernetes-and-PXE-bootable-servers-farm/Argo_CD_Applications_kubefarm-network.html), it looks about the same, but now apiserver started to be exposed outside. + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/argocd02.png)](https://kvaps.github.io/images/posts/Kubernetes-in-Kubernetes-and-PXE-bootable-servers-farm/Argo_CD_Applications_kubefarm-network.html) + +In the diagram, the IP is highlighted in green, the PXE server can be reached through it. At the moment, Kubernetes does not allow creating a single LoadBalancer service for TCP and UDP protocols by default, so you have to create two different services with the same IP address. One is for TFTP, and the second for HTTP, through which the system image is downloaded. + +But this simple example is not always enough, sometimes you might need to modify the logic at boot. For example, here is a directory [advanced_network](https://github.com/kvaps/kubefarm/tree/v0.13.1/examples/advanced_network), inside which there is a [values file](https://github.com/kvaps/kubefarm/tree/v0.13.1/examples/advanced_network) with a simple shell script. Let's call it `network.sh`: + +* [**network.sh**](https://github.com/kvaps/kubefarm/blob/v0.13.1/examples/advanced_network/values.yaml#L14-L78) + +All this script does is take environment variables at boot time, and generates a network configuration based on them. It creates a directory and puts the netplan config inside. For example, a bonding interface is created here. Basically, this script can contain everything you need. It can hold the network configuration or generate the system services, add some hooks or describe any other logic. Anything that can be described in bash or shell languages will work here, and it will be executed at boot time. + +Let's see how it can be [deployed](https://asciinema.org/a/407284). Let's pass the generic values file as the first parameter, and an additional values file as the second parameter. This is a standard Helm feature. This way you can also pass the secrets, but in this case, the configuration is just expanded by the second file: + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot06.svg)](https://asciinema.org/a/407284?autoplay=1) + +Let's look at the configmap **foo-kubernetes-ltsp** for the netboot server and make sure that `network.sh` script is really there. These commands used to configure the network at boot time: + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot07.svg)](https://asciinema.org/a/407284?t=15&autoplay=1) + +[Here](https://asciinema.org/a/407286) you can see how it works in principle. The chassis interface (we use HPE Moonshots 1500) have the nodes, you can enter `show node list` command to get a list of all the nodes. Now you can see the booting process. + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot08.svg)](https://asciinema.org/a/407286?autoplay=1) + +You can also get their MAC addresses by `show node macaddr all` command. We have a clever operator that collects MAC-addresses from chassis automatically and passes them to the DHCP server. Actually, it's just creating custom configuration resources for dnsmasq-controller which is running in same admin Kubernetes cluster. Also, trough this interface you can control the nodes themselves, e.g. turn them on and off. + +If you have no such opportunity to enter the chassis through iLO and collect a list of MAC addresses for your nodes, you can consider using [catchall cluster](https://asciinema.org/a/407287) pattern. Purely speaking, it is just a cluster with a dynamic DHCP pool. Thus, all nodes that are not described in the configuration to other clusters will automatically join to this cluster. + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot09.svg)](https://asciinema.org/a/407287?autoplay=1) + +For example, you can see a special cluster with some nodes. They are joined to the cluster with an auto-generated name based on their MAC address. Starting from this point you can connect to them and see what happens there. Here you can somehow prepare them, for example, set up the file system and then rejoin them to another cluster. + +Now let's try connecting to the node terminal and see how it is booting. After the BIOS, the network card is configured, here it sends a request to the DHCP server from a specific MAC address, which redirects it to a specific PXE server. Later the kernel and initrd image are downloaded from the server using the standard HTTP protocol: + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot10.svg)](https://asciinema.org/a/407286?t=28&autoplay=1) + +After loading the kernel, the node downloads the rootfs image and transfers control to systemd. Then the booting proceeds as usual, and after that the node joins Kubernetes: + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot11.svg)](https://asciinema.org/a/407286?t=80&autoplay=1) + +If you take a look at **fstab**, you can see only two entries there: **/var/lib/docker** and **/var/lib/kubelet**, they are mounted as **tmpfs** (in fact, from RAM). At the same time, the root partition is mounted as **overlayfs**, so all changes that you make here on the system will be lost on the next reboot. + +Looking into the block devices on the node, you can see some nvme disk, but it has not yet been mounted anywhere. There is also a loop device - this is the exact rootfs image downloaded from the server. At the moment it is located in RAM, occupies 653 MB and mounted with the **loop** option. + +If you look in **/etc/ltsp**, you find the `network.sh` file that was executed at boot. From containers, you can see running `kube-proxy` and `pause` container for it. + +[![](/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot12.svg)](https://asciinema.org/a/407286?t=100&autoplay=1) + +## Details + +### Network Boot Image + +But where does the main image come from? There is a little trick here. The image for the nodes is built through the [Dockerfile](https://github.com/kvaps/kubefarm/tree/v0.13.1/build/ltsp) along with the server. The [Docker multi-stage build](https://docs.docker.com/develop/develop-images/multistage-build/) feature allows you to easily add any packages and kernel modules exactly at the stage of the image build. It looks like this: + +* [**Dockerfile**](https://github.com/kvaps/kubefarm/blob/v0.13.1/build/ltsp/Dockerfile) + +What's going on here? First, we take a regular Ubuntu 20.04 and install all the packages we need. First of all we install the **kernel**, **lvm**, **systemd**, **ssh**. In general, everything that you want to see on the final node should be described here. Here we also install `docker` with `kubelet` and `kubeadm`, which are used to join the node to the cluster. + +And then we perform an additional configuration. In the last stage, we simply install `tftp` and `nginx` (which serves our image to clients), **grub** (bootloader). Then root of the previous stages copied into the final image and generate squashed image from it. That is, in fact, we get a docker image, which has both the server and the boot image for our nodes. At the same time, it can be easily updated by changing the Dockerfile. + +### Webhooks and API aggregation layer + +I want to pay special attention to the problem of webhooks and aggregation layer. In general, webhooks is a Kubernetes feature that allows you to respond to the creation or modification of any resources. Thus, you can add a handler so that when resources are applied, Kubernetes must send request to some pod and check if configuration of this resource is correct, or make additional changes to it. + +But the point is, in order for the webhooks to work, the apiserver must have direct access to the cluster for which it is running. And if it is started in a separate cluster, like our case, or even separately from any cluster, then Konnectivity service can help us here. Konnectivity is one of the optional but officially supported Kubernetes components. + +Let's take cluster of four nodes for example, each of them is running a `kubelet` and we have other Kubernetes components running outside: `kube-apiserver`, `kube-scheduler` and `kube-controller-manager`. By default, all these components interact with the apiserver directly - this is the most known part of the Kubernetes logic. But in fact, there is also a reverse connection. For example, when you want to view the logs or run a `kubectl exec command`, the API server establishes a connection to the specific kubelet independently: + +{{< figure src="/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity01.svg" alt="Kubernetes apiserver reaching kubelet" >}} + +But the problem is that if we have a webhook, then it usually runs as a standard pod with a service in our cluster. And when apiserver tries to reach it, it will fail because it will try to access an in-cluster service named **webhook.namespace.svc** being outside of the cluster where it is actually running: + +{{< figure src="/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity02.svg" alt="Kubernetes apiserver can't reach webhook" >}} + +And here Konnectivity comes to our rescue. Konnectivity is a tricky proxy server developed especially for Kubernetes. It can be deployed as a server next to the apiserver. And Konnectivity-agent is deployed in several replicas directly in the cluster you want to access. The agent establishes a connection to the server and sets up a stable channel to make apiserver able to access all webhooks and all kubelets in the cluster. Thus, now all communication with the cluster will take place through the Konnectivity-server: + +{{< figure src="/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity03.svg" alt="Kubernetes apiserver reaching webhook via konnectivity" >}} + +## Our plans + +Of course, we are not going to stop at this stage. People interested in the project often write to me. And if there will be a sufficient number of interested people, I hope to move Kubernetes-in-Kubernetes project under [Kubernetes SIGs](https://github.com/kubernetes-sigs), by representing it in form of the official Kubernetes Helm chart. Perhaps, by making this project independent we'll gather an even larger community. + +I am also thinking of integrating it with the Machine Controller Manager, which would allow creating worker nodes, not only of physical servers, but also, for example, for creating virtual machines using kubevirt and running them in the same Kubernetes cluster. By the way, it also allows to spawn virtual machines in the clouds, and have a control-plane deployed locally. + +I am also considering the option of integrating with the Cluster-API so that you can create physical Kubefarm clusters directly through the Kubernetes environment. But at the moment I'm not completely sure about this idea. If you have any thoughts on this matter, I'll be happy to listen to them. diff --git a/content/en/docs/concepts/architecture/garbage-collection.md b/content/en/docs/concepts/architecture/garbage-collection.md index bec39b4dd5..38aa99d654 100644 --- a/content/en/docs/concepts/architecture/garbage-collection.md +++ b/content/en/docs/concepts/architecture/garbage-collection.md @@ -137,7 +137,7 @@ collection, which deletes images in order based on the last time they were used, starting with the oldest first. The kubelet deletes images until disk usage reaches the `LowThresholdPercent` value. -### Container image garbage collection {#container-image-garbage-collection} +### Container garbage collection {#container-image-garbage-collection} The kubelet garbage collects unused containers based on the following variables, which you can define: @@ -152,11 +152,11 @@ which you can define: In addition to these variables, the kubelet garbage collects unidentified and deleted containers, typically starting with the oldest first. -`MaxPerPodContainer` and `MaxContainer` may potentially conflict with each other +`MaxPerPodContainer` and `MaxContainers` may potentially conflict with each other in situations where retaining the maximum number of containers per Pod (`MaxPerPodContainer`) would go outside the allowable total of global dead containers (`MaxContainers`). In this situation, the kubelet adjusts -`MaxPodPerContainer` to address the conflict. A worst-case scenario would be to +`MaxPerPodContainer` to address the conflict. A worst-case scenario would be to downgrade `MaxPerPodContainer` to `1` and evict the oldest containers. Additionally, containers owned by pods that have been deleted are removed once they are older than `MinAge`. @@ -180,4 +180,4 @@ configure garbage collection: * Learn more about [ownership of Kubernetes objects](/docs/concepts/overview/working-with-objects/owners-dependents/). * Learn more about Kubernetes [finalizers](/docs/concepts/overview/working-with-objects/finalizers/). -* Learn about the [TTL controller](/docs/concepts/workloads/controllers/ttlafterfinished/) (beta) that cleans up finished Jobs. \ No newline at end of file +* Learn about the [TTL controller](/docs/concepts/workloads/controllers/ttlafterfinished/) (beta) that cleans up finished Jobs. diff --git a/content/en/docs/concepts/architecture/nodes.md b/content/en/docs/concepts/architecture/nodes.md index d94aac5878..0974089f8d 100644 --- a/content/en/docs/concepts/architecture/nodes.md +++ b/content/en/docs/concepts/architecture/nodes.md @@ -442,7 +442,7 @@ Message: Pod was terminated in response to imminent node shutdown. To provide more flexibility during graceful node shutdown around the ordering of pods during shutdown, graceful node shutdown honors the PriorityClass for Pods, provided that you enabled this feature in your cluster. The feature -allows allows cluster administers to explicitly define the ordering of pods +allows cluster administers to explicitly define the ordering of pods during graceful node shutdown based on [priority classes](docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass). diff --git a/content/en/docs/concepts/cluster-administration/networking.md b/content/en/docs/concepts/cluster-administration/networking.md index fb34a82d50..ee7793d004 100644 --- a/content/en/docs/concepts/cluster-administration/networking.md +++ b/content/en/docs/concepts/cluster-administration/networking.md @@ -30,55 +30,7 @@ insert dynamic port numbers into configuration blocks, services have to know how to find each other, etc. Rather than deal with this, Kubernetes takes a different approach. -## The Kubernetes network model - -Every `Pod` gets its own IP address, maximum one per IP family. This means you -do not need need to deal with mapping container ports to host ports in order to -expose the `Pods` services on the network. This creates a clean, -backwards-compatible model where `Pods` can be treated much like VMs or physical -hosts from the perspectives of port allocation, naming, service discovery, load -balancing, application configuration, and migration. - -Kubernetes IP addresses exist at the `Pod` scope, in the `status.PodIPs` field -- containers within a `Pod` share their network namespaces - including their IP -address. This means that containers within a `Pod` can all reach each other's -ports on `localhost`. This also means that containers within a `Pod` must -coordinate port usage, but this is no different from processes in a VM. This is -called the _IP-per-pod_ model. - -In every cluster, there exists an abstract pod-network to which pods -are connected by default, unless explicitly configured to use the -host-network (on platforms that support it). Even if a host has -multiple IPs, host-network pods only have one Kubernetes IP address at -the `Pod` scope, that is, the `status.PodIPs` field contains one -IP per address family (for now), so the "IP-per-pod" model is guaranteed. - -Kubernetes imposes the following fundamental requirements on any networking -implementation (barring any intentional network segmentation policies): - - * any pod-network pod on any node can communicate with all other pod-network - pods on all nodes without NAT. - * non-pod processes on a node (the kubelet, and also for example any other system daemon) can - communicate with all pods on that node. - -In addition, for platforms and runtimes that support running pods in the host OS network: - - * host-network pods of a node can connect directly with all pods IPs on all - nodes, however, unlike pod-network pods, the source IP address might not be - present in the `Pod` `status.PodIPs` field. - -This model is principally compatible with the desire for Kubernetes to enable -low-friction porting of apps from VMs to containers. If your workload previously ran -in a VM, your VM typically had a single IP address; everything in that VM could talk to -other VMs on your network. -This is the same basic model but less complex overall. - -How this is implemented is a detail of the particular container runtime in use. Likewise, the networking option you choose may support [dual-stack IPv4/IPv6 networking](/docs/concepts/services-networking/dual-stack/); implementations vary. - -It is possible to request ports on the `Node` itself which forward to your `Pod` -(called host ports), but this is a very niche operation. How that forwarding is -implemented is also a detail of the container runtime. The `Pod` itself is -blind to the existence or non-existence of host ports. +To learn about the Kubernetes networking model, see [here](/docs/concepts/services-networking/). ## How to implement the Kubernetes networking model diff --git a/content/en/docs/concepts/configuration/configmap.md b/content/en/docs/concepts/configuration/configmap.md index 47ecaedba6..439d6a049d 100644 --- a/content/en/docs/concepts/configuration/configmap.md +++ b/content/en/docs/concepts/configuration/configmap.md @@ -239,6 +239,10 @@ propagation delay, where the cache propagation delay depends on the chosen cache ConfigMaps consumed as environment variables are not updated automatically and require a pod restart. +{{< note >}} +A container using a ConfigMap as a [subPath](/docs/concepts/storage/volumes#using-subpath) volume mount will not receive ConfigMap updates. +{{< /note >}} + ## Immutable ConfigMaps {#configmap-immutable} {{< feature-state for_k8s_version="v1.21" state="stable" >}} diff --git a/content/en/docs/concepts/configuration/manage-resources-containers.md b/content/en/docs/concepts/configuration/manage-resources-containers.md index 0e1516d2aa..6d90ed5fff 100644 --- a/content/en/docs/concepts/configuration/manage-resources-containers.md +++ b/content/en/docs/concepts/configuration/manage-resources-containers.md @@ -1,22 +1,24 @@ --- -title: Managing Resources for Containers +title: Resource Management for Pods and Containers content_type: concept weight: 40 feature: title: Automatic bin packing description: > - Automatically places containers based on their resource requirements and other constraints, while not sacrificing availability. Mix critical and best-effort workloads in order to drive up utilization and save even more resources. + Automatically places containers based on their resource requirements and other constraints, while not sacrificing availability. + Mix critical and best-effort workloads in order to drive up utilization and save even more resources. --- When you specify a {{< glossary_tooltip term_id="pod" >}}, you can optionally specify how -much of each resource a {{< glossary_tooltip text="Container" term_id="container" >}} needs. +much of each resource a {{< glossary_tooltip text="container" term_id="container" >}} needs. The most common resources to specify are CPU and memory (RAM); there are others. -When you specify the resource _request_ for Containers in a Pod, the scheduler uses this +When you specify the resource _request_ for containers in a Pod, the +{{< glossary_tooltip text="kube-scheduler" term_id="kube-scheduler" >}} uses this information to decide which node to place the Pod on. When you specify a resource _limit_ -for a Container, the kubelet enforces those limits so that the running container is not +for a container, the kubelet enforces those limits so that the running container is not allowed to use more of that resource than the limit you set. The kubelet also reserves at least the _request_ amount of that system resource specifically for that container to use. @@ -33,7 +35,7 @@ For example, if you set a `memory` request of 256 MiB for a container, and that a Pod scheduled to a Node with 8GiB of memory and no other Pods, then the container can try to use more RAM. -If you set a `memory` limit of 4GiB for that Container, the kubelet (and +If you set a `memory` limit of 4GiB for that container, the kubelet (and {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}) enforce the limit. The runtime prevents the container from using more than the configured resource limit. For example: when a process in the container tries to consume more than the allowed amount of memory, @@ -45,8 +47,8 @@ or by enforcement (the system prevents the container from ever exceeding the lim runtimes can have different ways to implement the same restrictions. {{< note >}} -If a Container specifies its own memory limit, but does not specify a memory request, Kubernetes -automatically assigns a memory request that matches the limit. Similarly, if a Container specifies its own +If a container specifies its own memory limit, but does not specify a memory request, Kubernetes +automatically assigns a memory request that matches the limit. Similarly, if a container specifies its own CPU limit, but does not specify a CPU request, Kubernetes automatically assigns a CPU request that matches the limit. {{< /note >}} @@ -56,7 +58,7 @@ the limit. *CPU* and *memory* are each a *resource type*. A resource type has a base unit. CPU represents compute processing and is specified in units of [Kubernetes CPUs](#meaning-of-cpu). Memory is specified in units of bytes. -If you're using Kubernetes v1.14 or newer, you can specify _huge page_ resources. +For Linux workloads, you can specify _huge page_ resources. Huge pages are a Linux-specific feature where the node kernel allocates blocks of memory that are much larger than the default page size. @@ -76,9 +78,10 @@ consumed. They are distinct from [Services](/docs/concepts/services-networking/service/) are objects that can be read and modified through the Kubernetes API server. -## Resource requests and limits of Pod and Container +## Resource requests and limits of Pod and container -Each Container of a Pod can specify one or more of the following: +For each container, you can specify resource limits and requests, +including the following: * `spec.containers[].resources.limits.cpu` * `spec.containers[].resources.limits.memory` @@ -87,49 +90,64 @@ Each Container of a Pod can specify one or more of the following: * `spec.containers[].resources.requests.memory` * `spec.containers[].resources.requests.hugepages-` -Although requests and limits can only be specified on individual Containers, it -is convenient to talk about Pod resource requests and limits. A -*Pod resource request/limit* for a particular resource type is the sum of the -resource requests/limits of that type for each Container in the Pod. +Although you can only specify requests and limits for individual containers, +it is also useful to think about the overall resource requests and limits for +a Pod. +For a particular resource, a *Pod resource request/limit* is the sum of the +resource requests/limits of that type for each container in the Pod. ## Resource units in Kubernetes -### Meaning of CPU +### CPU resource units {#meaning-of-cpu} Limits and requests for CPU resources are measured in *cpu* units. -One cpu, in Kubernetes, is equivalent to **1 vCPU/Core** for cloud providers and **1 hyperthread** on bare-metal Intel processors. +In Kubernetes, 1 CPU unit is equivalent to **1 physical CPU core**, +or **1 virtual core**, depending on whether the node is a physical host +or a virtual machine running inside a physical machine. Fractional requests are allowed. When you define a container with `spec.containers[].resources.requests.cpu` set to `0.5`, you are requesting half as much CPU time compared to if you asked for `1.0` CPU. -For CPU resource units, the expression `0.1` is equivalent to the +For CPU resource units, the [quantity](/docs/reference/kubernetes-api/common-definitions/quantity/) expression `0.1` is equivalent to the expression `100m`, which can be read as "one hundred millicpu". Some people say -"one hundred millicores", and this is understood to mean the same thing. A -request with a decimal point, like `0.1`, is converted to `100m` by the API, and -precision finer than `1m` is not allowed. For this reason, the form `100m` might -be preferred. +"one hundred millicores", and this is understood to mean the same thing. -CPU is always requested as an absolute quantity, never as a relative quantity; -0.1 is the same amount of CPU on a single-core, dual-core, or 48-core machine. +CPU resource is always specified as an absolute amount of resource, never as a relative amount. For example, +`500m` CPU represents the roughly same amount of computing power whether that container +runs on a single-core, dual-core, or 48-core machine. -### Meaning of memory +{{< note >}} +Kubernetes doesn't allow you to specify CPU resources with a precision finer than +`1m`. Because of this, it's useful to specify CPU units less than `1.0` or `1000m` using +the milliCPU form; for example, `5m` rather than `0.005`. +{{< /note >}} + +### Memory resource units {#meaning-of-memory} Limits and requests for `memory` are measured in bytes. You can express memory as -a plain integer or as a fixed-point number using one of these suffixes: -E, P, T, G, M, k, m (millis). You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, +a plain integer or as a fixed-point number using one of these +[quantity](/docs/reference/kubernetes-api/common-definitions/quantity/) suffixes: +E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki. For example, the following represent roughly the same value: ```shell 128974848, 129e6, 129M, 128974848000m, 123Mi ``` -Here's an example. -The following Pod has two Containers. Each Container has a request of 0.25 cpu -and 64MiB (226 bytes) of memory. Each Container has a limit of 0.5 -cpu and 128MiB of memory. You can say the Pod has a request of 0.5 cpu and 128 -MiB of memory, and a limit of 1 cpu and 256MiB of memory. +Take care about case for suffixes. If you request `400m` of memory, this is a request +for 0.4 bytes. Someone who types that probably meant to ask for 400 mebibytes (`400Mi`) +or 400 megabytes (`400M`). + +## Container resources example {#example-1} + +The following Pod has two containers. Both containers are defined with a request for +0.25 CPU +and 64MiB (226 bytes) of memory. Each container has a limit of 0.5 +CPU and 128MiB of memory. You can say the Pod has a request of 0.5 CPU and 128 +MiB of memory, and a limit of 1 CPU and 256MiB of memory. ```yaml +--- apiVersion: v1 kind: Pod metadata: @@ -162,56 +180,54 @@ When you create a Pod, the Kubernetes scheduler selects a node for the Pod to run on. Each node has a maximum capacity for each of the resource types: the amount of CPU and memory it can provide for Pods. The scheduler ensures that, for each resource type, the sum of the resource requests of the scheduled -Containers is less than the capacity of the node. Note that although actual memory +containers is less than the capacity of the node. +Note that although actual memory or CPU resource usage on nodes is very low, the scheduler still refuses to place a Pod on a node if the capacity check fails. This protects against a resource shortage on a node when resource usage later increases, for example, during a daily peak in request rate. -## How Pods with resource limits are run +## How Kubernetes applies resource requests and limits {#how-pods-with-resource-limits-are-run} -When the kubelet starts a Container of a Pod, it passes the CPU and memory limits -to the container runtime. +When the kubelet starts a container as part of a Pod, the kubelet passes that container's +requests and limits for memory and CPU to the container runtime. -When using Docker: +On Linux, the container runtime typically configures +kernel {{< glossary_tooltip text="cgroups" term_id="cgroup" >}} that apply and enforce the +limits you defined. -- The `spec.containers[].resources.requests.cpu` is converted to its core value, - which is potentially fractional, and multiplied by 1024. The greater of this number - or 2 is used as the value of the - [`--cpu-shares`](https://docs.docker.com/engine/reference/run/#cpu-share-constraint) - flag in the `docker run` command. +- The CPU limit defines a hard ceiling on how much CPU time that the container can use. + During each scheduling interval (time slice), the Linux kernel checks to see if this + limit is exceeded; if so, the kernel waits before allowing that cgroup to resume execution. +- The CPU request typically defines a weighting. If several different containers (cgroups) + want to run on a contended system, workloads with larger CPU requests are allocated more + CPU time than workloads with small requests. +- The memory request is mainly used during (Kubernetes) Pod scheduling. On a node that uses + cgroups v2, the container runtime might use the memory request as a hint to set + `memory.min` and `memory.low`. +- The memory limit defines a memory limit for that cgroup. If the container tries to + allocate more memory than this limit, the Linux kernel out-of-memory subsystem activates + and, typically, intervenes by stopping one of the processes in the container that tried + to allocate memory. If that process is the container's PID 1, and the container is marked + as restartable, Kubernetes restarts the container. +- The memory limit for the Pod or container can also apply to pages in memory backed + volumes, such as an `emptyDir`. The kubelet tracks `tmpfs` emptyDir volumes as container + memory use, rather than as local ephemeral storage. -- The `spec.containers[].resources.limits.cpu` is converted to its millicore value and - multiplied by 100. The resulting value is the total amount of CPU time in microseconds - that a container can use every 100ms. A container cannot use more than its share of - CPU time during this interval. +If a container exceeds its memory request and the node that it runs on becomes short of +memory overall, it is likely that the Pod the container belongs to will be +{{< glossary_tooltip text="evicted" term_id="eviction" >}}. - {{< note >}} - The default quota period is 100ms. The minimum resolution of CPU quota is 1ms. - {{}} +A container might or might not be allowed to exceed its CPU limit for extended periods of time. +However, container runtimes don't terminate Pods or containers for excessive CPU usage. -- The `spec.containers[].resources.limits.memory` is converted to an integer, and - used as the value of the - [`--memory`](https://docs.docker.com/engine/reference/run/#/user-memory-constraints) - flag in the `docker run` command. - -If a Container exceeds its memory limit, it might be terminated. If it is -restartable, the kubelet will restart it, as with any other type of runtime -failure. - -If a Container exceeds its memory request, it is likely that its Pod will -be evicted whenever the node runs out of memory. - -A Container might or might not be allowed to exceed its CPU limit for extended -periods of time. However, it will not be killed for excessive CPU usage. - -To determine whether a Container cannot be scheduled or is being killed due to -resource limits, see the -[Troubleshooting](#troubleshooting) section. +To determine whether a container cannot be scheduled or is being killed due to resource limits, +see the [Troubleshooting](#troubleshooting) section. ### Monitoring compute & memory resource usage -The resource usage of a Pod is reported as part of the Pod status. +The kubelet reports the resource usage of a Pod as part of the Pod +[`status`](/docs/concepts/overview/working-with-objects/kubernetes-objects/#object-spec-and-status). If optional [tools for monitoring](/docs/tasks/debug-application-cluster/resource-usage-monitoring/) are available in your cluster, then Pod resource usage can be retrieved either @@ -309,21 +325,26 @@ than as local ephemeral storage. ### Setting requests and limits for local ephemeral storage -You can use _ephemeral-storage_ for managing local ephemeral storage. Each Container of a Pod can specify one or more of the following: +You can specify `ephemeral-storage` for managing local ephemeral storage. Each +container of a Pod can specify either or both of the following: * `spec.containers[].resources.limits.ephemeral-storage` * `spec.containers[].resources.requests.ephemeral-storage` -Limits and requests for `ephemeral-storage` are measured in bytes. You can express storage as -a plain integer or as a fixed-point number using one of these suffixes: +Limits and requests for `ephemeral-storage` are measured in byte quantities. +You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, K. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, -Mi, Ki. For example, the following represent roughly the same value: +Mi, Ki. For example, the following quantities all represent roughly the same value: -```shell -128974848, 129e6, 129M, 123Mi -``` +- `128974848` +- `129e6` +- `129M` +- `123Mi` -In the following example, the Pod has two Containers. Each Container has a request of 2GiB of local ephemeral storage. Each Container has a limit of 4GiB of local ephemeral storage. Therefore, the Pod has a request of 4GiB of local ephemeral storage, and a limit of 8GiB of local ephemeral storage. +In the following example, the Pod has two containers. Each container has a request of +2GiB of local ephemeral storage. Each container has a limit of 4GiB of local ephemeral +storage. Therefore, the Pod has a request of 4GiB of local ephemeral storage, and +a limit of 8GiB of local ephemeral storage. ```yaml apiVersion: v1 @@ -360,9 +381,11 @@ spec: ### How Pods with ephemeral-storage requests are scheduled When you create a Pod, the Kubernetes scheduler selects a node for the Pod to -run on. Each node has a maximum amount of local ephemeral storage it can provide for Pods. For more information, see [Node Allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable). +run on. Each node has a maximum amount of local ephemeral storage it can provide for Pods. +For more information, see +[Node Allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable). -The scheduler ensures that the sum of the resource requests of the scheduled Containers is less than the capacity of the node. +The scheduler ensures that the sum of the resource requests of the scheduled containers is less than the capacity of the node. ### Ephemeral storage consumption management {#resource-emphemeralstorage-consumption} @@ -376,7 +399,7 @@ kubelet measures storage use in: If a Pod is using more ephemeral storage than you allow it to, the kubelet sets an eviction signal that triggers Pod eviction. -For container-level isolation, if a Container's writable layer and log +For container-level isolation, if a container's writable layer and log usage exceeds its storage limit, the kubelet marks the Pod for eviction. For pod-level isolation the kubelet works out an overall Pod storage limit by @@ -493,15 +516,19 @@ Plugin](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/) for how to advertise device plugin managed resources on each node. ##### Other resources + To advertise a new node-level extended resource, the cluster operator can submit a `PATCH` HTTP request to the API server to specify the available quantity in the `status.capacity` for a node in the cluster. After this operation, the node's `status.capacity` will include a new resource. The `status.allocatable` field is updated automatically with the new resource -asynchronously by the kubelet. Note that because the scheduler uses the node -`status.allocatable` value when evaluating Pod fitness, there may be a short -delay between patching the node capacity with a new resource and the first Pod -that requests the resource to be scheduled on that node. +asynchronously by the kubelet. + +Because the scheduler uses the node's `status.allocatable` value when +evaluating Pod fitness, the scheduler only takes account of the new value after +that asynchronous update. There may be a short delay between patching the +node capacity with a new resource and the time when the first Pod that requests +the resource can be scheduled on that node. **Example:** @@ -529,7 +556,7 @@ Cluster-level extended resources are not tied to nodes. They are usually managed by scheduler extenders, which handle the resource consumption and resource quota. You can specify the extended resources that are handled by scheduler extenders -in [scheduler policy configuration](/docs/reference/config-api/kube-scheduler-policy-config.v1/) +in [scheduler configuration](/docs/reference/config-api/kube-scheduler-config.v1beta3/) **Example:** @@ -611,27 +638,32 @@ spec: ## PID limiting -Process ID (PID) limits allow for the configuration of a kubelet to limit the number of PIDs that a given Pod can consume. See [Pid Limiting](/docs/concepts/policy/pid-limiting/) for information. +Process ID (PID) limits allow for the configuration of a kubelet +to limit the number of PIDs that a given Pod can consume. See +[PID Limiting](/docs/concepts/policy/pid-limiting/) for information. ## Troubleshooting -### My Pods are pending with event message failedScheduling +### My Pods are pending with event message `FailedScheduling` If the scheduler cannot find any node where a Pod can fit, the Pod remains -unscheduled until a place can be found. An event is produced each time the -scheduler fails to find a place for the Pod, like this: +unscheduled until a place can be found. An +[Event](/docs/reference/kubernetes-api/cluster-resources/event-v1/) is produced +each time the scheduler fails to find a place for the Pod. You can use `kubectl` +to view the events for a Pod; for example: ```shell -kubectl describe pod frontend | grep -A 3 Events +kubectl describe pod frontend | grep -A 9999999999 Events ``` ``` Events: - FirstSeen LastSeen Count From Subobject PathReason Message - 36s 5s 6 {scheduler } FailedScheduling Failed for reason PodExceedsFreeCPU and possibly others + Type Reason Age From Message + ---- ------ ---- ---- ------- + Warning FailedScheduling 23s default-scheduler 0/42 nodes available: insufficient cpu ``` In the preceding example, the Pod named "frontend" fails to be scheduled due to -insufficient CPU resource on the node. Similar error messages can also suggest +insufficient CPU resource on any node. Similar error messages can also suggest failure due to insufficient memory (PodExceedsFreeMemory). In general, if a Pod is pending with a message of this type, there are several things to try: @@ -640,6 +672,9 @@ is pending with a message of this type, there are several things to try: - Check that the Pod is not larger than all the nodes. For example, if all the nodes have a capacity of `cpu: 1`, then a Pod with a request of `cpu: 1.1` will never be scheduled. +- Check for node taints. If most of your nodes are tainted, and the new Pod does + not tolerate that taint, the scheduler only considers placements onto the + remaining nodes that don't have that taint. You can check node capacities and amounts allocated with the `kubectl describe nodes` command. For example: @@ -674,31 +709,46 @@ Allocated resources: 680m (34%) 400m (20%) 920Mi (11%) 1070Mi (13%) ``` -In the preceding output, you can see that if a Pod requests more than 1120m -CPUs or 6.23Gi of memory, it will not fit on the node. +In the preceding output, you can see that if a Pod requests more than 1.120 CPUs, +or more than 6.23Gi of memory, that Pod will not fit on the node. -By looking at the `Pods` section, you can see which Pods are taking up space on +By looking at the “Pods” section, you can see which Pods are taking up space on the node. The amount of resources available to Pods is less than the node capacity, because -system daemons use a portion of the available resources. The `allocatable` field -[NodeStatus](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#nodestatus-v1-core) -gives the amount of resources that are available to Pods. For more information, see -[Node Allocatable Resources](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md). +system daemons use a portion of the available resources. Within the Kubernetes API, +each Node has a `.status.allocatable` field +(see [NodeStatus](/docs/reference/kubernetes-api/cluster-resources/node-v1/#NodeStatus) +for details). -The [resource quota](/docs/concepts/policy/resource-quotas/) feature can be configured -to limit the total amount of resources that can be consumed. If used in conjunction -with namespaces, it can prevent one team from hogging all the resources. +The `.status.allocatable` field describes the amount of resources that are available +to Pods on that node (for example: 15 virtual CPUs and 7538 MiB of memory). +For more information on node allocatable resources in Kubernetes, see +[Reserve Compute Resources for System Daemons](/docs/tasks/administer-cluster/reserve-compute-resources/). -### My Container is terminated +You can configure [resource quotas](/docs/concepts/policy/resource-quotas/) +to limit the total amount of resources that a namespace can consume. +Kubernetes enforces quotas for objects in particular namespace when there is a +ResourceQuota in that namespace. +For example, if you assign specific namespaces to different teams, you +can add ResourceQuotas into those namespaces. Setting resource quotas helps to +prevent one team from using so much of any resource that this over-use affects other teams. -Your Container might get terminated because it is resource-starved. To check -whether a Container is being killed because it is hitting a resource limit, call +You should also consider what access you grant to that namespace: +**full** write access to a namespace allows someone with that access to remove any +resource, include a configured ResourceQuota. + +### My container is terminated + +Your container might get terminated because it is resource-starved. To check +whether a container is being killed because it is hitting a resource limit, call `kubectl describe pod` on the Pod of interest: ```shell kubectl describe pod simmemleak-hra99 ``` + +The output is similar to: ``` Name: simmemleak-hra99 Namespace: default @@ -709,57 +759,48 @@ Status: Running Reason: Message: IP: 10.244.2.75 -Replication Controllers: simmemleak (1/1 replicas created) Containers: simmemleak: - Image: saadali/simmemleak + Image: saadali/simmemleak:latest Limits: - cpu: 100m - memory: 50Mi - State: Running - Started: Tue, 07 Jul 2015 12:54:41 -0700 - Last Termination State: Terminated - Exit Code: 1 - Started: Fri, 07 Jul 2015 12:54:30 -0700 - Finished: Fri, 07 Jul 2015 12:54:33 -0700 - Ready: False - Restart Count: 5 + cpu: 100m + memory: 50Mi + State: Running + Started: Tue, 07 Jul 2019 12:54:41 -0700 + Last State: Terminated + Reason: OOMKilled + Exit Code: 137 + Started: Fri, 07 Jul 2019 12:54:30 -0700 + Finished: Fri, 07 Jul 2019 12:54:33 -0700 + Ready: False + Restart Count: 5 Conditions: Type Status Ready False Events: - FirstSeen LastSeen Count From SubobjectPath Reason Message - Tue, 07 Jul 2015 12:53:51 -0700 Tue, 07 Jul 2015 12:53:51 -0700 1 {scheduler } scheduled Successfully assigned simmemleak-hra99 to kubernetes-node-tf0f - Tue, 07 Jul 2015 12:53:51 -0700 Tue, 07 Jul 2015 12:53:51 -0700 1 {kubelet kubernetes-node-tf0f} implicitly required container POD pulled Pod container image "k8s.gcr.io/pause:0.8.0" already present on machine - Tue, 07 Jul 2015 12:53:51 -0700 Tue, 07 Jul 2015 12:53:51 -0700 1 {kubelet kubernetes-node-tf0f} implicitly required container POD created Created with docker id 6a41280f516d - Tue, 07 Jul 2015 12:53:51 -0700 Tue, 07 Jul 2015 12:53:51 -0700 1 {kubelet kubernetes-node-tf0f} implicitly required container POD started Started with docker id 6a41280f516d - Tue, 07 Jul 2015 12:53:51 -0700 Tue, 07 Jul 2015 12:53:51 -0700 1 {kubelet kubernetes-node-tf0f} spec.containers{simmemleak} created Created with docker id 87348f12526a + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Scheduled 42s default-scheduler Successfully assigned simmemleak-hra99 to kubernetes-node-tf0f + Normal Pulled 41s kubelet Container image "saadali/simmemleak:latest" already present on machine + Normal Created 41s kubelet Created container simmemleak + Normal Started 40s kubelet Started container simmemleak + Normal Killing 32s kubelet Killing container with id ead3fb35-5cf5-44ed-9ae1-488115be66c6: Need to kill Pod ``` In the preceding example, the `Restart Count: 5` indicates that the `simmemleak` -Container in the Pod was terminated and restarted five times. +container in the Pod was terminated and restarted five times (so far). +The `OOMKilled` reason shows that the container tried to use more memory than its limit. -You can call `kubectl get pod` with the `-o go-template=...` option to fetch the status -of previously terminated Containers: - -```shell -kubectl get pod -o go-template='{{range.status.containerStatuses}}{{"Container Name: "}}{{.name}}{{"\r\nLastState: "}}{{.lastState}}{{end}}' simmemleak-hra99 -``` -``` -Container Name: simmemleak -LastState: map[terminated:map[exitCode:137 reason:OOM Killed startedAt:2015-07-07T20:58:43Z finishedAt:2015-07-07T20:58:43Z containerID:docker://0e4095bba1feccdfe7ef9fb6ebffe972b4b14285d5acdec6f0d3ae8a22fad8b2]] -``` - -You can see that the Container was terminated because of `reason:OOM Killed`, where `OOM` stands for Out Of Memory. +Your next step might be to check the application code for a memory leak. If you +find that the application is behaving how you expect, consider setting a higher +memory limit (and possibly request) for that container. ## {{% heading "whatsnext" %}} -* Get hands-on experience [assigning Memory resources to Containers and Pods](/docs/tasks/configure-pod-container/assign-memory-resource/). -* Get hands-on experience [assigning CPU resources to Containers and Pods](/docs/tasks/configure-pod-container/assign-cpu-resource/). -* For more details about the difference between requests and limits, see - [Resource QoS](https://git.k8s.io/community/contributors/design-proposals/node/resource-qos.md). -* Read the [Container](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#container-v1-core) API reference -* Read the [ResourceRequirements](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#resourcerequirements-v1-core) API reference +* Get hands-on experience [assigning Memory resources to containers and Pods](/docs/tasks/configure-pod-container/assign-memory-resource/). +* Get hands-on experience [assigning CPU resources to containers and Pods](/docs/tasks/configure-pod-container/assign-cpu-resource/). +* Read how the API reference defines a [container](/docs/reference/kubernetes-api/workload-resources/pod-v1/#Container) + and its [resource requirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources) * Read about [project quotas](https://xfs.org/docs/xfsdocs-xml-dev/XFS_User_Guide/tmp/en-US/html/xfs-quotas.html) in XFS -* Read more about the [kube-scheduler Policy reference (v1)](/docs/reference/config-api/kube-scheduler-policy-config.v1/) +* Read more about the [kube-scheduler configuration reference (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) diff --git a/content/en/docs/concepts/scheduling-eviction/node-pressure-eviction.md b/content/en/docs/concepts/scheduling-eviction/node-pressure-eviction.md index e832d1d48c..6142c050c6 100644 --- a/content/en/docs/concepts/scheduling-eviction/node-pressure-eviction.md +++ b/content/en/docs/concepts/scheduling-eviction/node-pressure-eviction.md @@ -234,8 +234,8 @@ so the above scenario will not apply if the node is, for example, under `DiskPre `Guaranteed` pods are guaranteed only when requests and limits are specified for all the containers and they are equal. These pods will never be evicted because -of another pod's resource consumption. If a system daemon (such as `kubelet`, -`docker`, and `journald`) is consuming more resources than were reserved via +of another pod's resource consumption. If a system daemon (such as `kubelet` +and `journald`) is consuming more resources than were reserved via `system-reserved` or `kube-reserved` allocations, and the node only has `Guaranteed` or `Burstable` pods using less resources than requests left on it, then the kubelet must choose to evict one of these pods to preserve node stability diff --git a/content/en/docs/concepts/services-networking/_index.md b/content/en/docs/concepts/services-networking/_index.md index 2e7d91427e..ab1b784658 100644 --- a/content/en/docs/concepts/services-networking/_index.md +++ b/content/en/docs/concepts/services-networking/_index.md @@ -5,8 +5,50 @@ description: > Concepts and resources behind networking in Kubernetes. --- +## The Kubernetes network model + +Every [`Pod`](/docs/concepts/workloads/pods/) gets its own IP address. +This means you do not need to explicitly create links between `Pods` and you +almost never need to deal with mapping container ports to host ports. +This creates a clean, backwards-compatible model where `Pods` can be treated +much like VMs or physical hosts from the perspectives of port allocation, +naming, service discovery, [load balancing](/docs/concepts/services-networking/ingress/#load-balancing), application configuration, +and migration. + +Kubernetes imposes the following fundamental requirements on any networking +implementation (barring any intentional network segmentation policies): + + * pods on a [node](/docs/concepts/architecture/nodes/) can communicate with all pods on all nodes without NAT + * agents on a node (e.g. system daemons, kubelet) can communicate with all + pods on that node + +Note: For those platforms that support `Pods` running in the host network (e.g. +Linux): + + * pods in the host network of a node can communicate with all pods on all + nodes without NAT + +This model is not only less complex overall, but it is principally compatible +with the desire for Kubernetes to enable low-friction porting of apps from VMs +to containers. If your job previously ran in a VM, your VM had an IP and could +talk to other VMs in your project. This is the same basic model. + +Kubernetes IP addresses exist at the `Pod` scope - containers within a `Pod` +share their network namespaces - including their IP address and MAC address. +This means that containers within a `Pod` can all reach each other's ports on +`localhost`. This also means that containers within a `Pod` must coordinate port +usage, but this is no different from processes in a VM. This is called the +"IP-per-pod" model. + +How this is implemented is a detail of the particular container runtime in use. + +It is possible to request ports on the `Node` itself which forward to your `Pod` +(called host ports), but this is a very niche operation. How that forwarding is +implemented is also a detail of the container runtime. The `Pod` itself is +blind to the existence or non-existence of host ports. + Kubernetes networking addresses four concerns: -- Containers within a Pod use networking to communicate via loopback. +- Containers within a Pod [use networking to communicate](/docs/concepts/services-networking/dns-pod-service/) via loopback. - Cluster networking provides communication between different Pods. -- The Service resource lets you expose an application running in Pods to be reachable from outside your cluster. -- You can also use Services to publish services only for consumption inside your cluster. +- The [Service resource](/docs/concepts/services-networking/service/) lets you [expose an application running in Pods](/docs/concepts/services-networking/connect-applications-service/) to be reachable from outside your cluster. +- You can also use Services to [publish services only for consumption inside your cluster](/docs/concepts/services-networking/service-traffic-policy/). diff --git a/content/en/docs/concepts/services-networking/ingress-controllers.md b/content/en/docs/concepts/services-networking/ingress-controllers.md index 033533e35d..3186b56748 100644 --- a/content/en/docs/concepts/services-networking/ingress-controllers.md +++ b/content/en/docs/concepts/services-networking/ingress-controllers.md @@ -33,7 +33,7 @@ Kubernetes as a project supports and maintains [AWS](https://github.com/kubernet Citrix Application Delivery Controller. * [Contour](https://projectcontour.io/) is an [Envoy](https://www.envoyproxy.io/) based ingress controller. * [EnRoute](https://getenroute.io/) is an [Envoy](https://www.envoyproxy.io) based API gateway that can run as an ingress controller. -* [Easegress IngressController](https://github.com/megaease/easegress/blob/main/doc/ingresscontroller.md) is an [Easegress](https://megaease.com/easegress/) based API gateway that can run as an ingress controller. +* [Easegress IngressController](https://github.com/megaease/easegress/blob/main/doc/reference/ingresscontroller.md) is an [Easegress](https://megaease.com/easegress/) based API gateway that can run as an ingress controller. * F5 BIG-IP [Container Ingress Services for Kubernetes](https://clouddocs.f5.com/containers/latest/userguide/kubernetes/) lets you use an Ingress to configure F5 BIG-IP virtual servers. * [Gloo](https://gloo.solo.io) is an open-source ingress controller based on [Envoy](https://www.envoyproxy.io), diff --git a/content/en/docs/concepts/services-networking/ingress.md b/content/en/docs/concepts/services-networking/ingress.md index efcdff7151..04ca35a5b2 100644 --- a/content/en/docs/concepts/services-networking/ingress.md +++ b/content/en/docs/concepts/services-networking/ingress.md @@ -80,7 +80,7 @@ The name of an Ingress object must be a valid For general information about working with config files, see [deploying applications](/docs/tasks/run-application/run-stateless-application-deployment/), [configuring containers](/docs/tasks/configure-pod-container/configure-pod-configmap/), [managing resources](/docs/concepts/cluster-administration/manage-deployment/). Ingress frequently uses annotations to configure some options depending on the Ingress controller, an example of which is the [rewrite-target annotation](https://github.com/kubernetes/ingress-nginx/blob/master/docs/examples/rewrite/README.md). -Different [Ingress controller](/docs/concepts/services-networking/ingress-controllers) support different annotations. Review the documentation for +Different [Ingress controllers](/docs/concepts/services-networking/ingress-controllers) support different annotations. Review the documentation for your choice of Ingress controller to learn which annotations are supported. The Ingress [spec](https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status) diff --git a/content/en/docs/concepts/services-networking/network-policies.md b/content/en/docs/concepts/services-networking/network-policies.md index 108c2be59b..7c01017f05 100644 --- a/content/en/docs/concepts/services-networking/network-policies.md +++ b/content/en/docs/concepts/services-networking/network-policies.md @@ -10,7 +10,7 @@ weight: 50 -If you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then you might consider using Kubernetes NetworkPolicies for particular applications in your cluster. NetworkPolicies are an application-centric construct which allow you to specify how a {{< glossary_tooltip text="pod" term_id="pod">}} is allowed to communicate with various network "entities" (we use the word "entity" here to avoid overloading the more common terms such as "endpoints" and "services", which have specific Kubernetes connotations) over the network. +If you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then you might consider using Kubernetes NetworkPolicies for particular applications in your cluster. NetworkPolicies are an application-centric construct which allow you to specify how a {{< glossary_tooltip text="pod" term_id="pod">}} is allowed to communicate with various network "entities" (we use the word "entity" here to avoid overloading the more common terms such as "endpoints" and "services", which have specific Kubernetes connotations) over the network. NetworkPolicies apply to a connection with a pod on one or both ends, and are not relevant to other connections. The entities that a Pod can communicate with are identified through a combination of the following 3 identifiers: @@ -27,15 +27,17 @@ Meanwhile, when IP based NetworkPolicies are created, we define policies based o Network policies are implemented by the [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/). To use network policies, you must be using a networking solution which supports NetworkPolicy. Creating a NetworkPolicy resource without a controller that implements it will have no effect. -## Isolated and Non-isolated Pods +## The Two Sorts of Pod Isolation -By default, pods are non-isolated; they accept traffic from any source. +There are two sorts of isolation for a pod: isolation for egress, and isolation for ingress. They concern what connections may be established. "Isolation" here is not absolute, rather it means "some restrictions apply". The alternative, "non-isolated for $direction", means that no restrictions apply in the stated direction. The two sorts of isolation (or not) are declared independently, and are both relevant for a connection from one pod to another. -Pods become isolated by having a NetworkPolicy that selects them. Once there is any NetworkPolicy in a namespace selecting a particular pod, that pod will reject any connections that are not allowed by any NetworkPolicy. (Other pods in the namespace that are not selected by any NetworkPolicy will continue to accept all traffic.) +By default, a pod is non-isolated for egress; all outbound connections are allowed. A pod is isolated for egress if there is any NetworkPolicy that both selects the pod and has "Egress" in its `policyTypes`; we say that such a policy applies to the pod for egress. When a pod is isolated for egress, the only allowed connections from the pod are those allowed by the `egress` list of some NetworkPolicy that applies to the pod for egress. The effects of those `egress` lists combine additively. -Network policies do not conflict; they are additive. If any policy or policies select a pod, the pod is restricted to what is allowed by the union of those policies' ingress/egress rules. Thus, order of evaluation does not affect the policy result. +By default, a pod is non-isolated for ingress; all inbound connections are allowed. A pod is isolated for ingress if there is any NetworkPolicy that both selects the pod and has "Ingress" in its `policyTypes`; we say that such a policy applies to the pod for ingress. When a pod is isolated for ingress, the only allowed connections into the pod are those from the pod's node and those allowed by the `ingress` list of some NetworkPolicy that applies to the pod for ingress. The effects of those `ingress` lists combine additively. -For a network flow between two pods to be allowed, both the egress policy on the source pod and the ingress policy on the destination pod need to allow the traffic. If either the egress policy on the source, or the ingress policy on the destination denies the traffic, the traffic will be denied. +Network policies do not conflict; they are additive. If any policy or policies apply to a given pod for a given direction, the connections allowed in that direction from that pod is the union of what the applicable policies allow. Thus, order of evaluation does not affect the policy result. + +For a connection from a source pod to a destination pod to be allowed, both the egress policy on the source pod and the ingress policy on the destination pod need to allow the connection. If either side does not allow the connection, it will not happen. ## The NetworkPolicy resource {#networkpolicy-resource} @@ -176,18 +178,20 @@ in that namespace. ### Default deny all ingress traffic -You can create a "default" isolation policy for a namespace by creating a NetworkPolicy that selects all pods but does not allow any ingress traffic to those pods. +You can create a "default" ingress isolation policy for a namespace by creating a NetworkPolicy that selects all pods but does not allow any ingress traffic to those pods. {{< codenew file="service/networking/network-policy-default-deny-ingress.yaml" >}} -This ensures that even pods that aren't selected by any other NetworkPolicy will still be isolated. This policy does not change the default egress isolation behavior. +This ensures that even pods that aren't selected by any other NetworkPolicy will still be isolated for ingress. This policy does not affect isolation for egress from any pod. -### Default allow all ingress traffic +### Allow all ingress traffic -If you want to allow all traffic to all pods in a namespace (even if policies are added that cause some pods to be treated as "isolated"), you can create a policy that explicitly allows all traffic in that namespace. +If you want to allow all incoming connections to all pods in a namespace, you can create a policy that explicitly allows that. {{< codenew file="service/networking/network-policy-allow-all-ingress.yaml" >}} +With this policy in place, no additional policy or policies can cause any incoming connection to those pods to be denied. This policy has no effect on isolation for egress from any pod. + ### Default deny all egress traffic You can create a "default" egress isolation policy for a namespace by creating a NetworkPolicy that selects all pods but does not allow any egress traffic from those pods. @@ -195,14 +199,16 @@ You can create a "default" egress isolation policy for a namespace by creating a {{< codenew file="service/networking/network-policy-default-deny-egress.yaml" >}} This ensures that even pods that aren't selected by any other NetworkPolicy will not be allowed egress traffic. This policy does not -change the default ingress isolation behavior. +change the ingress isolation behavior of any pod. -### Default allow all egress traffic +### Allow all egress traffic -If you want to allow all traffic from all pods in a namespace (even if policies are added that cause some pods to be treated as "isolated"), you can create a policy that explicitly allows all egress traffic in that namespace. +If you want to allow all connections from all pods in a namespace, you can create a policy that explicitly allows all outgoing connections from pods in that namespace. {{< codenew file="service/networking/network-policy-allow-all-egress.yaml" >}} +With this policy in place, no additional policy or policies can cause any outgoing connection from those pods to be denied. This policy has no effect on isolation for ingress to any pod. + ### Default deny all ingress and all egress traffic You can create a "default" policy for a namespace which prevents all ingress AND egress traffic by creating the following NetworkPolicy in that namespace. diff --git a/content/en/docs/concepts/storage/persistent-volumes.md b/content/en/docs/concepts/storage/persistent-volumes.md index 1a887fcb38..41dab6b043 100644 --- a/content/en/docs/concepts/storage/persistent-volumes.md +++ b/content/en/docs/concepts/storage/persistent-volumes.md @@ -254,6 +254,16 @@ To request a larger volume for a PVC, edit the PVC object and specify a larger size. This triggers expansion of the volume that backs the underlying PersistentVolume. A new PersistentVolume is never created to satisfy the claim. Instead, an existing volume is resized. +{{< warning >}} +Directly editing the size of a PersistentVolume can prevent an automatic resize of that volume. +If you edit the capacity of a PersistentVolume, and then edit the `.spec` of a matching +PersistentVolumeClaim to make the size of the PersistentVolumeClaim match the PersistentVolume, +then no storage resize happens. +The Kubernetes control plane will see that the desired state of both resources matches, +conclude that the backing volume size has been manually +increased and that no resize is necessary. +{{< /warning >}} + #### CSI Volume expansion {{< feature-state for_k8s_version="v1.16" state="beta" >}} diff --git a/content/en/docs/concepts/storage/volume-snapshot-classes.md b/content/en/docs/concepts/storage/volume-snapshot-classes.md index 45f7149a38..485ca0a4a4 100644 --- a/content/en/docs/concepts/storage/volume-snapshot-classes.md +++ b/content/en/docs/concepts/storage/volume-snapshot-classes.md @@ -39,6 +39,10 @@ request a particular class. Administrators set the name and other parameters of a class when first creating VolumeSnapshotClass objects, and the objects cannot be updated once they are created. +{{< note >}} +Installation of the CRDs is the responsibility of the Kubernetes distribution. Without the required CRDs present, the creation of a VolumeSnapshotClass fails. +{{< /note >}} + ```yaml apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass diff --git a/content/en/docs/contribute/advanced.md b/content/en/docs/contribute/advanced.md index f82e07f28a..a951a2cbf2 100644 --- a/content/en/docs/contribute/advanced.md +++ b/content/en/docs/contribute/advanced.md @@ -110,15 +110,13 @@ membership in the Kubernetes organization. ## Serve as a SIG Co-chair -SIG Docs [approvers](/docs/contribute/participate/roles-and-responsibilities/#approvers) +SIG Docs [members](/docs/contribute/participate/roles-and-responsibilities/#members) can serve a term as a co-chair of SIG Docs. ### Prerequisites -Approvers must meet the following requirements to be a co-chair: +A Kubernetes member must meet the following requirements to be a co-chair: -- Have been a SIG Docs approver for at least 6 months -- Have [led a Kubernetes docs release](/docs/contribute/advanced/#coordinate-docs-for-a-kubernetes-release) or shadowed two releases - Understand SIG Docs workflows and tooling: git, Hugo, localization, blog subproject - Understand how other Kubernetes SIGs and repositories affect the SIG Docs workflow, including: @@ -126,6 +124,8 @@ Approvers must meet the following requirements to be a co-chair: [process in k/community](https://github.com/kubernetes/community/tree/master/sig-docs), plugins in [k/test-infra](https://github.com/kubernetes/test-infra/), and the role of [SIG Architecture](https://github.com/kubernetes/community/tree/master/sig-architecture). + In addition, understand how the [Kubernetes docs release process](/docs/contribute/advanced/#coordinate-docs-for-a-kubernetes-release) works. +- Approved by the SIG Docs community either directly or via lazy consensus. - Commit at least 5 hours per week (and often more) to the role for a minimum of 6 months ### Responsibilities diff --git a/content/en/docs/contribute/review/reviewing-prs.md b/content/en/docs/contribute/review/reviewing-prs.md index 9240d98f3b..77bdc85806 100644 --- a/content/en/docs/contribute/review/reviewing-prs.md +++ b/content/en/docs/contribute/review/reviewing-prs.md @@ -85,7 +85,11 @@ class third,fourth white - Reading the PR description to understand the changes made, and read any linked issues - Reading any comments by other reviewers - Clicking the **Files changed** tab to see the files and lines changed - - Previewing the changes in the Netlify preview build by scrolling to the PR's build check section at the bottom of the **Conversation** tab and clicking the **deploy/netlify** line's **Details** link. + - Previewing the changes in the Netlify preview build by scrolling to the PR's build check section at the bottom of the **Conversation** tab. + Here's a screenshot (this shows GitHub's desktop site; if you're reviewing + on a tablet or smartphone device, the GitHub web UI is slightly different): + {{< figure src="/images/docs/github_netlify_deploy_preview.png" alt="GitHub pull request details including link to Netlify preview" >}} + To open the preview, click on the **Details** link of the **deploy/netlify** line in the list of checks. 4. Go to the **Files changed** tab to start your review. 1. Click on the `+` symbol beside the line you want to comment on. diff --git a/content/en/docs/contribute/style/diagram-guide.md b/content/en/docs/contribute/style/diagram-guide.md new file mode 100644 index 0000000000..bc2cd926da --- /dev/null +++ b/content/en/docs/contribute/style/diagram-guide.md @@ -0,0 +1,671 @@ +--- +title: Diagram Guide +linktitle: Diagram guide +content_type: concept +weight: 15 +--- + + + +This guide shows you how to create, edit and share diagrams using the Mermaid Javascript library. Mermaid.js allows you to generate diagrams using a simple markdown-like syntax inside Markdown files. You can also use Mermaid to generate `.svg` or `.png` image files that you can add to your documentation. + +The target audience for this guide is anybody wishing to learn about Mermaid and/or how to create and add diagrams to Kubernetes documentation. + +Figure 1 outlines the topics covered in this section. + +{{< mermaid >}} +flowchart LR +subgraph m[Mermaid.js] +direction TB +S[ ]-.- +C[build
diagrams
with markdown] --> +D[on-line
live editor] +end +A[Why are diagrams
useful?] --> m +m --> N[3 x methods
for creating
diagrams] +N --> T[Examples] +T --> X[Styling
and
captions] +X --> V[Tips] + + + + classDef box fill:#fff,stroke:#000,stroke-width:1px,color:#000; + classDef spacewhite fill:#ffffff,stroke:#fff,stroke-width:0px,color:#000 + class A,C,D,N,X,m,T,V box + class S spacewhite + +%% you can hyperlink Mermaid diagram nodes to a URL using click statements + +click A "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgc3ViZ3JhcGggbVtNZXJtYWlkLmpzXVxuICAgIGRpcmVjdGlvbiBUQlxuICAgICAgICBTWyBdLS4tXG4gICAgICAgIENbYnVpbGQ8YnI-ZGlhZ3JhbXM8YnI-d2l0aCBtYXJrZG93bl0gLS0-XG4gICAgICAgIERbb24tbGluZTxicj5saXZlIGVkaXRvcl1cbiAgICBlbmRcbiAgICBBW1doeSBhcmUgZGlhZ3JhbXM8YnI-dXNlZnVsP10gLS0-IG1cbiAgICBtIC0tPiBOWzMgeCBtZXRob2RzPGJyPmZvciBjcmVhdGluZzxicj5kaWFncmFtc11cbiAgICBOIC0tPiBUW0V4YW1wbGVzXVxuICAgIFQgLS0-IFhbU3R5bGluZzxicj5hbmQ8YnI-Y2FwdGlvbnNdXG4gICAgWCAtLT4gVltUaXBzXVxuICAgIFxuIFxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIHNwYWNld2hpdGUgZmlsbDojZmZmZmZmLHN0cm9rZTojZmZmLHN0cm9rZS13aWR0aDowcHgsY29sb3I6IzAwMFxuICAgIGNsYXNzIEEsQyxELE4sWCxtLFQsViBib3hcbiAgICBjbGFzcyBTIHNwYWNld2hpdGUiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOnRydWV9" _blank +click C "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgc3ViZ3JhcGggbVtNZXJtYWlkLmpzXVxuICAgIGRpcmVjdGlvbiBUQlxuICAgICAgICBTWyBdLS4tXG4gICAgICAgIENbYnVpbGQ8YnI-ZGlhZ3JhbXM8YnI-d2l0aCBtYXJrZG93bl0gLS0-XG4gICAgICAgIERbb24tbGluZTxicj5saXZlIGVkaXRvcl1cbiAgICBlbmRcbiAgICBBW1doeSBhcmUgZGlhZ3JhbXM8YnI-dXNlZnVsP10gLS0-IG1cbiAgICBtIC0tPiBOWzMgeCBtZXRob2RzPGJyPmZvciBjcmVhdGluZzxicj5kaWFncmFtc11cbiAgICBOIC0tPiBUW0V4YW1wbGVzXVxuICAgIFQgLS0-IFhbU3R5bGluZzxicj5hbmQ8YnI-Y2FwdGlvbnNdXG4gICAgWCAtLT4gVltUaXBzXVxuICAgIFxuIFxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIHNwYWNld2hpdGUgZmlsbDojZmZmZmZmLHN0cm9rZTojZmZmLHN0cm9rZS13aWR0aDowcHgsY29sb3I6IzAwMFxuICAgIGNsYXNzIEEsQyxELE4sWCxtLFQsViBib3hcbiAgICBjbGFzcyBTIHNwYWNld2hpdGUiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOnRydWV9" _blank +click D "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgc3ViZ3JhcGggbVtNZXJtYWlkLmpzXVxuICAgIGRpcmVjdGlvbiBUQlxuICAgICAgICBTWyBdLS4tXG4gICAgICAgIENbYnVpbGQ8YnI-ZGlhZ3JhbXM8YnI-d2l0aCBtYXJrZG93bl0gLS0-XG4gICAgICAgIERbb24tbGluZTxicj5saXZlIGVkaXRvcl1cbiAgICBlbmRcbiAgICBBW1doeSBhcmUgZGlhZ3JhbXM8YnI-dXNlZnVsP10gLS0-IG1cbiAgICBtIC0tPiBOWzMgeCBtZXRob2RzPGJyPmZvciBjcmVhdGluZzxicj5kaWFncmFtc11cbiAgICBOIC0tPiBUW0V4YW1wbGVzXVxuICAgIFQgLS0-IFhbU3R5bGluZzxicj5hbmQ8YnI-Y2FwdGlvbnNdXG4gICAgWCAtLT4gVltUaXBzXVxuICAgIFxuIFxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIHNwYWNld2hpdGUgZmlsbDojZmZmZmZmLHN0cm9rZTojZmZmLHN0cm9rZS13aWR0aDowcHgsY29sb3I6IzAwMFxuICAgIGNsYXNzIEEsQyxELE4sWCxtLFQsViBib3hcbiAgICBjbGFzcyBTIHNwYWNld2hpdGUiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOnRydWV9" _blank +click N "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgc3ViZ3JhcGggbVtNZXJtYWlkLmpzXVxuICAgIGRpcmVjdGlvbiBUQlxuICAgICAgICBTWyBdLS4tXG4gICAgICAgIENbYnVpbGQ8YnI-ZGlhZ3JhbXM8YnI-d2l0aCBtYXJrZG93bl0gLS0-XG4gICAgICAgIERbb24tbGluZTxicj5saXZlIGVkaXRvcl1cbiAgICBlbmRcbiAgICBBW1doeSBhcmUgZGlhZ3JhbXM8YnI-dXNlZnVsP10gLS0-IG1cbiAgICBtIC0tPiBOWzMgeCBtZXRob2RzPGJyPmZvciBjcmVhdGluZzxicj5kaWFncmFtc11cbiAgICBOIC0tPiBUW0V4YW1wbGVzXVxuICAgIFQgLS0-IFhbU3R5bGluZzxicj5hbmQ8YnI-Y2FwdGlvbnNdXG4gICAgWCAtLT4gVltUaXBzXVxuICAgIFxuIFxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIHNwYWNld2hpdGUgZmlsbDojZmZmZmZmLHN0cm9rZTojZmZmLHN0cm9rZS13aWR0aDowcHgsY29sb3I6IzAwMFxuICAgIGNsYXNzIEEsQyxELE4sWCxtLFQsViBib3hcbiAgICBjbGFzcyBTIHNwYWNld2hpdGUiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOnRydWV9" _blank +click T "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgc3ViZ3JhcGggbVtNZXJtYWlkLmpzXVxuICAgIGRpcmVjdGlvbiBUQlxuICAgICAgICBTWyBdLS4tXG4gICAgICAgIENbYnVpbGQ8YnI-ZGlhZ3JhbXM8YnI-d2l0aCBtYXJrZG93bl0gLS0-XG4gICAgICAgIERbb24tbGluZTxicj5saXZlIGVkaXRvcl1cbiAgICBlbmRcbiAgICBBW1doeSBhcmUgZGlhZ3JhbXM8YnI-dXNlZnVsP10gLS0-IG1cbiAgICBtIC0tPiBOWzMgeCBtZXRob2RzPGJyPmZvciBjcmVhdGluZzxicj5kaWFncmFtc11cbiAgICBOIC0tPiBUW0V4YW1wbGVzXVxuICAgIFQgLS0-IFhbU3R5bGluZzxicj5hbmQ8YnI-Y2FwdGlvbnNdXG4gICAgWCAtLT4gVltUaXBzXVxuICAgIFxuIFxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIHNwYWNld2hpdGUgZmlsbDojZmZmZmZmLHN0cm9rZTojZmZmLHN0cm9rZS13aWR0aDowcHgsY29sb3I6IzAwMFxuICAgIGNsYXNzIEEsQyxELE4sWCxtLFQsViBib3hcbiAgICBjbGFzcyBTIHNwYWNld2hpdGUiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOnRydWV9" _blank +click X "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgc3ViZ3JhcGggbVtNZXJtYWlkLmpzXVxuICAgIGRpcmVjdGlvbiBUQlxuICAgICAgICBTWyBdLS4tXG4gICAgICAgIENbYnVpbGQ8YnI-ZGlhZ3JhbXM8YnI-d2l0aCBtYXJrZG93bl0gLS0-XG4gICAgICAgIERbb24tbGluZTxicj5saXZlIGVkaXRvcl1cbiAgICBlbmRcbiAgICBBW1doeSBhcmUgZGlhZ3JhbXM8YnI-dXNlZnVsP10gLS0-IG1cbiAgICBtIC0tPiBOWzMgeCBtZXRob2RzPGJyPmZvciBjcmVhdGluZzxicj5kaWFncmFtc11cbiAgICBOIC0tPiBUW0V4YW1wbGVzXVxuICAgIFQgLS0-IFhbU3R5bGluZzxicj5hbmQ8YnI-Y2FwdGlvbnNdXG4gICAgWCAtLT4gVltUaXBzXVxuICAgIFxuIFxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIHNwYWNld2hpdGUgZmlsbDojZmZmZmZmLHN0cm9rZTojZmZmLHN0cm9rZS13aWR0aDowcHgsY29sb3I6IzAwMFxuICAgIGNsYXNzIEEsQyxELE4sWCxtLFQsViBib3hcbiAgICBjbGFzcyBTIHNwYWNld2hpdGUiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOnRydWV9" _blank +click V "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgc3ViZ3JhcGggbVtNZXJtYWlkLmpzXVxuICAgIGRpcmVjdGlvbiBUQlxuICAgICAgICBTWyBdLS4tXG4gICAgICAgIENbYnVpbGQ8YnI-ZGlhZ3JhbXM8YnI-d2l0aCBtYXJrZG93bl0gLS0-XG4gICAgICAgIERbb24tbGluZTxicj5saXZlIGVkaXRvcl1cbiAgICBlbmRcbiAgICBBW1doeSBhcmUgZGlhZ3JhbXM8YnI-dXNlZnVsP10gLS0-IG1cbiAgICBtIC0tPiBOWzMgeCBtZXRob2RzPGJyPmZvciBjcmVhdGluZzxicj5kaWFncmFtc11cbiAgICBOIC0tPiBUW0V4YW1wbGVzXVxuICAgIFQgLS0-IFhbU3R5bGluZzxicj5hbmQ8YnI-Y2FwdGlvbnNdXG4gICAgWCAtLT4gVltUaXBzXVxuICAgIFxuIFxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIHNwYWNld2hpdGUgZmlsbDojZmZmZmZmLHN0cm9rZTojZmZmLHN0cm9rZS13aWR0aDowcHgsY29sb3I6IzAwMFxuICAgIGNsYXNzIEEsQyxELE4sWCxtLFQsViBib3hcbiAgICBjbGFzcyBTIHNwYWNld2hpdGUiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOnRydWV9" _blank + +{{< /mermaid >}} + +Figure 1. Topics covered in this section. + +All you need to begin working with Mermaid is the following: + +* Basic understanding of markdown. +* Using the Mermaid live editor. +* Using [Hugo shortcodes](/docs/contribute/style/hugo-shortcodes/). +* Using the [Hugo {{}} shortcode](https://gohugo.io/content-management/shortcodes/#figure). +* Performing [Hugo local previews](https://kubernetes.io/docs/contribute/new-content/open-a-pr/#preview-locally). +* Familiar with the [Contributing new content](/docs/contribute/new-content/) process. + +{{< note >}} +You can click on each diagram in this section to view the code and rendered diagram in the Mermaid live editor. +{{< /note >}} + + + +## Why you should use diagrams in documentation + +Diagrams improve documentation clarity and comprehension. There are advantages for both the user and the contributor. + +The user benefits include: + +* __Friendly landing spot__. A detailed text-only greeting page could intimidate users, in particular, first-time Kubernetes users. +* __Faster grasp of concepts__. A diagram can help users understand the key points of a complex topic. Your diagram can serve as a visual learning guide to dive into the topic details. +* __Better retention__. For some, it is easier to recall pictures rather than text. + +The contributor benefits include: + +* __Assist in developing the structure and content__ of your contribution. For example, you can start with a simple diagram covering the high-level points and then dive into details. +* __Expand and grow the user community__. Easily consumed documentation augmented with diagrams attracts new users who might previously have been reluctant to engage due to perceived complexities. + +You should consider your target audience. In addition to experienced K8s users, you will have many who are new to Kubernetes. Even a simple diagram can assist new users in absorbing Kubernetes concepts. They become emboldened and more confident to further explore Kubernetes and the documentation. + + +## Mermaid + +[Mermaid](https://mermaid-js.github.io/mermaid/#/) is an open source JavaScript library that allows you to create, edit and easily share diagrams using a simple, markdown-like syntax configured inline in Markdown files. + +The following lists features of Mermaid: + +* Simple code syntax. +* Includes a web-based tool allowing you to code and preview your diagrams. +* Supports multiple formats including flowchart, state and sequence. +* Easy collaboration with colleagues by sharing a per-diagram URL. +* Broad selection of shapes, lines, themes and styling. + + +The following lists advantages of using Mermaid: + +* No need for separate, non-Mermaid diagram tools. +* Adheres to existing PR workflow. You can think of Mermaid code as just Markdown text included in your PR. +* Simple tool builds simple diagrams. You don't want to get bogged down (re)crafting an overly complex and detailed picture. Keep it simple! + +Mermaid provides a simple, open and transparent method for the SIG communities to add, edit and collaborate on diagrams for new or existing documentation. + +{{< note >}} +You can still use Mermaid to create/edit diagrams even if it's not supported in your environment. This method is called __Mermaid+SVG__ and is explained below. +{{< /note >}} + +### Live editor + +The [Mermaid live editor](https://mermaid-js.github.io/mermaid-live-editor) is a web-based tool that enables you to create, edit and review diagrams. + +The following lists live editor functions: + +* Displays Mermaid code and rendered diagram. +* Generates a URL for each saved diagram. The URL is displayed in the URL field of your browser. You can share the URL with colleagues who can access and modify the diagram. +* Option to download `.svg` or `.png` files. + + +{{< note >}} +The live editor is the easiest and fastest way to create and edit Mermaid diagrams. +{{< /note >}} + + +## Methods for creating diagrams + +Figure 2 outlines the three methods to generate and add diagrams. + +{{< mermaid >}} +graph TB +A[Contributor] +B[Inline

Mermaid code
added to .md file] +C[Mermaid+SVG

Add mermaid-generated
svg file to .md file] +D[External tool

Add external-tool-
generated svg file
to .md file] + + A --> B + A --> C + A --> D + + classDef box fill:#fff,stroke:#000,stroke-width:1px,color:#000; + class A,B,C,D box + +%% you can hyperlink Mermaid diagram nodes to a URL using click statements + +click A "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggVEJcbiAgICBBW0NvbnRyaWJ1dG9yXVxuICAgIEJbSW5saW5lPGJyPjxicj5NZXJtYWlkIGNvZGU8YnI-YWRkZWQgdG8gLm1kIGZpbGVdXG4gICAgQ1tNZXJtYWlkK1NWRzxicj48YnI-QWRkIG1lcm1haWQtZ2VuZXJhdGVkPGJyPnN2ZyBmaWxlIHRvIC5tZCBmaWxlXVxuICAgIERbRXh0ZXJuYWwgdG9vbDxicj48YnI-QWRkIGV4dGVybmFsLXRvb2wtPGJyPmdlbmVyYXRlZCBzdmcgZmlsZTxicj50byAubWQgZmlsZV1cblxuICAgIEEgLS0-IEJcbiAgICBBIC0tPiBDXG4gICAgQSAtLT4gRFxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMsRCBib3giLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" _blank + +click B "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggVEJcbiAgICBBW0NvbnRyaWJ1dG9yXVxuICAgIEJbSW5saW5lPGJyPjxicj5NZXJtYWlkIGNvZGU8YnI-YWRkZWQgdG8gLm1kIGZpbGVdXG4gICAgQ1tNZXJtYWlkK1NWRzxicj48YnI-QWRkIG1lcm1haWQtZ2VuZXJhdGVkPGJyPnN2ZyBmaWxlIHRvIC5tZCBmaWxlXVxuICAgIERbRXh0ZXJuYWwgdG9vbDxicj48YnI-QWRkIGV4dGVybmFsLXRvb2wtPGJyPmdlbmVyYXRlZCBzdmcgZmlsZTxicj50byAubWQgZmlsZV1cblxuICAgIEEgLS0-IEJcbiAgICBBIC0tPiBDXG4gICAgQSAtLT4gRFxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMsRCBib3giLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" _blank + +click C "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggVEJcbiAgICBBW0NvbnRyaWJ1dG9yXVxuICAgIEJbSW5saW5lPGJyPjxicj5NZXJtYWlkIGNvZGU8YnI-YWRkZWQgdG8gLm1kIGZpbGVdXG4gICAgQ1tNZXJtYWlkK1NWRzxicj48YnI-QWRkIG1lcm1haWQtZ2VuZXJhdGVkPGJyPnN2ZyBmaWxlIHRvIC5tZCBmaWxlXVxuICAgIERbRXh0ZXJuYWwgdG9vbDxicj48YnI-QWRkIGV4dGVybmFsLXRvb2wtPGJyPmdlbmVyYXRlZCBzdmcgZmlsZTxicj50byAubWQgZmlsZV1cblxuICAgIEEgLS0-IEJcbiAgICBBIC0tPiBDXG4gICAgQSAtLT4gRFxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMsRCBib3giLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" _blank + +click D "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggVEJcbiAgICBBW0NvbnRyaWJ1dG9yXVxuICAgIEJbSW5saW5lPGJyPjxicj5NZXJtYWlkIGNvZGU8YnI-YWRkZWQgdG8gLm1kIGZpbGVdXG4gICAgQ1tNZXJtYWlkK1NWRzxicj48YnI-QWRkIG1lcm1haWQtZ2VuZXJhdGVkPGJyPnN2ZyBmaWxlIHRvIC5tZCBmaWxlXVxuICAgIERbRXh0ZXJuYWwgdG9vbDxicj48YnI-QWRkIGV4dGVybmFsLXRvb2wtPGJyPmdlbmVyYXRlZCBzdmcgZmlsZTxicj50byAubWQgZmlsZV1cblxuICAgIEEgLS0-IEJcbiAgICBBIC0tPiBDXG4gICAgQSAtLT4gRFxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMsRCBib3giLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" _blank + +{{< /mermaid >}} + +Figure 2. Methods to create diagrams. + + +### Inline + +Figure 3 outlines the steps to follow for adding a diagram using the Inline method. + +{{< mermaid >}} +graph LR +A[1. Use live editor
to create/edit
diagram] --> +B[2. Store diagram
URL somewhere] --> +C[3. Copy Mermaid code
to page markdown file] --> +D[4. Add caption] + + + classDef box fill:#fff,stroke:#000,stroke-width:1px,color:#000; + class A,B,C,D box + +%% you can hyperlink Mermaid diagram nodes to a URL using click statements + +click A "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggTFJcbiAgICBBWzEuIFVzZSBsaXZlIGVkaXRvcjxicj4gdG8gY3JlYXRlL2VkaXQ8YnI-ZGlhZ3JhbV0gLS0-XG4gICAgQlsyLiBTdG9yZSBkaWFncmFtPGJyPlVSTCBzb21ld2hlcmVdIC0tPlxuICAgIENbMy4gQ29weSBNZXJtYWlkIGNvZGU8YnI-dG8gcGFnZSBtYXJrZG93biBmaWxlXSAtLT5cbiAgICBEWzQuIEFkZCBjYXB0aW9uXVxuIFxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMsRCBib3hcbiAgICAiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" _blank + +click B "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggTFJcbiAgICBBWzEuIFVzZSBsaXZlIGVkaXRvcjxicj4gdG8gY3JlYXRlL2VkaXQ8YnI-ZGlhZ3JhbV0gLS0-XG4gICAgQlsyLiBTdG9yZSBkaWFncmFtPGJyPlVSTCBzb21ld2hlcmVdIC0tPlxuICAgIENbMy4gQ29weSBNZXJtYWlkIGNvZGU8YnI-dG8gcGFnZSBtYXJrZG93biBmaWxlXSAtLT5cbiAgICBEWzQuIEFkZCBjYXB0aW9uXVxuIFxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMsRCBib3hcbiAgICAiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" _blank + +click C "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggTFJcbiAgICBBWzEuIFVzZSBsaXZlIGVkaXRvcjxicj4gdG8gY3JlYXRlL2VkaXQ8YnI-ZGlhZ3JhbV0gLS0-XG4gICAgQlsyLiBTdG9yZSBkaWFncmFtPGJyPlVSTCBzb21ld2hlcmVdIC0tPlxuICAgIENbMy4gQ29weSBNZXJtYWlkIGNvZGU8YnI-dG8gcGFnZSBtYXJrZG93biBmaWxlXSAtLT5cbiAgICBEWzQuIEFkZCBjYXB0aW9uXVxuIFxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMsRCBib3hcbiAgICAiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" _blank + +click D "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggTFJcbiAgICBBWzEuIFVzZSBsaXZlIGVkaXRvcjxicj4gdG8gY3JlYXRlL2VkaXQ8YnI-ZGlhZ3JhbV0gLS0-XG4gICAgQlsyLiBTdG9yZSBkaWFncmFtPGJyPlVSTCBzb21ld2hlcmVdIC0tPlxuICAgIENbMy4gQ29weSBNZXJtYWlkIGNvZGU8YnI-dG8gcGFnZSBtYXJrZG93biBmaWxlXSAtLT5cbiAgICBEWzQuIEFkZCBjYXB0aW9uXVxuIFxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMsRCBib3hcbiAgICAiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" _blank + + + + +{{< /mermaid >}} + +Figure 3. Inline Method steps. + + +The following lists the steps you should follow for adding a diagram using the Inline method: + +1. Create your diagram using the live editor. +2. Store the diagram URL somewhere for later access. +3. Copy the mermaid code to the location in your `.md` file where you want the diagram to appear. +4. Add a caption below the diagram using Markdown text. + +A Hugo build runs the Mermaid code and turns it into a diagram. +{{< note >}} +You may find keeping track of diagram URLs is cumbersome. If so, make a note in the `.md` file that the Mermaid code is self-documenting. Contributors can copy the Mermaid code to and from the live editor for diagram edits. +{{< /note >}} + +Here is a sample code snippet contained in an `.md` file: + +``` +--- +title: My PR +--- +Figure 17 shows a simple A to B process. +some markdown text +... +{{}} + graph TB + A --> B +{{}} + +Figure 17. A to B +more text +``` +{{< note >}} +You must include the `{{}}`, `{{}}` shortcode tags at the start and end of the Mermaid code block. You should add a diagram caption below the diagram. +{{< /note >}} + +For more details on diagram captions, see [How to use captions](#how-to-use-captions). + +The following lists advantages of the Inline method: + +* Live editor tool. +* Easy to copy Mermaid code to and from the live editor and your `.md` file. +* No need for separate `.svg` image file handling. +* Content text, diagram code and diagram caption contained in the same `.md` file. + +You should use the [local](https://kubernetes.io/docs/contribute/new-content/open-a-pr/#preview-locally) and Netlify previews to verify the diagram is properly rendered. + +{{< caution >}} +The Mermaid live editor feature set may not support the K8s/website Mermaid feature set. You might see a syntax error or a blank screen after the Hugo build. If that is the case, consider using the Mermaid+SVG method. +{{< /caution >}} + +### Mermaid+SVG + +Figure 4 outlines the steps to follow for adding a diagram using the Mermaid+SVG method. + +{{< mermaid >}} +flowchart LR +A[1. Use live editor
to create/edit
diagram] +B[2. Store diagram
URL somewhere] +C[3. Generate .svg file
and download to
images/ folder] +subgraph w[ ] +direction TB +D[4. Use figure shortcode
to reference .svg
file in page
.md file] --> +E[5. Add caption] +end +A --> B +B --> C +C --> w + + classDef box fill:#fff,stroke:#000,stroke-width:1px,color:#000; + class A,B,C,D,E,w box + +click A "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgQVsxLiBVc2UgbGl2ZSBlZGl0b3I8YnI-IHRvIGNyZWF0ZS9lZGl0PGJyPmRpYWdyYW1dXG4gICAgQlsyLiBTdG9yZSBkaWFncmFtPGJyPlVSTCBzb21ld2hlcmVdXG4gICAgQ1szLiBHZW5lcmF0ZSAuc3ZnIGZpbGU8YnI-YW5kIGRvd25sb2FkIHRvPGJyPmltYWdlcy8gZm9sZGVyXVxuICAgIHN1YmdyYXBoIHdbIF1cbiAgICBkaXJlY3Rpb24gVEJcbiAgICBEWzQuIFVzZSBmaWd1cmUgc2hvcnRjb2RlPGJyPnRvIHJlZmVyZW5jZSAuc3ZnPGJyPmZpbGUgaW4gcGFnZTxicj4ubWQgZmlsZV0gLS0-XG4gICAgRVs1LiBBZGQgY2FwdGlvbl1cbiAgICBlbmRcbkEgLS0-IEJcbkIgLS0-IENcbkMgLS0-IHdcblxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzIEEsQixDLEQsRSx3IGJveFxuICAgICIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0" _blank + +click B "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgQVsxLiBVc2UgbGl2ZSBlZGl0b3I8YnI-IHRvIGNyZWF0ZS9lZGl0PGJyPmRpYWdyYW1dXG4gICAgQlsyLiBTdG9yZSBkaWFncmFtPGJyPlVSTCBzb21ld2hlcmVdXG4gICAgQ1szLiBHZW5lcmF0ZSAuc3ZnIGZpbGU8YnI-YW5kIGRvd25sb2FkIHRvPGJyPmltYWdlcy8gZm9sZGVyXVxuICAgIHN1YmdyYXBoIHdbIF1cbiAgICBkaXJlY3Rpb24gVEJcbiAgICBEWzQuIFVzZSBmaWd1cmUgc2hvcnRjb2RlPGJyPnRvIHJlZmVyZW5jZSAuc3ZnPGJyPmZpbGUgaW4gcGFnZTxicj4ubWQgZmlsZV0gLS0-XG4gICAgRVs1LiBBZGQgY2FwdGlvbl1cbiAgICBlbmRcbkEgLS0-IEJcbkIgLS0-IENcbkMgLS0-IHdcblxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzIEEsQixDLEQsRSx3IGJveFxuICAgICIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0" _blank + +click C "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgQVsxLiBVc2UgbGl2ZSBlZGl0b3I8YnI-IHRvIGNyZWF0ZS9lZGl0PGJyPmRpYWdyYW1dXG4gICAgQlsyLiBTdG9yZSBkaWFncmFtPGJyPlVSTCBzb21ld2hlcmVdXG4gICAgQ1szLiBHZW5lcmF0ZSAuc3ZnIGZpbGU8YnI-YW5kIGRvd25sb2FkIHRvPGJyPmltYWdlcy8gZm9sZGVyXVxuICAgIHN1YmdyYXBoIHdbIF1cbiAgICBkaXJlY3Rpb24gVEJcbiAgICBEWzQuIFVzZSBmaWd1cmUgc2hvcnRjb2RlPGJyPnRvIHJlZmVyZW5jZSAuc3ZnPGJyPmZpbGUgaW4gcGFnZTxicj4ubWQgZmlsZV0gLS0-XG4gICAgRVs1LiBBZGQgY2FwdGlvbl1cbiAgICBlbmRcbkEgLS0-IEJcbkIgLS0-IENcbkMgLS0-IHdcblxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzIEEsQixDLEQsRSx3IGJveFxuICAgICIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0" _blank + +click D "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgQVsxLiBVc2UgbGl2ZSBlZGl0b3I8YnI-IHRvIGNyZWF0ZS9lZGl0PGJyPmRpYWdyYW1dXG4gICAgQlsyLiBTdG9yZSBkaWFncmFtPGJyPlVSTCBzb21ld2hlcmVdXG4gICAgQ1szLiBHZW5lcmF0ZSAuc3ZnIGZpbGU8YnI-YW5kIGRvd25sb2FkIHRvPGJyPmltYWdlcy8gZm9sZGVyXVxuICAgIHN1YmdyYXBoIHdbIF1cbiAgICBkaXJlY3Rpb24gVEJcbiAgICBEWzQuIFVzZSBmaWd1cmUgc2hvcnRjb2RlPGJyPnRvIHJlZmVyZW5jZSAuc3ZnPGJyPmZpbGUgaW4gcGFnZTxicj4ubWQgZmlsZV0gLS0-XG4gICAgRVs1LiBBZGQgY2FwdGlvbl1cbiAgICBlbmRcbkEgLS0-IEJcbkIgLS0-IENcbkMgLS0-IHdcblxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzIEEsQixDLEQsRSx3IGJveFxuICAgICIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0" _blank + +click E "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgQVsxLiBVc2UgbGl2ZSBlZGl0b3I8YnI-IHRvIGNyZWF0ZS9lZGl0PGJyPmRpYWdyYW1dXG4gICAgQlsyLiBTdG9yZSBkaWFncmFtPGJyPlVSTCBzb21ld2hlcmVdXG4gICAgQ1szLiBHZW5lcmF0ZSAuc3ZnIGZpbGU8YnI-YW5kIGRvd25sb2FkIHRvPGJyPmltYWdlcy8gZm9sZGVyXVxuICAgIHN1YmdyYXBoIHdbIF1cbiAgICBkaXJlY3Rpb24gVEJcbiAgICBEWzQuIFVzZSBmaWd1cmUgc2hvcnRjb2RlPGJyPnRvIHJlZmVyZW5jZSAuc3ZnPGJyPmZpbGUgaW4gcGFnZTxicj4ubWQgZmlsZV0gLS0-XG4gICAgRVs1LiBBZGQgY2FwdGlvbl1cbiAgICBlbmRcbkEgLS0-IEJcbkIgLS0-IENcbkMgLS0-IHdcblxuICAgIGNsYXNzRGVmIGJveCBmaWxsOiNmZmYsc3Ryb2tlOiMwMDAsc3Ryb2tlLXdpZHRoOjFweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzIEEsQixDLEQsRSx3IGJveFxuICAgICIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0" _blank + + + +{{< /mermaid >}} + +Figure 4. Mermaid+SVG method steps. + +The following lists the steps you should follow for adding a diagram using the Mermaid+SVG method: + +1. Create your diagram using the live editor. +2. Store the diagram URL somewhere for later access. +3. Generate an `.svg` image file for the diagram and download it to the appropriate `images/` folder. +4. Use the `{{}}` shortcode to reference the diagram in the `.md` file. +5. Add a caption using the `{{}}` shortcode's `caption` parameter. + +For example, use the live editor to create a diagram called `boxnet`. Store the diagram URL somewhere for later access. Generate and download a `boxnet.svg` file to the appropriate `../images/` folder. + +Use the `{{}}` shortcode in your PR's `.md` file to reference the `.svg` image file and add a caption. +```json +{{}} +``` + +For more details on diagram captions, see [How to use captions](#how-to-use-captions). + +{{< note >}} +The `{{}}` shortcode is the preferred method for adding `.svg` image files to your documentation. You can also use the standard markdown image syntax like so: `![my boxnet diagram](static/images/boxnet.svg)`. And you will need to add a caption below the diagram. +{{< /note >}} + +You should add the live editor URL as a comment block in the `.svg` image file using a text editor. For example, you would include the following at the beginning of the `.svg` image file: + +``` + + +``` + +The following lists advantages of the Mermaid+SVG method: + +* Live editor tool. +* Live editor tool supports the most current Mermaid feature set. +* Employ existing K8s/website methods for handling `.svg` image files. +* Environment doesn't require Mermaid support. + +Be sure to check that your diagram renders properly using the [local](https://kubernetes.io/docs/contribute/new-content/open-a-pr/#preview-locally) and Netlify previews. + +### External tool + +Figure 5 outlines the steps to follow for adding a diagram using the External Tool method. + +First, use your external tool to create the diagram and save it as an `.svg` or `.png` image file. After that, use the same steps as the __Mermaid+SVG__ method for adding `.svg` image files. + +{{< mermaid >}} +flowchart LR +A[1. Use external
tool to create/edit
diagram] +B[2. If possible, save
diagram coordinates
for contributor
access] +C[3. Generate .svg
or.png file
and download to
appropriate
images/ folder] +subgraph w[ ] +direction TB +D[4. Use figure shortcode
to reference svg or
png file in
page .md file] --> +E[5. Add caption] +end +A --> B +B --> C +C --> w +classDef box fill:#fff,stroke:#000,stroke-width:1px,color:#000; +class A,B,C,D,E,w box + +click A "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgQVsxLiBVc2UgZXh0ZXJuYWw8YnI-dG9vbCB0byBjcmVhdGUvZWRpdDxicj5kaWFncmFtXVxuICAgIEJbMi4gSWYgcG9zc2libGUsIHNhdmU8YnI-ZGlhZ3JhbSBjb29yZGluYXRlczxicj5mb3IgY29udHJpYnV0b3I8YnI-YWNjZXNzXVxuICAgIENbMy4gR2VuZXJhdGUgLnN2ZyA8YnI-b3IucG5nIGZpbGU8YnI-YW5kIGRvd25sb2FkIHRvPGJyPmFwcHJvcHJpYXRlPGJyPmltYWdlcy8gZm9sZGVyXVxuICAgIHN1YmdyYXBoIHdbIF1cbiAgICBkaXJlY3Rpb24gVEJcbiAgICBEWzQuIFVzZSBmaWd1cmUgc2hvcnRjb2RlPGJyPnRvIHJlZmVyZW5jZSBzdmcgb3I8YnI-cG5nIGZpbGUgaW48YnI-cGFnZSAubWQgZmlsZV0gLS0-XG4gICAgRVs1LiBBZGQgY2FwdGlvbl1cbiAgICBlbmRcbiAgICBBIC0tPiBCXG4gICAgQiAtLT4gQ1xuICAgIEMgLS0-IHdcbiAgICBjbGFzc0RlZiBib3ggZmlsbDojZmZmLHN0cm9rZTojMDAwLHN0cm9rZS13aWR0aDoxcHgsY29sb3I6IzAwMDtcbiAgICBjbGFzcyBBLEIsQyxELEUsdyBib3hcbiAgICAiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" + +click B "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgQVsxLiBVc2UgZXh0ZXJuYWw8YnI-dG9vbCB0byBjcmVhdGUvZWRpdDxicj5kaWFncmFtXVxuICAgIEJbMi4gSWYgcG9zc2libGUsIHNhdmU8YnI-ZGlhZ3JhbSBjb29yZGluYXRlczxicj5mb3IgY29udHJpYnV0b3I8YnI-YWNjZXNzXVxuICAgIENbMy4gR2VuZXJhdGUgLnN2ZyA8YnI-b3IucG5nIGZpbGU8YnI-YW5kIGRvd25sb2FkIHRvPGJyPmFwcHJvcHJpYXRlPGJyPmltYWdlcy8gZm9sZGVyXVxuICAgIHN1YmdyYXBoIHdbIF1cbiAgICBkaXJlY3Rpb24gVEJcbiAgICBEWzQuIFVzZSBmaWd1cmUgc2hvcnRjb2RlPGJyPnRvIHJlZmVyZW5jZSBzdmcgb3I8YnI-cG5nIGZpbGUgaW48YnI-cGFnZSAubWQgZmlsZV0gLS0-XG4gICAgRVs1LiBBZGQgY2FwdGlvbl1cbiAgICBlbmRcbiAgICBBIC0tPiBCXG4gICAgQiAtLT4gQ1xuICAgIEMgLS0-IHdcbiAgICBjbGFzc0RlZiBib3ggZmlsbDojZmZmLHN0cm9rZTojMDAwLHN0cm9rZS13aWR0aDoxcHgsY29sb3I6IzAwMDtcbiAgICBjbGFzcyBBLEIsQyxELEUsdyBib3hcbiAgICAiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" + +click C "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgQVsxLiBVc2UgZXh0ZXJuYWw8YnI-dG9vbCB0byBjcmVhdGUvZWRpdDxicj5kaWFncmFtXVxuICAgIEJbMi4gSWYgcG9zc2libGUsIHNhdmU8YnI-ZGlhZ3JhbSBjb29yZGluYXRlczxicj5mb3IgY29udHJpYnV0b3I8YnI-YWNjZXNzXVxuICAgIENbMy4gR2VuZXJhdGUgLnN2ZyA8YnI-b3IucG5nIGZpbGU8YnI-YW5kIGRvd25sb2FkIHRvPGJyPmFwcHJvcHJpYXRlPGJyPmltYWdlcy8gZm9sZGVyXVxuICAgIHN1YmdyYXBoIHdbIF1cbiAgICBkaXJlY3Rpb24gVEJcbiAgICBEWzQuIFVzZSBmaWd1cmUgc2hvcnRjb2RlPGJyPnRvIHJlZmVyZW5jZSBzdmcgb3I8YnI-cG5nIGZpbGUgaW48YnI-cGFnZSAubWQgZmlsZV0gLS0-XG4gICAgRVs1LiBBZGQgY2FwdGlvbl1cbiAgICBlbmRcbiAgICBBIC0tPiBCXG4gICAgQiAtLT4gQ1xuICAgIEMgLS0-IHdcbiAgICBjbGFzc0RlZiBib3ggZmlsbDojZmZmLHN0cm9rZTojMDAwLHN0cm9rZS13aWR0aDoxcHgsY29sb3I6IzAwMDtcbiAgICBjbGFzcyBBLEIsQyxELEUsdyBib3hcbiAgICAiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" + +click D "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgQVsxLiBVc2UgZXh0ZXJuYWw8YnI-dG9vbCB0byBjcmVhdGUvZWRpdDxicj5kaWFncmFtXVxuICAgIEJbMi4gSWYgcG9zc2libGUsIHNhdmU8YnI-ZGlhZ3JhbSBjb29yZGluYXRlczxicj5mb3IgY29udHJpYnV0b3I8YnI-YWNjZXNzXVxuICAgIENbMy4gR2VuZXJhdGUgLnN2ZyA8YnI-b3IucG5nIGZpbGU8YnI-YW5kIGRvd25sb2FkIHRvPGJyPmFwcHJvcHJpYXRlPGJyPmltYWdlcy8gZm9sZGVyXVxuICAgIHN1YmdyYXBoIHdbIF1cbiAgICBkaXJlY3Rpb24gVEJcbiAgICBEWzQuIFVzZSBmaWd1cmUgc2hvcnRjb2RlPGJyPnRvIHJlZmVyZW5jZSBzdmcgb3I8YnI-cG5nIGZpbGUgaW48YnI-cGFnZSAubWQgZmlsZV0gLS0-XG4gICAgRVs1LiBBZGQgY2FwdGlvbl1cbiAgICBlbmRcbiAgICBBIC0tPiBCXG4gICAgQiAtLT4gQ1xuICAgIEMgLS0-IHdcbiAgICBjbGFzc0RlZiBib3ggZmlsbDojZmZmLHN0cm9rZTojMDAwLHN0cm9rZS13aWR0aDoxcHgsY29sb3I6IzAwMDtcbiAgICBjbGFzcyBBLEIsQyxELEUsdyBib3hcbiAgICAiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" + +click E "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZmxvd2NoYXJ0IExSXG4gICAgQVsxLiBVc2UgZXh0ZXJuYWw8YnI-dG9vbCB0byBjcmVhdGUvZWRpdDxicj5kaWFncmFtXVxuICAgIEJbMi4gSWYgcG9zc2libGUsIHNhdmU8YnI-ZGlhZ3JhbSBjb29yZGluYXRlczxicj5mb3IgY29udHJpYnV0b3I8YnI-YWNjZXNzXVxuICAgIENbMy4gR2VuZXJhdGUgLnN2ZyA8YnI-b3IucG5nIGZpbGU8YnI-YW5kIGRvd25sb2FkIHRvPGJyPmFwcHJvcHJpYXRlPGJyPmltYWdlcy8gZm9sZGVyXVxuICAgIHN1YmdyYXBoIHdbIF1cbiAgICBkaXJlY3Rpb24gVEJcbiAgICBEWzQuIFVzZSBmaWd1cmUgc2hvcnRjb2RlPGJyPnRvIHJlZmVyZW5jZSBzdmcgb3I8YnI-cG5nIGZpbGUgaW48YnI-cGFnZSAubWQgZmlsZV0gLS0-XG4gICAgRVs1LiBBZGQgY2FwdGlvbl1cbiAgICBlbmRcbiAgICBBIC0tPiBCXG4gICAgQiAtLT4gQ1xuICAgIEMgLS0-IHdcbiAgICBjbGFzc0RlZiBib3ggZmlsbDojZmZmLHN0cm9rZTojMDAwLHN0cm9rZS13aWR0aDoxcHgsY29sb3I6IzAwMDtcbiAgICBjbGFzcyBBLEIsQyxELEUsdyBib3hcbiAgICAiLCJtZXJtYWlkIjoie1xuICBcInRoZW1lXCI6IFwiZGVmYXVsdFwiXG59IiwidXBkYXRlRWRpdG9yIjpmYWxzZSwiYXV0b1N5bmMiOnRydWUsInVwZGF0ZURpYWdyYW0iOmZhbHNlfQ" + +{{< /mermaid >}} + +Figure 5. External Tool method steps + + +The following lists the steps you should follow for adding a diagram using the External Tool method: + +1. Use your external tool to create a diagram. +2. Save the diagram coordinates for contributor access. For example, your tool may offer a link to the diagram image, or you could place the source code file, such as an `.xml` file, in a public repository for later contributor access. +3. Generate and save the diagram as an `.svg` or `.png` image file. Download this file to the appropriate `../images/` folder. +4. Use the `{{}}` shortcode to reference the diagram in the `.md` file. +5. Add a caption using the `{{}}` shortcode's `caption` parameter. + +Here is the `{{}}` shortcode for the `images/apple.svg` diagram: +```text +{{}} +``` + +If your external drawing tool permits: + +* You can incorporate multiple `.svg` or `.png` logos, icons and images into your diagram. However, make sure you observe copyright and follow the Kubernetes documentation + [guidelines](/docs/contribute/style/content-guide/) on the use of third party content. +* You should save the diagram source coordinates for later contributor access. For example, your tool may offer a link to the diagram image, or you could place the source code file, such as an `.xml` file, somewhere for contributor access. + +For more information on K8s and CNCF logos and images, check out [CNCF Artwork](https://github.com/cncf/artwork). + +The following lists advantages of the External Tool method: + +* Contributor familiarity with external tool. +* Diagrams require more detail than what Mermaid can offer. + +Don't forget to check that your diagram renders correctly using the [local](https://kubernetes.io/docs/contribute/new-content/open-a-pr/#preview-locally) and Netlify previews. + +## Examples + +This section shows several examples of Mermaid diagrams. + +{{< note >}} +The code block examples omit the Hugo `{{}}`, `{{}}` shortcode tags. This allows you to copy the code block into the live editor to experiment on your own. Note that the live editor doesn't recognize Hugo shortcodes. +{{< /note >}} + +### Example 1 - Pod topology spread constraints + +Figure 6 shows the diagram appearing in the [Pod Topology Spread Constraints](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#node-labels) page. + +{{< mermaid >}} + graph TB + subgraph "zoneB" + n3(Node3) + n4(Node4) + end + subgraph "zoneA" + n1(Node1) + n2(Node2) + end + + classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; + classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; + classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; + class n1,n2,n3,n4 k8s; + class zoneA,zoneB cluster; + +click n3 "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggVEJcbiAgICBzdWJncmFwaCBcInpvbmVCXCJcbiAgICAgICAgbjMoTm9kZTMpXG4gICAgICAgIG40KE5vZGU0KVxuICAgIGVuZFxuICAgIHN1YmdyYXBoIFwiem9uZUFcIlxuICAgICAgICBuMShOb2RlMSlcbiAgICAgICAgbjIoTm9kZTIpXG4gICAgZW5kXG5cbiAgICBjbGFzc0RlZiBwbGFpbiBmaWxsOiNkZGQsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICAgIGNsYXNzRGVmIGNsdXN0ZXIgZmlsbDojZmZmLHN0cm9rZTojYmJiLHN0cm9rZS13aWR0aDoycHgsY29sb3I6IzMyNmNlNTtcbiAgICBjbGFzcyBuMSxuMixuMyxuNCBrOHM7XG4gICAgY2xhc3Mgem9uZUEsem9uZUIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0" _blank + +click n4 "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggVEJcbiAgICBzdWJncmFwaCBcInpvbmVCXCJcbiAgICAgICAgbjMoTm9kZTMpXG4gICAgICAgIG40KE5vZGU0KVxuICAgIGVuZFxuICAgIHN1YmdyYXBoIFwiem9uZUFcIlxuICAgICAgICBuMShOb2RlMSlcbiAgICAgICAgbjIoTm9kZTIpXG4gICAgZW5kXG5cbiAgICBjbGFzc0RlZiBwbGFpbiBmaWxsOiNkZGQsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICAgIGNsYXNzRGVmIGNsdXN0ZXIgZmlsbDojZmZmLHN0cm9rZTojYmJiLHN0cm9rZS13aWR0aDoycHgsY29sb3I6IzMyNmNlNTtcbiAgICBjbGFzcyBuMSxuMixuMyxuNCBrOHM7XG4gICAgY2xhc3Mgem9uZUEsem9uZUIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0" _blank + +click n1 "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggVEJcbiAgICBzdWJncmFwaCBcInpvbmVCXCJcbiAgICAgICAgbjMoTm9kZTMpXG4gICAgICAgIG40KE5vZGU0KVxuICAgIGVuZFxuICAgIHN1YmdyYXBoIFwiem9uZUFcIlxuICAgICAgICBuMShOb2RlMSlcbiAgICAgICAgbjIoTm9kZTIpXG4gICAgZW5kXG5cbiAgICBjbGFzc0RlZiBwbGFpbiBmaWxsOiNkZGQsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICAgIGNsYXNzRGVmIGNsdXN0ZXIgZmlsbDojZmZmLHN0cm9rZTojYmJiLHN0cm9rZS13aWR0aDoycHgsY29sb3I6IzMyNmNlNTtcbiAgICBjbGFzcyBuMSxuMixuMyxuNCBrOHM7XG4gICAgY2xhc3Mgem9uZUEsem9uZUIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0" _blank + +click n2 "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggVEJcbiAgICBzdWJncmFwaCBcInpvbmVCXCJcbiAgICAgICAgbjMoTm9kZTMpXG4gICAgICAgIG40KE5vZGU0KVxuICAgIGVuZFxuICAgIHN1YmdyYXBoIFwiem9uZUFcIlxuICAgICAgICBuMShOb2RlMSlcbiAgICAgICAgbjIoTm9kZTIpXG4gICAgZW5kXG5cbiAgICBjbGFzc0RlZiBwbGFpbiBmaWxsOiNkZGQsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojMDAwO1xuICAgIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICAgIGNsYXNzRGVmIGNsdXN0ZXIgZmlsbDojZmZmLHN0cm9rZTojYmJiLHN0cm9rZS13aWR0aDoycHgsY29sb3I6IzMyNmNlNTtcbiAgICBjbGFzcyBuMSxuMixuMyxuNCBrOHM7XG4gICAgY2xhc3Mgem9uZUEsem9uZUIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0" _blank + +{{< /mermaid >}} + +Figure 6. Pod Topology Spread Constraints. + +Code block: +``` +graph TB + subgraph "zoneB" + n3(Node3) + n4(Node4) + end + subgraph "zoneA" + n1(Node1) + n2(Node2) + end + + classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; + classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; + classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; + class n1,n2,n3,n4 k8s; + class zoneA,zoneB cluster; +``` + +### Example 2 - Ingress + +Figure 7 shows the diagram appearing in the [What is Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/#what-is-ingress) page. + +{{< mermaid >}} +graph LR; +client([client])-. Ingress-managed
load balancer .->ingress[Ingress]; +ingress-->|routing rule|service[Service]; +subgraph cluster +ingress; +service-->pod1[Pod]; +service-->pod2[Pod]; +end +classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; +classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; +classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; +class ingress,service,pod1,pod2 k8s; +class client plain; +class cluster cluster; + +click client "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggIExSXG4gIGNsaWVudChbY2xpZW50XSktLiBJbmdyZXNzLW1hbmFnZWQgPGJyPiBsb2FkIGJhbGFuY2VyIC4tPmluZ3Jlc3NbSW5ncmVzc107XG4gIGluZ3Jlc3MtLT58cm91dGluZyBydWxlfHNlcnZpY2VbU2VydmljZV07XG4gIHN1YmdyYXBoIGNsdXN0ZXJcbiAgaW5ncmVzcztcbiAgc2VydmljZS0tPnBvZDFbUG9kXTtcbiAgc2VydmljZS0tPnBvZDJbUG9kXTtcbiAgZW5kXG4gIGNsYXNzRGVmIHBsYWluIGZpbGw6I2RkZCxzdHJva2U6I2ZmZixzdHJva2Utd2lkdGg6NHB4LGNvbG9yOiMwMDA7XG4gIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICBjbGFzc0RlZiBjbHVzdGVyIGZpbGw6I2ZmZixzdHJva2U6I2JiYixzdHJva2Utd2lkdGg6MnB4LGNvbG9yOiMzMjZjZTU7XG4gIGNsYXNzIGluZ3Jlc3Msc2VydmljZSxwb2QxLHBvZDIgazhzO1xuICBjbGFzcyBjbGllbnQgcGxhaW47XG4gIGNsYXNzIGNsdXN0ZXIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6ZmFsc2V9" _blank + +click ingress "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggIExSXG4gIGNsaWVudChbY2xpZW50XSktLiBJbmdyZXNzLW1hbmFnZWQgPGJyPiBsb2FkIGJhbGFuY2VyIC4tPmluZ3Jlc3NbSW5ncmVzc107XG4gIGluZ3Jlc3MtLT58cm91dGluZyBydWxlfHNlcnZpY2VbU2VydmljZV07XG4gIHN1YmdyYXBoIGNsdXN0ZXJcbiAgaW5ncmVzcztcbiAgc2VydmljZS0tPnBvZDFbUG9kXTtcbiAgc2VydmljZS0tPnBvZDJbUG9kXTtcbiAgZW5kXG4gIGNsYXNzRGVmIHBsYWluIGZpbGw6I2RkZCxzdHJva2U6I2ZmZixzdHJva2Utd2lkdGg6NHB4LGNvbG9yOiMwMDA7XG4gIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICBjbGFzc0RlZiBjbHVzdGVyIGZpbGw6I2ZmZixzdHJva2U6I2JiYixzdHJva2Utd2lkdGg6MnB4LGNvbG9yOiMzMjZjZTU7XG4gIGNsYXNzIGluZ3Jlc3Msc2VydmljZSxwb2QxLHBvZDIgazhzO1xuICBjbGFzcyBjbGllbnQgcGxhaW47XG4gIGNsYXNzIGNsdXN0ZXIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6ZmFsc2V9" _blank + +click service "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggIExSXG4gIGNsaWVudChbY2xpZW50XSktLiBJbmdyZXNzLW1hbmFnZWQgPGJyPiBsb2FkIGJhbGFuY2VyIC4tPmluZ3Jlc3NbSW5ncmVzc107XG4gIGluZ3Jlc3MtLT58cm91dGluZyBydWxlfHNlcnZpY2VbU2VydmljZV07XG4gIHN1YmdyYXBoIGNsdXN0ZXJcbiAgaW5ncmVzcztcbiAgc2VydmljZS0tPnBvZDFbUG9kXTtcbiAgc2VydmljZS0tPnBvZDJbUG9kXTtcbiAgZW5kXG4gIGNsYXNzRGVmIHBsYWluIGZpbGw6I2RkZCxzdHJva2U6I2ZmZixzdHJva2Utd2lkdGg6NHB4LGNvbG9yOiMwMDA7XG4gIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICBjbGFzc0RlZiBjbHVzdGVyIGZpbGw6I2ZmZixzdHJva2U6I2JiYixzdHJva2Utd2lkdGg6MnB4LGNvbG9yOiMzMjZjZTU7XG4gIGNsYXNzIGluZ3Jlc3Msc2VydmljZSxwb2QxLHBvZDIgazhzO1xuICBjbGFzcyBjbGllbnQgcGxhaW47XG4gIGNsYXNzIGNsdXN0ZXIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6ZmFsc2V9" _blank + +click pod1 "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggIExSXG4gIGNsaWVudChbY2xpZW50XSktLiBJbmdyZXNzLW1hbmFnZWQgPGJyPiBsb2FkIGJhbGFuY2VyIC4tPmluZ3Jlc3NbSW5ncmVzc107XG4gIGluZ3Jlc3MtLT58cm91dGluZyBydWxlfHNlcnZpY2VbU2VydmljZV07XG4gIHN1YmdyYXBoIGNsdXN0ZXJcbiAgaW5ncmVzcztcbiAgc2VydmljZS0tPnBvZDFbUG9kXTtcbiAgc2VydmljZS0tPnBvZDJbUG9kXTtcbiAgZW5kXG4gIGNsYXNzRGVmIHBsYWluIGZpbGw6I2RkZCxzdHJva2U6I2ZmZixzdHJva2Utd2lkdGg6NHB4LGNvbG9yOiMwMDA7XG4gIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICBjbGFzc0RlZiBjbHVzdGVyIGZpbGw6I2ZmZixzdHJva2U6I2JiYixzdHJva2Utd2lkdGg6MnB4LGNvbG9yOiMzMjZjZTU7XG4gIGNsYXNzIGluZ3Jlc3Msc2VydmljZSxwb2QxLHBvZDIgazhzO1xuICBjbGFzcyBjbGllbnQgcGxhaW47XG4gIGNsYXNzIGNsdXN0ZXIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6ZmFsc2V9" _blank + +click pod2 "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggIExSXG4gIGNsaWVudChbY2xpZW50XSktLiBJbmdyZXNzLW1hbmFnZWQgPGJyPiBsb2FkIGJhbGFuY2VyIC4tPmluZ3Jlc3NbSW5ncmVzc107XG4gIGluZ3Jlc3MtLT58cm91dGluZyBydWxlfHNlcnZpY2VbU2VydmljZV07XG4gIHN1YmdyYXBoIGNsdXN0ZXJcbiAgaW5ncmVzcztcbiAgc2VydmljZS0tPnBvZDFbUG9kXTtcbiAgc2VydmljZS0tPnBvZDJbUG9kXTtcbiAgZW5kXG4gIGNsYXNzRGVmIHBsYWluIGZpbGw6I2RkZCxzdHJva2U6I2ZmZixzdHJva2Utd2lkdGg6NHB4LGNvbG9yOiMwMDA7XG4gIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICBjbGFzc0RlZiBjbHVzdGVyIGZpbGw6I2ZmZixzdHJva2U6I2JiYixzdHJva2Utd2lkdGg6MnB4LGNvbG9yOiMzMjZjZTU7XG4gIGNsYXNzIGluZ3Jlc3Msc2VydmljZSxwb2QxLHBvZDIgazhzO1xuICBjbGFzcyBjbGllbnQgcGxhaW47XG4gIGNsYXNzIGNsdXN0ZXIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6ZmFsc2V9" _blank + + + +{{< /mermaid >}} +Figure 7. Ingress + +Code block: + +```mermaid +graph LR; + client([client])-. Ingress-managed
load balancer .->ingress[Ingress]; + ingress-->|routing rule|service[Service]; + subgraph cluster + ingress; + service-->pod1[Pod]; + service-->pod2[Pod]; + end + classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; + classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; + classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; + class ingress,service,pod1,pod2 k8s; + class client plain; + class cluster cluster; +``` + +### Example 3 - K8s system flow + +Figure 8 depicts a Mermaid sequence diagram showing the system flow between K8s components to start a container. + +{{< figure src="/docs/images/diagram-guide-example-3.svg" alt="K8s system flow diagram" class="diagram-large" caption="Figure 8. K8s system flow diagram" link="https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiJSV7aW5pdDp7XCJ0aGVtZVwiOlwibmV1dHJhbFwifX0lJVxuc2VxdWVuY2VEaWFncmFtXG4gICAgYWN0b3IgbWVcbiAgICBwYXJ0aWNpcGFudCBhcGlTcnYgYXMgY29udHJvbCBwbGFuZTxicj48YnI-YXBpLXNlcnZlclxuICAgIHBhcnRpY2lwYW50IGV0Y2QgYXMgY29udHJvbCBwbGFuZTxicj48YnI-ZXRjZCBkYXRhc3RvcmVcbiAgICBwYXJ0aWNpcGFudCBjbnRybE1nciBhcyBjb250cm9sIHBsYW5lPGJyPjxicj5jb250cm9sbGVyPGJyPm1hbmFnZXJcbiAgICBwYXJ0aWNpcGFudCBzY2hlZCBhcyBjb250cm9sIHBsYW5lPGJyPjxicj5zY2hlZHVsZXJcbiAgICBwYXJ0aWNpcGFudCBrdWJlbGV0IGFzIG5vZGU8YnI-PGJyPmt1YmVsZXRcbiAgICBwYXJ0aWNpcGFudCBjb250YWluZXIgYXMgbm9kZTxicj48YnI-Y29udGFpbmVyPGJyPnJ1bnRpbWVcbiAgICBtZS0-PmFwaVNydjogMS4ga3ViZWN0bCBjcmVhdGUgLWYgcG9kLnlhbWxcbiAgICBhcGlTcnYtLT4-ZXRjZDogMi4gc2F2ZSBuZXcgc3RhdGVcbiAgICBjbnRybE1nci0-PmFwaVNydjogMy4gY2hlY2sgZm9yIGNoYW5nZXNcbiAgICBzY2hlZC0-PmFwaVNydjogNC4gd2F0Y2ggZm9yIHVuYXNzaWduZWQgcG9kcyhzKVxuICAgIGFwaVNydi0-PnNjaGVkOiA1LiBub3RpZnkgYWJvdXQgcG9kIHcgbm9kZW5hbWU9XCIgXCJcbiAgICBzY2hlZC0-PmFwaVNydjogNi4gYXNzaWduIHBvZCB0byBub2RlXG4gICAgYXBpU3J2LS0-PmV0Y2Q6IDcuIHNhdmUgbmV3IHN0YXRlXG4gICAga3ViZWxldC0-PmFwaVNydjogOC4gbG9vayBmb3IgbmV3bHkgYXNzaWduZWQgcG9kKHMpXG4gICAgYXBpU3J2LT4-a3ViZWxldDogOS4gYmluZCBwb2QgdG8gbm9kZVxuICAgIGt1YmVsZXQtPj5jb250YWluZXI6IDEwLiBzdGFydCBjb250YWluZXJcbiAgICBrdWJlbGV0LT4-YXBpU3J2OiAxMS4gdXBkYXRlIHBvZCBzdGF0dXNcbiAgICBhcGlTcnYtLT4-ZXRjZDogMTIuIHNhdmUgbmV3IHN0YXRlIiwibWVybWFpZCI6IntcbiAgXCJ0aGVtZVwiOiBcImRlZmF1bHRcIlxufSIsInVwZGF0ZUVkaXRvciI6ZmFsc2UsImF1dG9TeW5jIjp0cnVlLCJ1cGRhdGVEaWFncmFtIjp0cnVlfQ" >}} + + + +Code block: +``` +%%{init:{"theme":"neutral"}}%% +sequenceDiagram + actor me + participant apiSrv as control plane

api-server + participant etcd as control plane

etcd datastore + participant cntrlMgr as control plane

controller
manager + participant sched as control plane

scheduler + participant kubelet as node

kubelet + participant container as node

container
runtime + me->>apiSrv: 1. kubectl create -f pod.yaml + apiSrv-->>etcd: 2. save new state + cntrlMgr->>apiSrv: 3. check for changes + sched->>apiSrv: 4. watch for unassigned pods(s) + apiSrv->>sched: 5. notify about pod w nodename=" " + sched->>apiSrv: 6. assign pod to node + apiSrv-->>etcd: 7. save new state + kubelet->>apiSrv: 8. look for newly assigned pod(s) + apiSrv->>kubelet: 9. bind pod to node + kubelet->>container: 10. start container + kubelet->>apiSrv: 11. update pod status + apiSrv-->>etcd: 12. save new state +``` + +## How to style diagrams + +You can style one or more diagram elements using well-known CSS nomenclature. You accomplish this using two types of statements in the Mermaid code. + +* `classDef` defines a class of style attributes. +* `class` defines one or more elements to apply the class to. + +In the code for [figure 7](https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggIExSXG4gIGNsaWVudChbY2xpZW50XSktLiBJbmdyZXNzLW1hbmFnZWQgPGJyPiBsb2FkIGJhbGFuY2VyIC4tPmluZ3Jlc3NbSW5ncmVzc107XG4gIGluZ3Jlc3MtLT58cm91dGluZyBydWxlfHNlcnZpY2VbU2VydmljZV07XG4gIHN1YmdyYXBoIGNsdXN0ZXJcbiAgaW5ncmVzcztcbiAgc2VydmljZS0tPnBvZDFbUG9kXTtcbiAgc2VydmljZS0tPnBvZDJbUG9kXTtcbiAgZW5kXG4gIGNsYXNzRGVmIHBsYWluIGZpbGw6I2RkZCxzdHJva2U6I2ZmZixzdHJva2Utd2lkdGg6NHB4LGNvbG9yOiMwMDA7XG4gIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICBjbGFzc0RlZiBjbHVzdGVyIGZpbGw6I2ZmZixzdHJva2U6I2JiYixzdHJva2Utd2lkdGg6MnB4LGNvbG9yOiMzMjZjZTU7XG4gIGNsYXNzIGluZ3Jlc3Msc2VydmljZSxwb2QxLHBvZDIgazhzO1xuICBjbGFzcyBjbGllbnQgcGxhaW47XG4gIGNsYXNzIGNsdXN0ZXIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0), you can see examples of both. +``` +classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; // defines style for the k8s class +class ingress,service,pod1,pod2 k8s; // k8s class is applied to elements ingress, service, pod1 and pod2. +``` +You can include one or multiple `classDef` and `class` statements in your diagram. You can also use the official K8s `#326ce5` hex color code for K8s components in your diagram. + +For more information on styling and classes, see [Mermaid Styling and classes docs](https://mermaid-js.github.io/mermaid/#/flowchart?id=styling-and-classes). + +## How to use captions + +A caption is a brief description of a diagram. A title or a short description of the diagram are examples of captions. Captions aren't meant to replace explanatory text you have in your documentation. Rather, they serve as a "context link" between that text and your diagram. + +The combination of some text and a diagram tied together with a caption help provide a concise representation of the information you wish to convey to the user. + +Without captions, you are asking the user to scan the text above or below the diagram to figure out a meaning. This can be frustrating for the user. + +Figure 9 lays out the three components for proper captioning: diagram, diagram caption and the diagram referral. + +{{< mermaid >}} +flowchart +A[Diagram

Inline Mermaid or
SVG image files] +B[Diagram Caption

Add Figure Number. and
Caption Text] +C[Diagram Referral

Referenence Figure Number
in text] + + classDef box fill:#fff,stroke:#000,stroke-width:1px,color:#000; + class A,B,C box + +click A "https://mermaid-js.github.io/mermaid-live-editor/edit#eyJjb2RlIjoiZmxvd2NoYXJ0XG4gICAgQVtEaWFncmFtPGJyPjxicj5JbmxpbmUgTWVybWFpZCBvcjxicj5TVkcgaW1hZ2UgZmlsZXNdXG4gICAgQltEaWFncmFtIENhcHRpb248YnI-PGJyPkFkZCBGaWd1cmUgTnVtYmVyLiBhbmQ8YnI-Q2FwdGlvbiBUZXh0XVxuICAgIENbRGlhZ3JhbSBSZWZlcnJhbDxicj48YnI-UmVmZXJlbmVuY2UgRmlndXJlIE51bWJlcjxicj5pbiB0ZXh0XVxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMgYm94IiwibWVybWFpZCI6IntcbiAgXCJ0aGVtZVwiOiBcImRlZmF1bHRcIlxufSIsInVwZGF0ZUVkaXRvciI6ZmFsc2UsImF1dG9TeW5jIjp0cnVlLCJ1cGRhdGVEaWFncmFtIjpmYWxzZX0" _blank + +click B "https://mermaid-js.github.io/mermaid-live-editor/edit#eyJjb2RlIjoiZmxvd2NoYXJ0XG4gICAgQVtEaWFncmFtPGJyPjxicj5JbmxpbmUgTWVybWFpZCBvcjxicj5TVkcgaW1hZ2UgZmlsZXNdXG4gICAgQltEaWFncmFtIENhcHRpb248YnI-PGJyPkFkZCBGaWd1cmUgTnVtYmVyLiBhbmQ8YnI-Q2FwdGlvbiBUZXh0XVxuICAgIENbRGlhZ3JhbSBSZWZlcnJhbDxicj48YnI-UmVmZXJlbmVuY2UgRmlndXJlIE51bWJlcjxicj5pbiB0ZXh0XVxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMgYm94IiwibWVybWFpZCI6IntcbiAgXCJ0aGVtZVwiOiBcImRlZmF1bHRcIlxufSIsInVwZGF0ZUVkaXRvciI6ZmFsc2UsImF1dG9TeW5jIjp0cnVlLCJ1cGRhdGVEaWFncmFtIjpmYWxzZX0" _blank + +click C "https://mermaid-js.github.io/mermaid-live-editor/edit#eyJjb2RlIjoiZmxvd2NoYXJ0XG4gICAgQVtEaWFncmFtPGJyPjxicj5JbmxpbmUgTWVybWFpZCBvcjxicj5TVkcgaW1hZ2UgZmlsZXNdXG4gICAgQltEaWFncmFtIENhcHRpb248YnI-PGJyPkFkZCBGaWd1cmUgTnVtYmVyLiBhbmQ8YnI-Q2FwdGlvbiBUZXh0XVxuICAgIENbRGlhZ3JhbSBSZWZlcnJhbDxicj48YnI-UmVmZXJlbmVuY2UgRmlndXJlIE51bWJlcjxicj5pbiB0ZXh0XVxuXG4gICAgY2xhc3NEZWYgYm94IGZpbGw6I2ZmZixzdHJva2U6IzAwMCxzdHJva2Utd2lkdGg6MXB4LGNvbG9yOiMwMDA7XG4gICAgY2xhc3MgQSxCLEMgYm94IiwibWVybWFpZCI6IntcbiAgXCJ0aGVtZVwiOiBcImRlZmF1bHRcIlxufSIsInVwZGF0ZUVkaXRvciI6ZmFsc2UsImF1dG9TeW5jIjp0cnVlLCJ1cGRhdGVEaWFncmFtIjpmYWxzZX0" _blank + +{{< /mermaid >}} +Figure 9. Caption Components. + +{{< note >}} +You should always add a caption to each diagram in your documentation. +{{< /note >}} + +**Diagram** + +The `Mermaid+SVG` and `External Tool` methods generate `.svg` image files. + +Here is the `{{}}` shortcode for the diagram defined in an `.svg` image file saved to `/images/docs/components-of-kubernetes.svg`: +```text +{{}} +``` +You should pass the `src`, `alt`, `class` and `caption` values into the `{{}}` shortcode. You can adjust the size of the diagram using `diagram-large`, `diagram-medium` and `diagram-small` classes. + +{{< note >}} +Diagrams created using the `Inline` method don't use the `{{}}` shortcode. The Mermaid code defines how the diagram will render on your page. +{{< /note >}} + +See [Methods for creating diagrams](#methods-for-creating-diagrams) for more information on the different methods for creating diagrams. + +**Diagram Caption** + +Next, add a diagram caption. + +If you define your diagram in an `.svg` image file, then you should use the `{{}}` shortcode's `caption` parameter. + +```text +{{}} +``` +If you define your diagram using inline Mermaid code, then you should use Markdown text. +```text +Figure 4. Kubernetes Architecture Components +``` + +The following lists several items to consider when adding diagram captions: + +* Use the `{{}}` shortcode to add a diagram caption for `Mermaid+SVG` and `External Tool` diagrams. +* Use simple Markdown text to add a diagram caption for the `Inline` method. +* Prepend your diagram caption with `Figure NUMBER.`. You must use `Figure` and the number must be unique for each diagram in your documentation page. Add a period after the number. +* Add your diagram caption text after the `Figure NUMBER.` on the same line. You must puncuate the caption with a period. Keep the caption text short. +* Position your diagram caption __BELOW__ your diagram. + +**Diagram Referral** + +Finally, you can add a diagram referral. This is used inside your text and should precede the diagram itself. It allows a user to connect your text with the associated diagram. The `Figure NUMBER` in your referral and caption must match. + +You should avoid using spatial references such as `..the image below..` or `..the following figure ..` + +Here is an example of a diagram referral: +```text +Figure 10 depicts the components of the Kubernetes architecture. The control plane ... +``` +Diagram referrals are optional and there are cases where they might not be suitable. If you are not sure, add a diagram referral to your text to see if it looks and sounds okay. When in doubt, use a diagram referral. + +**Complete picture** + +Figure 10 shows the Kubernetes Architecture diagram that includes the diagram, diagram caption and diagram referral. The `{{}}` shortcode renders the diagram, adds the caption and includes the optional `link` parameter so you can hyperlink the diagram. The diagram referral is contained in this paragraph. + +Here is the `{{}}` shortcode for this diagram: +``` +{{}} +``` + +{{< figure src="/images/docs/components-of-kubernetes.svg" alt="Kubernetes pod running inside a cluster" class="diagram-large" caption="Figure 10. Kubernetes Architecture." link="https://kubernetes.io/docs/concepts/overview/components/" >}} + + +## Tips + +* Always use the live editor to create/edit your diagram. + +* Always use Hugo local and Netlify previews to check out how the diagram appears in the documentation. + +* Include diagram source pointers such as a URL, source code location, or indicate the code is self-documenting. + +* Always use diagram captions. + +* Very helpful to include the diagram `.svg` or `.png` image and/or Mermaid source code in issues and PRs. + +* With the `Mermaid+SVG` and `External Tool` methods, use `.svg` image files because they stay sharp when you zoom in on the diagram. + +* Best practice for `.svg` files is to load it into an SVG editing tool and use the + “Convert text to paths” function. This ensures that the diagram renders the same on all systems, regardless of font availability and font rendering support. + +* No Mermaid support for additional icons or artwork. + +* Hugo Mermaid shortcodes don't work in the live editor. + +* Any time you modify a diagram in the live editor, you __must save__ it to generate a new URL for the diagram. + +* Click on the diagrams in this section to view the code and diagram rendering in the live editor. + +* Look over the source code of this page, `diagram-guide.md`, for more examples. + +* Check out the [Mermaid docs](https://mermaid-js.github.io/mermaid/#/) for explanations and examples. + +Most important, __Keep Diagrams Simple__. This will save time for you and fellow contributors, and allow for easier reading by new and experienced users. + + + + + + + diff --git a/content/en/docs/images/diagram-guide-example-3.svg b/content/en/docs/images/diagram-guide-example-3.svg new file mode 100644 index 0000000000..85fef13910 --- /dev/null +++ b/content/en/docs/images/diagram-guide-example-3.svg @@ -0,0 +1 @@ +mecontrol planeapi-servercontrol planeetcd datastorecontrol planecontrollermanagercontrol planeschedulernodekubeletnodecontainerruntime1. kubectl create -f pod.yaml2. save new state3. check for changes4. watch for unassigned pods(s)5. notify about pod w nodename=" "6. assign pod to node7. save new state8. look for newly assigned pod(s)9. bind pod to node10. start container11. update pod status12. save new statemecontrol planeapi-servercontrol planeetcd datastorecontrol planecontrollermanagercontrol planeschedulernodekubeletnodecontainerruntime \ No newline at end of file diff --git a/content/en/docs/reference/_index.md b/content/en/docs/reference/_index.md index 377c612e61..dfeeb7d8b0 100644 --- a/content/en/docs/reference/_index.md +++ b/content/en/docs/reference/_index.md @@ -73,14 +73,16 @@ configure kubernetes components or tools. Most of these APIs are not exposed by the API server in a RESTful way though they are essential for a user or an operator to use or manage a cluster. -* [kube-apiserver configuration (v1beta1)](/docs/reference/config-api/apiserver-config.v1beta1/) -* [kubelet configuration (v1beta1)](/docs/reference/config-api/kubelet-config.v1beta1/) -* [kube-scheduler configuration (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) -* [kube-scheduler configuration (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) -* [kube-scheduler policy reference (v1)](/docs/reference/config-api/kube-scheduler-policy-config.v1/) + +* [kube-apiserver configuration (v1)](/docs/reference/config-api/apiserver-config.v1/) +* [kubelet configuration (v1alpha1)](/docs/reference/config-api/kubelet-config.v1alpha1/) and + [kubelet configuration (v1beta1)](/docs/reference/config-api/kubelet-config.v1beta1/) +* [kube-scheduler configuration (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) and + [kube-scheduler configuration (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) * [kube-proxy configuration (v1alpha1)](/docs/reference/config-api/kube-proxy-config.v1alpha1/) * [`audit.k8s.io/v1` API](/docs/reference/config-api/apiserver-audit.v1/) -* [Client authentication API (v1beta1)](/docs/reference/config-api/client-authentication.v1beta1/) +* [Client authentication API (v1beta1)](/docs/reference/config-api/client-authentication.v1beta1/) and + [Client authentication API (v1)](/docs/reference/config-api/client-authentication.v1/) * [WebhookAdmission configuration (v1)](/docs/reference/config-api/apiserver-webhookadmission.v1/) ## Config API for kubeadm diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index 7a38493a70..a7d5cd84d9 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -1232,3 +1232,5 @@ The following `ExecCredential` manifest describes a cluster information sample. ## {{% heading "whatsnext" %}} * Read the [client authentication reference (v1beta1)](/docs/reference/config-api/client-authentication.v1beta1/) +* Read the [client authentication reference (v1)](/docs/reference/config-api/client-authentication.v1/) + diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 2f788cae34..6eb9e1d40e 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -65,7 +65,10 @@ different Kubernetes components. | `ControllerManagerLeaderMigration` | `false` | Alpha | 1.21 | | | `CPUManager` | `false` | Alpha | 1.8 | 1.9 | | `CPUManager` | `true` | Beta | 1.10 | | -| `CPUManagerPolicyOptions` | `false` | Alpha | 1.22 | | +| `CPUManagerPolicyAlphaOptions` | `false` | Alpha | 1.23 | | +| `CPUManagerPolicyBetaOptions` | `true` | Beta | 1.23 | | +| `CPUManagerPolicyOptions` | `false` | Alpha | 1.22 | 1.22 | +| `CPUManagerPolicyOptions` | `true` | Beta | 1.23 | | | `CSIInlineVolume` | `false` | Alpha | 1.15 | 1.15 | | `CSIInlineVolume` | `true` | Beta | 1.16 | - | | `CSIMigration` | `false` | Alpha | 1.14 | 1.16 | @@ -90,8 +93,6 @@ different Kubernetes components. | `CSIStorageCapacity` | `true` | Beta | 1.21 | | | `CSIVolumeHealth` | `false` | Alpha | 1.21 | | | `CSRDuration` | `true` | Beta | 1.22 | | -| `ConfigurableFSGroupPolicy` | `false` | Alpha | 1.18 | 1.19 | -| `ConfigurableFSGroupPolicy` | `true` | Beta | 1.20 | | | `ControllerManagerLeaderMigration` | `false` | Alpha | 1.21 | 1.21 | | `ControllerManagerLeaderMigration` | `true` | Beta | 1.22 | | | `CustomCPUCFSQuotaPeriod` | `false` | Alpha | 1.12 | | @@ -100,12 +101,14 @@ different Kubernetes components. | `DaemonSetUpdateSurge` | `true` | Beta | 1.22 | | | `DefaultPodTopologySpread` | `false` | Alpha | 1.19 | 1.19 | | `DefaultPodTopologySpread` | `true` | Beta | 1.20 | | -| `DelegateFSGroupToCSIDriver` | `false` | Alpha | 1.22 | | +| `DelegateFSGroupToCSIDriver` | `false` | Alpha | 1.22 | 1.22 | +| `DelegateFSGroupToCSIDriver` | `true` | Beta | 1.23 | | | `DevicePlugins` | `false` | Alpha | 1.8 | 1.9 | | `DevicePlugins` | `true` | Beta | 1.10 | | | `DisableAcceleratorUsageMetrics` | `false` | Alpha | 1.19 | 1.19 | | `DisableAcceleratorUsageMetrics` | `true` | Beta | 1.20 | | | `DisableCloudProviders` | `false` | Alpha | 1.22 | | +| `DisableKubeletCloudCredentialProviders` | `false` | Alpha | 1.23 | | | `DownwardAPIHugePages` | `false` | Alpha | 1.20 | 1.20 | | `DownwardAPIHugePages` | `false` | Beta | 1.21 | | | `EfficientWatchResumption` | `false` | Alpha | 1.20 | 1.20 | @@ -124,7 +127,9 @@ different Kubernetes components. | `ExperimentalHostUserNamespaceDefaulting` | `false` | Beta | 1.5 | | | `GracefulNodeShutdown` | `false` | Alpha | 1.20 | 1.20 | | `GracefulNodeShutdown` | `true` | Beta | 1.21 | | +| `GracefulNodeShutdownBasedOnPodPriority` | `false` | Alpha | 1.23 | | | `GRPCContainerProbe` | `false` | Alpha | 1.23 | | +| `HonorPVReclaimPolicy` | `false` | Alpha | 1.23 | | | `HPAContainerMetrics` | `false` | Alpha | 1.20 | | | `HPAScaleToZero` | `false` | Alpha | 1.16 | | | `IdentifyPodOS` | `false` | Alpha | 1.23 | | @@ -135,6 +140,8 @@ different Kubernetes components. | `InTreePluginAzureFileUnregister` | `false` | Alpha | 1.21 | | | `InTreePluginGCEUnregister` | `false` | Alpha | 1.21 | | | `InTreePluginOpenStackUnregister` | `false` | Alpha | 1.21 | | +| `InTreePluginPortworxUnregister` | `false` | Alpha | 1.23 | | +| `InTreePluginRBDUnregister` | `false` | Alpha | 1.23 | | | `InTreePluginvSphereUnregister` | `false` | Alpha | 1.21 | | | `JobMutableNodeSchedulingDirectives` | `true` | Beta | 1.23 | | | `JobReadyPods` | `false` | Alpha | 1.23 | | @@ -142,7 +149,10 @@ different Kubernetes components. | `JobTrackingWithFinalizers` | `true` | Beta | 1.23 | | | `KubeletCredentialProviders` | `false` | Alpha | 1.20 | | | `KubeletInUserNamespace` | `false` | Alpha | 1.22 | | -| `KubeletPodResourcesGetAllocatable` | `false` | Alpha | 1.21 | | +| `KubeletPodResources` | `false` | Alpha | 1.13 | 1.14 | +| `KubeletPodResources` | `true` | Beta | 1.15 | | +| `KubeletPodResourcesGetAllocatable` | `false` | Alpha | 1.21 | 1.22 | +| `KubeletPodResourcesGetAllocatable` | `false` | Beta | 1.23 | | | `LocalStorageCapacityIsolation` | `false` | Alpha | 1.7 | 1.9 | | `LocalStorageCapacityIsolation` | `true` | Beta | 1.10 | | | `LocalStorageCapacityIsolationFSQuotaMonitoring` | `false` | Alpha | 1.15 | | @@ -157,10 +167,13 @@ different Kubernetes components. | `NodeSwap` | `false` | Alpha | 1.22 | | | `NonPreemptingPriority` | `false` | Alpha | 1.15 | 1.18 | | `NonPreemptingPriority` | `true` | Beta | 1.19 | | -| `PodDeletionCost` | `false` | Alpha | 1.21 | 1.21 | -| `PodDeletionCost` | `true` | Beta | 1.22 | | +| `OpenAPIEnum` | `false` | Alpha | 1.23 | | +| `OpenAPIv3` | `false` | Alpha | 1.23 | | +| `PodAndContainerStatsFromCRI` | `false` | Alpha | 1.23 | | | `PodAffinityNamespaceSelector` | `false` | Alpha | 1.21 | 1.21 | | `PodAffinityNamespaceSelector` | `true` | Beta | 1.22 | | +| `PodDeletionCost` | `false` | Alpha | 1.21 | 1.21 | +| `PodDeletionCost` | `true` | Beta | 1.22 | | | `PodOverhead` | `false` | Alpha | 1.16 | 1.17 | | `PodOverhead` | `true` | Beta | 1.18 | | | `PodSecurity` | `false` | Alpha | 1.22 | 1.22 | @@ -189,6 +202,7 @@ different Kubernetes components. | `ServiceLoadBalancerClass` | `true` | Beta | 1.22 | | | `SizeMemoryBackedVolumes` | `false` | Alpha | 1.20 | 1.21 | | `SizeMemoryBackedVolumes` | `true` | Beta | 1.22 | | +| `StatefulSetAutoDeletePVC` | `false` | Alpha | 1.22 | | | `StatefulSetMinReadySeconds` | `false` | Alpha | 1.22 | 1.22 | | `StatefulSetMinReadySeconds` | `true` | Beta | 1.23 | | | `StorageVersionAPI` | `false` | Alpha | 1.20 | | @@ -197,13 +211,14 @@ different Kubernetes components. | `SuspendJob` | `false` | Alpha | 1.21 | 1.21 | | `SuspendJob` | `true` | Beta | 1.22 | | | `TopologyAwareHints` | `false` | Alpha | 1.21 | 1.22 | -| `TopologyAwareHints` | `true` | Beta | 1.23 | | +| `TopologyAwareHints` | `false` | Beta | 1.23 | | | `TopologyManager` | `false` | Alpha | 1.16 | 1.17 | | `TopologyManager` | `true` | Beta | 1.18 | | | `VolumeCapacityPriority` | `false` | Alpha | 1.21 | - | | `WinDSR` | `false` | Alpha | 1.14 | | | `WinOverlay` | `false` | Alpha | 1.14 | 1.19 | | `WinOverlay` | `true` | Beta | 1.20 | | +| `WindowsHostProcessContainers` | `false` | Alpha | 1.22 | 1.22 | | `WindowsHostProcessContainers` | `false` | Beta | 1.23 | | {{< /table >}} @@ -233,6 +248,8 @@ different Kubernetes components. | `BoundServiceAccountTokenVolume` | `false` | Alpha | 1.13 | 1.20 | | `BoundServiceAccountTokenVolume` | `true` | Beta | 1.21 | 1.21 | | `BoundServiceAccountTokenVolume` | `true` | GA | 1.22 | - | +| `ConfigurableFSGroupPolicy` | `false` | Alpha | 1.18 | 1.19 | +| `ConfigurableFSGroupPolicy` | `true` | Beta | 1.20 | 1.22 | | `ConfigurableFSGroupPolicy` | `true` | GA | 1.23 | | | `CRIContainerLogRotation` | `false` | Alpha | 1.10 | 1.10 | | `CRIContainerLogRotation` | `true` | Beta | 1.11 | 1.20 | @@ -312,12 +329,12 @@ different Kubernetes components. | `EndpointSliceProxying` | `false` | Alpha | 1.18 | 1.18 | | `EndpointSliceProxying` | `true` | Beta | 1.19 | 1.21 | | `EndpointSliceProxying` | `true` | GA | 1.22 | - | -| `ExperimentalCriticalPodAnnotation` | `false` | Alpha | 1.5 | 1.12 | -| `ExperimentalCriticalPodAnnotation` | `false` | Deprecated | 1.13 | - | | `EvenPodsSpread` | `false` | Alpha | 1.16 | 1.17 | | `EvenPodsSpread` | `true` | Beta | 1.18 | 1.18 | | `EvenPodsSpread` | `true` | GA | 1.19 | - | | `ExecProbeTimeout` | `true` | GA | 1.20 | - | +| `ExperimentalCriticalPodAnnotation` | `false` | Alpha | 1.5 | 1.12 | +| `ExperimentalCriticalPodAnnotation` | `false` | Deprecated | 1.13 | - | | `ExternalPolicyForExternalIP` | `true` | GA | 1.18 | - | | `GCERegionalPersistentDisk` | `true` | Beta | 1.10 | 1.12 | | `GCERegionalPersistentDisk` | `true` | GA | 1.13 | - | @@ -330,9 +347,6 @@ different Kubernetes components. | `HugePages` | `false` | Alpha | 1.8 | 1.9 | | `HugePages` | `true` | Beta| 1.10 | 1.13 | | `HugePages` | `true` | GA | 1.14 | - | -| `HugePageStorageMediumSize` | `false` | Alpha | 1.18 | 1.18 | -| `HugePageStorageMediumSize` | `true` | Beta | 1.19 | 1.21 | -| `HugePageStorageMediumSize` | `true` | GA | 1.22 | - | | `HyperVContainer` | `false` | Alpha | 1.10 | 1.19 | | `HyperVContainer` | `false` | Deprecated | 1.20 | - | | `ImmutableEphemeralVolumes` | `false` | Alpha | 1.18 | 1.18 | @@ -351,9 +365,6 @@ different Kubernetes components. | `KubeletPluginsWatcher` | `false` | Alpha | 1.11 | 1.11 | | `KubeletPluginsWatcher` | `true` | Beta | 1.12 | 1.12 | | `KubeletPluginsWatcher` | `true` | GA | 1.13 | - | -| `KubeletPodResources` | `false` | Alpha | 1.13 | 1.14 | -| `KubeletPodResources` | `true` | Beta | 1.15 | | -| `KubeletPodResources` | `true` | GA | 1.20 | | | `LegacyNodeRoleBehavior` | `false` | Alpha | 1.16 | 1.18 | | `LegacyNodeRoleBehavior` | `true` | Beta | 1.19 | 1.20 | | `LegacyNodeRoleBehavior` | `false` | GA | 1.21 | - | @@ -375,7 +386,6 @@ different Kubernetes components. | `PersistentLocalVolumes` | `false` | Alpha | 1.7 | 1.9 | | `PersistentLocalVolumes` | `true` | Beta | 1.10 | 1.13 | | `PersistentLocalVolumes` | `true` | GA | 1.14 | - | -| `PodAndContainerStatsFromCRI` | `false` | Alpha | 1.23 | | | `PodDisruptionBudget` | `false` | Alpha | 1.3 | 1.4 | | `PodDisruptionBudget` | `true` | Beta | 1.5 | 1.20 | | `PodDisruptionBudget` | `true` | GA | 1.21 | - | @@ -497,7 +507,6 @@ different Kubernetes components. | `WindowsGMSA` | `false` | Alpha | 1.14 | 1.15 | | `WindowsGMSA` | `true` | Beta | 1.16 | 1.17 | | `WindowsGMSA` | `true` | GA | 1.18 | - | -| `WindowsHostProcessContainers` | `false` | Alpha | 1.22 | | `WindowsRunAsUserName` | `false` | Alpha | 1.16 | 1.16 | | `WindowsRunAsUserName` | `true` | Beta | 1.17 | 1.17 | | `WindowsRunAsUserName` | `true` | GA | 1.18 | - | @@ -586,6 +595,12 @@ Each feature gate is designed for enabling/disabling a specific feature: (e.g. the cloud-controller-manager) in an HA cluster without downtime. - `CPUManager`: Enable container level CPU affinity support, see [CPU Management Policies](/docs/tasks/administer-cluster/cpu-management-policies/). +- `CPUManagerPolicyAlphaOptions`: This allows fine-tuning of CPUManager policies, experimental, Alpha-quality options + This feature gate guards *a group* of CPUManager options whose quality level is alpha. + This feature gate will never graduate to beta or stable. +- `CPUManagerPolicyBetaOptions`: This allows fine-tuning of CPUManager policies, experimental, Beta-quality options + This feature gate guards *a group* of CPUManager options whose quality level is beta. + This feature gate will never graduate to stable. - `CPUManagerPolicyOptions`: Allow fine-tuning of CPUManager policies. - `CRIContainerLogRotation`: Enable container log rotation for CRI container runtime. The default max size of a log file is 10MB and the default max number of log files allowed for a container is 5. These values can be configured in the kubelet config. @@ -728,6 +743,8 @@ Each feature gate is designed for enabling/disabling a specific feature: - `DisableCloudProviders`: Disables any functionality in `kube-apiserver`, `kube-controller-manager` and `kubelet` related to the `--cloud-provider` component flag. +- `DisableKubeletCloudCredentialProviders`: Disable the in-tree functionality in kubelet + to authenticate to a cloud provider container registry for image pull credentials. - `DownwardAPIHugePages`: Enables usage of hugepages in [downward API](/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information). - `DryRun`: Enable server-side [dry run](/docs/reference/using-api/api-concepts/#dry-run) requests @@ -792,7 +809,10 @@ Each feature gate is designed for enabling/disabling a specific feature: and gracefully terminate pods running on the node. See [Graceful Node Shutdown](/docs/concepts/architecture/nodes/#graceful-node-shutdown) for more details. += `GracefulNodeShutdownBasedOnPodPriority`: Enables the kubelet to check Pod priorities + when shutting down a node gracefully. - `GRPCContainerProbe`: Enables the gRPC probe method for {Liveness,Readiness,Startup}Probe. See [Configure Liveness, Readiness and Startup Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-grpc-liveness-probe). +- `HonorPVReclaimPolicy`: Honor persistent volume reclaim policy when it is `Delete` irrespective of PV-PVC deletion ordering. - `HPAContainerMetrics`: Enable the `HorizontalPodAutoscaler` to scale based on metrics from individual containers in target pods. - `HPAScaleToZero`: Enables setting `minReplicas` to 0 for `HorizontalPodAutoscaler` @@ -818,6 +838,10 @@ Each feature gate is designed for enabling/disabling a specific feature: and volume controllers. - `InTreePluginOpenStackUnregister`: Stops registering the OpenStack cinder in-tree plugin in kubelet and volume controllers. +- `InTreePluginPortworxUnregister`: Stops registering the Portworx in-tree plugin in kubelet + and volume controllers. +- `InTreePluginRBDUnregister`: Stops registering the RBD in-tree plugin in kubelet + and volume controllers. - `InTreePluginvSphereUnregister`: Stops registering the vSphere in-tree plugin in kubelet and volume controllers. - `IndexedJob`: Allows the [Job](/docs/concepts/workloads/controllers/job/) @@ -889,6 +913,9 @@ Each feature gate is designed for enabling/disabling a specific feature: Must be used with `KubeletConfiguration.failSwapOn` set to false. For more details, please see [swap memory](/docs/concepts/architecture/nodes/#swap-memory) - `NonPreemptingPriority`: Enable `preemptionPolicy` field for PriorityClass and Pod. +- `OpenAPIEnum`: Enables populating "enum" fields of OpenAPI schemas in the + spec returned from the API server. +- `OpenAPIv3`: Enables the API server to publish OpenAPI v3. - `PVCProtection`: Enable the prevention of a PersistentVolumeClaim (PVC) from being deleted when it is still used by any Pod. - `PodDeletionCost`: Enable the [Pod Deletion Cost](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost) diff --git a/content/en/docs/reference/command-line-tools-reference/kubelet.md b/content/en/docs/reference/command-line-tools-reference/kubelet.md index 75698b3966..ac54718b01 100644 --- a/content/en/docs/reference/command-line-tools-reference/kubelet.md +++ b/content/en/docs/reference/command-line-tools-reference/kubelet.md @@ -916,7 +916,7 @@ WindowsHostProcessContainers=true|false (ALPHA - default=false)
---pod-infra-container-image string     Default: k8s.gcr.io/pause:3.5 +--pod-infra-container-image string     Default: k8s.gcr.io/pause:3.6 Specified image will not be pruned by the image garbage collector. When container-runtime is set to docker, all containers in each pod will use the network/IPC namespaces from this image. Other CRI implementations have their own configuration to set this image. diff --git a/content/en/docs/reference/config-api/apiserver-audit.v1.md b/content/en/docs/reference/config-api/apiserver-audit.v1.md index f722e81341..e817b838ae 100644 --- a/content/en/docs/reference/config-api/apiserver-audit.v1.md +++ b/content/en/docs/reference/config-api/apiserver-audit.v1.md @@ -16,14 +16,12 @@ auto_generated: true - ## `Event` {#audit-k8s-io-v1-Event} **Appears in:** - - [EventList](#audit-k8s-io-v1-EventList) @@ -81,7 +79,7 @@ For non-resource requests, this is the lower-cased HTTP method. user [Required]
-authentication/v1.UserInfo +authentication/v1.UserInfo Authenticated user information. @@ -89,7 +87,7 @@ For non-resource requests, this is the lower-cased HTTP method. impersonatedUser
-authentication/v1.UserInfo +authentication/v1.UserInfo Impersonated user information. @@ -123,7 +121,7 @@ Does not apply for List-type requests, or non-resource requests. responseStatus
-meta/v1.Status +meta/v1.Status The response status, populated even when the ResponseObject is not a Status type. @@ -154,7 +152,7 @@ at Response Level. requestReceivedTimestamp
-meta/v1.MicroTime +meta/v1.MicroTime Time the request reached the apiserver. @@ -162,7 +160,7 @@ at Response Level. stageTimestamp
-meta/v1.MicroTime +meta/v1.MicroTime Time the request reached current audit stage. @@ -184,8 +182,6 @@ should be short. Annotations are included in the Metadata level. - - ## `EventList` {#audit-k8s-io-v1-EventList} @@ -206,7 +202,7 @@ EventList is a list of audit Events. metadata
-meta/v1.ListMeta +meta/v1.ListMeta No description provided. @@ -225,8 +221,6 @@ EventList is a list of audit Events. - - ## `Policy` {#audit-k8s-io-v1-Policy} @@ -234,7 +228,6 @@ EventList is a list of audit Events. **Appears in:** - - [PolicyList](#audit-k8s-io-v1-PolicyList) @@ -252,7 +245,7 @@ categories are logged. metadata
-meta/v1.ObjectMeta +meta/v1.ObjectMeta ObjectMeta is included for interoperability with API infrastructure.Refer to the Kubernetes API documentation for the fields of the metadata field. @@ -294,8 +287,6 @@ in a rule will override the global default. - - ## `PolicyList` {#audit-k8s-io-v1-PolicyList} @@ -316,7 +307,7 @@ PolicyList is a list of audit Policies. metadata
-meta/v1.ListMeta +meta/v1.ListMeta No description provided. @@ -335,8 +326,6 @@ PolicyList is a list of audit Policies. - - ## `GroupResources` {#audit-k8s-io-v1-GroupResources} @@ -344,7 +333,6 @@ PolicyList is a list of audit Policies. **Appears in:** - - [PolicyRule](#audit-k8s-io-v1-PolicyRule) @@ -397,8 +385,6 @@ An empty list implies that every instance of the resource is matched. - - ## `Level` {#audit-k8s-io-v1-Level} @@ -406,17 +392,13 @@ An empty list implies that every instance of the resource is matched. **Appears in:** - - [Event](#audit-k8s-io-v1-Event) - - [PolicyRule](#audit-k8s-io-v1-PolicyRule) Level defines the amount of information logged during auditing - - ## `ObjectReference` {#audit-k8s-io-v1-ObjectReference} @@ -424,7 +406,6 @@ Level defines the amount of information logged during auditing **Appears in:** - - [Event](#audit-k8s-io-v1-Event) @@ -509,8 +490,6 @@ The empty string represents the core API group. - - ## `PolicyRule` {#audit-k8s-io-v1-PolicyRule} @@ -518,7 +497,6 @@ The empty string represents the core API group. **Appears in:** - - [Policy](#audit-k8s-io-v1-Policy) @@ -624,8 +602,6 @@ Policy.OmitManagedFields will stand. - - ## `Stage` {#audit-k8s-io-v1-Stage} @@ -633,16 +609,12 @@ Policy.OmitManagedFields will stand. **Appears in:** - - [Event](#audit-k8s-io-v1-Event) - - [Policy](#audit-k8s-io-v1-Policy) - - [PolicyRule](#audit-k8s-io-v1-PolicyRule) Stage defines the stages in request handling that audit events may be generated. - diff --git a/content/en/docs/reference/config-api/apiserver-config.v1.md b/content/en/docs/reference/config-api/apiserver-config.v1.md new file mode 100644 index 0000000000..7767a4e406 --- /dev/null +++ b/content/en/docs/reference/config-api/apiserver-config.v1.md @@ -0,0 +1,91 @@ +--- +title: kube-apiserver Configuration (v1) +content_type: tool-reference +package: apiserver.config.k8s.io/v1 +auto_generated: true +--- +Package v1 is the v1 version of the API. + +## Resource Types + + +- [AdmissionConfiguration](#apiserver-config-k8s-io-v1-AdmissionConfiguration) + + + +## `AdmissionConfiguration` {#apiserver-config-k8s-io-v1-AdmissionConfiguration} + + + + + +AdmissionConfiguration provides versioned configuration for admission controllers. + + + + + + + + + + + + + + + + + +
FieldDescription
apiVersion
string		apiserver.config.k8s.io/v1
kind
string		AdmissionConfiguration
plugins
+[]AdmissionPluginConfiguration +		 + Plugins allows specifying a configuration per admission control plugin.
+ +## `AdmissionPluginConfiguration` {#apiserver-config-k8s-io-v1-AdmissionPluginConfiguration} + + + + +**Appears in:** +- [AdmissionConfiguration](#apiserver-config-k8s-io-v1-AdmissionConfiguration) + + +AdmissionPluginConfiguration provides the configuration for a single plug-in. + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
name [Required]
+string +		 + Name is the name of the admission controller. +It must match the registered admission plugin name.
path
+string +		 + Path is the path to a configuration file that contains the plugin's +configuration
configuration
+k8s.io/apimachinery/pkg/runtime.Unknown +		 + Configuration is an embedded configuration object to be used as the plugin's +configuration. If present, it will be used instead of the path to the configuration file.
+ diff --git a/content/en/docs/reference/config-api/apiserver-config.v1beta1.md b/content/en/docs/reference/config-api/apiserver-config.v1beta1.md deleted file mode 100644 index fb5363f58d..0000000000 --- a/content/en/docs/reference/config-api/apiserver-config.v1beta1.md +++ /dev/null @@ -1,311 +0,0 @@ ---- -title: kube-apiserver Configuration (v1beta1) -content_type: tool-reference -package: apiserver.k8s.io/v1beta1 -auto_generated: true ---- -Package v1beta1 is the v1beta1 version of the API. - -## Resource Types - - -- [EgressSelectorConfiguration](#apiserver-k8s-io-v1beta1-EgressSelectorConfiguration) - - - - -## `EgressSelectorConfiguration` {#apiserver-k8s-io-v1beta1-EgressSelectorConfiguration} - - - - - -EgressSelectorConfiguration provides versioned configuration for egress selector clients. - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		apiserver.k8s.io/v1beta1
kind
string		EgressSelectorConfiguration
egressSelections [Required]
-[]EgressSelection -		 - connectionServices contains a list of egress selection client configurations
- - - -## `Connection` {#apiserver-k8s-io-v1beta1-Connection} - - - - -**Appears in:** - -- [EgressSelection](#apiserver-k8s-io-v1beta1-EgressSelection) - - -Connection provides the configuration for a single egress selection client. - - - - - - - - - - - - - - - - - - -
FieldDescription
proxyProtocol [Required]
-ProtocolType -		 - Protocol is the protocol used to connect from client to the konnectivity server.
transport
-Transport -		 - Transport defines the transport configurations we use to dial to the konnectivity server. -This is required if ProxyProtocol is HTTPConnect or GRPC.
- - - -## `EgressSelection` {#apiserver-k8s-io-v1beta1-EgressSelection} - - - - -**Appears in:** - -- [EgressSelectorConfiguration](#apiserver-k8s-io-v1beta1-EgressSelectorConfiguration) - - -EgressSelection provides the configuration for a single egress selection client. - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - name is the name of the egress selection. -Currently supported values are "controlplane", "master", "etcd" and "cluster" -The "master" egress selector is deprecated in favor of "controlplane"
connection [Required]
-Connection -		 - connection is the exact information used to configure the egress selection
- - - -## `ProtocolType` {#apiserver-k8s-io-v1beta1-ProtocolType} - -(Alias of `string`) - - -**Appears in:** - -- [Connection](#apiserver-k8s-io-v1beta1-Connection) - - -ProtocolType is a set of valid values for Connection.ProtocolType - - - - - -## `TCPTransport` {#apiserver-k8s-io-v1beta1-TCPTransport} - - - - -**Appears in:** - -- [Transport](#apiserver-k8s-io-v1beta1-Transport) - - -TCPTransport provides the information to connect to konnectivity server via TCP - - - - - - - - - - - - - - - - - - -
FieldDescription
url [Required]
-string -		 - URL is the location of the konnectivity server to connect to. -As an example it might be "https://127.0.0.1:8131"
tlsConfig
-TLSConfig -		 - TLSConfig is the config needed to use TLS when connecting to konnectivity server
- - - -## `TLSConfig` {#apiserver-k8s-io-v1beta1-TLSConfig} - - - - -**Appears in:** - -- [TCPTransport](#apiserver-k8s-io-v1beta1-TCPTransport) - - -TLSConfig provides the authentication information to connect to konnectivity server -Only used with TCPTransport - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
caBundle
-string -		 - caBundle is the file location of the CA to be used to determine trust with the konnectivity server. -Must be absent/empty if TCPTransport.URL is prefixed with http:// -If absent while TCPTransport.URL is prefixed with https://, default to system trust roots.
clientKey
-string -		 - clientKey is the file location of the client key to be used in mtls handshakes with the konnectivity server. -Must be absent/empty if TCPTransport.URL is prefixed with http:// -Must be configured if TCPTransport.URL is prefixed with https://
clientCert
-string -		 - clientCert is the file location of the client certificate to be used in mtls handshakes with the konnectivity server. -Must be absent/empty if TCPTransport.URL is prefixed with http:// -Must be configured if TCPTransport.URL is prefixed with https://
- - - -## `Transport` {#apiserver-k8s-io-v1beta1-Transport} - - - - -**Appears in:** - -- [Connection](#apiserver-k8s-io-v1beta1-Connection) - - -Transport defines the transport configurations we use to dial to the konnectivity server - - - - - - - - - - - - - - - - - - -
FieldDescription
tcp
-TCPTransport -		 - TCP is the TCP configuration for communicating with the konnectivity server via TCP -ProxyProtocol of GRPC is not supported with TCP transport at the moment -Requires at least one of TCP or UDS to be set
uds
-UDSTransport -		 - UDS is the UDS configuration for communicating with the konnectivity server via UDS -Requires at least one of TCP or UDS to be set
- - - -## `UDSTransport` {#apiserver-k8s-io-v1beta1-UDSTransport} - - - - -**Appears in:** - -- [Transport](#apiserver-k8s-io-v1beta1-Transport) - - -UDSTransport provides the information to connect to konnectivity server via UDS - - - - - - - - - - - - - -
FieldDescription
udsName [Required]
-string -		 - UDSName is the name of the unix domain socket to connect to konnectivity server -This does not use a unix:// prefix. (Eg: /etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket)
- - diff --git a/content/en/docs/reference/config-api/apiserver-webhookadmission.v1.md b/content/en/docs/reference/config-api/apiserver-webhookadmission.v1.md index fb45ca7b1a..cecebc3d10 100644 --- a/content/en/docs/reference/config-api/apiserver-webhookadmission.v1.md +++ b/content/en/docs/reference/config-api/apiserver-webhookadmission.v1.md @@ -13,7 +13,6 @@ Package v1 is the v1 version of the API. - ## `WebhookAdmission` {#apiserver-config-k8s-io-v1-WebhookAdmission} @@ -42,5 +41,4 @@ WebhookAdmission provides configuration for the webhook admission controller. - diff --git a/content/en/docs/reference/config-api/client-authentication.v1.md b/content/en/docs/reference/config-api/client-authentication.v1.md new file mode 100644 index 0000000000..20f7554854 --- /dev/null +++ b/content/en/docs/reference/config-api/client-authentication.v1.md @@ -0,0 +1,249 @@ +--- +title: Client Authentication (v1) +content_type: tool-reference +package: client.authentication.k8s.io/v1 +auto_generated: true +--- + + +## Resource Types + + +- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential) + + + +## `ExecCredential` {#client-authentication-k8s-io-v1-ExecCredential} + + + + + +ExecCredential is used by exec-based plugins to communicate credentials to +HTTP transports. + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
apiVersion
string		client.authentication.k8s.io/v1
kind
string		ExecCredential
spec [Required]
+ExecCredentialSpec +		 + Spec holds information passed to the plugin by the transport.
status
+ExecCredentialStatus +		 + Status is filled in by the plugin and holds the credentials that the transport +should use to contact the API.
+ +## `Cluster` {#client-authentication-k8s-io-v1-Cluster} + + + + +**Appears in:** +- [ExecCredentialSpec](#client-authentication-k8s-io-v1-ExecCredentialSpec) + + +Cluster contains information to allow an exec plugin to communicate +with the kubernetes cluster being authenticated to. + +To ensure that this struct contains everything someone would need to communicate +with a kubernetes cluster (just like they would via a kubeconfig), the fields +should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception +of CertificateAuthority, since CA data will always be passed to the plugin as bytes. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
server [Required]
+string +		 + Server is the address of the kubernetes cluster (https://hostname:port).
tls-server-name
+string +		 + TLSServerName is passed to the server for SNI and is used in the client to +check server certificates against. If ServerName is empty, the hostname +used to contact the server is used.
insecure-skip-tls-verify
+bool +		 + InsecureSkipTLSVerify skips the validity check for the server's certificate. +This will make your HTTPS connections insecure.
certificate-authority-data
+[]byte +		 + CAData contains PEM-encoded certificate authority certificates. +If empty, system roots should be used.
proxy-url
+string +		 + ProxyURL is the URL to the proxy to be used for all requests to this +cluster.
config
+k8s.io/apimachinery/pkg/runtime.RawExtension +		 + Config holds additional config data that is specific to the exec +plugin with regards to the cluster being authenticated to. + +This data is sourced from the clientcmd Cluster object's +extensions[client.authentication.k8s.io/exec] field: + +clusters: +- name: my-cluster + cluster: + ... + extensions: + - name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config + extension: + audience: 06e3fbd18de8 # arbitrary config + +In some environments, the user config may be exactly the same across many clusters +(i.e. call this exec plugin) minus some details that are specific to each cluster +such as the audience. This field allows the per cluster config to be directly +specified with the cluster info. Using this field to store secret data is not +recommended as one of the prime benefits of exec plugins is that no secrets need +to be stored directly in the kubeconfig.
+ +## `ExecCredentialSpec` {#client-authentication-k8s-io-v1-ExecCredentialSpec} + + + + +**Appears in:** +- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential) + + +ExecCredentialSpec holds request and runtime specific information provided by +the transport. + + + + + + + + + + + + + + + + + + +
FieldDescription
cluster
+Cluster +		 + Cluster contains information to allow an exec plugin to communicate with the +kubernetes cluster being authenticated to. Note that Cluster is non-nil only +when provideClusterInfo is set to true in the exec provider config (i.e., +ExecConfig.ProvideClusterInfo).
interactive [Required]
+bool +		 + Interactive declares whether stdin has been passed to this exec plugin.
+ +## `ExecCredentialStatus` {#client-authentication-k8s-io-v1-ExecCredentialStatus} + + + + +**Appears in:** +- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential) + + +ExecCredentialStatus holds credentials for the transport to use. + +Token and ClientKeyData are sensitive fields. This data should only be +transmitted in-memory between client and exec plugin process. Exec plugin +itself should at least be protected via file permissions. + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
expirationTimestamp
+meta/v1.Time +		 + ExpirationTimestamp indicates a time when the provided credentials expire.
token [Required]
+string +		 + Token is a bearer token used by the client for request authentication.
clientCertificateData [Required]
+string +		 + PEM-encoded client TLS certificates (including intermediates, if any).
clientKeyData [Required]
+string +		 + PEM-encoded private key for the above certificate.
+ diff --git a/content/en/docs/reference/config-api/client-authentication.v1beta1.md b/content/en/docs/reference/config-api/client-authentication.v1beta1.md index d018fb208f..025e762274 100644 --- a/content/en/docs/reference/config-api/client-authentication.v1beta1.md +++ b/content/en/docs/reference/config-api/client-authentication.v1beta1.md @@ -13,13 +13,10 @@ auto_generated: true - ## `ExecCredential` {#client-authentication-k8s-io-v1beta1-ExecCredential} - - ExecCredential is used by exec-based plugins to communicate credentials to HTTP transports. @@ -30,41 +27,32 @@ HTTP transports. apiVersion
stringclient.authentication.k8s.io/v1beta1 kind
stringExecCredential - - spec [Required]
ExecCredentialSpec - Spec holds information passed to the plugin by the transport. + Spec holds information passed to the plugin by the transport. + - - status
ExecCredentialStatus Status is filled in by the plugin and holds the credentials that the transport -should use to contact the API. +should use to contact the API. + - - - - ## `Cluster` {#client-authentication-k8s-io-v1beta1-Cluster} - - **Appears in:** - [ExecCredentialSpec](#client-authentication-k8s-io-v1beta1-ExecCredentialSpec) - Cluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to. @@ -77,53 +65,47 @@ of CertificateAuthority, since CA data will always be passed to the plugin as by FieldDescription - server [Required]
string - Server is the address of the kubernetes cluster (https://hostname:port). + Server is the address of the kubernetes cluster (https://hostname:port). + - - tls-server-name
string TLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname -used to contact the server is used. +used to contact the server is used. + - - insecure-skip-tls-verify
bool InsecureSkipTLSVerify skips the validity check for the server's certificate. -This will make your HTTPS connections insecure. +This will make your HTTPS connections insecure. + - - certificate-authority-data
[]byte CAData contains PEM-encoded certificate authority certificates. -If empty, system roots should be used. +If empty, system roots should be used. + - - proxy-url
string ProxyURL is the URL to the proxy to be used for all requests to this -cluster. +cluster. + - - config
k8s.io/apimachinery/pkg/runtime.RawExtension @@ -148,25 +130,19 @@ In some environments, the user config may be exactly the same across many cluste such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need -to be stored directly in the kubeconfig. +to be stored directly in the kubeconfig. + - - - - ## `ExecCredentialSpec` {#client-authentication-k8s-io-v1beta1-ExecCredentialSpec} - - **Appears in:** - [ExecCredential](#client-authentication-k8s-io-v1beta1-ExecCredential) - ExecCredentialSpec holds request and runtime specific information provided by the transport. @@ -174,7 +150,6 @@ the transport. FieldDescription - cluster
Cluster @@ -183,33 +158,26 @@ the transport. Cluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to. Note that Cluster is non-nil only when provideClusterInfo is set to true in the exec provider config (i.e., -ExecConfig.ProvideClusterInfo). +ExecConfig.ProvideClusterInfo). + - - interactive [Required]
bool - Interactive declares whether stdin has been passed to this exec plugin. + Interactive declares whether stdin has been passed to this exec plugin. + - - - - ## `ExecCredentialStatus` {#client-authentication-k8s-io-v1beta1-ExecCredentialStatus} - - **Appears in:** - [ExecCredential](#client-authentication-k8s-io-v1beta1-ExecCredential) - ExecCredentialStatus holds credentials for the transport to use. Token and ClientKeyData are sensitive fields. This data should only be @@ -220,41 +188,35 @@ itself should at least be protected via file permissions. FieldDescription - expirationTimestamp
-meta/v1.Time +meta/v1.Time - ExpirationTimestamp indicates a time when the provided credentials expire. + ExpirationTimestamp indicates a time when the provided credentials expire. + - - token [Required]
string - Token is a bearer token used by the client for request authentication. + Token is a bearer token used by the client for request authentication. + - - clientCertificateData [Required]
string - PEM-encoded client TLS certificates (including intermediates, if any). + PEM-encoded client TLS certificates (including intermediates, if any). + - - clientKeyData [Required]
string - PEM-encoded private key for the above certificate. + PEM-encoded private key for the above certificate. + - - - diff --git a/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md b/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md index c0c2312f6f..2dc445cd7e 100644 --- a/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md +++ b/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md @@ -13,13 +13,10 @@ auto_generated: true - ## `KubeProxyConfiguration` {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration} - - KubeProxyConfiguration contains everything necessary to configure the Kubernetes proxy server. @@ -30,156 +27,137 @@ Kubernetes proxy server. apiVersion
stringkubeproxy.config.k8s.io/v1alpha1 kind
stringKubeProxyConfiguration - - featureGates [Required]
map[string]bool - featureGates is a map of feature names to bools that enable or disable alpha/experimental features. + featureGates is a map of feature names to bools that enable or disable alpha/experimental features. + - - bindAddress [Required]
string bindAddress is the IP address for the proxy server to serve on (set to 0.0.0.0 -for all interfaces) +for all interfaces) + - - healthzBindAddress [Required]
string healthzBindAddress is the IP address and port for the health check server to serve on, -defaulting to 0.0.0.0:10256 +defaulting to 0.0.0.0:10256 + - - metricsBindAddress [Required]
string metricsBindAddress is the IP address and port for the metrics server to serve on, -defaulting to 127.0.0.1:10249 (set to 0.0.0.0 for all interfaces) +defaulting to 127.0.0.1:10249 (set to 0.0.0.0 for all interfaces) + - - bindAddressHardFail [Required]
bool - bindAddressHardFail, if true, kube-proxy will treat failure to bind to a port as fatal and exit + bindAddressHardFail, if true, kube-proxy will treat failure to bind to a port as fatal and exit + - - enableProfiling [Required]
bool enableProfiling enables profiling via web interface on /debug/pprof handler. -Profiling handlers will be handled by metrics server. +Profiling handlers will be handled by metrics server. + - - clusterCIDR [Required]
string clusterCIDR is the CIDR range of the pods in the cluster. It is used to bridge traffic coming from outside of the cluster. If not provided, -no off-cluster bridging will be performed. +no off-cluster bridging will be performed. + - - hostnameOverride [Required]
string - hostnameOverride, if non-empty, will be used as the identity instead of the actual hostname. + hostnameOverride, if non-empty, will be used as the identity instead of the actual hostname. + - - clientConnection [Required]
ClientConnectionConfiguration clientConnection specifies the kubeconfig file and client connection settings for the proxy -server to use when communicating with the apiserver. +server to use when communicating with the apiserver. + - - iptables [Required]
KubeProxyIPTablesConfiguration - iptables contains iptables-related configuration options. + iptables contains iptables-related configuration options. + - - ipvs [Required]
KubeProxyIPVSConfiguration - ipvs contains ipvs-related configuration options. + ipvs contains ipvs-related configuration options. + - - oomScoreAdj [Required]
int32 oomScoreAdj is the oom-score-adj value for kube-proxy process. Values must be within -the range [-1000, 1000] +the range [-1000, 1000] + - - mode [Required]
ProxyMode - mode specifies which proxy mode to use. + mode specifies which proxy mode to use. + - - portRange [Required]
string portRange is the range of host ports (beginPort-endPort, inclusive) that may be consumed -in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen. +in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen. + - - udpIdleTimeout [Required]
meta/v1.Duration udpIdleTimeout is how long an idle UDP connection will be kept open (e.g. '250ms', '2s'). -Must be greater than 0. Only applicable for proxyMode=userspace. +Must be greater than 0. Only applicable for proxyMode=userspace. + - - conntrack [Required]
KubeProxyConntrackConfiguration - conntrack contains conntrack-related configuration options. + conntrack contains conntrack-related configuration options. + - - configSyncPeriod [Required]
meta/v1.Duration configSyncPeriod is how often configuration from the apiserver is refreshed. Must be greater -than 0. +than 0. + - - nodePortAddresses [Required]
[]string @@ -190,49 +168,40 @@ In case someone would like to expose a service on localhost for local visit and particular purpose, a list of IP blocks would do that. If set it to "127.0.0.0/8", kube-proxy will only select the loopback interface for NodePort. If set it to a non-zero IP block, kube-proxy will filter that down to just the IPs that applied to the node. -An empty string slice is meant to select all network interfaces. +An empty string slice is meant to select all network interfaces. + - - winkernel [Required]
KubeProxyWinkernelConfiguration - winkernel contains winkernel-related configuration options. + winkernel contains winkernel-related configuration options. + - - showHiddenMetricsForVersion [Required]
string - ShowHiddenMetricsForVersion is the version for which you want to show hidden metrics. + ShowHiddenMetricsForVersion is the version for which you want to show hidden metrics. + - - detectLocalMode [Required]
LocalMode - DetectLocalMode determines mode to use for detecting local traffic, defaults to LocalModeClusterCIDR + DetectLocalMode determines mode to use for detecting local traffic, defaults to LocalModeClusterCIDR + - - - - ## `KubeProxyConntrackConfiguration` {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConntrackConfiguration} - - **Appears in:** - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) - KubeProxyConntrackConfiguration contains conntrack settings for the Kubernetes proxy server. @@ -240,60 +209,50 @@ the Kubernetes proxy server. FieldDescription - maxPerCore [Required]
int32 maxPerCore is the maximum number of NAT connections to track -per CPU core (0 to leave the limit as-is and ignore min). +per CPU core (0 to leave the limit as-is and ignore min). + - - min [Required]
int32 min is the minimum value of connect-tracking records to allocate, -regardless of conntrackMaxPerCore (set maxPerCore=0 to leave the limit as-is). +regardless of conntrackMaxPerCore (set maxPerCore=0 to leave the limit as-is). + - - tcpEstablishedTimeout [Required]
meta/v1.Duration tcpEstablishedTimeout is how long an idle TCP connection will be kept open -(e.g. '2s'). Must be greater than 0 to set. +(e.g. '2s'). Must be greater than 0 to set. + - - tcpCloseWaitTimeout [Required]
meta/v1.Duration tcpCloseWaitTimeout is how long an idle conntrack entry in CLOSE_WAIT state will remain in the conntrack -table. (e.g. '60s'). Must be greater than 0 to set. +table. (e.g. '60s'). Must be greater than 0 to set. + - - - - ## `KubeProxyIPTablesConfiguration` {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyIPTablesConfiguration} - - **Appears in:** - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) - KubeProxyIPTablesConfiguration contains iptables-related configuration details for the Kubernetes proxy server. @@ -301,58 +260,48 @@ details for the Kubernetes proxy server. FieldDescription - masqueradeBit [Required]
int32 masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using -the pure iptables proxy mode. Values must be within the range [0, 31]. +the pure iptables proxy mode. Values must be within the range [0, 31]. + - - masqueradeAll [Required]
bool - masqueradeAll tells kube-proxy to SNAT everything if using the pure iptables proxy mode. + masqueradeAll tells kube-proxy to SNAT everything if using the pure iptables proxy mode. + - - syncPeriod [Required]
meta/v1.Duration syncPeriod is the period that iptables rules are refreshed (e.g. '5s', '1m', -'2h22m'). Must be greater than 0. +'2h22m'). Must be greater than 0. + - - minSyncPeriod [Required]
meta/v1.Duration minSyncPeriod is the minimum period that iptables rules are refreshed (e.g. '5s', '1m', -'2h22m'). +'2h22m'). + - - - - ## `KubeProxyIPVSConfiguration` {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyIPVSConfiguration} - - **Appears in:** - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) - KubeProxyIPVSConfiguration contains ipvs-related configuration details for the Kubernetes proxy server. @@ -360,94 +309,80 @@ details for the Kubernetes proxy server. FieldDescription - syncPeriod [Required]
meta/v1.Duration syncPeriod is the period that ipvs rules are refreshed (e.g. '5s', '1m', -'2h22m'). Must be greater than 0. +'2h22m'). Must be greater than 0. + - - minSyncPeriod [Required]
meta/v1.Duration minSyncPeriod is the minimum period that ipvs rules are refreshed (e.g. '5s', '1m', -'2h22m'). +'2h22m'). + - - scheduler [Required]
string - ipvs scheduler + ipvs scheduler + - - excludeCIDRs [Required]
[]string excludeCIDRs is a list of CIDR's which the ipvs proxier should not touch -when cleaning up ipvs services. +when cleaning up ipvs services. + - - strictARP [Required]
bool strict ARP configure arp_ignore and arp_announce to avoid answering ARP queries -from kube-ipvs0 interface +from kube-ipvs0 interface + - - tcpTimeout [Required]
meta/v1.Duration tcpTimeout is the timeout value used for idle IPVS TCP sessions. -The default value is 0, which preserves the current timeout value on the system. +The default value is 0, which preserves the current timeout value on the system. + - - tcpFinTimeout [Required]
meta/v1.Duration tcpFinTimeout is the timeout value used for IPVS TCP sessions after receiving a FIN. -The default value is 0, which preserves the current timeout value on the system. +The default value is 0, which preserves the current timeout value on the system. + - - udpTimeout [Required]
meta/v1.Duration udpTimeout is the timeout value used for IPVS UDP packets. -The default value is 0, which preserves the current timeout value on the system. +The default value is 0, which preserves the current timeout value on the system. + - - - - ## `KubeProxyWinkernelConfiguration` {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyWinkernelConfiguration} - - **Appears in:** - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) - KubeProxyWinkernelConfiguration contains Windows/HNS settings for the Kubernetes proxy server. @@ -455,66 +390,52 @@ the Kubernetes proxy server. FieldDescription - networkName [Required]
string networkName is the name of the network kube-proxy will use -to create endpoints and policies +to create endpoints and policies + - - sourceVip [Required]
string sourceVip is the IP address of the source VIP endoint used for -NAT when loadbalancing +NAT when loadbalancing + - - enableDSR [Required]
bool enableDSR tells kube-proxy whether HNS policies should be created -with DSR +with DSR + - - - - ## `LocalMode` {#kubeproxy-config-k8s-io-v1alpha1-LocalMode} (Alias of `string`) - - **Appears in:** - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) - LocalMode represents modes to detect local traffic from the node - - ## `ProxyMode` {#kubeproxy-config-k8s-io-v1alpha1-ProxyMode} (Alias of `string`) - - **Appears in:** - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) - ProxyMode represents modes used by the Kubernetes proxy server. Currently, three modes of proxy are available in Linux platform: 'userspace' (older, going to be EOL), 'iptables' @@ -532,7 +453,6 @@ future). If winkernel proxy is selected, regardless of how, but the Windows kern this always falls back to the userspace proxy. - @@ -540,122 +460,62 @@ this always falls back to the userspace proxy. ## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} - - **Appears in:** - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) - -- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) - - ClientConnectionConfiguration contains details for constructing a client. - + kubeconfig is the path to a KubeConfig file. + - - +client. + - - + contentType is the content type used when sending data to the server from this client. + - - + qps controls the number of queries per second allowed for this connection. + - - - - - - -
FieldDescription
kubeconfig [Required]
string 		- kubeconfig is the path to a KubeConfig file.
acceptContentTypes [Required]
string 		acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the default value of 'application/json'. This field will control all connections to the server used by a particular -client.
contentType [Required]
string 		- contentType is the content type used when sending data to the server from this client.
qps [Required]
float32 		- qps controls the number of queries per second allowed for this connection.
burst [Required]
int32 		- burst allows extra queries to accumulate when a client is exceeding its rate.
- -## `DebuggingConfiguration` {#DebuggingConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - -- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) - - -DebuggingConfiguration holds configuration for Debugging related features. - - - - - - - - - - - - - - - -
FieldDescription
enableProfiling [Required]
-bool + burst allows extra queries to accumulate when a client is exceeding its rate. 		- enableProfiling enables profiling via web interface host:port/debug/pprof/
enableContentionProfiling [Required]
-bool -		 - enableContentionProfiling enables lock contention profiling, if -enableProfiling is true.
## `FormatOptions` {#FormatOptions} - - **Appears in:** -- [LoggingConfiguration](#LoggingConfiguration) FormatOptions contains options for the different logging formats. @@ -664,36 +524,30 @@ FormatOptions contains options for the different logging formats. FieldDescription - json [Required]
JSONOptions - [Experimental] JSON contains options for logging format "json". + [Experimental] JSON contains options for logging format "json". + - - ## `JSONOptions` {#JSONOptions} - - **Appears in:** - [FormatOptions](#FormatOptions) - JSONOptions contains options for logging format "json". - +both to stdout, without buffering. + - - - - - - -
FieldDescription
splitStream [Required]
bool @@ -701,206 +555,25 @@ JSONOptions contains options for logging format "json". 		[Experimental] SplitStream redirects error messages to stderr while info messages go to stdout, with buffering. The default is to write -both to stdout, without buffering.
infoBufferSize [Required]
-k8s.io/apimachinery/pkg/api/resource.QuantityValue +k8s.io/apimachinery/pkg/api/resource.QuantityValue 		[Experimental] InfoBufferSize sets the size of the info stream when -using split streams. The default is zero, which disables buffering.
- -## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) - -- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) - - -LeaderElectionConfiguration defines the configuration of leader election -clients for components that can run with leader election enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
leaderElect [Required]
-bool +using split streams. The default is zero, which disables buffering. 		- leaderElect enables a leader election client to gain leadership -before executing the main loop. Enable this when running replicated -components for high availability.
leaseDuration [Required]
-meta/v1.Duration -		 - leaseDuration is the duration that non-leader candidates will wait -after observing a leadership renewal until attempting to acquire -leadership of a led but unrenewed leader slot. This is effectively the -maximum duration that a leader can be stopped before it is replaced -by another candidate. This is only applicable if leader election is -enabled.
renewDeadline [Required]
-meta/v1.Duration -		 - renewDeadline is the interval between attempts by the acting master to -renew a leadership slot before it stops leading. This must be less -than or equal to the lease duration. This is only applicable if leader -election is enabled.
retryPeriod [Required]
-meta/v1.Duration -		 - retryPeriod is the duration the clients should wait between attempting -acquisition and renewal of a leadership. This is only applicable if -leader election is enabled.
resourceLock [Required]
-string -		 - resourceLock indicates the resource object type that will be used to lock -during leader election cycles.
resourceName [Required]
-string -		 - resourceName indicates the name of resource object that will be used to lock -during leader election cycles.
resourceNamespace [Required]
-string -		 - resourceName indicates the namespace of resource object that will be used to lock -during leader election cycles.
- -## `LoggingConfiguration` {#LoggingConfiguration} - - - - -**Appears in:** - -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - - -LoggingConfiguration contains logging options -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
format [Required]
-string -		 - Format Flag specifies the structure of log messages. -default value of format is `text`
flushFrequency [Required]
-time.Duration -		 - Maximum number of seconds between log flushes. Ignored if the -selected logging backend writes log messages without buffering.
verbosity [Required]
-uint32 -		 - Verbosity is the threshold that determines which log messages are -logged. Default is zero which logs only the most important -messages. Higher values enable additional messages. Error messages -are always logged.
vmodule [Required]
-VModuleConfiguration -		 - VModule overrides the verbosity threshold for individual files. -Only supported for "text" log format.
sanitization [Required]
-bool -		 - [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). -Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
options [Required]
-FormatOptions -		 - [Experimental] Options holds additional parameters that are specific -to the different logging formats. Only the options for the selected -format get used, but all of them get validated.
## `VModuleConfiguration` {#VModuleConfiguration} (Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) - - **Appears in:** -- [LoggingConfiguration](#LoggingConfiguration) VModuleConfiguration is a collection of individual file names or patterns diff --git a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta1.md b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta1.md deleted file mode 100644 index ac32e65674..0000000000 --- a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta1.md +++ /dev/null @@ -1,2156 +0,0 @@ ---- -title: kube-scheduler Configuration (v1beta1) -content_type: tool-reference -package: kubescheduler.config.k8s.io/v1 -auto_generated: true ---- - - -## Resource Types - - -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) -- [DefaultPreemptionArgs](#kubescheduler-config-k8s-io-v1beta1-DefaultPreemptionArgs) -- [InterPodAffinityArgs](#kubescheduler-config-k8s-io-v1beta1-InterPodAffinityArgs) -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta1-KubeSchedulerConfiguration) -- [NodeAffinityArgs](#kubescheduler-config-k8s-io-v1beta1-NodeAffinityArgs) -- [NodeLabelArgs](#kubescheduler-config-k8s-io-v1beta1-NodeLabelArgs) -- [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta1-NodeResourcesFitArgs) -- [NodeResourcesLeastAllocatedArgs](#kubescheduler-config-k8s-io-v1beta1-NodeResourcesLeastAllocatedArgs) -- [NodeResourcesMostAllocatedArgs](#kubescheduler-config-k8s-io-v1beta1-NodeResourcesMostAllocatedArgs) -- [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta1-PodTopologySpreadArgs) -- [RequestedToCapacityRatioArgs](#kubescheduler-config-k8s-io-v1beta1-RequestedToCapacityRatioArgs) -- [ServiceAffinityArgs](#kubescheduler-config-k8s-io-v1beta1-ServiceAffinityArgs) -- [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta1-VolumeBindingArgs) - - - - -## `Policy` {#kubescheduler-config-k8s-io-v1-Policy} - - - - - -Policy describes a struct for a policy resource used in api. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1
kind
string		Policy
predicates [Required]
-[]PredicatePolicy -		 - Holds the information to configure the fit predicate functions
priorities [Required]
-[]PriorityPolicy -		 - Holds the information to configure the priority functions
extenders [Required]
-[]LegacyExtender -		 - Holds the information to communicate with the extender(s)
hardPodAffinitySymmetricWeight [Required]
-int32 -		 - RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule -corresponding to every RequiredDuringScheduling affinity rule. -HardPodAffinitySymmetricWeight represents the weight of implicit PreferredDuringScheduling affinity rule, in the range 1-100.
alwaysCheckAllPredicates [Required]
-bool -		 - When AlwaysCheckAllPredicates is set to true, scheduler checks all -the configured predicates even after one or more of them fails. -When the flag is set to false, scheduler skips checking the rest -of the predicates after it finds one predicate that failed.
- - - -## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1-ExtenderManagedResource} - - - - -**Appears in:** - -- [Extender](#kubescheduler-config-k8s-io-v1beta1-Extender) - -- [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender) - - -ExtenderManagedResource describes the arguments of extended resources -managed by an extender. - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Name is the extended resource name.
ignoredByScheduler [Required]
-bool -		 - IgnoredByScheduler indicates whether kube-scheduler should ignore this -resource when applying predicates.
- - - -## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1-ExtenderTLSConfig} - - - - -**Appears in:** - -- [Extender](#kubescheduler-config-k8s-io-v1beta1-Extender) - -- [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender) - - -ExtenderTLSConfig contains settings to enable TLS with extender - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
insecure [Required]
-bool -		 - Server should be accessed without verifying the TLS certificate. For testing only.
serverName [Required]
-string -		 - ServerName is passed to the server for SNI and is used in the client to check server -certificates against. If ServerName is empty, the hostname used to contact the -server is used.
certFile [Required]
-string -		 - Server requires TLS client certificate authentication
keyFile [Required]
-string -		 - Server requires TLS client certificate authentication
caFile [Required]
-string -		 - Trusted root certificates for server
certData [Required]
-[]byte -		 - CertData holds PEM-encoded bytes (typically read from a client certificate file). -CertData takes precedence over CertFile
keyData [Required]
-[]byte -		 - KeyData holds PEM-encoded bytes (typically read from a client certificate key file). -KeyData takes precedence over KeyFile
caData [Required]
-[]byte -		 - CAData holds PEM-encoded bytes (typically read from a root certificates bundle). -CAData takes precedence over CAFile
- - - -## `LabelPreference` {#kubescheduler-config-k8s-io-v1-LabelPreference} - - - - -**Appears in:** - -- [PriorityArgument](#kubescheduler-config-k8s-io-v1-PriorityArgument) - - -LabelPreference holds the parameters that are used to configure the corresponding priority function - - - - - - - - - - - - - - - - - - -
FieldDescription
label [Required]
-string -		 - Used to identify node "groups"
presence [Required]
-bool -		 - This is a boolean flag -If true, higher priority is given to nodes that have the label -If false, higher priority is given to nodes that do not have the label
- - - -## `LabelsPresence` {#kubescheduler-config-k8s-io-v1-LabelsPresence} - - - - -**Appears in:** - -- [PredicateArgument](#kubescheduler-config-k8s-io-v1-PredicateArgument) - - -LabelsPresence holds the parameters that are used to configure the corresponding predicate in scheduler policy configuration. - - - - - - - - - - - - - - - - - - -
FieldDescription
labels [Required]
-[]string -		 - The list of labels that identify node "groups" -All of the labels should be either present (or absent) for the node to be considered a fit for hosting the pod
presence [Required]
-bool -		 - The boolean flag that indicates whether the labels should be present or absent from the node
- - - -## `LegacyExtender` {#kubescheduler-config-k8s-io-v1-LegacyExtender} - - - - -**Appears in:** - -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) - - -LegacyExtender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, -it is assumed that the extender chose not to provide that extension. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
urlPrefix [Required]
-string -		 - URLPrefix at which the extender is available
filterVerb [Required]
-string -		 - Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.
preemptVerb [Required]
-string -		 - Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.
prioritizeVerb [Required]
-string -		 - Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.
weight [Required]
-int64 -		 - The numeric multiplier for the node scores that the prioritize call generates. -The weight should be a positive integer
bindVerb [Required]
-string -		 - Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. -If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender -can implement this function.
enableHttps [Required]
-bool -		 - EnableHTTPS specifies whether https should be used to communicate with the extender
tlsConfig [Required]
-ExtenderTLSConfig -		 - TLSConfig specifies the transport layer security config
httpTimeout [Required]
-time.Duration -		 - HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize -timeout is ignored, k8s/other extenders priorities are used to select the node.
nodeCacheCapable [Required]
-bool -		 - NodeCacheCapable specifies that the extender is capable of caching node information, -so the scheduler should only send minimal information about the eligible nodes -assuming that the extender already cached full details of all nodes in the cluster
managedResources
-[]ExtenderManagedResource -		 - ManagedResources is a list of extended resources that are managed by -this extender. -- A pod will be sent to the extender on the Filter, Prioritize and Bind - (if the extender is the binder) phases iff the pod requests at least - one of the extended resources in this list. If empty or unspecified, - all pods will be sent to this extender. -- If IgnoredByScheduler is set to true for a resource, kube-scheduler - will skip checking the resource in predicates.
ignorable [Required]
-bool -		 - Ignorable specifies if the extender is ignorable, i.e. scheduling should not -fail when the extender returns an error or is not reachable.
- - - -## `PredicateArgument` {#kubescheduler-config-k8s-io-v1-PredicateArgument} - - - - -**Appears in:** - -- [PredicatePolicy](#kubescheduler-config-k8s-io-v1-PredicatePolicy) - - -PredicateArgument represents the arguments to configure predicate functions in scheduler policy configuration. -Only one of its members may be specified - - - - - - - - - - - - - - - - - - -
FieldDescription
serviceAffinity [Required]
-ServiceAffinity -		 - The predicate that provides affinity for pods belonging to a service -It uses a label to identify nodes that belong to the same "group"
labelsPresence [Required]
-LabelsPresence -		 - The predicate that checks whether a particular node has a certain label -defined or not, regardless of value
- - - -## `PredicatePolicy` {#kubescheduler-config-k8s-io-v1-PredicatePolicy} - - - - -**Appears in:** - -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) - - -PredicatePolicy describes a struct of a predicate policy. - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Identifier of the predicate policy -For a custom predicate, the name can be user-defined -For the Kubernetes provided predicates, the name is the identifier of the pre-defined predicate
argument [Required]
-PredicateArgument -		 - Holds the parameters to configure the given predicate
- - - -## `PriorityArgument` {#kubescheduler-config-k8s-io-v1-PriorityArgument} - - - - -**Appears in:** - -- [PriorityPolicy](#kubescheduler-config-k8s-io-v1-PriorityPolicy) - - -PriorityArgument represents the arguments to configure priority functions in scheduler policy configuration. -Only one of its members may be specified - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
serviceAntiAffinity [Required]
-ServiceAntiAffinity -		 - The priority function that ensures a good spread (anti-affinity) for pods belonging to a service -It uses a label to identify nodes that belong to the same "group"
labelPreference [Required]
-LabelPreference -		 - The priority function that checks whether a particular node has a certain label -defined or not, regardless of value
requestedToCapacityRatioArguments [Required]
-RequestedToCapacityRatioArguments -		 - The RequestedToCapacityRatio priority function is parametrized with function shape.
- - - -## `PriorityPolicy` {#kubescheduler-config-k8s-io-v1-PriorityPolicy} - - - - -**Appears in:** - -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) - - -PriorityPolicy describes a struct of a priority policy. - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Identifier of the priority policy -For a custom priority, the name can be user-defined -For the Kubernetes provided priority functions, the name is the identifier of the pre-defined priority function
weight [Required]
-int64 -		 - The numeric multiplier for the node scores that the priority function generates -The weight should be non-zero and can be a positive or a negative integer
argument [Required]
-PriorityArgument -		 - Holds the parameters to configure the given priority function
- - - -## `RequestedToCapacityRatioArguments` {#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioArguments} - - - - -**Appears in:** - -- [PriorityArgument](#kubescheduler-config-k8s-io-v1-PriorityArgument) - - -RequestedToCapacityRatioArguments holds arguments specific to RequestedToCapacityRatio priority function. - - - - - - - - - - - - - - - - - - -
FieldDescription
shape [Required]
-[]UtilizationShapePoint -		 - Array of point defining priority function shape.
resources [Required]
-[]ResourceSpec -		 - No description provided. -
- - - -## `ResourceSpec` {#kubescheduler-config-k8s-io-v1-ResourceSpec} - - - - -**Appears in:** - -- [RequestedToCapacityRatioArguments](#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioArguments) - - -ResourceSpec represents single resource and weight for bin packing of priority RequestedToCapacityRatioArguments. - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Name of the resource to be managed by RequestedToCapacityRatio function.
weight [Required]
-int64 -		 - Weight of the resource.
- - - -## `ServiceAffinity` {#kubescheduler-config-k8s-io-v1-ServiceAffinity} - - - - -**Appears in:** - -- [PredicateArgument](#kubescheduler-config-k8s-io-v1-PredicateArgument) - - -ServiceAffinity holds the parameters that are used to configure the corresponding predicate in scheduler policy configuration. - - - - - - - - - - - - - -
FieldDescription
labels [Required]
-[]string -		 - The list of labels that identify node "groups" -All of the labels should match for the node to be considered a fit for hosting the pod
- - - -## `ServiceAntiAffinity` {#kubescheduler-config-k8s-io-v1-ServiceAntiAffinity} - - - - -**Appears in:** - -- [PriorityArgument](#kubescheduler-config-k8s-io-v1-PriorityArgument) - - -ServiceAntiAffinity holds the parameters that are used to configure the corresponding priority function - - - - - - - - - - - - - -
FieldDescription
label [Required]
-string -		 - Used to identify node "groups"
- - - -## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1-UtilizationShapePoint} - - - - -**Appears in:** - -- [RequestedToCapacityRatioArguments](#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioArguments) - - -UtilizationShapePoint represents single point of priority function shape. - - - - - - - - - - - - - - - - - - -
FieldDescription
utilization [Required]
-int32 -		 - Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.
score [Required]
-int32 -		 - Score assigned to given utilization (y axis). Valid values are 0 to 10.
- - - - - -## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta1-KubeSchedulerConfiguration) - - -ClientConnectionConfiguration contains details for constructing a client. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
kubeconfig [Required]
-string -		 - kubeconfig is the path to a KubeConfig file.
acceptContentTypes [Required]
-string -		 - acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the -default value of 'application/json'. This field will control all connections to the server used by a particular -client.
contentType [Required]
-string -		 - contentType is the content type used when sending data to the server from this client.
qps [Required]
-float32 -		 - qps controls the number of queries per second allowed for this connection.
burst [Required]
-int32 -		 - burst allows extra queries to accumulate when a client is exceeding its rate.
- -## `DebuggingConfiguration` {#DebuggingConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta1-KubeSchedulerConfiguration) - - -DebuggingConfiguration holds configuration for Debugging related features. - - - - - - - - - - - - - - - - - - -
FieldDescription
enableProfiling [Required]
-bool -		 - enableProfiling enables profiling via web interface host:port/debug/pprof/
enableContentionProfiling [Required]
-bool -		 - enableContentionProfiling enables lock contention profiling, if -enableProfiling is true.
- -## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta1-KubeSchedulerConfiguration) - - -LeaderElectionConfiguration defines the configuration of leader election -clients for components that can run with leader election enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
leaderElect [Required]
-bool -		 - leaderElect enables a leader election client to gain leadership -before executing the main loop. Enable this when running replicated -components for high availability.
leaseDuration [Required]
-meta/v1.Duration -		 - leaseDuration is the duration that non-leader candidates will wait -after observing a leadership renewal until attempting to acquire -leadership of a led but unrenewed leader slot. This is effectively the -maximum duration that a leader can be stopped before it is replaced -by another candidate. This is only applicable if leader election is -enabled.
renewDeadline [Required]
-meta/v1.Duration -		 - renewDeadline is the interval between attempts by the acting master to -renew a leadership slot before it stops leading. This must be less -than or equal to the lease duration. This is only applicable if leader -election is enabled.
retryPeriod [Required]
-meta/v1.Duration -		 - retryPeriod is the duration the clients should wait between attempting -acquisition and renewal of a leadership. This is only applicable if -leader election is enabled.
resourceLock [Required]
-string -		 - resourceLock indicates the resource object type that will be used to lock -during leader election cycles.
resourceName [Required]
-string -		 - resourceName indicates the name of resource object that will be used to lock -during leader election cycles.
resourceNamespace [Required]
-string -		 - resourceName indicates the namespace of resource object that will be used to lock -during leader election cycles.
- -## `LoggingConfiguration` {#LoggingConfiguration} - - - - -**Appears in:** - -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - - -LoggingConfiguration contains logging options -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. - - - - - - - - - - - - - - - - - - -
FieldDescription
format [Required]
-string -		 - Format Flag specifies the structure of log messages. -default value of format is `text`
sanitization [Required]
-bool -		 - [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). -Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
- - - - -## `DefaultPreemptionArgs` {#kubescheduler-config-k8s-io-v1beta1-DefaultPreemptionArgs} - - - - - -DefaultPreemptionArgs holds arguments used to configure the -DefaultPreemption plugin. - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		DefaultPreemptionArgs
minCandidateNodesPercentage [Required]
-int32 -		 - MinCandidateNodesPercentage is the minimum number of candidates to -shortlist when dry running preemption as a percentage of number of nodes. -Must be in the range [0, 100]. Defaults to 10% of the cluster size if -unspecified.
minCandidateNodesAbsolute [Required]
-int32 -		 - MinCandidateNodesAbsolute is the absolute minimum number of candidates to -shortlist. The likely number of candidates enumerated for dry running -preemption is given by the formula: -numCandidates = max(numNodes ∗ minCandidateNodesPercentage, minCandidateNodesAbsolute) -We say "likely" because there are other factors such as PDB violations -that play a role in the number of candidates shortlisted. Must be at least -0 nodes. Defaults to 100 nodes if unspecified.
- - - -## `InterPodAffinityArgs` {#kubescheduler-config-k8s-io-v1beta1-InterPodAffinityArgs} - - - - - -InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plugin. - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		InterPodAffinityArgs
hardPodAffinityWeight [Required]
-int32 -		 - HardPodAffinityWeight is the scoring weight for existing pods with a -matching hard affinity to the incoming pod.
- - - -## `KubeSchedulerConfiguration` {#kubescheduler-config-k8s-io-v1beta1-KubeSchedulerConfiguration} - - - - - -KubeSchedulerConfiguration configures a scheduler - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		KubeSchedulerConfiguration
parallelism [Required]
-int32 -		 - Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16
leaderElection [Required]
-LeaderElectionConfiguration -		 - LeaderElection defines the configuration of leader election client.
clientConnection [Required]
-ClientConnectionConfiguration -		 - ClientConnection specifies the kubeconfig file and client connection -settings for the proxy server to use when communicating with the apiserver.
healthzBindAddress [Required]
-string -		 - HealthzBindAddress is the IP address and port for the health check server to serve on, -defaulting to 0.0.0.0:10251
metricsBindAddress [Required]
-string -		 - MetricsBindAddress is the IP address and port for the metrics server to -serve on, defaulting to 0.0.0.0:10251.
DebuggingConfiguration [Required]
-DebuggingConfiguration -		(Members of DebuggingConfiguration are embedded into this type.) - DebuggingConfiguration holds configuration for Debugging related features -TODO: We might wanna make this a substruct like Debugging componentbaseconfigv1alpha1.DebuggingConfiguration
percentageOfNodesToScore [Required]
-int32 -		 - PercentageOfNodesToScore is the percentage of all nodes that once found feasible -for running a pod, the scheduler stops its search for more feasible nodes in -the cluster. This helps improve scheduler's performance. Scheduler always tries to find -at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. -Example: if the cluster size is 500 nodes and the value of this flag is 30, -then scheduler stops finding further feasible nodes once it finds 150 feasible ones. -When the value is 0, default percentage (5%--50% based on the size of the cluster) of the -nodes will be scored.
podInitialBackoffSeconds [Required]
-int64 -		 - PodInitialBackoffSeconds is the initial backoff for unschedulable pods. -If specified, it must be greater than 0. If this value is null, the default value (1s) -will be used.
podMaxBackoffSeconds [Required]
-int64 -		 - PodMaxBackoffSeconds is the max backoff for unschedulable pods. -If specified, it must be greater than podInitialBackoffSeconds. If this value is null, -the default value (10s) will be used.
profiles [Required]
-[]KubeSchedulerProfile -		 - Profiles are scheduling profiles that kube-scheduler supports. Pods can -choose to be scheduled under a particular profile by setting its associated -scheduler name. Pods that don't specify any scheduler name are scheduled -with the "default-scheduler" profile, if present here.
extenders [Required]
-[]Extender -		 - Extenders are the list of scheduler extenders, each holding the values of how to communicate -with the extender. These extenders are shared by all scheduler profiles.
- - - -## `NodeAffinityArgs` {#kubescheduler-config-k8s-io-v1beta1-NodeAffinityArgs} - - - - - -NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		NodeAffinityArgs
addedAffinity
-core/v1.NodeAffinity -		 - AddedAffinity is applied to all Pods additionally to the NodeAffinity -specified in the PodSpec. That is, Nodes need to satisfy AddedAffinity -AND .spec.NodeAffinity. AddedAffinity is empty by default (all Nodes -match). -When AddedAffinity is used, some Pods with affinity requirements that match -a specific Node (such as Daemonset Pods) might remain unschedulable.
- - - -## `NodeLabelArgs` {#kubescheduler-config-k8s-io-v1beta1-NodeLabelArgs} - - - - - -NodeLabelArgs holds arguments used to configure the NodeLabel plugin. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		NodeLabelArgs
presentLabels [Required]
-[]string -		 - PresentLabels should be present for the node to be considered a fit for hosting the pod
absentLabels [Required]
-[]string -		 - AbsentLabels should be absent for the node to be considered a fit for hosting the pod
presentLabelsPreference [Required]
-[]string -		 - Nodes that have labels in the list will get a higher score.
absentLabelsPreference [Required]
-[]string -		 - Nodes that don't have labels in the list will get a higher score.
- - - -## `NodeResourcesFitArgs` {#kubescheduler-config-k8s-io-v1beta1-NodeResourcesFitArgs} - - - - - -NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plugin. - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		NodeResourcesFitArgs
ignoredResources [Required]
-[]string -		 - IgnoredResources is the list of resources that NodeResources fit filter -should ignore.
ignoredResourceGroups [Required]
-[]string -		 - IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. -e.g. if group is ["example.com"], it will ignore all resource names that begin -with "example.com", such as "example.com/aaa" and "example.com/bbb". -A resource group name can't contain '/'.
- - - -## `NodeResourcesLeastAllocatedArgs` {#kubescheduler-config-k8s-io-v1beta1-NodeResourcesLeastAllocatedArgs} - - - - - -NodeResourcesLeastAllocatedArgs holds arguments used to configure NodeResourcesLeastAllocated plugin. - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		NodeResourcesLeastAllocatedArgs
resources [Required]
-[]ResourceSpec -		 - Resources to be managed, if no resource is provided, default resource set with both -the weight of "cpu" and "memory" set to "1" will be applied. -Resource with "0" weight will not accountable for the final score.
- - - -## `NodeResourcesMostAllocatedArgs` {#kubescheduler-config-k8s-io-v1beta1-NodeResourcesMostAllocatedArgs} - - - - - -NodeResourcesMostAllocatedArgs holds arguments used to configure NodeResourcesMostAllocated plugin. - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		NodeResourcesMostAllocatedArgs
resources [Required]
-[]ResourceSpec -		 - Resources to be managed, if no resource is provided, default resource set with both -the weight of "cpu" and "memory" set to "1" will be applied. -Resource with "0" weight will not accountable for the final score.
- - - -## `PodTopologySpreadArgs` {#kubescheduler-config-k8s-io-v1beta1-PodTopologySpreadArgs} - - - - - -PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread plugin. - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		PodTopologySpreadArgs
defaultConstraints
-[]core/v1.TopologySpreadConstraint -		 - DefaultConstraints defines topology spread constraints to be applied to -Pods that don't define any in `pod.spec.topologySpreadConstraints`. -`.defaultConstraints[∗].labelSelectors` must be empty, as they are -deduced from the Pod's membership to Services, ReplicationControllers, -ReplicaSets or StatefulSets. -When not empty, .defaultingType must be "List".
defaultingType
-PodTopologySpreadConstraintsDefaulting -		 - DefaultingType determines how .defaultConstraints are deduced. Can be one -of "System" or "List". - -- "System": Use kubernetes defined constraints that spread Pods among - Nodes and Zones. -- "List": Use constraints defined in .defaultConstraints. - -Defaults to "List" if feature gate DefaultPodTopologySpread is disabled -and to "System" if enabled.
- - - -## `RequestedToCapacityRatioArgs` {#kubescheduler-config-k8s-io-v1beta1-RequestedToCapacityRatioArgs} - - - - - -RequestedToCapacityRatioArgs holds arguments used to configure RequestedToCapacityRatio plugin. - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		RequestedToCapacityRatioArgs
shape [Required]
-[]UtilizationShapePoint -		 - Points defining priority function shape
resources [Required]
-[]ResourceSpec -		 - Resources to be managed
- - - -## `ServiceAffinityArgs` {#kubescheduler-config-k8s-io-v1beta1-ServiceAffinityArgs} - - - - - -ServiceAffinityArgs holds arguments used to configure the ServiceAffinity plugin. - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		ServiceAffinityArgs
affinityLabels [Required]
-[]string -		 - AffinityLabels are homogeneous for pods that are scheduled to a node. -(i.e. it returns true IFF this pod can be added to this node such that all other pods in -the same service are running on nodes with the exact same values for Labels).
antiAffinityLabelsPreference [Required]
-[]string -		 - AntiAffinityLabelsPreference are the labels to consider for service anti affinity scoring.
- - - -## `VolumeBindingArgs` {#kubescheduler-config-k8s-io-v1beta1-VolumeBindingArgs} - - - - - -VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin. - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta1
kind
string		VolumeBindingArgs
bindTimeoutSeconds [Required]
-int64 -		 - BindTimeoutSeconds is the timeout in seconds in volume binding operation. -Value must be non-negative integer. The value zero indicates no waiting. -If this value is nil, the default value (600) will be used.
- - - -## `Extender` {#kubescheduler-config-k8s-io-v1beta1-Extender} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta1-KubeSchedulerConfiguration) - - -Extender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, -it is assumed that the extender chose not to provide that extension. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
urlPrefix [Required]
-string -		 - URLPrefix at which the extender is available
filterVerb [Required]
-string -		 - Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.
preemptVerb [Required]
-string -		 - Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.
prioritizeVerb [Required]
-string -		 - Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.
weight [Required]
-int64 -		 - The numeric multiplier for the node scores that the prioritize call generates. -The weight should be a positive integer
bindVerb [Required]
-string -		 - Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. -If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender -can implement this function.
enableHTTPS [Required]
-bool -		 - EnableHTTPS specifies whether https should be used to communicate with the extender
tlsConfig [Required]
-ExtenderTLSConfig -		 - TLSConfig specifies the transport layer security config
httpTimeout [Required]
-meta/v1.Duration -		 - HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize -timeout is ignored, k8s/other extenders priorities are used to select the node.
nodeCacheCapable [Required]
-bool -		 - NodeCacheCapable specifies that the extender is capable of caching node information, -so the scheduler should only send minimal information about the eligible nodes -assuming that the extender already cached full details of all nodes in the cluster
managedResources
-[]ExtenderManagedResource -		 - ManagedResources is a list of extended resources that are managed by -this extender. -- A pod will be sent to the extender on the Filter, Prioritize and Bind - (if the extender is the binder) phases iff the pod requests at least - one of the extended resources in this list. If empty or unspecified, - all pods will be sent to this extender. -- If IgnoredByScheduler is set to true for a resource, kube-scheduler - will skip checking the resource in predicates.
ignorable [Required]
-bool -		 - Ignorable specifies if the extender is ignorable, i.e. scheduling should not -fail when the extender returns an error or is not reachable.
- - - -## `KubeSchedulerProfile` {#kubescheduler-config-k8s-io-v1beta1-KubeSchedulerProfile} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta1-KubeSchedulerConfiguration) - - -KubeSchedulerProfile is a scheduling profile. - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
schedulerName [Required]
-string -		 - SchedulerName is the name of the scheduler associated to this profile. -If SchedulerName matches with the pod's "spec.schedulerName", then the pod -is scheduled with this profile.
plugins [Required]
-Plugins -		 - Plugins specify the set of plugins that should be enabled or disabled. -Enabled plugins are the ones that should be enabled in addition to the -default plugins. Disabled plugins are any of the default plugins that -should be disabled. -When no enabled or disabled plugin is specified for an extension point, -default plugins for that extension point will be used if there is any. -If a QueueSort plugin is specified, the same QueueSort Plugin and -PluginConfig must be specified for all profiles.
pluginConfig [Required]
-[]PluginConfig -		 - PluginConfig is an optional set of custom plugin arguments for each plugin. -Omitting config args for a plugin is equivalent to using the default config -for that plugin.
- - - -## `Plugin` {#kubescheduler-config-k8s-io-v1beta1-Plugin} - - - - -**Appears in:** - -- [PluginSet](#kubescheduler-config-k8s-io-v1beta1-PluginSet) - - -Plugin specifies a plugin name and its weight when applicable. Weight is used only for Score plugins. - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Name defines the name of plugin
weight [Required]
-int32 -		 - Weight defines the weight of plugin, only used for Score plugins.
- - - -## `PluginConfig` {#kubescheduler-config-k8s-io-v1beta1-PluginConfig} - - - - -**Appears in:** - -- [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta1-KubeSchedulerProfile) - - -PluginConfig specifies arguments that should be passed to a plugin at the time of initialization. -A plugin that is invoked at multiple extension points is initialized once. Args can have arbitrary structure. -It is up to the plugin to process these Args. - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Name defines the name of plugin being configured
args [Required]
-k8s.io/apimachinery/pkg/runtime.RawExtension -		 - Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure.
- - - -## `PluginSet` {#kubescheduler-config-k8s-io-v1beta1-PluginSet} - - - - -**Appears in:** - -- [Plugins](#kubescheduler-config-k8s-io-v1beta1-Plugins) - - -PluginSet specifies enabled and disabled plugins for an extension point. -If an array is empty, missing, or nil, default plugins at that extension point will be used. - - - - - - - - - - - - - - - - - - -
FieldDescription
enabled [Required]
-[]Plugin -		 - Enabled specifies plugins that should be enabled in addition to default plugins. -These are called after default plugins and in the same order specified here.
disabled [Required]
-[]Plugin -		 - Disabled specifies default plugins that should be disabled. -When all default plugins need to be disabled, an array containing only one "∗" should be provided.
- - - -## `Plugins` {#kubescheduler-config-k8s-io-v1beta1-Plugins} - - - - -**Appears in:** - -- [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta1-KubeSchedulerProfile) - - -Plugins include multiple extension points. When specified, the list of plugins for -a particular extension point are the only ones enabled. If an extension point is -omitted from the config, then the default set of plugins is used for that extension point. -Enabled plugins are called in the order specified here, after default plugins. If they need to -be invoked before default plugins, default plugins must be disabled and re-enabled here in desired order. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
queueSort [Required]
-PluginSet -		 - QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue.
preFilter [Required]
-PluginSet -		 - PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework.
filter [Required]
-PluginSet -		 - Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod.
postFilter [Required]
-PluginSet -		 - PostFilter is a list of plugins that are invoked after filtering phase, no matter whether filtering succeeds or not.
preScore [Required]
-PluginSet -		 - PreScore is a list of plugins that are invoked before scoring.
score [Required]
-PluginSet -		 - Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase.
reserve [Required]
-PluginSet -		 - Reserve is a list of plugins invoked when reserving/unreserving resources -after a node is assigned to run the pod.
permit [Required]
-PluginSet -		 - Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod.
preBind [Required]
-PluginSet -		 - PreBind is a list of plugins that should be invoked before a pod is bound.
bind [Required]
-PluginSet -		 - Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. -The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success.
postBind [Required]
-PluginSet -		 - PostBind is a list of plugins that should be invoked after a pod is successfully bound.
- - - -## `PodTopologySpreadConstraintsDefaulting` {#kubescheduler-config-k8s-io-v1beta1-PodTopologySpreadConstraintsDefaulting} - -(Alias of `string`) - - -**Appears in:** - -- [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta1-PodTopologySpreadArgs) - - -PodTopologySpreadConstraintsDefaulting defines how to set default constraints -for the PodTopologySpread plugin. - - - - - -## `ResourceSpec` {#kubescheduler-config-k8s-io-v1beta1-ResourceSpec} - - - - -**Appears in:** - -- [NodeResourcesLeastAllocatedArgs](#kubescheduler-config-k8s-io-v1beta1-NodeResourcesLeastAllocatedArgs) - -- [NodeResourcesMostAllocatedArgs](#kubescheduler-config-k8s-io-v1beta1-NodeResourcesMostAllocatedArgs) - -- [RequestedToCapacityRatioArgs](#kubescheduler-config-k8s-io-v1beta1-RequestedToCapacityRatioArgs) - - -ResourceSpec represents single resource and weight for bin packing of priority RequestedToCapacityRatioArguments. - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Name of the resource to be managed by RequestedToCapacityRatio function.
weight [Required]
-int64 -		 - Weight of the resource.
- - - -## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1beta1-UtilizationShapePoint} - - - - -**Appears in:** - -- [RequestedToCapacityRatioArgs](#kubescheduler-config-k8s-io-v1beta1-RequestedToCapacityRatioArgs) - - -UtilizationShapePoint represents single point of priority function shape. - - - - - - - - - - - - - - - - - - -
FieldDescription
utilization [Required]
-int32 -		 - Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.
score [Required]
-int32 -		 - Score assigned to given utilization (y axis). Valid values are 0 to 10.
- - diff --git a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md index 5479abcf36..6e04ce3879 100644 --- a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md +++ b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md @@ -20,7 +20,6 @@ auto_generated: true - ## `DefaultPreemptionArgs` {#kubescheduler-config-k8s-io-v1beta2-DefaultPreemptionArgs} @@ -67,8 +66,6 @@ that play a role in the number of candidates shortlisted. Must be at least - - ## `InterPodAffinityArgs` {#kubescheduler-config-k8s-io-v1beta2-InterPodAffinityArgs} @@ -99,8 +96,6 @@ matching hard affinity to the incoming pod. - - ## `KubeSchedulerConfiguration` {#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration} @@ -229,8 +224,6 @@ with the extender. These extenders are shared by all scheduler profiles. - - ## `NodeAffinityArgs` {#kubescheduler-config-k8s-io-v1beta2-NodeAffinityArgs} @@ -251,7 +244,7 @@ NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. addedAffinity
-core/v1.NodeAffinity +core/v1.NodeAffinity AddedAffinity is applied to all Pods additionally to the NodeAffinity @@ -265,8 +258,6 @@ a specific Node (such as Daemonset Pods) might remain unschedulable. - - ## `NodeResourcesBalancedAllocationArgs` {#kubescheduler-config-k8s-io-v1beta2-NodeResourcesBalancedAllocationArgs} @@ -296,8 +287,6 @@ NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResour - - ## `NodeResourcesFitArgs` {#kubescheduler-config-k8s-io-v1beta2-NodeResourcesFitArgs} @@ -348,8 +337,6 @@ The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.< - - ## `PodTopologySpreadArgs` {#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadArgs} @@ -370,7 +357,7 @@ PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread pl defaultConstraints
-[]core/v1.TopologySpreadConstraint +[]core/v1.TopologySpreadConstraint DefaultConstraints defines topology spread constraints to be applied to @@ -400,8 +387,6 @@ and to "System" if enabled. - - ## `VolumeBindingArgs` {#kubescheduler-config-k8s-io-v1beta2-VolumeBindingArgs} @@ -451,8 +436,6 @@ All points must be sorted in increasing order by utilization. - - ## `Extender` {#kubescheduler-config-k8s-io-v1beta2-Extender} @@ -460,7 +443,6 @@ All points must be sorted in increasing order by utilization. **Appears in:** - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) @@ -585,8 +567,6 @@ fail when the extender returns an error or is not reachable. - - ## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1beta2-ExtenderManagedResource} @@ -594,7 +574,6 @@ fail when the extender returns an error or is not reachable. **Appears in:** - - [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) @@ -626,8 +605,6 @@ resource when applying predicates. - - ## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1beta2-ExtenderTLSConfig} @@ -635,7 +612,6 @@ resource when applying predicates. **Appears in:** - - [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) @@ -718,8 +694,6 @@ CAData takes precedence over CAFile - - ## `KubeSchedulerProfile` {#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile} @@ -727,7 +701,6 @@ CAData takes precedence over CAFile **Appears in:** - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) @@ -776,8 +749,6 @@ for that plugin. - - ## `Plugin` {#kubescheduler-config-k8s-io-v1beta2-Plugin} @@ -785,7 +756,6 @@ for that plugin. **Appears in:** - - [PluginSet](#kubescheduler-config-k8s-io-v1beta2-PluginSet) @@ -815,8 +785,6 @@ Plugin specifies a plugin name and its weight when applicable. Weight is used on - - ## `PluginConfig` {#kubescheduler-config-k8s-io-v1beta2-PluginConfig} @@ -824,7 +792,6 @@ Plugin specifies a plugin name and its weight when applicable. Weight is used on **Appears in:** - - [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile) @@ -856,8 +823,6 @@ It is up to the plugin to process these Args. - - ## `PluginSet` {#kubescheduler-config-k8s-io-v1beta2-PluginSet} @@ -865,7 +830,6 @@ It is up to the plugin to process these Args. **Appears in:** - - [Plugins](#kubescheduler-config-k8s-io-v1beta2-Plugins) @@ -900,8 +864,6 @@ When all default plugins need to be disabled, an array containing only one "&low - - ## `Plugins` {#kubescheduler-config-k8s-io-v1beta2-Plugins} @@ -909,7 +871,6 @@ When all default plugins need to be disabled, an array containing only one "&low **Appears in:** - - [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile) @@ -1025,8 +986,6 @@ The scheduler call these plugins in order. Scheduler skips the rest of these plu - - ## `PodTopologySpreadConstraintsDefaulting` {#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadConstraintsDefaulting} @@ -1034,7 +993,6 @@ The scheduler call these plugins in order. Scheduler skips the rest of these plu **Appears in:** - - [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadArgs) @@ -1042,8 +1000,6 @@ PodTopologySpreadConstraintsDefaulting defines how to set default constraints for the PodTopologySpread plugin. - - ## `RequestedToCapacityRatioParam` {#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioParam} @@ -1051,7 +1007,6 @@ for the PodTopologySpread plugin. **Appears in:** - - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) @@ -1073,8 +1028,6 @@ RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters - - ## `ResourceSpec` {#kubescheduler-config-k8s-io-v1beta2-ResourceSpec} @@ -1082,9 +1035,7 @@ RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters **Appears in:** - - [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesBalancedAllocationArgs) - - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) @@ -1114,8 +1065,6 @@ ResourceSpec represents a single resource. - - ## `ScoringStrategy` {#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy} @@ -1123,7 +1072,6 @@ ResourceSpec represents a single resource. **Appears in:** - - [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesFitArgs) @@ -1164,8 +1112,6 @@ Weight defaults to 1 if not specified or explicitly set to 0. - - ## `ScoringStrategyType` {#kubescheduler-config-k8s-io-v1beta2-ScoringStrategyType} @@ -1173,15 +1119,12 @@ Weight defaults to 1 if not specified or explicitly set to 0. **Appears in:** - - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin. - - ## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1beta2-UtilizationShapePoint} @@ -1189,9 +1132,7 @@ ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin **Appears in:** - - [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta2-VolumeBindingArgs) - - [RequestedToCapacityRatioParam](#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioParam) @@ -1221,7 +1162,6 @@ UtilizationShapePoint represents single point of priority function shape. - @@ -1232,7 +1172,6 @@ UtilizationShapePoint represents single point of priority function shape. **Appears in:** - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) @@ -1295,7 +1234,6 @@ client. **Appears in:** - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) @@ -1333,7 +1271,6 @@ enableProfiling is true. **Appears in:** - - [LoggingConfiguration](#LoggingConfiguration) @@ -1362,7 +1299,6 @@ FormatOptions contains options for the different logging formats. **Appears in:** - - [FormatOptions](#FormatOptions) @@ -1385,7 +1321,7 @@ both to stdout, without buffering. infoBufferSize [Required]
-k8s.io/apimachinery/pkg/api/resource.QuantityValue +k8s.io/apimachinery/pkg/api/resource.QuantityValue [Experimental] InfoBufferSize sets the size of the info stream when @@ -1402,7 +1338,6 @@ using split streams. The default is zero, which disables buffering. **Appears in:** - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) @@ -1495,7 +1430,6 @@ during leader election cycles. **Appears in:** - - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -1574,7 +1508,6 @@ format get used, but all of them get validated. **Appears in:** - - [LoggingConfiguration](#LoggingConfiguration) diff --git a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md index f9ca9e5bd8..55ae376feb 100644 --- a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md +++ b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md @@ -20,7 +20,6 @@ auto_generated: true - ## `DefaultPreemptionArgs` {#kubescheduler-config-k8s-io-v1beta3-DefaultPreemptionArgs} @@ -67,8 +66,6 @@ that play a role in the number of candidates shortlisted. Must be at least - - ## `InterPodAffinityArgs` {#kubescheduler-config-k8s-io-v1beta3-InterPodAffinityArgs} @@ -99,8 +96,6 @@ matching hard affinity to the incoming pod. - - ## `KubeSchedulerConfiguration` {#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration} @@ -211,8 +206,6 @@ with the extender. These extenders are shared by all scheduler profiles. - - ## `NodeAffinityArgs` {#kubescheduler-config-k8s-io-v1beta3-NodeAffinityArgs} @@ -233,7 +226,7 @@ NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. addedAffinity
-core/v1.NodeAffinity +core/v1.NodeAffinity AddedAffinity is applied to all Pods additionally to the NodeAffinity @@ -247,8 +240,6 @@ a specific Node (such as Daemonset Pods) might remain unschedulable. - - ## `NodeResourcesBalancedAllocationArgs` {#kubescheduler-config-k8s-io-v1beta3-NodeResourcesBalancedAllocationArgs} @@ -278,8 +269,6 @@ NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResour - - ## `NodeResourcesFitArgs` {#kubescheduler-config-k8s-io-v1beta3-NodeResourcesFitArgs} @@ -330,8 +319,6 @@ The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.< - - ## `PodTopologySpreadArgs` {#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadArgs} @@ -352,7 +339,7 @@ PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread pl defaultConstraints
-[]core/v1.TopologySpreadConstraint +[]core/v1.TopologySpreadConstraint DefaultConstraints defines topology spread constraints to be applied to @@ -382,8 +369,6 @@ and to "System" if enabled. - - ## `VolumeBindingArgs` {#kubescheduler-config-k8s-io-v1beta3-VolumeBindingArgs} @@ -433,8 +418,6 @@ All points must be sorted in increasing order by utilization. - - ## `Extender` {#kubescheduler-config-k8s-io-v1beta3-Extender} @@ -442,7 +425,6 @@ All points must be sorted in increasing order by utilization. **Appears in:** - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) @@ -567,8 +549,6 @@ fail when the extender returns an error or is not reachable. - - ## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1beta3-ExtenderManagedResource} @@ -576,7 +556,6 @@ fail when the extender returns an error or is not reachable. **Appears in:** - - [Extender](#kubescheduler-config-k8s-io-v1beta3-Extender) @@ -608,8 +587,6 @@ resource when applying predicates. - - ## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1beta3-ExtenderTLSConfig} @@ -617,7 +594,6 @@ resource when applying predicates. **Appears in:** - - [Extender](#kubescheduler-config-k8s-io-v1beta3-Extender) @@ -700,8 +676,6 @@ CAData takes precedence over CAFile - - ## `KubeSchedulerProfile` {#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile} @@ -709,7 +683,6 @@ CAData takes precedence over CAFile **Appears in:** - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) @@ -758,8 +731,6 @@ for that plugin. - - ## `Plugin` {#kubescheduler-config-k8s-io-v1beta3-Plugin} @@ -767,7 +738,6 @@ for that plugin. **Appears in:** - - [PluginSet](#kubescheduler-config-k8s-io-v1beta3-PluginSet) @@ -797,8 +767,6 @@ Plugin specifies a plugin name and its weight when applicable. Weight is used on - - ## `PluginConfig` {#kubescheduler-config-k8s-io-v1beta3-PluginConfig} @@ -806,7 +774,6 @@ Plugin specifies a plugin name and its weight when applicable. Weight is used on **Appears in:** - - [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile) @@ -838,8 +805,6 @@ It is up to the plugin to process these Args. - - ## `PluginSet` {#kubescheduler-config-k8s-io-v1beta3-PluginSet} @@ -847,7 +812,6 @@ It is up to the plugin to process these Args. **Appears in:** - - [Plugins](#kubescheduler-config-k8s-io-v1beta3-Plugins) @@ -882,8 +846,6 @@ When all default plugins need to be disabled, an array containing only one "&low - - ## `Plugins` {#kubescheduler-config-k8s-io-v1beta3-Plugins} @@ -891,7 +853,6 @@ When all default plugins need to be disabled, an array containing only one "&low **Appears in:** - - [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile) @@ -1022,8 +983,6 @@ plugin through MultiPoint. This follows the same behavior as all other extension - - ## `PodTopologySpreadConstraintsDefaulting` {#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadConstraintsDefaulting} @@ -1031,7 +990,6 @@ plugin through MultiPoint. This follows the same behavior as all other extension **Appears in:** - - [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadArgs) @@ -1039,8 +997,6 @@ PodTopologySpreadConstraintsDefaulting defines how to set default constraints for the PodTopologySpread plugin. - - ## `RequestedToCapacityRatioParam` {#kubescheduler-config-k8s-io-v1beta3-RequestedToCapacityRatioParam} @@ -1048,7 +1004,6 @@ for the PodTopologySpread plugin. **Appears in:** - - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) @@ -1070,8 +1025,6 @@ RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters - - ## `ResourceSpec` {#kubescheduler-config-k8s-io-v1beta3-ResourceSpec} @@ -1079,9 +1032,7 @@ RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters **Appears in:** - - [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesBalancedAllocationArgs) - - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) @@ -1111,8 +1062,6 @@ ResourceSpec represents a single resource. - - ## `ScoringStrategy` {#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy} @@ -1120,7 +1069,6 @@ ResourceSpec represents a single resource. **Appears in:** - - [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesFitArgs) @@ -1161,8 +1109,6 @@ Weight defaults to 1 if not specified or explicitly set to 0. - - ## `ScoringStrategyType` {#kubescheduler-config-k8s-io-v1beta3-ScoringStrategyType} @@ -1170,15 +1116,12 @@ Weight defaults to 1 if not specified or explicitly set to 0. **Appears in:** - - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin. - - ## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1beta3-UtilizationShapePoint} @@ -1186,9 +1129,7 @@ ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin **Appears in:** - - [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta3-VolumeBindingArgs) - - [RequestedToCapacityRatioParam](#kubescheduler-config-k8s-io-v1beta3-RequestedToCapacityRatioParam) @@ -1218,7 +1159,6 @@ UtilizationShapePoint represents single point of priority function shape. - @@ -1229,9 +1169,7 @@ UtilizationShapePoint represents single point of priority function shape. **Appears in:** - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) @@ -1294,10 +1232,8 @@ client. **Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) DebuggingConfiguration holds configuration for Debugging related features. @@ -1334,7 +1270,6 @@ enableProfiling is true. **Appears in:** - - [LoggingConfiguration](#LoggingConfiguration) @@ -1363,7 +1298,6 @@ FormatOptions contains options for the different logging formats. **Appears in:** - - [FormatOptions](#FormatOptions) @@ -1386,7 +1320,7 @@ both to stdout, without buffering. infoBufferSize [Required]
-k8s.io/apimachinery/pkg/api/resource.QuantityValue +k8s.io/apimachinery/pkg/api/resource.QuantityValue [Experimental] InfoBufferSize sets the size of the info stream when @@ -1403,9 +1337,7 @@ using split streams. The default is zero, which disables buffering. **Appears in:** - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) @@ -1498,7 +1430,6 @@ during leader election cycles. **Appears in:** - - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -1577,7 +1508,6 @@ format get used, but all of them get validated. **Appears in:** - - [LoggingConfiguration](#LoggingConfiguration) diff --git a/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md b/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md deleted file mode 100644 index e694f7ecbc..0000000000 --- a/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md +++ /dev/null @@ -1,799 +0,0 @@ ---- -title: kube-scheduler Policy Configuration (v1) -content_type: tool-reference -package: kubescheduler.config.k8s.io/v1 -auto_generated: true ---- - - -## Resource Types - - -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) - - - - -## `Policy` {#kubescheduler-config-k8s-io-v1-Policy} - - - - - -Policy describes a struct for a policy resource used in api. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1
kind
string		Policy
predicates [Required]
-[]PredicatePolicy -		 - Holds the information to configure the fit predicate functions
priorities [Required]
-[]PriorityPolicy -		 - Holds the information to configure the priority functions
extenders [Required]
-[]LegacyExtender -		 - Holds the information to communicate with the extender(s)
hardPodAffinitySymmetricWeight [Required]
-int32 -		 - RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule -corresponding to every RequiredDuringScheduling affinity rule. -HardPodAffinitySymmetricWeight represents the weight of implicit PreferredDuringScheduling affinity rule, in the range 1-100.
alwaysCheckAllPredicates [Required]
-bool -		 - When AlwaysCheckAllPredicates is set to true, scheduler checks all -the configured predicates even after one or more of them fails. -When the flag is set to false, scheduler skips checking the rest -of the predicates after it finds one predicate that failed.
- - - -## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1-ExtenderManagedResource} - - - - -**Appears in:** - -- [Extender](#kubescheduler-config-k8s-io-v1beta1-Extender) - -- [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender) - - -ExtenderManagedResource describes the arguments of extended resources -managed by an extender. - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Name is the extended resource name.
ignoredByScheduler [Required]
-bool -		 - IgnoredByScheduler indicates whether kube-scheduler should ignore this -resource when applying predicates.
- - - -## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1-ExtenderTLSConfig} - - - - -**Appears in:** - -- [Extender](#kubescheduler-config-k8s-io-v1beta1-Extender) - -- [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender) - - -ExtenderTLSConfig contains settings to enable TLS with extender - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
insecure [Required]
-bool -		 - Server should be accessed without verifying the TLS certificate. For testing only.
serverName [Required]
-string -		 - ServerName is passed to the server for SNI and is used in the client to check server -certificates against. If ServerName is empty, the hostname used to contact the -server is used.
certFile [Required]
-string -		 - Server requires TLS client certificate authentication
keyFile [Required]
-string -		 - Server requires TLS client certificate authentication
caFile [Required]
-string -		 - Trusted root certificates for server
certData [Required]
-[]byte -		 - CertData holds PEM-encoded bytes (typically read from a client certificate file). -CertData takes precedence over CertFile
keyData [Required]
-[]byte -		 - KeyData holds PEM-encoded bytes (typically read from a client certificate key file). -KeyData takes precedence over KeyFile
caData [Required]
-[]byte -		 - CAData holds PEM-encoded bytes (typically read from a root certificates bundle). -CAData takes precedence over CAFile
- - - -## `LabelPreference` {#kubescheduler-config-k8s-io-v1-LabelPreference} - - - - -**Appears in:** - -- [PriorityArgument](#kubescheduler-config-k8s-io-v1-PriorityArgument) - - -LabelPreference holds the parameters that are used to configure the corresponding priority function - - - - - - - - - - - - - - - - - - -
FieldDescription
label [Required]
-string -		 - Used to identify node "groups"
presence [Required]
-bool -		 - This is a boolean flag -If true, higher priority is given to nodes that have the label -If false, higher priority is given to nodes that do not have the label
- - - -## `LabelsPresence` {#kubescheduler-config-k8s-io-v1-LabelsPresence} - - - - -**Appears in:** - -- [PredicateArgument](#kubescheduler-config-k8s-io-v1-PredicateArgument) - - -LabelsPresence holds the parameters that are used to configure the corresponding predicate in scheduler policy configuration. - - - - - - - - - - - - - - - - - - -
FieldDescription
labels [Required]
-[]string -		 - The list of labels that identify node "groups" -All of the labels should be either present (or absent) for the node to be considered a fit for hosting the pod
presence [Required]
-bool -		 - The boolean flag that indicates whether the labels should be present or absent from the node
- - - -## `LegacyExtender` {#kubescheduler-config-k8s-io-v1-LegacyExtender} - - - - -**Appears in:** - -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) - - -LegacyExtender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, -it is assumed that the extender chose not to provide that extension. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
urlPrefix [Required]
-string -		 - URLPrefix at which the extender is available
filterVerb [Required]
-string -		 - Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.
preemptVerb [Required]
-string -		 - Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.
prioritizeVerb [Required]
-string -		 - Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.
weight [Required]
-int64 -		 - The numeric multiplier for the node scores that the prioritize call generates. -The weight should be a positive integer
bindVerb [Required]
-string -		 - Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. -If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender -can implement this function.
enableHttps [Required]
-bool -		 - EnableHTTPS specifies whether https should be used to communicate with the extender
tlsConfig [Required]
-ExtenderTLSConfig -		 - TLSConfig specifies the transport layer security config
httpTimeout [Required]
-time.Duration -		 - HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize -timeout is ignored, k8s/other extenders priorities are used to select the node.
nodeCacheCapable [Required]
-bool -		 - NodeCacheCapable specifies that the extender is capable of caching node information, -so the scheduler should only send minimal information about the eligible nodes -assuming that the extender already cached full details of all nodes in the cluster
managedResources
-[]ExtenderManagedResource -		 - ManagedResources is a list of extended resources that are managed by -this extender. -- A pod will be sent to the extender on the Filter, Prioritize and Bind - (if the extender is the binder) phases iff the pod requests at least - one of the extended resources in this list. If empty or unspecified, - all pods will be sent to this extender. -- If IgnoredByScheduler is set to true for a resource, kube-scheduler - will skip checking the resource in predicates.
ignorable [Required]
-bool -		 - Ignorable specifies if the extender is ignorable, i.e. scheduling should not -fail when the extender returns an error or is not reachable.
- - - -## `PredicateArgument` {#kubescheduler-config-k8s-io-v1-PredicateArgument} - - - - -**Appears in:** - -- [PredicatePolicy](#kubescheduler-config-k8s-io-v1-PredicatePolicy) - - -PredicateArgument represents the arguments to configure predicate functions in scheduler policy configuration. -Only one of its members may be specified - - - - - - - - - - - - - - - - - - -
FieldDescription
serviceAffinity [Required]
-ServiceAffinity -		 - The predicate that provides affinity for pods belonging to a service -It uses a label to identify nodes that belong to the same "group"
labelsPresence [Required]
-LabelsPresence -		 - The predicate that checks whether a particular node has a certain label -defined or not, regardless of value
- - - -## `PredicatePolicy` {#kubescheduler-config-k8s-io-v1-PredicatePolicy} - - - - -**Appears in:** - -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) - - -PredicatePolicy describes a struct of a predicate policy. - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Identifier of the predicate policy -For a custom predicate, the name can be user-defined -For the Kubernetes provided predicates, the name is the identifier of the pre-defined predicate
argument [Required]
-PredicateArgument -		 - Holds the parameters to configure the given predicate
- - - -## `PriorityArgument` {#kubescheduler-config-k8s-io-v1-PriorityArgument} - - - - -**Appears in:** - -- [PriorityPolicy](#kubescheduler-config-k8s-io-v1-PriorityPolicy) - - -PriorityArgument represents the arguments to configure priority functions in scheduler policy configuration. -Only one of its members may be specified - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
serviceAntiAffinity [Required]
-ServiceAntiAffinity -		 - The priority function that ensures a good spread (anti-affinity) for pods belonging to a service -It uses a label to identify nodes that belong to the same "group"
labelPreference [Required]
-LabelPreference -		 - The priority function that checks whether a particular node has a certain label -defined or not, regardless of value
requestedToCapacityRatioArguments [Required]
-RequestedToCapacityRatioArguments -		 - The RequestedToCapacityRatio priority function is parametrized with function shape.
- - - -## `PriorityPolicy` {#kubescheduler-config-k8s-io-v1-PriorityPolicy} - - - - -**Appears in:** - -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) - - -PriorityPolicy describes a struct of a priority policy. - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Identifier of the priority policy -For a custom priority, the name can be user-defined -For the Kubernetes provided priority functions, the name is the identifier of the pre-defined priority function
weight [Required]
-int64 -		 - The numeric multiplier for the node scores that the priority function generates -The weight should be non-zero and can be a positive or a negative integer
argument [Required]
-PriorityArgument -		 - Holds the parameters to configure the given priority function
- - - -## `RequestedToCapacityRatioArguments` {#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioArguments} - - - - -**Appears in:** - -- [PriorityArgument](#kubescheduler-config-k8s-io-v1-PriorityArgument) - - -RequestedToCapacityRatioArguments holds arguments specific to RequestedToCapacityRatio priority function. - - - - - - - - - - - - - - - - - - -
FieldDescription
shape [Required]
-[]UtilizationShapePoint -		 - Array of point defining priority function shape.
resources [Required]
-[]ResourceSpec -		 - No description provided. -
- - - -## `ResourceSpec` {#kubescheduler-config-k8s-io-v1-ResourceSpec} - - - - -**Appears in:** - -- [RequestedToCapacityRatioArguments](#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioArguments) - - -ResourceSpec represents single resource and weight for bin packing of priority RequestedToCapacityRatioArguments. - - - - - - - - - - - - - - - - - - -
FieldDescription
name [Required]
-string -		 - Name of the resource to be managed by RequestedToCapacityRatio function.
weight [Required]
-int64 -		 - Weight of the resource.
- - - -## `ServiceAffinity` {#kubescheduler-config-k8s-io-v1-ServiceAffinity} - - - - -**Appears in:** - -- [PredicateArgument](#kubescheduler-config-k8s-io-v1-PredicateArgument) - - -ServiceAffinity holds the parameters that are used to configure the corresponding predicate in scheduler policy configuration. - - - - - - - - - - - - - -
FieldDescription
labels [Required]
-[]string -		 - The list of labels that identify node "groups" -All of the labels should match for the node to be considered a fit for hosting the pod
- - - -## `ServiceAntiAffinity` {#kubescheduler-config-k8s-io-v1-ServiceAntiAffinity} - - - - -**Appears in:** - -- [PriorityArgument](#kubescheduler-config-k8s-io-v1-PriorityArgument) - - -ServiceAntiAffinity holds the parameters that are used to configure the corresponding priority function - - - - - - - - - - - - - -
FieldDescription
label [Required]
-string -		 - Used to identify node "groups"
- - - -## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1-UtilizationShapePoint} - - - - -**Appears in:** - -- [RequestedToCapacityRatioArguments](#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioArguments) - - -UtilizationShapePoint represents single point of priority function shape. - - - - - - - - - - - - - - - - - - -
FieldDescription
utilization [Required]
-int32 -		 - Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.
score [Required]
-int32 -		 - Score assigned to given utilization (y axis). Valid values are 0 to 10.
- - diff --git a/content/en/docs/reference/config-api/kubeadm-config.v1beta2.md b/content/en/docs/reference/config-api/kubeadm-config.v1beta2.md index 77595b4599..f3c5b521ab 100644 --- a/content/en/docs/reference/config-api/kubeadm-config.v1beta2.md +++ b/content/en/docs/reference/config-api/kubeadm-config.v1beta2.md @@ -4,18 +4,21 @@ content_type: tool-reference package: kubeadm.k8s.io/v1beta2 auto_generated: true --- +## Overview + Package v1beta2 defines the v1beta2 version of the kubeadm configuration file format. This version improves on the v1beta1 format by fixing some minor issues and adding a few new fields. A list of changes since v1beta1: -- `certificateKey" field is added to InitConfiguration and JoinConfiguration. +- "certificateKey" field is added to InitConfiguration and JoinConfiguration. - "ignorePreflightErrors" field is added to the NodeRegistrationOptions. - The JSON "omitempty" tag is used in a more places where appropriate. - The JSON "omitempty" tag of the "taints" field (inside NodeRegistrationOptions) is removed. + See the Kubernetes 1.15 changelog for further details. -## Migration from old kubeadm config versions +Migration from old kubeadm config versions Please convert your v1beta1 configuration files to v1beta2 using the "kubeadm config migrate" command of kubeadm v1.15.x (conversion from older releases of kubeadm config files requires older release of kubeadm as well e.g. @@ -27,11 +30,11 @@ Nevertheless, kubeadm v1.15.x will support reading from v1beta1 version of the k ## Basics -The preferred way to configure kubeadm is to pass an YAML configuration file with the --config option. Some of the +The preferred way to configure kubeadm is to pass an YAML configuration file with the `--config` option. Some of the configuration options defined in the kubeadm config file are also available as command line flags, but only the most common/simple use case are supported with this approach. -A kubeadm config file could contain multiple configuration types separated using three dashes (“---”). +A kubeadm config file could contain multiple configuration types separated using three dashes (`---`). kubeadm supports the following configuration types: @@ -60,14 +63,14 @@ kubeadm config print join-defaults ``` The list of configuration types that must be included in a configuration file depends by the action you are -performing (init or join) and by the configuration options you are going to use (defaults or advanced customization). +performing (`init` or `join`) and by the configuration options you are going to use (defaults or advanced customization). If some configuration types are not provided, or provided only partially, kubeadm will use default values; defaults provided by kubeadm includes also enforcing consistency of values across components when required (e.g. -cluster-cidr flag on controller manager and clusterCIDR on kube-proxy). +`--cluster-cidr` flag on controller manager and `clusterCIDR` on kube-proxy). Users are always allowed to override default values, with the only exception of a small subset of setting with -relevance for security (e.g. enforce authorization-mode Node and RBAC on api server) +relevance for security (e.g. enforce authorization-mode Node and RBAC on API server) If the user provides a configuration types that is not expected for the action you are performing, kubeadm will ignore those types and print a warning. @@ -82,20 +85,20 @@ between InitConfiguration and ClusterConfiguration is mandatory. apiVersion: kubeadm.k8s.io/v1beta2 kind: InitConfiguration bootstrapTokens: - ... + ... nodeRegistration: - ... + ... ``` -The InitConfiguration type should be used to configure runtime settings, that in case of kubeadm init +The InitConfiguration type should be used to configure runtime settings, that in case of `kubeadm init` are the configuration of the bootstrap token and all the setting which are specific to the node where kubeadm is executed, including: -- NodeRegistration, that holds fields that relate to registering the new node to the cluster; +- `nodeRegistration`, that holds fields that relate to registering the new node to the cluster; use it to customize the node name, the CRI socket to use or any other settings that should apply to this node only (e.g. the node ip). -- LocalAPIEndpoint, that represents the endpoint of the instance of the API server to be deployed on this node; +- `apiServer`, that represents the endpoint of the instance of the API server to be deployed on this node; use it e.g. to customize the API server advertise address. ```yaml @@ -110,6 +113,7 @@ is executed, including: ... extraVolumes: ... + ... ``` The ClusterConfiguration type should be used to configure cluster-wide settings, @@ -117,33 +121,37 @@ including settings for: - Networking, that holds configuration for the networking topology of the cluster; use it e.g. to customize pod subnet or services subnet. + - Etcd configurations; use it e.g. to customize the local etcd or to configure the API server for using an external etcd cluster. + - kube-apiserver, kube-scheduler, kube-controller-manager configurations; use it to customize control-plane components by adding customized setting or overriding kubeadm default settings. ```yaml apiVersion: kubeproxy.config.k8s.io/v1alpha1 kind: KubeProxyConfiguration - ... + ... ``` The KubeProxyConfiguration type should be used to change the configuration passed to kube-proxy instances deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults. -See https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/ or https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration +See https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/ or +https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration for kube proxy official documentation. ```yaml apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration -... + ... ``` The KubeletConfiguration type should be used to change the configurations that will be passed to all kubelet instances deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults. -See https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ or https://godoc.org/k8s.io/kubelet/config/v1beta1#KubeletConfiguration +See https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ or +https://godoc.org/k8s.io/kubelet/config/v1beta1#KubeletConfiguration for kubelet official documentation. Here is a fully populated example of a single YAML file containing multiple @@ -171,7 +179,7 @@ nodeRegistration: value: "master" effect: "NoSchedule" kubeletExtraArgs: - cgroup-driver: "cgroupfs" + v: 4 ignorePreflightErrors: - IsPrivilegedUser localAPIEndpoint: @@ -183,60 +191,60 @@ apiVersion: kubeadm.k8s.io/v1beta2 kind: ClusterConfiguration etcd: # one of local or external - local: - imageRepository: "k8s.gcr.io" - imageTag: "3.2.24" - dataDir: "/var/lib/etcd" - extraArgs: - listen-client-urls: "http://10.100.0.1:2379" - serverCertSANs: - - "ec2-10-100-0-1.compute-1.amazonaws.com" - peerCertSANs: - - "10.100.0.1" - # external: - # endpoints: - # - "10.100.0.1:2379" - # - "10.100.0.2:2379" - # caFile: "/etcd/kubernetes/pki/etcd/etcd-ca.crt" - # certFile: "/etcd/kubernetes/pki/etcd/etcd.crt" - # keyFile: "/etcd/kubernetes/pki/etcd/etcd.key" - networking: - serviceSubnet: "10.96.0.0/12" - podSubnet: "10.100.0.1/24" - dnsDomain: "cluster.local" - kubernetesVersion: "v1.12.0" - controlPlaneEndpoint: "10.100.0.1:6443" - apiServer: - extraArgs: - authorization-mode: "Node,RBAC" - extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File - certSANs: - - "10.100.1.1" - - "ec2-10-100-0-1.compute-1.amazonaws.com" - timeoutForControlPlane: 4m0s - controllerManager: - extraArgs: - "node-cidr-mask-size": "20" - extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File - scheduler: - extraArgs: - address: "10.100.0.1" - extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File +local: + imageRepository: "k8s.gcr.io" + imageTag: "3.2.24" + dataDir: "/var/lib/etcd" + extraArgs: + listen-client-urls: "http://10.100.0.1:2379" + serverCertSANs: + - "ec2-10-100-0-1.compute-1.amazonaws.com" + peerCertSANs: + - "10.100.0.1" +# external: +# endpoints: +# - "10.100.0.1:2379" +# - "10.100.0.2:2379" +# caFile: "/etcd/kubernetes/pki/etcd/etcd-ca.crt" +# certFile: "/etcd/kubernetes/pki/etcd/etcd.crt" +# keyFile: "/etcd/kubernetes/pki/etcd/etcd.key" +networking: + serviceSubnet: "10.96.0.0/16" + podSubnet: "10.244.0.0/24" + dnsDomain: "cluster.local" +kubernetesVersion: "v1.12.0" +controlPlaneEndpoint: "10.100.0.1:6443" +apiServer: + extraArgs: + authorization-mode: "Node,RBAC" + extraVolumes: + - name: "some-volume" + hostPath: "/etc/some-path" + mountPath: "/etc/some-pod-path" + readOnly: false + pathType: File + certSANs: + - "10.100.1.1" + - "ec2-10-100-0-1.compute-1.amazonaws.com" + timeoutForControlPlane: 4m0s +controllerManager: + extraArgs: + "node-cidr-mask-size": "20" + extraVolumes: + - name: "some-volume" + hostPath: "/etc/some-path" + mountPath: "/etc/some-pod-path" + readOnly: false + pathType: File +scheduler: + extraArgs: + address: "10.100.0.1" + extraVolumes: + - name: "some-volume" + hostPath: "/etc/some-path" + mountPath: "/etc/some-pod-path" + readOnly: false + pathType: File certificatesDir: "/etc/kubernetes/pki" imageRepository: "k8s.gcr.io" useHyperKubeImage: false @@ -258,18 +266,18 @@ When executing kubeadm join with the `--config` option, the JoinConfiguration ty ```yaml apiVersion: kubeadm.k8s.io/v1beta2 kind: JoinConfiguration -... + ... ``` -The JoinConfiguration type should be used to configure runtime settings, that in case of kubeadm join +The JoinConfiguration type should be used to configure runtime settings, that in case of `kubeadm join` are the discovery method used for accessing the cluster info and all the setting which are specific to the node where kubeadm is executed, including: -- NodeRegistration, that holds fields that relate to registering the new node to the cluster; +- `NodeRegistration`, that holds fields that relate to registering the new node to the cluster; use it to customize the node name, the CRI socket to use or any other settings that should apply to this - node only (e.g. the node ip). + node only (e.g. the node IP). -- APIEndpoint, that represents the endpoint of the instance of the API server to be eventually deployed on this node. +- `APIEndpoint`, that represents the endpoint of the instance of the API server to be eventually deployed on this node. ## Resource Types @@ -281,7 +289,6 @@ to the node where kubeadm is executed, including: - ## `ClusterConfiguration` {#kubeadm-k8s-io-v1beta2-ClusterConfiguration} @@ -330,15 +337,15 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster `controlPlaneEndpoint` sets a stable IP address or DNS name for the control plane; it can be a valid IP address or a RFC-1123 DNS subdomain, both with optional TCP port. -In case the ControlPlaneEndpoint is not specified, the AdvertiseAddress + BindPort -are used; in case the ControlPlaneEndpoint is specified but without a TCP port, -the BindPort is used. +In case the `controlPlaneEndpoint` is not specified, the `advertiseAddress` + `bindPort` +are used; in case the `controlPlaneEndpoint` is specified but without a TCP port, +the `bindPort` is used. Possible usages are: - In a cluster with more than one control plane instances, this field should be assigned the address of the external load balancer in front of the control plane instances. -- In environments with enforced node recycling, the ControlPlaneEndpoint +- In environments with enforced node recycling, the `controlPlaneEndpoint` could be used for assigning a stable DNS to the control plane. @@ -371,7 +378,7 @@ Possible usages are: DNS - `dns` defines the options for the DNS add-on. + `dns` defines the options for the DNS add-on installed in the cluster. @@ -387,11 +394,11 @@ Possible usages are: string - `imageRepository` sets the container registry to pull images from. + `mageRepository` sets the container registry to pull images from. If empty, `k8s.gcr.io` will be used by default; in case of kubernetes version is -a CI build (kubernetes version starts with `ci/` or `ci-cross/`) -`gcr.io/k8s-staging-ci-images` will be used as a default for control plane -components and for kube-proxy, while `k8s.gcr.io` will be used for all the other images. +a CI build (kubernetes version starts with `ci/`) `gcr.io/k8s-staging-ci-images` +is used as a default for control plane components and for kube-proxy, while +`k8s.gcr.io` will be used for all the other images. @@ -399,11 +406,11 @@ components and for kube-proxy, while `k8s.gcr.io` will be used for all the other bool - `useHyperKubeImage` controls if hyperkube should be used for Kubernetes -components instead of their respective separate images -DEPRECATED: As hyperkube is itself deprecated, this fields is too. It will -be removed in future kubeadm config versions, kubeadm will print multiple -warnings when this is set to true, and at some point it may become ignored. + `useHyperKubeImage` controls if hyperkube should be used for Kubernetes components +instead of their respective separate images. +DEPRECATED: As `hyperkube` is itself deprecated, this fields is too. It will be +removed in future kubeadm config versions, kubeadm will print multiple warnings +when this set to true, and at some point it may become ignored. @@ -411,7 +418,7 @@ warnings when this is set to true, and at some point it may become ignored. map[string]bool - Feature gates enabled by the user. + `featureGates` contains the feature gates enabled by the user. @@ -419,14 +426,12 @@ warnings when this is set to true, and at some point it may become ignored. string - The cluster name + The cluster name. - - ## `ClusterStatus` {#kubeadm-k8s-io-v1beta2-ClusterStatus} @@ -434,8 +439,9 @@ warnings when this is set to true, and at some point it may become ignored. -ClusterStatus contains the cluster status. The ClusterStatus will be stored in the kubeadm-config -ConfigMap in the cluster, and then updated by kubeadm when additional control plane instance joins or leaves the cluster. +ClusterStatus contains the cluster status. The ClusterStatus will be stored in +the kubeadm-config ConfigMap in the cluster, and then updated by kubeadm when +additional control plane instance joins or leaves the cluster. @@ -452,14 +458,13 @@ ConfigMap in the cluster, and then updated by kubeadm when additional control pl +plane/API server instance. +The key of the map is the IP of the host's default interface.
FieldDescription
`apiEndpoints` currently available in the cluster, one for each control -plane/API server instance. The key of the map is the IP of the host's default interface
- - ## `InitConfiguration` {#kubeadm-k8s-io-v1beta2-InitConfiguration} @@ -484,8 +489,8 @@ information. []BootstrapToken - `bootstrapTokens` is respected at `kubeadm init` time and describes a set of Bootstrap Tokens to create. -This information IS NOT uploaded to the kubeadm cluster configmap, partly because of its sensitive nature + `bootstrapTokens` is respected at `kubeadm init` time and describes a set of bootstrap tokens to create. +This information IS NOT uploaded to the kubeadm cluster ConfigMap, partly because of its sensitive nature. @@ -493,7 +498,7 @@ This information IS NOT uploaded to the kubeadm cluster configmap, partly becaus NodeRegistrationOptions - `nodeRegistration` holds fields that relate to registering the new control-plane node to the cluster + `nodeRegistration` holds fields that relate to registering the new control-plane node to the cluster. @@ -501,9 +506,9 @@ This information IS NOT uploaded to the kubeadm cluster configmap, partly becaus APIEndpoint - `localAPIEndpoint` represents the endpoint of the API server instance that's deployed on this control plane node -In HA setups, this differs from ClusterConfiguration.ControlPlaneEndpoint in the sense that ControlPlaneEndpoint -is the global endpoint for the cluster, which then loadbalances the requests to each individual API server. This + `localAPIEndpoint` represents the endpoint of the API server instance that's deployed on this control plane node. +In HA setups, this differs from `ClusterConfiguration.controlPlaneEndpoint` in the sense that ControlPlaneEndpoint +is the global endpoint for the cluster, which then load-balances the requests to each individual API server. This configuration object lets you customize what IP/DNS name and port the local API server advertises it's accessible on. By default, kubeadm tries to auto-detect the IP of the default interface and use that, but in case that process fails you may set the desired value here. @@ -515,14 +520,12 @@ fails you may set the desired value here. `certificateKey` sets the key with which certificates and keys are encrypted prior to being uploaded in -a Secret in the cluster during the "uploadcerts" init phase. +a secret in the cluster during the `uploadcerts init` phase. - - ## `JoinConfiguration` {#kubeadm-k8s-io-v1beta2-JoinConfiguration} @@ -546,8 +549,8 @@ JoinConfiguration contains elements describing a particular node. NodeRegistrationOptions - `nodeRegistration` holds fields that relate to registering the new control-plane -node to the cluster + `nodeRegistration` holds fields that relate to registering the new +control-plane node to the cluster @@ -556,7 +559,7 @@ node to the cluster `caCertPath` is the path to the SSL certificate authority used to -secure comunications between node and control-plane. +secure comunications between a node and the control-plane. Defaults to "/etc/kubernetes/pki/ca.crt". @@ -565,8 +568,8 @@ Defaults to "/etc/kubernetes/pki/ca.crt". Discovery - `discovery` specifies the options for the kubelet to use during the TLS Bootstrap -process + `discovery` specifies the options for the kubelet to use during the TLS +bootstrap process. @@ -574,15 +577,13 @@ process JoinControlPlane - `controlPlane` defines the additional control plane instance to be deployed on the -joining node. If nil, no additional control plane instance will be deployed. + `controlPlane` defines the additional control plane instance to be deployed +on the joining node. If nil, no additional control plane instance will be deployed. - - ## `APIEndpoint` {#kubeadm-k8s-io-v1beta2-APIEndpoint} @@ -590,11 +591,8 @@ joining node. If nil, no additional control plane instance will be deployed.int32 - `bindPort` sets the secure port for the API Server to bind to. Defaults to 6443. + `bindPort` sets the secure port for the API Server to bind to. +Defaults to 6443. - - ## `APIServer` {#kubeadm-k8s-io-v1beta2-APIServer} @@ -633,11 +630,10 @@ APIEndpoint struct contains elements of API server instance deployed on a node. **Appears in:** - - [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) -APIServer holds settings necessary for API server deployments in the cluster +APIServer holds settings necessary for API server deployments in the cluster. @@ -658,7 +654,8 @@ APIServer holds settings necessary for API server deployments in the cluster []string + `certSANs` sets extra Subject Alternative Names (SANs) for the API Server +signing certificate. @@ -666,14 +663,13 @@ APIServer holds settings necessary for API server deployments in the cluster meta/v1.Duration + `timeoutForControlPlane` controls the timeout that we wait for the API server +to appear.
FieldDescription
- `certSANs` sets extra Subject Alternative Names for the API Server signing cert.
- `timeoutForControlPlane` controls the timeout that we use for API server to appear
- - ## `BootstrapToken` {#kubeadm-k8s-io-v1beta2-BootstrapToken} @@ -681,7 +677,6 @@ APIServer holds settings necessary for API server deployments in the cluster **Appears in:** - - [InitConfiguration](#kubeadm-k8s-io-v1beta2-InitConfiguration) @@ -697,7 +692,7 @@ BootstrapToken describes one bootstrap token, stored as a Secret in the cluster BootstrapTokenString - `token` used for establishing bidirectional trust between nodes and control-planes. + `token` is used for establishing bidirectional trust between nodes and control-planes. Used for joining nodes in the cluster. @@ -715,13 +710,13 @@ for, so other administrators can know its purpose. meta/v1.Duration - `ttl` defines the time to live for this token. Defaults to "24h". + `ttl` defines the time to live for this token. Defaults to '24h'. `expires` and `ttl` are mutually exclusive. expires [Required]
-meta/v1.Time +meta/v1.Time `expires` specifies the timestamp when this token expires. Defaults to being set @@ -743,14 +738,12 @@ for establishing bidirectional trust, but that can be changed here. `groups` specifies the extra groups that this token will authenticate as when/if -used for authentication +used for authentication. - - ## `BootstrapTokenDiscovery` {#kubeadm-k8s-io-v1beta2-BootstrapTokenDiscovery} @@ -758,7 +751,6 @@ used for authentication **Appears in:** - - [Discovery](#kubeadm-k8s-io-v1beta2-Discovery) @@ -774,7 +766,8 @@ BootstrapTokenDiscovery is used to set the options for bootstrap token based dis string - `token` is a token used to validate cluster information fetched from the control-plane. + `token` is a token used to validate cluster information fetched from +the control-plane. @@ -782,8 +775,8 @@ BootstrapTokenDiscovery is used to set the options for bootstrap token based dis string - `apiServerEndpoint` is an IP or domain name to the API server from which -information will be fetched. + `apiServerEndpoint` is an IP or domain name to the API server from which information +will be fetched. @@ -791,12 +784,12 @@ information will be fetched. []string - discovery is used. The root CA found during discovery must match one of these -values. Specifying an empty set disables root CA pinning, which can be unsafe. -Each hash is specified as `:`, where the only currently supported -type is "sha256". This is a hex-encoded SHA-256 hash of the Subject Public Key -Info (SPKI) object in DER-encoded ASN.1. These hashes can be calculated using, -for example, OpenSSL. + `caCertHashes` specifies a set of public key pins to verify when token-based discovery +is used. The root CA found during discovery must match one of these values. +Specifying an empty set disables root CA pinning, which can be unsafe. +Each hash is specified as ":", where the only currently supported type is "sha256". +This is a hex-encoded SHA-256 hash of the Subject Public Key Info (SPKI) object in +DER-encoded ASN.1. These hashes can be calculated using, for example, OpenSSL. @@ -804,16 +797,14 @@ for example, OpenSSL. bool - `unsafeSkipCAVerification` allows token-based discovery without CA verification -via `caCertHashes`. This can weaken the security of kubeadm since other nodes -can impersonate the control-plane. + `unsafeSkipCAVerification` allows token-based discovery without CA verification via +`caCertHashes`. This can weaken the security of kubeadm since other nodes can +impersonate the control-plane. - - ## `BootstrapTokenString` {#kubeadm-k8s-io-v1beta2-BootstrapTokenString} @@ -821,7 +812,6 @@ can impersonate the control-plane. **Appears in:** - - [BootstrapToken](#kubeadm-k8s-io-v1beta2-BootstrapToken) @@ -856,8 +846,6 @@ of view and as an authentication method for the node in the bootstrap phase of - - ## `ControlPlaneComponent` {#kubeadm-k8s-io-v1beta2-ControlPlaneComponent} @@ -865,9 +853,7 @@ of view and as an authentication method for the node in the bootstrap phase of **Appears in:** - - [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) - - [APIServer](#kubeadm-k8s-io-v1beta2-APIServer) @@ -883,7 +869,9 @@ ControlPlaneComponent holds settings common to control plane component of the cl map[string]string - `extraArgs` is an extra set of flags to pass to the control plane component. + `extraArgs` is an extra set of flags to pass to a control plane component. +A key in this map is the flag name as it appears on the command line except +without leading dash(es). @@ -891,14 +879,13 @@ ControlPlaneComponent holds settings common to control plane component of the cl []HostPathMount - `extraVolumes` is an extra set of host volumes, mounted to the control plane component. + `extraVolumes` is an extra set of host volumes mounted to the control plane +component. - - ## `DNS` {#kubeadm-k8s-io-v1beta2-DNS} @@ -906,7 +893,6 @@ ControlPlaneComponent holds settings common to control plane component of the cl **Appears in:** - - [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) @@ -922,7 +908,7 @@ DNS defines the DNS addon that should be used in the cluster DNSAddOnType - `type` defines the DNS add-on to use. + `type` defines the DNS add-on to be used. @@ -930,14 +916,12 @@ DNS defines the DNS addon that should be used in the cluster ImageMeta (Members of ImageMeta are embedded into this type.) - `imageMeta` allows to customize the image used for the DNS. + ImageMeta allows to customize the image used for the DNS component - - ## `DNSAddOnType` {#kubeadm-k8s-io-v1beta2-DNSAddOnType} @@ -945,15 +929,12 @@ DNS defines the DNS addon that should be used in the cluster **Appears in:** - - [DNS](#kubeadm-k8s-io-v1beta2-DNS) -DNSAddOnType defines string identifying DNS add-on types +DNSAddOnType defines string identifying DNS add-on types. - - ## `Discovery` {#kubeadm-k8s-io-v1beta2-Discovery} @@ -961,7 +942,6 @@ DNSAddOnType defines string identifying DNS add-on types **Appears in:** - - [JoinConfiguration](#kubeadm-k8s-io-v1beta2-JoinConfiguration) @@ -986,7 +966,8 @@ Discovery specifies the options for the kubelet to use during the TLS Bootstrap FileDiscovery - `file` specifies a file or URL to a kubeconfig file from which to load cluster information. + `file` is used to specify a file or URL to a kubeconfig file from which to load +cluster information. `bootstrapToken` and `file` are mutually exclusive. @@ -996,10 +977,10 @@ Discovery specifies the options for the kubelet to use during the TLS Bootstrap `tlsBootstrapToken` is a token used for TLS bootstrapping. -If `bootstrapToken` is set, this field is defaulted to `bootstrapToken.token`, +If `bootstrapToken` is set, this field is defaulted to `.bootstrapToken.token, but can be overridden. -If `file` is set, this field ∗∗must be set∗∗ in case the KubeConfigFile does -not contain any other authentication information +If `file` is set, this field ∗∗must be set∗∗ in case the KubeConfigFile does not +contain any other authentication information. @@ -1013,8 +994,6 @@ not contain any other authentication information - - ## `Etcd` {#kubeadm-k8s-io-v1beta2-Etcd} @@ -1022,7 +1001,6 @@ not contain any other authentication information **Appears in:** - - [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) @@ -1054,8 +1032,6 @@ Etcd contains elements describing Etcd configuration. - - ## `ExternalEtcd` {#kubeadm-k8s-io-v1beta2-ExternalEtcd} @@ -1063,7 +1039,6 @@ Etcd contains elements describing Etcd configuration. **Appears in:** - - [Etcd](#kubeadm-k8s-io-v1beta2-Etcd) @@ -1080,7 +1055,7 @@ Kubeadm has no knowledge of where certificate files live and they must be suppli []string - `endpoints` are endpoints of etcd members. This field is required. + `endpoints` of etcd members. @@ -1088,7 +1063,7 @@ Kubeadm has no knowledge of where certificate files live and they must be suppli string - `caFile` is an SSL Certificate Authority file used to secure etcd communication. + `caFile` is an SSL Certificate Authority (CA) file used to secure etcd communication. Required if using a TLS connection. @@ -1113,8 +1088,6 @@ Required if using a TLS connection. - - ## `FileDiscovery` {#kubeadm-k8s-io-v1beta2-FileDiscovery} @@ -1122,7 +1095,6 @@ Required if using a TLS connection. **Appears in:** - - [Discovery](#kubeadm-k8s-io-v1beta2-Discovery) @@ -1138,15 +1110,13 @@ FileDiscovery is used to specify a file or URL to a kubeconfig file from which t string - `kubeConfigPath` specifies the actual file path or URL to the kubeconfig file -from which to load cluster information + `kubeConfigPath` is used to specify the actual file path or URL to the kubeconfig file +from which to load cluster information. - - ## `HostPathMount` {#kubeadm-k8s-io-v1beta2-HostPathMount} @@ -1154,7 +1124,6 @@ from which to load cluster information **Appears in:** - - [ControlPlaneComponent](#kubeadm-k8s-io-v1beta2-ControlPlaneComponent) @@ -1170,7 +1139,7 @@ HostPathMount contains elements describing volumes that are mounted from the hos string - `name` is the volume name inside the Pod template. + `name` of the volume inside the Pod template. @@ -1186,7 +1155,7 @@ HostPathMount contains elements describing volumes that are mounted from the hos string - `mountPath` is the path inside the Pod where the `hostPath` volume is mounted. + `mountPath`is the path inside the Pod where hostPath volume will be mounted. @@ -1199,17 +1168,15 @@ HostPathMount contains elements describing volumes that are mounted from the hos pathType [Required]
-core/v1.HostPathType +core/v1.HostPathType - `pathType` is the type of the `hostPath` volume. + `pathType` is the type of the HostPath. - - ## `ImageMeta` {#kubeadm-k8s-io-v1beta2-ImageMeta} @@ -1217,9 +1184,7 @@ HostPathMount contains elements describing volumes that are mounted from the hos **Appears in:** - - [DNS](#kubeadm-k8s-io-v1beta2-DNS) - - [LocalEtcd](#kubeadm-k8s-io-v1beta2-LocalEtcd) @@ -1236,8 +1201,8 @@ originated from the Kubernetes/Kubernetes release process string - `imageRepository` sets the container registry to pull images from. -If not set, the ImageRepository defined in ClusterConfiguration will be used instead. + `mageRepository` sets the container registry to pull images from. +If not set, the `imageRepository` defined in ClusterConfiguration will be used. @@ -1245,7 +1210,7 @@ If not set, the ImageRepository defined in ClusterConfiguration will be used ins string - `imageTag` allows to specify a tag for the image. + `imageTag` allows for specifying a tag for the image. In case this value is set, kubeadm does not change automatically the version of the above components during upgrades. @@ -1253,8 +1218,6 @@ version of the above components during upgrades. - - ## `JoinControlPlane` {#kubeadm-k8s-io-v1beta2-JoinControlPlane} @@ -1262,11 +1225,11 @@ version of the above components during upgrades. **Appears in:** - - [JoinConfiguration](#kubeadm-k8s-io-v1beta2-JoinConfiguration) -JoinControlPlane contains elements describing an additional control plane instance to be deployed on the joining node. +JoinControlPlane contains elements describing an additional control plane instance +to be deployed on the joining node. @@ -1278,8 +1241,8 @@ JoinControlPlane contains elements describing an additional control plane instan APIEndpoint + `localAPIEndpoint` represents the endpoint of the API server instance +to be deployed on this node. @@ -1287,16 +1250,14 @@ on this node.string + `certificateKey` is the key that is used for decryption of certificates after +they are downloaded from the secret upon joining a new control plane node. +The corresponding encryption key is in the InitConfiguration.
FieldDescription
- `localAPIEndpoint` represents the endpoint of the API server instance to be deployed -on this node.
- `certificateKey` is the key that is used for decryption of certificates after they -are downloaded from the secret upon joining a new control plane node. The -corresponding encryption key is in the InitConfiguration.
- - ## `LocalEtcd` {#kubeadm-k8s-io-v1beta2-LocalEtcd} @@ -1304,11 +1265,10 @@ corresponding encryption key is in the InitConfiguration. **Appears in:** - - [Etcd](#kubeadm-k8s-io-v1beta2-Etcd) -LocalEtcd describes that kubeadm should run an etcd cluster locally +LocalEtcd describes that kubeadm should run an etcd cluster locally. @@ -1320,7 +1280,7 @@ LocalEtcd describes that kubeadm should run an etcd cluster locally ImageMeta + ImageMeta allows to customize the container used for etcd. @@ -1337,8 +1297,10 @@ Defaults to "/var/lib/etcd".map[string]string + `extraArgs` are extra arguments provided to the etcd binary when run +inside a static pod. +A key in this map is the flag name as it appears on the +command line except without leading dash(es). @@ -1346,7 +1308,8 @@ when run inside a static pod.[]string + `serverCertSANs` sets extra Subject Alternative Names (SANs) for the +etcd server signing certificate. @@ -1354,14 +1317,13 @@ when run inside a static pod.[]string + `peerCertSANs` sets extra Subject Alternative Names (SANs) for the +etcd peer signing certificate.
FieldDescription
(Members of ImageMeta are embedded into this type.) - `ImageMeta` allows to customize the container used for etcd.
- `extraArgs` are extra arguments provided to the etcd binary -when run inside a static pod.
- `serverCertSANs` sets extra Subject Alternative Names for the etcd server signing cert.
- `peerCertSANs` sets extra Subject Alternative Names for the etcd peer signing cert.
- - ## `Networking` {#kubeadm-k8s-io-v1beta2-Networking} @@ -1369,7 +1331,6 @@ when run inside a static pod. **Appears in:** - - [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) @@ -1385,7 +1346,7 @@ Networking contains elements describing cluster's networking configuration string - `serviceSubnet` is the subnet used by k8s services. Defaults to "10.96.0.0/12". + `serviceSubnet` is the subnet used by kubernetes Services. Defaults to "10.96.0.0/12". @@ -1401,14 +1362,12 @@ Networking contains elements describing cluster's networking configuration string - `dnsDomain` is the DNS domain used by k8s services. Defaults to "cluster.local". + `dnsDomain` is the DNS domain used by kubernetes Services. Defaults to "cluster.local". - - ## `NodeRegistrationOptions` {#kubeadm-k8s-io-v1beta2-NodeRegistrationOptions} @@ -1416,13 +1375,12 @@ Networking contains elements describing cluster's networking configuration **Appears in:** - - [InitConfiguration](#kubeadm-k8s-io-v1beta2-InitConfiguration) - - [JoinConfiguration](#kubeadm-k8s-io-v1beta2-JoinConfiguration) -NodeRegistrationOptions holds fields that relate to registering a new control-plane or node to the cluster, either via "kubeadm init" or "kubeadm join" +NodeRegistrationOptions holds fields that relate to registering a new control-plane +or node to the cluster, either via "kubeadm init" or "kubeadm join". @@ -1434,10 +1392,11 @@ NodeRegistrationOptions holds fields that relate to registering a new control-pl string + `name` is the `.Metadata.Name` field of the Node API object that will be created +in this `kubeadm init` or `kubeadm join` operation. +This field is also used in the `CommonName` field of the kubelet's client certificate +to the API server. +Defaults to the hostname of the node if not provided. @@ -1445,20 +1404,20 @@ API server. Defaults to the hostname of the node if not provided.string + `criSocket is used to retrieve container runtime information. This information will +be annotated to the Node API object, for later re-use. + `taints` specifies the taints the Node API object should be registered with. +If this field is unset, i.e. nil, in the `kubeadm init` process it will be defaulted to +`'node-role.kubernetes.io/master=""'`. If you don't want to taint your control-plane node, +set this field to an empty list, i.e. `taints: []` in the YAML file. This field is +solely used for Node registration. @@ -1466,11 +1425,13 @@ file. This field is solely used for Node registration.map[string]string + `kubeletExtraArgs` passes through extra arguments to the kubelet. The arguments here are +passed to the kubelet command line via the environment file kubeadm writes at runtime for +the kubelet to source. This overrides the generic base-level configuration in the +'kubelet-config-1.X' ConfigMap. +Flags have higher priority when parsing. These values are local and specific to the node +kubeadm is executing on. +A key in this map is the flag name as it appears on the command line except without leading dash(es). @@ -1478,12 +1439,11 @@ parsing. These values are local and specific to the node kubeadm is executing on []string + `ignorePreflightErrors` provides a list of pre-flight errors to be ignored when the +current node is registered.
FieldDescription
- `name` is the `.metadata.name` field of the Node API object that will be created in this -`kubeadm init` or `kubeadm join` operation. -This field is also used in the CommonName field of the kubelet's client certificate to the -API server. Defaults to the hostname of the node if not provided.
- `criSocket` is used to retrieve container runtime info. This information will be -annotated to the Node API object, for later re-use.
taints [Required]
-[]core/v1.Taint +[]core/v1.Taint 		- `taints` specifies the taints the Node API object should be registered with. If -this field is unset, i.e. nil, in the `kubeadm init` process, it will be defaulted -to `['"node-role.kubernetes.io/master"=""']`. If you don't want to taint your -control-plane node, set this field to an empty list, i.e. `taints: []` in the YAML -file. This field is solely used for Node registration.
- `kubeletExtraArgs` passes through extra arguments to the kubelet. The arguments here -are passed to the kubelet command line via the environment file kubeadm writes at -runtime for the kubelet to source. This overrides the generic base-level -configuration in the "kubelet-config-1.X" ConfigMap. Flags have higher priority when -parsing. These values are local and specific to the node kubeadm is executing on.
- `ignorePreflightErrors` provides a slice of pre-flight errors to be ignored when -the current node is registered.
- diff --git a/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md b/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md index 602f646e84..024a4a6f0a 100644 --- a/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md +++ b/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md @@ -163,6 +163,7 @@ for kubelet official documentation. Here is a fully populated example of a single YAML file containing multiple configuration types to be used during a `kubeadm init` run. +```yaml apiVersion: kubeadm.k8s.io/v1beta3 kind: InitConfiguration bootstrapTokens: @@ -264,6 +265,7 @@ kind: KubeletConfiguration apiVersion: kubeproxy.config.k8s.io/v1alpha1 kind: KubeProxyConfiguration # kube-proxy specific options here +``` ## Kubeadm join configuration types @@ -289,12 +291,10 @@ to the node where kubeadm is executed, including: - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) -- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) - [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) - ## `ClusterConfiguration` {#kubeadm-k8s-io-v1beta3-ClusterConfiguration} @@ -317,7 +317,7 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster Etcd - Etcd holds configuration for etcd. + `etcd` holds the configuration for etcd. @@ -325,7 +325,7 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster Networking - Networking holds configuration for the networking topology of the cluster. + `networking` holds configuration for the networking topology of the cluster. @@ -333,7 +333,7 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster string - KubernetesVersion is the target version of the control plane. + `kubernetesVersion` is the target version of the control plane. @@ -341,17 +341,18 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster string - ControlPlaneEndpoint sets a stable IP address or DNS name for the control plane; it -can be a valid IP address or a RFC-1123 DNS subdomain, both with optional TCP port. -In case the ControlPlaneEndpoint is not specified, the AdvertiseAddress + BindPort -are used; in case the ControlPlaneEndpoint is specified but without a TCP port, -the BindPort is used. + `controlPlaneEndpoint` sets a stable IP address or DNS name for the control plane. +It can be a valid IP address or a RFC-1123 DNS subdomain, both with optional TCP port. +In case the `controlPlaneEndpoint` is not specified, the `advertiseAddress` + `bindPort` +are used; in case the `controlPlaneEndpoint` is specified but without a TCP port, +the `bindPort` is used. Possible usages are: -e.g. In a cluster with more than one control plane instances, this field should be -assigned the address of the external load balancer in front of the -control plane instances. -e.g. in environments with enforced node recycling, the ControlPlaneEndpoint -could be used for assigning a stable DNS to the control plane. + +- In a cluster with more than one control plane instances, this field should be + assigned the address of the external load balancer in front of the + control plane instances. +- In environments with enforced node recycling, the `controlPlaneEndpoint` could + be used for assigning a stable DNS to the control plane. @@ -359,7 +360,7 @@ could be used for assigning a stable DNS to the control plane. APIServer - APIServer contains extra settings for the API server control plane component + `apiServer` contains extra settings for the API server. @@ -367,7 +368,7 @@ could be used for assigning a stable DNS to the control plane. ControlPlaneComponent - ControllerManager contains extra settings for the controller manager control plane component + `controllerManager` contains extra settings for the controller manager. @@ -375,7 +376,7 @@ could be used for assigning a stable DNS to the control plane. ControlPlaneComponent - Scheduler contains extra settings for the scheduler control plane component + `scheduler` contains extra settings for the scheduler. @@ -383,7 +384,7 @@ could be used for assigning a stable DNS to the control plane. DNS - DNS defines the options for the DNS add-on installed in the cluster. + `dns` defines the options for the DNS add-on installed in the cluster. @@ -391,7 +392,7 @@ could be used for assigning a stable DNS to the control plane. string - CertificatesDir specifies where to store or look for all required certificates. + `certificatesDir` specifies where to store or look for all required certificates. @@ -399,10 +400,11 @@ could be used for assigning a stable DNS to the control plane. string - ImageRepository sets the container registry to pull images from. -If empty, `k8s.gcr.io` will be used by default; in case of kubernetes version is a CI build (kubernetes version starts with `ci/`) -`gcr.io/k8s-staging-ci-images` will be used as a default for control plane components and for kube-proxy, while `k8s.gcr.io` -will be used for all the other images. + `imageRepository` sets the container registry to pull images from. +If empty, `k8s.gcr.io` will be used by default. +In case of kubernetes version is a CI build (kubernetes version starts with `ci/`) +`gcr.io/k8s-staging-ci-images` will be used as a default for control plane components +and for kube-proxy, while `k8s.gcr.io` will be used for all the other images. @@ -410,7 +412,7 @@ will be used for all the other images. map[string]bool - FeatureGates enabled by the user. + `featureGates` contains the feature gates enabled by the user. @@ -418,96 +420,12 @@ will be used for all the other images. string - The cluster name + The cluster name. - - - -## `InitConfiguration` {#kubeadm-k8s-io-v1beta3-InitConfiguration} - - - - - -InitConfiguration contains a list of elements that is specific "kubeadm init"-only runtime -information. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
apiVersion
string		kubeadm.k8s.io/v1beta3
kind
string		InitConfiguration
bootstrapTokens
-[]BootstrapToken -		 - BootstrapTokens is respected at `kubeadm init` time and describes a set of Bootstrap Tokens to create. -This information IS NOT uploaded to the kubeadm cluster configmap, partly because of its sensitive nature
nodeRegistration
-NodeRegistrationOptions -		 - NodeRegistration holds fields that relate to registering the new control-plane node to the cluster
localAPIEndpoint
-APIEndpoint -		 - LocalAPIEndpoint represents the endpoint of the API server instance that's deployed on this control plane node -In HA setups, this differs from ClusterConfiguration.ControlPlaneEndpoint in the sense that ControlPlaneEndpoint -is the global endpoint for the cluster, which then loadbalances the requests to each individual API server. This -configuration object lets you customize what IP/DNS name and port the local API server advertises it's accessible -on. By default, kubeadm tries to auto-detect the IP of the default interface and use that, but in case that process -fails you may set the desired value here.
certificateKey
-string -		 - CertificateKey sets the key with which certificates and keys are encrypted prior to being uploaded in -a secret in the cluster during the uploadcerts init phase.
skipPhases
-[]string -		 - SkipPhases is a list of phases to skip during command execution. -The list of phases can be obtained with the "kubeadm init --help" command. -The flag "--skip-phases" takes precedence over this field.
patches
-Patches -		 - Patches contains options related to applying patches to components deployed by kubeadm during -"kubeadm init".
- - ## `JoinConfiguration` {#kubeadm-k8s-io-v1beta3-JoinConfiguration} @@ -531,7 +449,8 @@ JoinConfiguration contains elements describing a particular node. NodeRegistrationOptions - NodeRegistration holds fields that relate to registering the new control-plane node to the cluster + `nodeRegistration` holds fields that relate to registering the new +control-plane node to the cluster. @@ -539,8 +458,8 @@ JoinConfiguration contains elements describing a particular node. string - CACertPath is the path to the SSL certificate authority used to -secure comunications between node and control-plane. + `caCertPath` is the path to the SSL certificate authority used to secure +comunications between a node and the control-plane. Defaults to "/etc/kubernetes/pki/ca.crt". @@ -549,7 +468,8 @@ Defaults to "/etc/kubernetes/pki/ca.crt". Discovery - Discovery specifies the options for the kubelet to use during the TLS Bootstrap process + `discovery` specifies the options for the kubelet to use during the TLS +bootstrap process. @@ -557,8 +477,8 @@ Defaults to "/etc/kubernetes/pki/ca.crt". JoinControlPlane - ControlPlane defines the additional control plane instance to be deployed on the joining node. -If nil, no additional control plane instance will be deployed. + `controlPlane` defines the additional control plane instance to be deployed +on the joining node. If nil, no additional control plane instance will be deployed. @@ -566,9 +486,9 @@ If nil, no additional control plane instance will be deployed. []string - SkipPhases is a list of phases to skip during command execution. -The list of phases can be obtained with the "kubeadm join --help" command. -The flag "--skip-phases" takes precedence over this field. + `skipPhases` is a list of phases to skip during command execution. +The list of phases can be obtained with the `kubeadm join --help` command. +The flag `--skip-phases` takes precedence over this field. @@ -576,15 +496,13 @@ The flag "--skip-phases" takes precedence over this field. Patches - Patches contains options related to applying patches to components deployed by kubeadm during -"kubeadm join". + `patches` contains options related to applying patches to components deployed +by kubeadm during `kubeadm join`. - - ## `APIEndpoint` {#kubeadm-k8s-io-v1beta3-APIEndpoint} @@ -592,9 +510,6 @@ The flag "--skip-phases" takes precedence over this field. **Appears in:** - -- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) - - [JoinControlPlane](#kubeadm-k8s-io-v1beta3-JoinControlPlane) @@ -610,7 +525,7 @@ APIEndpoint struct contains elements of API server instance deployed on a node. string - AdvertiseAddress sets the IP address for the API server to advertise. + `advertiseAddress` sets the IP address for the API server to advertise. @@ -618,15 +533,13 @@ APIEndpoint struct contains elements of API server instance deployed on a node. int32 - BindPort sets the secure port for the API Server to bind to. + `bindPorti` sets the secure port for the API Server to bind to. Defaults to 6443. - - ## `APIServer` {#kubeadm-k8s-io-v1beta3-APIServer} @@ -634,7 +547,6 @@ Defaults to 6443. **Appears in:** - - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) @@ -659,7 +571,8 @@ APIServer holds settings necessary for API server deployments in the cluster []string - CertSANs sets extra Subject Alternative Names for the API Server signing cert. + `certSANs` sets extra Subject Alternative Names (SANs) for the API Server signing +certificate. @@ -667,14 +580,12 @@ APIServer holds settings necessary for API server deployments in the cluster meta/v1.Duration - TimeoutForControlPlane controls the timeout that we use for API server to appear + `timeoutForControlPlane` controls the timeout that we wait for API server to appear. - - ## `BootstrapTokenDiscovery` {#kubeadm-k8s-io-v1beta3-BootstrapTokenDiscovery} @@ -682,7 +593,6 @@ APIServer holds settings necessary for API server deployments in the cluster **Appears in:** - - [Discovery](#kubeadm-k8s-io-v1beta3-Discovery) @@ -698,8 +608,8 @@ BootstrapTokenDiscovery is used to set the options for bootstrap token based dis string - Token is a token used to validate cluster information -fetched from the control-plane. + `token` is a token used to validate cluster information fetched from the +control-plane. @@ -707,7 +617,8 @@ fetched from the control-plane. string - APIServerEndpoint is an IP or domain name to the API server from which info will be fetched. + `apiServerEndpoint` is an IP or domain name to the API server from which +information will be fetched. @@ -715,13 +626,12 @@ fetched from the control-plane. []string - CACertHashes specifies a set of public key pins to verify -when token-based discovery is used. The root CA found during discovery -must match one of these values. Specifying an empty set disables root CA -pinning, which can be unsafe. Each hash is specified as ":", -where the only currently supported type is "sha256". This is a hex-encoded -SHA-256 hash of the Subject Public Key Info (SPKI) object in DER-encoded -ASN.1. These hashes can be calculated using, for example, OpenSSL. + `caCertHashes` specifies a set of public key pins to verify when token-based discovery +is used. The root CA found during discovery must match one of these values. +Specifying an empty set disables root CA pinning, which can be unsafe. +Each hash is specified as ":", where the only currently supported type is +"sha256". This is a hex-encoded SHA-256 hash of the Subject Public Key Info (SPKI) +object in DER-encoded ASN.1. These hashes can be calculated using, for example, OpenSSL. @@ -729,16 +639,14 @@ ASN.1. These hashes can be calculated using, for example, OpenSSL. bool - UnsafeSkipCAVerification allows token-based discovery -without CA verification via CACertHashes. This can weaken -the security of kubeadm since other nodes can impersonate the control-plane. + `unsafeSkipCAVerification` allows token-based discovery without CA verification +via `caCertHashes`. This can weaken the security of kubeadm since other nodes can +impersonate the control-plane. - - ## `ControlPlaneComponent` {#kubeadm-k8s-io-v1beta3-ControlPlaneComponent} @@ -746,9 +654,7 @@ the security of kubeadm since other nodes can impersonate the control-plane.map[string]string - ExtraArgs is an extra set of flags to pass to the control plane component. -A key in this map is the flag name as it appears on the -command line except without leading dash(es). -TODO: This is temporary and ideally we would like to switch all components to -use ComponentConfig + ConfigMaps. + `extraArgs` is an extra set of flags to pass to the control plane component. +A key in this map is the flag name as it appears on the command line except +without leading dash(es). @@ -776,14 +680,12 @@ use ComponentConfig + ConfigMaps. []HostPathMount - ExtraVolumes is an extra set of host volumes, mounted to the control plane component. + `extraVolumes` is an extra set of host volumes, mounted to the control plane component. - - ## `DNS` {#kubeadm-k8s-io-v1beta3-DNS} @@ -791,7 +693,6 @@ use ComponentConfig + ConfigMaps. **Appears in:** - - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) @@ -807,26 +708,12 @@ DNS defines the DNS addon that should be used in the cluster ImageMeta (Members of ImageMeta are embedded into this type.) - ImageMeta allows to customize the image used for the DNS component + `imageMeta` allows to customize the image used for the DNS component. - - - -## `DNSAddOnType` {#kubeadm-k8s-io-v1beta3-DNSAddOnType} - -(Alias of `string`) - - - -DNSAddOnType defines string identifying DNS add-on types - - - - ## `Discovery` {#kubeadm-k8s-io-v1beta3-Discovery} @@ -834,11 +721,10 @@ DNSAddOnType defines string identifying DNS add-on types **Appears in:** - - [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) -Discovery specifies the options for the kubelet to use during the TLS Bootstrap process +Discovery specifies the options for the kubelet to use during the TLS Bootstrap process. @@ -850,8 +736,8 @@ Discovery specifies the options for the kubelet to use during the TLS Bootstrap BootstrapTokenDiscovery + `bootstrapToken` is used to set the options for bootstrap token based discovery. +`bootstrapToken` and `file` are mutually exclusive. @@ -859,8 +745,9 @@ BootstrapToken and File are mutually exclusiveFileDiscovery + `file` is used to specify a file or URL to a kubeconfig file from which to load +cluster information. +`bootstrapToken` and `file` are mutually exclusive. @@ -868,9 +755,10 @@ BootstrapToken and File are mutually exclusivestring + `tlsBootstrapToken` is a token used for TLS bootstrapping. +If `bootstrapToken` is set, this field is defaulted to `.bootstrapToken.token`, but +can be overridden. If `file` is set, this field ∗∗must be set∗∗ in case the KubeConfigFile +does not contain any other authentication information @@ -878,14 +766,12 @@ If .File is set, this field ∗∗must be set∗∗ in case meta/v1.Duration + `timeout` modifies the discovery timeout.
FieldDescription
- BootstrapToken is used to set the options for bootstrap token based discovery -BootstrapToken and File are mutually exclusive
- File is used to specify a file or URL to a kubeconfig file from which to load cluster information -BootstrapToken and File are mutually exclusive
- TLSBootstrapToken is a token used for TLS bootstrapping. -If .BootstrapToken is set, this field is defaulted to .BootstrapToken.Token, but can be overridden. -If .File is set, this field ∗∗must be set∗∗ in case the KubeConfigFile does not contain any other authentication information
- Timeout modifies the discovery timeout
- - ## `Etcd` {#kubeadm-k8s-io-v1beta3-Etcd} @@ -893,7 +779,6 @@ If .File is set, this field ∗∗must be set∗∗ in case **Appears in:** - - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) @@ -909,8 +794,8 @@ Etcd contains elements describing Etcd configuration. LocalEtcd - Local provides configuration knobs for configuring the local etcd instance -Local and External are mutually exclusive + `local` provides configuration knobs for configuring the local etcd instance. +`local` and `external` are mutually exclusive. @@ -918,15 +803,13 @@ Local and External are mutually exclusive ExternalEtcd - External describes how to connect to an external etcd cluster -Local and External are mutually exclusive + `external` describes how to connect to an external etcd cluster. +`local` and `external` are mutually exclusive. - - ## `ExternalEtcd` {#kubeadm-k8s-io-v1beta3-ExternalEtcd} @@ -934,7 +817,6 @@ Local and External are mutually exclusive **Appears in:** - - [Etcd](#kubeadm-k8s-io-v1beta3-Etcd) @@ -951,7 +833,7 @@ Kubeadm has no knowledge of where certificate files live and they must be suppli []string - Endpoints of etcd members. Required for ExternalEtcd. + `endpoints` contains the list of etcd members. @@ -959,7 +841,7 @@ Kubeadm has no knowledge of where certificate files live and they must be suppli string - CAFile is an SSL Certificate Authority file used to secure etcd communication. + `caFile` is an SSL Certificate Authority (CA) file used to secure etcd communication. Required if using a TLS connection. @@ -968,7 +850,7 @@ Required if using a TLS connection. string - CertFile is an SSL certification file used to secure etcd communication. + `certFile` is an SSL certification file used to secure etcd communication. Required if using a TLS connection. @@ -977,15 +859,13 @@ Required if using a TLS connection. string - KeyFile is an SSL key file used to secure etcd communication. + `keyFile` is an SSL key file used to secure etcd communication. Required if using a TLS connection. - - ## `FileDiscovery` {#kubeadm-k8s-io-v1beta3-FileDiscovery} @@ -993,11 +873,11 @@ Required if using a TLS connection. **Appears in:** - - [Discovery](#kubeadm-k8s-io-v1beta3-Discovery) -FileDiscovery is used to specify a file or URL to a kubeconfig file from which to load cluster information +FileDiscovery is used to specify a file or URL to a kubeconfig file from which to load +cluster information. @@ -1009,14 +889,13 @@ FileDiscovery is used to specify a file or URL to a kubeconfig file from which t string + `kubeConfigPath` is used to specify the actual file path or URL to the kubeconfig +file from which to load cluster information.
FieldDescription
- KubeConfigPath is used to specify the actual file path or URL to the kubeconfig file from which to load cluster information
- - ## `HostPathMount` {#kubeadm-k8s-io-v1beta3-HostPathMount} @@ -1024,12 +903,10 @@ FileDiscovery is used to specify a file or URL to a kubeconfig file from which t **Appears in:** - - [ControlPlaneComponent](#kubeadm-k8s-io-v1beta3-ControlPlaneComponent) -HostPathMount contains elements describing volumes that are mounted from the -host. +HostPathMount contains elements describing volumes that are mounted from the host. @@ -1041,7 +918,7 @@ host. string + `name` is the name of the volume inside the Pod template. @@ -1049,8 +926,7 @@ host. string + `hostPath` is the path in the host that will be mounted inside the Pod. @@ -1058,7 +934,7 @@ the pod.string + `mountPath` is the path inside the Pod where `hostPath` will be mounted. @@ -1066,22 +942,20 @@ the pod.bool + `readOnly` controls write access to the volume. + `pathType` is the type of the `hostPath`.
FieldDescription
- Name of the volume inside the pod template.
- HostPath is the path in the host that will be mounted inside -the pod.
- MountPath is the path inside the pod where hostPath will be mounted.
- ReadOnly controls write access to the volume
pathType
-core/v1.HostPathType +core/v1.HostPathType 		- PathType is the type of the HostPath.
- - ## `ImageMeta` {#kubeadm-k8s-io-v1beta3-ImageMeta} @@ -1089,9 +963,7 @@ the pod. **Appears in:** - - [DNS](#kubeadm-k8s-io-v1beta3-DNS) - - [LocalEtcd](#kubeadm-k8s-io-v1beta3-LocalEtcd) @@ -1108,8 +980,8 @@ originated from the Kubernetes/Kubernetes release process string - ImageRepository sets the container registry to pull images from. -if not set, the ImageRepository defined in ClusterConfiguration will be used instead. + `imageRepository` sets the container registry to pull images from. +If not set, the `imageRepository` defined in ClusterConfiguration will be used instead. @@ -1117,15 +989,14 @@ if not set, the ImageRepository defined in ClusterConfiguration will be used ins string - ImageTag allows to specify a tag for the image. -In case this value is set, kubeadm does not change automatically the version of the above components during upgrades. + `imageTag` allows to specify a tag for the image. +In case this value is set, kubeadm does not change automatically the version of +the above components during upgrades. - - ## `JoinControlPlane` {#kubeadm-k8s-io-v1beta3-JoinControlPlane} @@ -1133,11 +1004,11 @@ In case this value is set, kubeadm does not change automatically the version of **Appears in:** - - [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) -JoinControlPlane contains elements describing an additional control plane instance to be deployed on the joining node. +JoinControlPlane contains elements describing an additional control plane instance +to be deployed on the joining node. @@ -1149,7 +1020,8 @@ JoinControlPlane contains elements describing an additional control plane instan APIEndpoint + `localAPIEndpoint` represents the endpoint of the API server instance to be +deployed on this node. @@ -1157,15 +1029,14 @@ JoinControlPlane contains elements describing an additional control plane instan string + `certificateKey` is the key that is used for decryption of certificates after +they are downloaded from the secret upon joining a new control plane node. +The corresponding encryption key is in the InitConfiguration.
FieldDescription
- LocalAPIEndpoint represents the endpoint of the API server instance to be deployed on this node.
- CertificateKey is the key that is used for decryption of certificates after they are downloaded from the secret -upon joining a new control plane node. The corresponding encryption key is in the InitConfiguration.
- - ## `LocalEtcd` {#kubeadm-k8s-io-v1beta3-LocalEtcd} @@ -1173,7 +1044,6 @@ upon joining a new control plane node. The corresponding encryption key is in th **Appears in:** - - [Etcd](#kubeadm-k8s-io-v1beta3-Etcd) @@ -1189,7 +1059,7 @@ LocalEtcd describes that kubeadm should run an etcd cluster locally ImageMeta (Members of ImageMeta are embedded into this type.) - ImageMeta allows to customize the container used for etcd + ImageMeta allows to customize the container used for etcd. @@ -1197,7 +1067,7 @@ LocalEtcd describes that kubeadm should run an etcd cluster locally string - DataDir is the directory etcd will place its data. + `dataDir` is the directory etcd will place its data. Defaults to "/var/lib/etcd". @@ -1206,9 +1076,8 @@ Defaults to "/var/lib/etcd". map[string]string - ExtraArgs are extra arguments provided to the etcd binary -when run inside a static pod. -A key in this map is the flag name as it appears on the + `extraArgs` are extra arguments provided to the etcd binary when run +inside a static Pod. A key in this map is the flag name as it appears on the command line except without leading dash(es). @@ -1217,7 +1086,8 @@ command line except without leading dash(es). []string - ServerCertSANs sets extra Subject Alternative Names for the etcd server signing cert. + `serverCertSANs` sets extra Subject Alternative Names (SANs) for the etcd +server signing certificate. @@ -1225,14 +1095,13 @@ command line except without leading dash(es). []string - PeerCertSANs sets extra Subject Alternative Names for the etcd peer signing cert. + `peerCertSANs` sets extra Subject Alternative Names (SANs) for the etcd peer +signing certificate. - - ## `Networking` {#kubeadm-k8s-io-v1beta3-Networking} @@ -1240,7 +1109,6 @@ command line except without leading dash(es). **Appears in:** - - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) @@ -1256,7 +1124,7 @@ Networking contains elements describing cluster's networking configuration string - ServiceSubnet is the subnet used by k8s services. Defaults to "10.96.0.0/12". + `serviceSubnet` is the subnet used by Kubernetes Services. Defaults to "10.96.0.0/12". @@ -1264,7 +1132,7 @@ Networking contains elements describing cluster's networking configuration string - PodSubnet is the subnet used by pods. + `podSubnet` is the subnet used by Pods. @@ -1272,14 +1140,12 @@ Networking contains elements describing cluster's networking configuration string - DNSDomain is the dns domain used by k8s services. Defaults to "cluster.local". + `dnsDomain` is the DNS domain used by Kubernetes Services. Defaults to "cluster.local". - - ## `NodeRegistrationOptions` {#kubeadm-k8s-io-v1beta3-NodeRegistrationOptions} @@ -1287,13 +1153,11 @@ Networking contains elements describing cluster's networking configuration **Appears in:** - -- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) - - [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) -NodeRegistrationOptions holds fields that relate to registering a new control-plane or node to the cluster, either via "kubeadm init" or "kubeadm join" +NodeRegistrationOptions holds fields that relate to registering a new control-plane or +node to the cluster, either via "kubeadm init" or "kubeadm join" @@ -1305,8 +1169,10 @@ NodeRegistrationOptions holds fields that relate to registering a new control-pl string @@ -1315,17 +1181,20 @@ Defaults to the hostname of the node if not provided.string + `criSocket` is used to retrieve container runtime info. +This information will be annotated to the Node API object, for later re-use + `tains` specifies the taints the Node API object should be registered with. +If this field is unset, i.e. nil, in the `kubeadm init` process it will be defaulted to +`taints: ["node-role.kubernetes.io/master:""]`. +If you don't want to taint your control-plane node, set this field to an empty slice, +i.e. `taints: []` in the YAML file. This field is solely used for Node registration. @@ -1333,10 +1202,12 @@ empty slice, i.e. `taints: []` in the YAML file. This field is solely used for N map[string]string @@ -1345,24 +1216,25 @@ command line except without leading dash(es).[]string + `ignorePreflightErrors` provides a list of pre-flight errors to be ignored when +the current node is registered. +If this field is unset kubeadm will default it to "IfNotPresent", or pull the required +images if not present on the host.
FieldDescription
- Name is the `.Metadata.Name` field of the Node API object that will be created in this `kubeadm init` or `kubeadm join` operation. -This field is also used in the CommonName field of the kubelet's client certificate to the API server. + `name` is the `.metadata.name` field of the Node API object that will be created in this +`kubeadm init` or `kubeadm join` operation. +This field is also used in the `CommonName` field of the kubelet's client certificate to +the API server. Defaults to the hostname of the node if not provided.
- CRISocket is used to retrieve container runtime info. This information will be annotated to the Node API object, for later re-use
taints [Required]
-[]core/v1.Taint +[]core/v1.Taint 		- Taints specifies the taints the Node API object should be registered with. If this field is unset, i.e. nil, in the `kubeadm init` process -it will be defaulted to []v1.Taint{'node-role.kubernetes.io/master=""'}. If you don't want to taint your control-plane node, set this field to an -empty slice, i.e. `taints: []` in the YAML file. This field is solely used for Node registration.
- KubeletExtraArgs passes through extra arguments to the kubelet. The arguments here are passed to the kubelet command line via the environment file -kubeadm writes at runtime for the kubelet to source. This overrides the generic base-level configuration in the kubelet-config-1.X ConfigMap -Flags have higher priority when parsing. These values are local and specific to the node kubeadm is executing on. -A key in this map is the flag name as it appears on the + `kubeletExtraArgs` passes through extra arguments to the kubelet. +The arguments here are passed to the kubelet command line via the environment file +kubeadm writes at runtime for the kubelet to source. +This overrides the generic base-level configuration in the 'kubelet-config-1.X' ConfigMap. +Flags have higher priority when parsing. These values are local and specific to the node +kubeadm is executing on. A key in this map is the flag name as it appears on the command line except without leading dash(es).
- IgnorePreflightErrors provides a slice of pre-flight errors to be ignored when the current node is registered.
imagePullPolicy
-core/v1.PullPolicy +core/v1.PullPolicy 		- ImagePullPolicy specifies the policy for image pulling during kubeadm "init" and "join" operations. + `imagePullPolicy` specifies the policy for image pulling during kubeadm "init" and +"join" operations. The value of this field must be one of "Always", "IfNotPresent" or "Never". -If this field is unset kubeadm will default it to "IfNotPresent", or pull the required images if not present on the host.
- - ## `Patches` {#kubeadm-k8s-io-v1beta3-Patches} @@ -1370,9 +1242,6 @@ If this field is unset kubeadm will default it to "IfNotPresent", or pull the re **Appears in:** - -- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) - - [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) @@ -1388,10 +1257,12 @@ Patches contains options related to applying patches to components deployed by k string - Directory is a path to a directory that contains files named "target[suffix][+patchtype].extension". + `directory` is a path to a directory that contains files named +"target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of -"kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one -of "strategic" "merge" or "json" and they match the patch formats supported by kubectl. +"kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can +be one of "strategic" "merge" or "json" and they match the patch formats supported by +kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically. @@ -1400,7 +1271,6 @@ first alpha-numerically. - @@ -1412,8 +1282,6 @@ first alpha-numerically. **Appears in:** -- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) - BootstrapToken describes one bootstrap token, stored as a Secret in the cluster @@ -1451,7 +1319,7 @@ for, so other administrators can know its purpose. expires
-meta/v1.Time +meta/v1.Time `expires` specifies the timestamp when this token expires. Defaults to being set @@ -1486,7 +1354,6 @@ used for authentication **Appears in:** - - [BootstrapToken](#BootstrapToken) diff --git a/content/en/docs/reference/config-api/kubelet-config.v1alpha1.md b/content/en/docs/reference/config-api/kubelet-config.v1alpha1.md new file mode 100644 index 0000000000..ffb3d85ac2 --- /dev/null +++ b/content/en/docs/reference/config-api/kubelet-config.v1alpha1.md @@ -0,0 +1,281 @@ +--- +title: Kubelet Configuration (v1alpha1) +content_type: tool-reference +package: kubelet.config.k8s.io/v1alpha1 +auto_generated: true +--- + + +## Resource Types + + +- [CredentialProviderConfig](#kubelet-config-k8s-io-v1alpha1-CredentialProviderConfig) + + + +## `FormatOptions` {#FormatOptions} + + + + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +FormatOptions contains options for the different logging formats. + + + + + + + + + + + + + +
FieldDescription
json [Required]
+JSONOptions +		 + [Experimental] JSON contains options for logging format "json".
+ +## `JSONOptions` {#JSONOptions} + + + + +**Appears in:** + +- [FormatOptions](#FormatOptions) + + +JSONOptions contains options for logging format "json". + + + + + + + + + + + + + + + + + + +
FieldDescription
splitStream [Required]
+bool +		 + [Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering.
infoBufferSize [Required]
+k8s.io/apimachinery/pkg/api/resource.QuantityValue +		 + [Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.
+ +## `VModuleConfiguration` {#VModuleConfiguration} + +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold. + + + + + + +## `CredentialProviderConfig` {#kubelet-config-k8s-io-v1alpha1-CredentialProviderConfig} + + + + + +CredentialProviderConfig is the configuration containing information about +each exec credential provider. Kubelet reads this configuration from disk and enables +each provider as specified by the CredentialProvider type. + + + + + + + + + + + + + + + + + +
FieldDescription
apiVersion
string		kubelet.config.k8s.io/v1alpha1
kind
string		CredentialProviderConfig
providers [Required]
+[]CredentialProvider +		 + providers is a list of credential provider plugins that will be enabled by the kubelet. +Multiple providers may match against a single image, in which case credentials +from all providers will be returned to the kubelet. If multiple providers are called +for a single image, the results are combined. If providers return overlapping +auth keys, the value from the provider earlier in this list is used.
+ + + +## `CredentialProvider` {#kubelet-config-k8s-io-v1alpha1-CredentialProvider} + + + + +**Appears in:** + +- [CredentialProviderConfig](#kubelet-config-k8s-io-v1alpha1-CredentialProviderConfig) + + +CredentialProvider represents an exec plugin to be invoked by the kubelet. The plugin is only +invoked when an image being pulled matches the images handled by the plugin (see matchImages). + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
name [Required]
+string +		 + name is the required name of the credential provider. It must match the name of the +provider executable as seen by the kubelet. The executable must be in the kubelet's +bin directory (set by the --image-credential-provider-bin-dir flag).
matchImages [Required]
+[]string +		 + matchImages is a required list of strings used to match against images in order to +determine if this provider should be invoked. If one of the strings matches the +requested image from the kubelet, the plugin will be invoked and given a chance +to provide credentials. Images are expected to contain the registry domain +and URL path. + +Each entry in matchImages is a pattern which can optionally contain a port and a path. +Globs can be used in the domain, but not in the port or the path. Globs are supported +as subdomains like '∗.k8s.io' or 'k8s.∗.io', and top-level-domains such as 'k8s.∗'. +Matching partial subdomains like 'app∗.k8s.io' is also supported. Each glob can only match +a single subdomain segment, so ∗.io does not match ∗.k8s.io. + +A match exists between an image and a matchImage when all of the below are true: +- Both contain the same number of domain parts and each part matches. +- The URL path of an imageMatch must be a prefix of the target image URL path. +- If the imageMatch contains a port, then the port must match in the image as well. + +Example values of matchImages: + - 123456789.dkr.ecr.us-east-1.amazonaws.com + - ∗.azurecr.io + - gcr.io + - ∗.∗.registry.io + - registry.io:8080/path
defaultCacheDuration [Required]
+meta/v1.Duration +		 + defaultCacheDuration is the default duration the plugin will cache credentials in-memory +if a cache duration is not provided in the plugin response. This field is required.
apiVersion [Required]
+string +		 + Required input version of the exec CredentialProviderRequest. The returned CredentialProviderResponse +MUST use the same encoding version as the input. Current supported values are: +- credentialprovider.kubelet.k8s.io/v1alpha1
args
+[]string +		 + Arguments to pass to the command when executing it.
env
+[]ExecEnvVar +		 + Env defines additional environment variables to expose to the process. These +are unioned with the host's environment, as well as variables client-go uses +to pass argument to the plugin.
+ + + +## `ExecEnvVar` {#kubelet-config-k8s-io-v1alpha1-ExecEnvVar} + + + + +**Appears in:** + +- [CredentialProvider](#kubelet-config-k8s-io-v1alpha1-CredentialProvider) + + +ExecEnvVar is used for setting environment variables when executing an exec-based +credential plugin. + + + + + + + + + + + + + + + + + + +
FieldDescription
name [Required]
+string +		 + No description provided. +
value [Required]
+string +		 + No description provided. +
+ + diff --git a/content/en/docs/reference/config-api/kubelet-config.v1beta1.md b/content/en/docs/reference/config-api/kubelet-config.v1beta1.md index 619b8d70f6..c299c56470 100644 --- a/content/en/docs/reference/config-api/kubelet-config.v1beta1.md +++ b/content/en/docs/reference/config-api/kubelet-config.v1beta1.md @@ -14,6 +14,166 @@ auto_generated: true +## `FormatOptions` {#FormatOptions} + + + + +**Appears in:** +- [LoggingConfiguration](#LoggingConfiguration) + + +FormatOptions contains options for the different logging formats. + + + + + + + + + + + + + +
FieldDescription
json [Required]
+JSONOptions +		 + [Experimental] JSON contains options for logging format "json".
+ +## `JSONOptions` {#JSONOptions} + + + + +**Appears in:** +- [FormatOptions](#FormatOptions) + + +JSONOptions contains options for logging format "json". + + + + + + + + + + + + + + + + + + +
FieldDescription
splitStream [Required]
+bool +		 + [Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering.
infoBufferSize [Required]
+k8s.io/apimachinery/pkg/api/resource.QuantityValue +		 + [Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.
+ +## `LoggingConfiguration` {#LoggingConfiguration} + + + + +**Appears in:** +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +LoggingConfiguration contains logging options +Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
format [Required]
+string +		 + Format Flag specifies the structure of log messages. +default value of format is `text`
flushFrequency [Required]
+time.Duration +		 + Maximum number of seconds between log flushes. Ignored if the +selected logging backend writes log messages without buffering.
verbosity [Required]
+uint32 +		 + Verbosity is the threshold that determines which log messages are +logged. Default is zero which logs only the most important +messages. Higher values enable additional messages. Error messages +are always logged.
vmodule [Required]
+VModuleConfiguration +		 + VModule overrides the verbosity threshold for individual files. +Only supported for "text" log format.
sanitization [Required]
+bool +		 + [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). +Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
options [Required]
+FormatOptions +		 + [Experimental] Options holds additional parameters that are specific +to the different logging formats. Only the options for the selected +format get used, but all of them get validated.
+ +## `VModuleConfiguration` {#VModuleConfiguration} + +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + + +**Appears in:** +- [LoggingConfiguration](#LoggingConfiguration) + + +VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold. + + + + ## `KubeletConfiguration` {#kubelet-config-k8s-io-v1beta1-KubeletConfiguration} @@ -1517,7 +1677,7 @@ Default: 0.8 registerWithTaints
-[]core/v1.Taint +[]core/v1.Taint registerWithTaints are an array of taints to add to a node object when @@ -1538,8 +1698,6 @@ Default: true - - ## `SerializedNodeConfigSource` {#kubelet-config-k8s-io-v1beta1-SerializedNodeConfigSource} @@ -1562,7 +1720,7 @@ It exists in the kubeletconfig API group because it is classified as a versioned source
-core/v1.NodeConfigSource +core/v1.NodeConfigSource source is the source that we are serializing. @@ -1571,21 +1729,6 @@ It exists in the kubeletconfig API group because it is classified as a versioned - - - -## `HairpinMode` {#kubelet-config-k8s-io-v1beta1-HairpinMode} - -(Alias of `string`) - - - -HairpinMode denotes how the kubelet should configure networking to handle -hairpin packets. - - - - ## `KubeletAnonymousAuthentication` {#kubelet-config-k8s-io-v1beta1-KubeletAnonymousAuthentication} @@ -1593,7 +1736,6 @@ hairpin packets. **Appears in:** - - [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) @@ -1619,8 +1761,6 @@ Anonymous requests have a username of `system:anonymous`, and a group name of - - ## `KubeletAuthentication` {#kubelet-config-k8s-io-v1beta1-KubeletAuthentication} @@ -1628,7 +1768,6 @@ Anonymous requests have a username of `system:anonymous`, and a group name of **Appears in:** - - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -1666,8 +1805,6 @@ Anonymous requests have a username of `system:anonymous`, and a group name of - - ## `KubeletAuthorization` {#kubelet-config-k8s-io-v1beta1-KubeletAuthorization} @@ -1675,7 +1812,6 @@ Anonymous requests have a username of `system:anonymous`, and a group name of **Appears in:** - - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -1707,8 +1843,6 @@ Webhook mode uses the SubjectAccessReview API to determine authorization. - - ## `KubeletAuthorizationMode` {#kubelet-config-k8s-io-v1beta1-KubeletAuthorizationMode} @@ -1716,15 +1850,12 @@ Webhook mode uses the SubjectAccessReview API to determine authorization. **Appears in:** - - [KubeletAuthorization](#kubelet-config-k8s-io-v1beta1-KubeletAuthorization) - - ## `KubeletWebhookAuthentication` {#kubelet-config-k8s-io-v1beta1-KubeletWebhookAuthentication} @@ -1732,7 +1863,6 @@ Webhook mode uses the SubjectAccessReview API to determine authorization. **Appears in:** - - [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) @@ -1763,8 +1893,6 @@ tokenreviews.authentication.k8s.io API. - - ## `KubeletWebhookAuthorization` {#kubelet-config-k8s-io-v1beta1-KubeletWebhookAuthorization} @@ -1772,7 +1900,6 @@ tokenreviews.authentication.k8s.io API. **Appears in:** - - [KubeletAuthorization](#kubelet-config-k8s-io-v1beta1-KubeletAuthorization) @@ -1804,8 +1931,6 @@ the webhook authorizer. - - ## `KubeletX509Authentication` {#kubelet-config-k8s-io-v1beta1-KubeletX509Authentication} @@ -1813,7 +1938,6 @@ the webhook authorizer. **Appears in:** - - [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) @@ -1838,8 +1962,6 @@ and groups corresponding to the Organization in the client certificate. - - ## `MemoryReservation` {#kubelet-config-k8s-io-v1beta1-MemoryReservation} @@ -1847,7 +1969,6 @@ and groups corresponding to the Organization in the client certificate. **Appears in:** - - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -1869,7 +1990,7 @@ MemoryReservation specifies the memory reservation of different types for each N limits [Required]
-core/v1.ResourceList +core/v1.ResourceList No description provided. @@ -1879,8 +2000,6 @@ MemoryReservation specifies the memory reservation of different types for each N - - ## `MemorySwapConfiguration` {#kubelet-config-k8s-io-v1beta1-MemorySwapConfiguration} @@ -1888,7 +2007,6 @@ MemoryReservation specifies the memory reservation of different types for each N **Appears in:** - - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -1912,8 +2030,6 @@ MemoryReservation specifies the memory reservation of different types for each N - - ## `ResourceChangeDetectionStrategy` {#kubelet-config-k8s-io-v1beta1-ResourceChangeDetectionStrategy} @@ -1921,7 +2037,6 @@ MemoryReservation specifies the memory reservation of different types for each N **Appears in:** - - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -1929,8 +2044,6 @@ ResourceChangeDetectionStrategy denotes a mode in which internal managers (secret, configmap) are discovering object changes. - - ## `ShutdownGracePeriodByPodPriority` {#kubelet-config-k8s-io-v1beta1-ShutdownGracePeriodByPodPriority} @@ -1938,7 +2051,6 @@ managers (secret, configmap) are discovering object changes. **Appears in:** - - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -1968,170 +2080,4 @@ ShutdownGracePeriodByPodPriority specifies the shutdown grace period for Pods ba - - - - -## `FormatOptions` {#FormatOptions} - - - - -**Appears in:** - -- [LoggingConfiguration](#LoggingConfiguration) - - -FormatOptions contains options for the different logging formats. - - - - - - - - - - - - - -
FieldDescription
json [Required]
-JSONOptions -		 - [Experimental] JSON contains options for logging format "json".
- -## `JSONOptions` {#JSONOptions} - - - - -**Appears in:** - -- [FormatOptions](#FormatOptions) - - -JSONOptions contains options for logging format "json". - - - - - - - - - - - - - - - - - - -
FieldDescription
splitStream [Required]
-bool -		 - [Experimental] SplitStream redirects error messages to stderr while -info messages go to stdout, with buffering. The default is to write -both to stdout, without buffering.
infoBufferSize [Required]
-k8s.io/apimachinery/pkg/api/resource.QuantityValue -		 - [Experimental] InfoBufferSize sets the size of the info stream when -using split streams. The default is zero, which disables buffering.
- -## `LoggingConfiguration` {#LoggingConfiguration} - - - - -**Appears in:** - -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - - -LoggingConfiguration contains logging options -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
format [Required]
-string -		 - Format Flag specifies the structure of log messages. -default value of format is `text`
flushFrequency [Required]
-time.Duration -		 - Maximum number of seconds between log flushes. Ignored if the -selected logging backend writes log messages without buffering.
verbosity [Required]
-uint32 -		 - Verbosity is the threshold that determines which log messages are -logged. Default is zero which logs only the most important -messages. Higher values enable additional messages. Error messages -are always logged.
vmodule [Required]
-VModuleConfiguration -		 - VModule overrides the verbosity threshold for individual files. -Only supported for "text" log format.
sanitization [Required]
-bool -		 - [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). -Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
options [Required]
-FormatOptions -		 - [Experimental] Options holds additional parameters that are specific -to the different logging formats. Only the options for the selected -format get used, but all of them get validated.
- -## `VModuleConfiguration` {#VModuleConfiguration} - -(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) - - -**Appears in:** - -- [LoggingConfiguration](#LoggingConfiguration) - - -VModuleConfiguration is a collection of individual file names or patterns -and the corresponding verbosity threshold. - - diff --git a/content/en/docs/reference/scheduling/policies.md b/content/en/docs/reference/scheduling/policies.md index 13cc13845c..5a28b41769 100644 --- a/content/en/docs/reference/scheduling/policies.md +++ b/content/en/docs/reference/scheduling/policies.md @@ -17,4 +17,4 @@ This scheduling policy is not supported since Kubernetes v1.23. Associated flags * Learn about [scheduling](/docs/concepts/scheduling-eviction/kube-scheduler/) * Learn about [kube-scheduler Configuration](/docs/reference/scheduling/config/) * Read the [kube-scheduler configuration reference (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) -* Read the [kube-scheduler Policy reference (v1)](/docs/reference/config-api/kube-scheduler-policy-config.v1/) + diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md index b7f3e05a8b..0700538f56 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md @@ -55,7 +55,7 @@ kubeadm config images list [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
IPv6DualStack=true|false (BETA - default=true)
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UnversionedKubeletConfigMap=true|false (ALPHA - default=false)

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md index a44970a68a..7423ad1934 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md @@ -48,7 +48,7 @@ kubeadm config images pull [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
IPv6DualStack=true|false (BETA - default=true)
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UnversionedKubeletConfigMap=true|false (ALPHA - default=false)

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md index 62f4ca7e5b..f71e83cf1b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md @@ -138,7 +138,7 @@ kubeadm init [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
IPv6DualStack=true|false (BETA - default=true)
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UnversionedKubeletConfigMap=true|false (ALPHA - default=false)

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md index c30d45980c..198aee2657 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md @@ -62,7 +62,7 @@ kubeadm init phase addon all [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
IPv6DualStack=true|false (BETA - default=true)
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UnversionedKubeletConfigMap=true|false (ALPHA - default=false)

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md index 3e4076a862..8b07e647da 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md @@ -41,7 +41,7 @@ kubeadm init phase addon coredns [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
IPv6DualStack=true|false (BETA - default=true)
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UnversionedKubeletConfigMap=true|false (ALPHA - default=false)

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md index 6a53512cc4..c5b6ce6dba 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md @@ -101,7 +101,7 @@ kubeadm init phase control-plane all [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
IPv6DualStack=true|false (BETA - default=true)
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UnversionedKubeletConfigMap=true|false (ALPHA - default=false)

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md index b46d5ea7c8..4f589f3dbd 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md @@ -83,7 +83,7 @@ kubeadm init phase control-plane apiserver [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
IPv6DualStack=true|false (BETA - default=true)
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UnversionedKubeletConfigMap=true|false (ALPHA - default=false)

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md index 145f0bc340..b40539a17e 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md @@ -157,6 +157,13 @@ kubeadm join [api-server-endpoint] [flags]

For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

+ +--dry-run + + +

Don't apply any changes; just output what would be done.

+ + -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md index 19bdbb417a..e5cffa35f8 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md @@ -19,10 +19,9 @@ Performs a best effort revert of changes made to this host by 'kubeadm init' or The "reset" command executes the following phases: ``` -preflight Run reset pre-flight checks -update-cluster-status Remove this node from the ClusterStatus object (DEPRECATED). -remove-etcd-member Remove a local etcd member. -cleanup-node Run cleanup node. +preflight Run reset pre-flight checks +remove-etcd-member Remove a local etcd member. +cleanup-node Run cleanup node. ``` diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md index 3add5a98c2..9fd720662e 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md @@ -76,7 +76,7 @@ kubeadm upgrade apply [version] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
IPv6DualStack=true|false (BETA - default=true)
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UnversionedKubeletConfigMap=true|false (ALPHA - default=false)

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md index c3cc133169..d592249f76 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md @@ -55,7 +55,7 @@ kubeadm upgrade plan [version] [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
IPv6DualStack=true|false (BETA - default=true)
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
PublicKeysECDSA=true|false (ALPHA - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UnversionedKubeletConfigMap=true|false (ALPHA - default=false)

diff --git a/content/en/docs/reference/using-api/client-libraries.md b/content/en/docs/reference/using-api/client-libraries.md index 93f9d88c94..8647198fe9 100644 --- a/content/en/docs/reference/using-api/client-libraries.md +++ b/content/en/docs/reference/using-api/client-libraries.md @@ -67,6 +67,7 @@ their authors, not the Kubernetes team. | PHP | [github.com/travisghansen/kubernetes-client-php](https://github.com/travisghansen/kubernetes-client-php) | | PHP | [github.com/renoki-co/php-k8s](https://github.com/renoki-co/php-k8s) | | Python | [github.com/fiaas/k8s](https://github.com/fiaas/k8s) | +| Python | [github.com/gtsystem/lightkube](https://github.com/gtsystem/lightkube) | | Python | [github.com/mnubo/kubernetes-py](https://github.com/mnubo/kubernetes-py) | | Python | [github.com/tomplus/kubernetes_asyncio](https://github.com/tomplus/kubernetes_asyncio) | | Python | [github.com/Frankkkkk/pykorm](https://github.com/Frankkkkk/pykorm) | diff --git a/content/en/docs/reference/using-api/deprecation-guide.md b/content/en/docs/reference/using-api/deprecation-guide.md index 0de8345d10..e34f81c757 100644 --- a/content/en/docs/reference/using-api/deprecation-guide.md +++ b/content/en/docs/reference/using-api/deprecation-guide.md @@ -24,6 +24,14 @@ deprecated API versions to newer and more stable API versions. The **v1.26** release will stop serving the following deprecated API versions: +#### Flow control resources {#flowcontrol-resources-v126} + +The **flowcontrol.apiserver.k8s.io/v1beta1** API version of FlowSchema and PriorityLevelConfiguration will no longer be served in v1.26. + +* Migrate manifests and API clients to use the **flowcontrol.apiserver.k8s.io/v1beta2** API version, available since v1.23. +* All existing persisted objects are accessible via the new API +* No notable changes + #### HorizontalPodAutoscaler {#horizontalpodautoscaler-v126} The **autoscaling/v2beta2** API version of HorizontalPodAutoscaler will no longer be served in v1.26. diff --git a/content/en/docs/setup/best-practices/certificates.md b/content/en/docs/setup/best-practices/certificates.md index defa8b59f6..56ecb7f544 100644 --- a/content/en/docs/setup/best-practices/certificates.md +++ b/content/en/docs/setup/best-practices/certificates.md @@ -77,7 +77,7 @@ Required certificates: | Default CN | Parent CA | O (in Subject) | kind | hosts (SAN) | |-------------------------------|---------------------------|----------------|----------------------------------------|---------------------------------------------| -| kube-etcd | etcd-ca | | server, client | `localhost`, `127.0.0.1` | +| kube-etcd | etcd-ca | | server, client | ``, ``, `localhost`, `127.0.0.1` | | kube-etcd-peer | etcd-ca | | server, client | ``, ``, `localhost`, `127.0.0.1` | | kube-etcd-healthcheck-client | etcd-ca | | client | | | kube-apiserver-etcd-client | etcd-ca | system:masters | client | | diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md b/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md index ffd5839c23..9a448caed5 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md @@ -43,7 +43,9 @@ similar to the following example: kubeadm init --pod-network-cidr=10.244.0.0/16,2001:db8:42:0::/56 --service-cidr=10.96.0.0/16,2001:db8:42:1::/112 ``` -To make things clearer, here is an example kubeadm [configuration file](https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3) `kubeadm-config.yaml` for the primary dual-stack control plane node. +To make things clearer, here is an example kubeadm +[configuration file](/docs/reference/config-api/kubeadm-config.v1beta3/) +`kubeadm-config.yaml` for the primary dual-stack control plane node. ```yaml --- @@ -81,7 +83,8 @@ The `--apiserver-advertise-address` flag does not support dual-stack. Before joining a node, make sure that the node has IPv6 routable network interface and allows IPv6 forwarding. -Here is an example kubeadm [configuration file](https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3) `kubeadm-config.yaml` for joining a worker node to the cluster. +Here is an example kubeadm [configuration file](/docs/reference/config-api/kubeadm-config.v1beta3/) +`kubeadm-config.yaml` for joining a worker node to the cluster. ```yaml apiVersion: kubeadm.k8s.io/v1beta3 @@ -98,7 +101,9 @@ nodeRegistration: node-ip: 10.100.0.3,fd00:1:2:3::3 ``` -Also, here is an example kubeadm [configuration file](https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3) `kubeadm-config.yaml` for joining another control plane node to the cluster. +Also, here is an example kubeadm [configuration file](/docs/reference/config-api/kubeadm-config.v1beta3/) +`kubeadm-config.yaml` for joining another control plane node to the cluster. + ```yaml apiVersion: kubeadm.k8s.io/v1beta3 kind: JoinConfiguration @@ -132,7 +137,9 @@ Dual-stack support doesn't mean that you need to use dual-stack addressing. You can deploy a single-stack cluster that has the dual-stack networking feature enabled. {{< /note >}} -To make things more clear, here is an example kubeadm [configuration file](https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3) `kubeadm-config.yaml` for the single-stack control plane node. +To make things more clear, here is an example kubeadm +[configuration file](/docs/reference/config-api/kubeadm-config.v1beta3/) +`kubeadm-config.yaml` for the single-stack control plane node. ```yaml apiVersion: kubeadm.k8s.io/v1beta3 diff --git a/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md b/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md index 13f90862f0..659aa95af8 100644 --- a/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md +++ b/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md @@ -612,12 +612,12 @@ network port spaces). Kubernetes uses pause containers to allow for worker conta crashing or restarting without losing any of the networking configuration. Kubernetes maintains a multi-architecture image that includes support for Windows. -For Kubernetes v1.22 the recommended pause image is `k8s.gcr.io/pause:3.5`. +For Kubernetes v{{< skew currentVersion >}} the recommended pause image is `k8s.gcr.io/pause:3.6`. The [source code](https://github.com/kubernetes/kubernetes/tree/master/build/pause) is available on GitHub. Microsoft maintains a different multi-architecture image, with Linux and Windows -amd64 support, that you can find as `mcr.microsoft.com/oss/kubernetes/pause:3.5`. +amd64 support, that you can find as `mcr.microsoft.com/oss/kubernetes/pause:3.6`. This image is built from the same source as the Kubernetes maintained image but all of the Windows binaries are [authenticode signed](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/authenticode) by Microsoft. The Kubernetes project recommends using the Microsoft maintained image if you are @@ -661,14 +661,15 @@ On Windows nodes, strict compatibility rules apply where the host OS version mus match the container base image OS version. Only Windows containers with a container operating system of Windows Server 2019 are fully supported. -For Kubernetes v1.22, operating system compatibility for Windows nodes (and Pods) +For Kubernetes v{{< skew currentVersion >}}, operating system compatibility for Windows nodes (and Pods) is as follows: Windows Server LTSC release : Windows Server 2019 +: Windows Server 2022 Windows Server SAC release -: Windows Server version 2004, Windows Server version 20H2 +: Windows Server version 20H2 The Kubernetes [version-skew policy](/docs/setup/release/version-skew-policy/) also applies. @@ -774,9 +775,9 @@ SIG Windows [contributing guide on gathering logs](https://github.com/kubernetes nssm start flanneld # Register kubelet.exe - # Microsoft releases the pause infrastructure container at mcr.microsoft.com/oss/kubernetes/pause:1.4.1 + # Microsoft releases the pause infrastructure container at mcr.microsoft.com/oss/kubernetes/pause:3.6 nssm install kubelet C:\k\kubelet.exe - nssm set kubelet AppParameters --hostname-override= --v=6 --pod-infra-container-image=mcr.microsoft.com/oss/kubernetes/pause:1.4.1 --resolv-conf="" --allow-privileged=true --enable-debugging-handlers --cluster-dns= --cluster-domain=cluster.local --kubeconfig=c:\k\config --hairpin-mode=promiscuous-bridge --image-pull-progress-deadline=20m --cgroups-per-qos=false --log-dir= --logtostderr=false --enforce-node-allocatable="" --network-plugin=cni --cni-bin-dir=c:\k\cni --cni-conf-dir=c:\k\cni\config + nssm set kubelet AppParameters --hostname-override= --v=6 --pod-infra-container-image=mcr.microsoft.com/oss/kubernetes/pause:3.6 --resolv-conf="" --allow-privileged=true --enable-debugging-handlers --cluster-dns= --cluster-domain=cluster.local --kubeconfig=c:\k\config --hairpin-mode=promiscuous-bridge --image-pull-progress-deadline=20m --cgroups-per-qos=false --log-dir= --logtostderr=false --enforce-node-allocatable="" --network-plugin=cni --cni-bin-dir=c:\k\cni --cni-conf-dir=c:\k\cni\config nssm set kubelet AppDirectory C:\k nssm start kubelet @@ -922,7 +923,7 @@ SIG Windows [contributing guide on gathering logs](https://github.com/kubernetes 1. `kubectl port-forward` fails with "unable to do port forwarding: wincat not found" - This was implemented in Kubernetes 1.15 by including `wincat.exe` in the pause infrastructure container `mcr.microsoft.com/oss/kubernetes/pause:1.4.1`. Be sure to use a supported version of Kubernetes. + This was implemented in Kubernetes 1.15 by including `wincat.exe` in the pause infrastructure container `mcr.microsoft.com/oss/kubernetes/pause:3.6`. Be sure to use a supported version of Kubernetes. If you would like to build your own pause infrastructure container be sure to include [wincat](https://github.com/kubernetes/kubernetes/tree/master/build/pause/windows/wincat). 1. My Kubernetes installation is failing because my Windows Server node is behind a proxy diff --git a/content/en/docs/tasks/access-application-cluster/access-cluster.md b/content/en/docs/tasks/access-application-cluster/access-cluster.md index 9f56a409f4..aad72d9dae 100644 --- a/content/en/docs/tasks/access-application-cluster/access-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/access-cluster.md @@ -214,7 +214,7 @@ In each case, the credentials of the pod are used to communicate securely with t ## Accessing services running on the cluster -The previous section describes how to connect to the Kubernetes API server. For information about connecting to other services running on a Kubernetes cluster, see [Access Cluster Services.](/docs/tasks/access-application-cluster/access-cluster/) +The previous section describes how to connect to the Kubernetes API server. For information about connecting to other services running on a Kubernetes cluster, see [Access Cluster Services.](/docs/tasks/administer-cluster/access-cluster-services/) ## Requesting redirects diff --git a/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md b/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md index e13b6e075a..79015b0209 100644 --- a/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md +++ b/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md @@ -219,7 +219,7 @@ allocated resources, events and pods running on the node. Shows all applications running in the selected namespace. The view lists applications by workload kind (for example: Deployments, ReplicaSets, StatefulSets). -and each workload kind can be viewed separately. +Each workload kind can be viewed separately. The lists summarize actionable information about the workloads, such as the number of ready pods for a ReplicaSet or current memory usage for a Pod. diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index 676e5f7643..094b7a767a 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -283,7 +283,7 @@ the node identity with an out of band mechanism. {{% thirdparty-content %}} Third party custom controllers can be used: -- [kubelet-rubber-stamp](https://github.com/kontena/kubelet-rubber-stamp) +- [kubelet-csr-approver](https://github.com/postfinance/kubelet-csr-approver) Such a controller is not a secure mechanism unless it not only verifies the CommonName in the CSR but also verifies the requested IPs and domain names. This would prevent diff --git a/content/en/docs/tasks/administer-cluster/memory-manager.md b/content/en/docs/tasks/administer-cluster/memory-manager.md index 27a0ed2405..3680bfb7c6 100644 --- a/content/en/docs/tasks/administer-cluster/memory-manager.md +++ b/content/en/docs/tasks/administer-cluster/memory-manager.md @@ -1,390 +1,478 @@ ---- -title: Utilizing the NUMA-aware Memory Manager - -reviewers: -- klueska -- derekwaynecarr - -content_type: task -min-kubernetes-server-version: v1.21 ---- - - - -{{< feature-state state="beta" for_k8s_version="v1.22" >}} - -The Kubernetes *Memory Manager* enables the feature of guaranteed memory (and hugepages) allocation for pods in the `Guaranteed` {{< glossary_tooltip text="QoS class" term_id="qos-class" >}}. - -The Memory Manager employs hint generation protocol to yield the most suitable NUMA affinity for a pod. The Memory Manager feeds the central manager (*Topology Manager*) with these affinity hints. Based on both the hints and Topology Manager policy, the pod is rejected or admitted to the node. - -Moreover, the Memory Manager ensures that the memory which a pod requests is allocated from a minimum number of NUMA nodes. - -The Memory Manager is only pertinent to Linux based hosts. - -## {{% heading "prerequisites" %}} - -{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} - -To align memory resources with other requested resources in a Pod Spec: -- the CPU Manager should be enabled and proper CPU Manager policy should be configured on a Node. See [control CPU Management Policies](/docs/tasks/administer-cluster/cpu-management-policies/); -- the Topology Manager should be enabled and proper Topology Manager policy should be configured on a Node. See [control Topology Management Policies](/docs/tasks/administer-cluster/topology-manager/). - -Starting from v1.22, the Memory Manager is enabled by default through `MemoryManager` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/). - -Preceding v1.22, the `kubelet` must be started with the following flag: - -`--feature-gates=MemoryManager=true` - -in order to enable the Memory Manager feature. - -## How Memory Manager Operates? - -The Memory Manager currently offers the guaranteed memory (and hugepages) allocation for Pods in Guaranteed QoS class. To immediately put the Memory Manager into operation follow the guidelines in the section [Memory Manager configuration](#memory-manager-configuration), and subsequently, prepare and deploy a `Guaranteed` pod as illustrated in the section [Placing a Pod in the Guaranteed QoS class](#placing-a-pod-in-the-guaranteed-qos-class). - -The Memory Manager is a Hint Provider, and it provides topology hints for the Topology Manager which then aligns the requested resources according to these topology hints. It also enforces `cgroups` (i.e. `cpuset.mems`) for pods. The complete flow diagram concerning pod admission and deployment process is illustrated in [Memory Manager KEP: Design Overview][4] and below: - -![Memory Manager in the pod admission and deployment process](/images/docs/memory-manager-diagram.svg) - -During this process, the Memory Manager updates its internal counters stored in [Node Map and Memory Maps][2] to manage guaranteed memory allocation. - -The Memory Manager updates the Node Map during the startup and runtime as follows. - -### Startup - -This occurs once a node administrator employs `--reserved-memory` (section [Reserved memory flag](#reserved-memory-flag)). In this case, the Node Map becomes updated to reflect this reservation as illustrated in [Memory Manager KEP: Memory Maps at start-up (with examples)][5]. - -The administrator must provide `--reserved-memory` flag when `Static` policy is configured. - -### Runtime - -Reference [Memory Manager KEP: Memory Maps at runtime (with examples)][6] illustrates how a successful pod deployment affects the Node Map, and it also relates to how potential Out-of-Memory (OOM) situations are handled further by Kubernetes or operating system. - -Important topic in the context of Memory Manager operation is the management of NUMA groups. Each time pod's memory request is in excess of single NUMA node capacity, the Memory Manager attempts to create a group that comprises several NUMA nodes and features extend memory capacity. The problem has been solved as elaborated in [Memory Manager KEP: How to enable the guaranteed memory allocation over many NUMA nodes?][3]. Also, reference [Memory Manager KEP: Simulation - how the Memory Manager works? (by examples)][1] illustrates how the management of groups occurs. - -## Memory Manager configuration - -Other Managers should be first pre-configured (section [Pre-configuration](#pre-configuration)). Next, the Memory Manger feature should be enabled (section [Enable the Memory Manager feature](#enable-the-memory-manager-feature)) and be run with `Static` policy (section [Static policy](#static-policy)). Optionally, some amount of memory can be reserved for system or kubelet processes to increase node stability (section [Reserved memory flag](#reserved-memory-flag)). - -### Policies - -Memory Manager supports two policies. You can select a policy via a `kubelet` flag `--memory-manager-policy`. - -Two policies can be selected: - -* `None` (default) -* `Static` - -#### None policy {#policy-none} - -This is the default policy and does not affect the memory allocation in any way. -It acts the same as if the Memory Manager is not present at all. - -The `None` policy returns default topology hint. This special hint denotes that Hint Provider (Memory Manger in this case) has no preference for NUMA affinity with any resource. - -#### Static policy {#policy-static} - -In the case of the `Guaranteed` pod, the `Static` Memory Manger policy returns topology hints relating to the set of NUMA nodes where the memory can be guaranteed, and reserves the memory through updating the internal [NodeMap][2] object. - -In the case of the `BestEffort` or `Burstable` pod, the `Static` Memory Manager policy sends back the default topology hint as there is no request for the guaranteed memory, and does not reserve the memory in the internal [NodeMap][2] object. - -### Reserved memory flag - -The [Node Allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/) mechanism is commonly used by node administrators to reserve K8S node system resources for the kubelet or operating system processes in order to enhance the node stability. A dedicated set of flags can be used for this purpose to set the total amount of reserved memory for a node. This pre-configured value is subsequently utilized to calculate the real amount of node's "allocatable" memory available to pods. - -The Kubernetes scheduler incorporates "allocatable" to optimise pod scheduling process. The foregoing flags include `--kube-reserved`, `--system-reserved` and `--eviction-threshold`. The sum of their values will account for the total amount of reserved memory. - - -A new `--reserved-memory` flag was added to Memory Manager to allow for this total reserved memory to be split (by a node administrator) and accordingly reserved across many NUMA nodes. - -The flag specifies a comma-separated list of memory reservations per NUMA node. -This parameter is only useful in the context of the Memory Manager feature. -The Memory Manager will not use this reserved memory for the allocation of container workloads. - -For example, if you have a NUMA node "NUMA0" with `10Gi` of memory available, and the `--reserved-memory` was specified to reserve `1Gi` of memory at "NUMA0", the Memory Manager assumes that only `9Gi` is available for containers. - -You can omit this parameter, however, you should be aware that the quantity of reserved memory from all NUMA nodes should be equal to the quantity of memory specified by the [Node Allocatable feature](/docs/tasks/administer-cluster/reserve-compute-resources/). If at least one node allocatable parameter is non-zero, you will need to specify `--reserved-memory` for at least one NUMA node. In fact, `eviction-hard` threshold value is equal to `100Mi` by default, so if `Static` policy is used, `--reserved-memory` is obligatory. - -Also, avoid the following configurations: -1. duplicates, i.e. the same NUMA node or memory type, but with a different value; -2. setting zero limit for any of memory types; -3. NUMA node IDs that do not exist in the machine hardware; -4. memory type names different than `memory` or `hugepages-` (hugepages of particular `` should also exist). - -Syntax: - -`--reserved-memory N:memory-type1=value1,memory-type2=value2,...` -* `N` (integer) - NUMA node index, e.g. `0` -* `memory-type` (string) - represents memory type: - * `memory` - conventional memory - * `hugepages-2Mi` or `hugepages-1Gi` - hugepages -* `value` (string) - the quantity of reserved memory, e.g. `1Gi` - -Example usage: - -`--reserved-memory 0:memory=1Gi,hugepages-1Gi=2Gi` - -or - -`--reserved-memory 0:memory=1Gi --reserved-memory 1:memory=2Gi` - -When you specify values for `--reserved-memory` flag, you must comply with the setting that you prior provided via Node Allocatable Feature flags. That is, the following rule must be obeyed for each memory type: - -`sum(reserved-memory(i)) = kube-reserved + system-reserved + eviction-threshold`, - -where `i` is an index of a NUMA node. - -If you do not follow the formula above, the Memory Manager will show an error on startup. - -In other words, the example above illustrates that for the conventional memory (`type=memory`), we reserve `3Gi` in total, i.e.: - -`sum(reserved-memory(i)) = reserved-memory(0) + reserved-memory(1) = 1Gi + 2Gi = 3Gi` - -An example of kubelet command-line arguments relevant to the node Allocatable configuration: -* `--kube-reserved=cpu=500m,memory=50Mi` -* `--system-reserved=cpu=123m,memory=333Mi` -* `--eviction-hard=memory.available<500Mi` - -{{< note >}} -The default hard eviction threshold is 100MiB, and **not** zero. Remember to increase the quantity of memory that you reserve by setting `--reserved-memory` by that hard eviction threshold. Otherwise, the kubelet will not start Memory Manager and display an error. -{{< /note >}} - -Here is an example of a correct configuration: - -```shell ---feature-gates=MemoryManager=true ---kube-reserved=cpu=4,memory=4Gi ---system-reserved=cpu=1,memory=1Gi ---memory-manager-policy=Static ---reserved-memory 0:memory=3Gi --reserved-memory 1:memory=2148Mi -``` -Let us validate the configuration above: -1. `kube-reserved + system-reserved + eviction-hard(default) = reserved-memory(0) + reserved-memory(1)` -2. `4GiB + 1GiB + 100MiB = 3GiB + 2148MiB` -3. `5120MiB + 100MiB = 3072MiB + 2148MiB` -4. `5220MiB = 5220MiB` (which is correct) - -## Placing a Pod in the Guaranteed QoS class - -If the selected policy is anything other than `None`, the Memory Manager identifies pods that are in the `Guaranteed` QoS class. The Memory Manager provides specific topology hints to the Topology Manager for each `Guaranteed` pod. For pods in a QoS class other than `Guaranteed`, the Memory Manager provides default topology hints to the Topology Manager. - -The following excerpts from pod manifests assign a pod to the `Guaranteed` QoS class. - -Pod with integer CPU(s) runs in the `Guaranteed` QoS class, when `requests` are equal to `limits`: - -```yaml -spec: - containers: - - name: nginx - image: nginx - resources: - limits: - memory: "200Mi" - cpu: "2" - example.com/device: "1" - requests: - memory: "200Mi" - cpu: "2" - example.com/device: "1" -``` - -Also, a pod sharing CPU(s) runs in the `Guaranteed` QoS class, when `requests` are equal to `limits`. - -```yaml -spec: - containers: - - name: nginx - image: nginx - resources: - limits: - memory: "200Mi" - cpu: "300m" - example.com/device: "1" - requests: - memory: "200Mi" - cpu: "300m" - example.com/device: "1" -``` - -Notice that both CPU and memory requests must be specified for a Pod to lend it to Guaranteed QoS class. - -## Troubleshooting - -The following means can be used to troubleshoot the reason why a pod could not be deployed or became rejected at a node: -- pod status - indicates topology affinity errors -- system logs - include valuable information for debugging, e.g., about generated hints -- state file - the dump of internal state of the Memory Manager (includes [Node Map and Memory Maps][2]) -- starting from v1.22, the [device plugin resource API](#device-plugin-resource-api) can be used - to retrieve information about the memory reserved for containers - - - -### Pod status (TopologyAffinityError) {#TopologyAffinityError} - -This error typically occurs in the following situations: -* a node has not enough resources available to satisfy the pod's request -* the pod's request is rejected due to particular Topology Manager policy constraints - -The error appears in the status of a pod: -```shell -# kubectl get pods -NAME READY STATUS RESTARTS AGE -guaranteed 0/1 TopologyAffinityError 0 113s -``` - -Use `kubectl describe pod ` or `kubectl get events` to obtain detailed error message: -```shell -Warning TopologyAffinityError 10m kubelet, dell8 Resources cannot be allocated with Topology locality -``` - -### System logs - -Search system logs with respect to a particular pod. - -The set of hints that Memory Manager generated for the pod can be found in the logs. -Also, the set of hints generated by CPU Manager should be present in the logs. - -Topology Manager merges these hints to calculate a single best hint. -The best hint should be also present in the logs. - -The best hint indicates where to allocate all the resources. Topology Manager tests this hint against its current policy, and based on the verdict, it either admits the pod to the node or rejects it. - -Also, search the logs for occurrences associated with the Memory Manager, e.g. to find out information about `cgroups` and `cpuset.mems` updates. - -### Examine the memory manager state on a node - -Let us first deploy a sample `Guaranteed` pod whose specification is as follows: -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: guaranteed -spec: - containers: - - name: guaranteed - image: consumer - imagePullPolicy: Never - resources: - limits: - cpu: "2" - memory: 150Gi - requests: - cpu: "2" - memory: 150Gi - command: ["sleep","infinity"] -``` - -Next, let us log into the node where it was deployed and examine the state file in `/var/lib/kubelet/memory_manager_state`: -```json -{ - "policyName":"Static", - "machineState":{ - "0":{ - "numberOfAssignments":1, - "memoryMap":{ - "hugepages-1Gi":{ - "total":0, - "systemReserved":0, - "allocatable":0, - "reserved":0, - "free":0 - }, - "memory":{ - "total":134987354112, - "systemReserved":3221225472, - "allocatable":131766128640, - "reserved":131766128640, - "free":0 - } - }, - "nodes":[ - 0, - 1 - ] - }, - "1":{ - "numberOfAssignments":1, - "memoryMap":{ - "hugepages-1Gi":{ - "total":0, - "systemReserved":0, - "allocatable":0, - "reserved":0, - "free":0 - }, - "memory":{ - "total":135286722560, - "systemReserved":2252341248, - "allocatable":133034381312, - "reserved":29295144960, - "free":103739236352 - } - }, - "nodes":[ - 0, - 1 - ] - } - }, - "entries":{ - "fa9bdd38-6df9-4cf9-aa67-8c4814da37a8":{ - "guaranteed":[ - { - "numaAffinity":[ - 0, - 1 - ], - "type":"memory", - "size":161061273600 - } - ] - } - }, - "checksum":4142013182 -} -``` - -It can be deduced from the state file that the pod was pinned to both NUMA nodes, i.e.: - -```json -"numaAffinity":[ - 0, - 1 -], -``` - -Pinned term means that pod's memory consumption is constrained (through `cgroups` configuration) to these NUMA nodes. - -This automatically implies that Memory Manager instantiated a new group that comprises these two NUMA nodes, i.e. `0` and `1` indexed NUMA nodes. - -Notice that the management of groups is handled in a relatively complex manner, and further elaboration is provided in Memory Manager KEP in [this][1] and [this][3] sections. - -In order to analyse memory resources available in a group, the corresponding entries from NUMA nodes belonging to the group must be added up. - -For example, the total amount of free "conventional" memory in the group can be computed by adding up the free memory available at every NUMA node in the group, i.e., in the `"memory"` section of NUMA node `0` (`"free":0`) and NUMA node `1` (`"free":103739236352`). So, the total amount of free "conventional" memory in this group is equal to `0 + 103739236352` bytes. - -The line `"systemReserved":3221225472` indicates that the administrator of this node reserved `3221225472` bytes (i.e. `3Gi`) to serve kubelet and system processes at NUMA node `0`, by using `--reserved-memory` flag. - -### Device plugin resource API - -By employing the [API](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/), the information about reserved memory for each container can be retrieved, which is contained in protobuf `ContainerMemory` message. This information can be retrieved solely for pods in Guaranteed QoS class. - -## {{% heading "whatsnext" %}} - -- [Memory Manager KEP: Design Overview][4] - -- [Memory Manager KEP: Memory Maps at start-up (with examples)][5] - -- [Memory Manager KEP: Memory Maps at runtime (with examples)][6] - -- [Memory Manager KEP: Simulation - how the Memory Manager works? (by examples)][1] - -- [Memory Manager KEP: The Concept of Node Map and Memory Maps][2] - -- [Memory Manager KEP: How to enable the guaranteed memory allocation over many NUMA nodes?][3] - -[1]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#simulation---how-the-memory-manager-works-by-examples -[2]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#the-concept-of-node-map-and-memory-maps -[3]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#how-to-enable-the-guaranteed-memory-allocation-over-many-numa-nodes -[4]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#design-overview -[5]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#memory-maps-at-start-up-with-examples -[6]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#memory-maps-at-runtime-with-examples +--- +title: Utilizing the NUMA-aware Memory Manager + +reviewers: +- klueska +- derekwaynecarr + +content_type: task +min-kubernetes-server-version: v1.21 +--- + + + +{{< feature-state state="beta" for_k8s_version="v1.22" >}} + +The Kubernetes *Memory Manager* enables the feature of guaranteed memory (and hugepages) +allocation for pods in the `Guaranteed` {{< glossary_tooltip text="QoS class" term_id="qos-class" >}}. + +The Memory Manager employs hint generation protocol to yield the most suitable NUMA affinity for a pod. +The Memory Manager feeds the central manager (*Topology Manager*) with these affinity hints. +Based on both the hints and Topology Manager policy, the pod is rejected or admitted to the node. + +Moreover, the Memory Manager ensures that the memory which a pod requests +is allocated from a minimum number of NUMA nodes. + +The Memory Manager is only pertinent to Linux based hosts. + +## {{% heading "prerequisites" %}} + +{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} + +To align memory resources with other requested resources in a Pod spec: + +- the CPU Manager should be enabled and proper CPU Manager policy should be configured on a Node. + See [control CPU Management Policies](/docs/tasks/administer-cluster/cpu-management-policies/); +- the Topology Manager should be enabled and proper Topology Manager policy should be configured on a Node. + See [control Topology Management Policies](/docs/tasks/administer-cluster/topology-manager/). + +Starting from v1.22, the Memory Manager is enabled by default through `MemoryManager` +[feature gate](/docs/reference/command-line-tools-reference/feature-gates/). + +Preceding v1.22, the `kubelet` must be started with the following flag: + +`--feature-gates=MemoryManager=true` + +in order to enable the Memory Manager feature. + +## How Memory Manager Operates? + +The Memory Manager currently offers the guaranteed memory (and hugepages) allocation +for Pods in Guaranteed QoS class. +To immediately put the Memory Manager into operation follow the guidelines in the section +[Memory Manager configuration](#memory-manager-configuration), and subsequently, +prepare and deploy a `Guaranteed` pod as illustrated in the section +[Placing a Pod in the Guaranteed QoS class](#placing-a-pod-in-the-guaranteed-qos-class). + +The Memory Manager is a Hint Provider, and it provides topology hints for +the Topology Manager which then aligns the requested resources according to these topology hints. +It also enforces `cgroups` (i.e. `cpuset.mems`) for pods. +The complete flow diagram concerning pod admission and deployment process is illustrated in +[Memory Manager KEP: Design Overview][4] and below: + +![Memory Manager in the pod admission and deployment process](/images/docs/memory-manager-diagram.svg) + +During this process, the Memory Manager updates its internal counters stored in +[Node Map and Memory Maps][2] to manage guaranteed memory allocation. + +The Memory Manager updates the Node Map during the startup and runtime as follows. + +### Startup + +This occurs once a node administrator employs `--reserved-memory` (section +[Reserved memory flag](#reserved-memory-flag)). +In this case, the Node Map becomes updated to reflect this reservation as illustrated in +[Memory Manager KEP: Memory Maps at start-up (with examples)][5]. + +The administrator must provide `--reserved-memory` flag when `Static` policy is configured. + +### Runtime + +Reference [Memory Manager KEP: Memory Maps at runtime (with examples)][6] illustrates +how a successful pod deployment affects the Node Map, and it also relates to +how potential Out-of-Memory (OOM) situations are handled further by Kubernetes or operating system. + +Important topic in the context of Memory Manager operation is the management of NUMA groups. +Each time pod's memory request is in excess of single NUMA node capacity, the Memory Manager +attempts to create a group that comprises several NUMA nodes and features extend memory capacity. +The problem has been solved as elaborated in +[Memory Manager KEP: How to enable the guaranteed memory allocation over many NUMA nodes?][3]. +Also, reference [Memory Manager KEP: Simulation - how the Memory Manager works? (by examples)][1] +illustrates how the management of groups occurs. + +## Memory Manager configuration + +Other Managers should be first pre-configured. Next, the Memory Manger feature should be enabled +and be run with `Static` policy (section [Static policy](#policy-static)). +Optionally, some amount of memory can be reserved for system or kubelet processes to increase +node stability (section [Reserved memory flag](#reserved-memory-flag)). + +### Policies + +Memory Manager supports two policies. You can select a policy via a `kubelet` flag `--memory-manager-policy`: + +* `None` (default) +* `Static` + +#### None policy {#policy-none} + +This is the default policy and does not affect the memory allocation in any way. +It acts the same as if the Memory Manager is not present at all. + +The `None` policy returns default topology hint. This special hint denotes that Hint Provider +(Memory Manger in this case) has no preference for NUMA affinity with any resource. + +#### Static policy {#policy-static} + +In the case of the `Guaranteed` pod, the `Static` Memory Manger policy returns topology hints +relating to the set of NUMA nodes where the memory can be guaranteed, +and reserves the memory through updating the internal [NodeMap][2] object. + +In the case of the `BestEffort` or `Burstable` pod, the `Static` Memory Manager policy sends back +the default topology hint as there is no request for the guaranteed memory, +and does not reserve the memory in the internal [NodeMap][2] object. + +### Reserved memory flag + +The [Node Allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/) mechanism +is commonly used by node administrators to reserve K8S node system resources for the kubelet +or operating system processes in order to enhance the node stability. +A dedicated set of flags can be used for this purpose to set the total amount of reserved memory +for a node. This pre-configured value is subsequently utilized to calculate +the real amount of node's "allocatable" memory available to pods. + +The Kubernetes scheduler incorporates "allocatable" to optimise pod scheduling process. +The foregoing flags include `--kube-reserved`, `--system-reserved` and `--eviction-threshold`. +The sum of their values will account for the total amount of reserved memory. + +A new `--reserved-memory` flag was added to Memory Manager to allow for this total reserved memory +to be split (by a node administrator) and accordingly reserved across many NUMA nodes. + +The flag specifies a comma-separated list of memory reservations per NUMA node. +This parameter is only useful in the context of the Memory Manager feature. +The Memory Manager will not use this reserved memory for the allocation of container workloads. + +For example, if you have a NUMA node "NUMA0" with `10Gi` of memory available, and +the `--reserved-memory` was specified to reserve `1Gi` of memory at "NUMA0", +the Memory Manager assumes that only `9Gi` is available for containers. + +You can omit this parameter, however, you should be aware that the quantity of reserved memory +from all NUMA nodes should be equal to the quantity of memory specified by the +[Node Allocatable feature](/docs/tasks/administer-cluster/reserve-compute-resources/). +If at least one node allocatable parameter is non-zero, you will need to specify +`--reserved-memory` for at least one NUMA node. +In fact, `eviction-hard` threshold value is equal to `100Mi` by default, so +if `Static` policy is used, `--reserved-memory` is obligatory. + +Also, avoid the following configurations: + +1. duplicates, i.e. the same NUMA node or memory type, but with a different value; +1. setting zero limit for any of memory types; +1. NUMA node IDs that do not exist in the machine hardware; +1. memory type names different than `memory` or `hugepages-` + (hugepages of particular `` should also exist). + +Syntax: + +`--reserved-memory N:memory-type1=value1,memory-type2=value2,...` + +* `N` (integer) - NUMA node index, e.g. `0` +* `memory-type` (string) - represents memory type: + * `memory` - conventional memory + * `hugepages-2Mi` or `hugepages-1Gi` - hugepages +* `value` (string) - the quantity of reserved memory, e.g. `1Gi` + +Example usage: + +`--reserved-memory 0:memory=1Gi,hugepages-1Gi=2Gi` + +or + +`--reserved-memory 0:memory=1Gi --reserved-memory 1:memory=2Gi` + +When you specify values for `--reserved-memory` flag, you must comply with the setting that +you prior provided via Node Allocatable Feature flags. +That is, the following rule must be obeyed for each memory type: + +`sum(reserved-memory(i)) = kube-reserved + system-reserved + eviction-threshold`, + +where `i` is an index of a NUMA node. + +If you do not follow the formula above, the Memory Manager will show an error on startup. + +In other words, the example above illustrates that for the conventional memory (`type=memory`), +we reserve `3Gi` in total, i.e.: + +`sum(reserved-memory(i)) = reserved-memory(0) + reserved-memory(1) = 1Gi + 2Gi = 3Gi` + +An example of kubelet command-line arguments relevant to the node Allocatable configuration: + +* `--kube-reserved=cpu=500m,memory=50Mi` +* `--system-reserved=cpu=123m,memory=333Mi` +* `--eviction-hard=memory.available<500Mi` + +{{< note >}} +The default hard eviction threshold is 100MiB, and **not** zero. +Remember to increase the quantity of memory that you reserve by setting `--reserved-memory` +by that hard eviction threshold. Otherwise, the kubelet will not start Memory Manager and +display an error. +{{< /note >}} + +Here is an example of a correct configuration: + +```shell +--feature-gates=MemoryManager=true +--kube-reserved=cpu=4,memory=4Gi +--system-reserved=cpu=1,memory=1Gi +--memory-manager-policy=Static +--reserved-memory 0:memory=3Gi --reserved-memory 1:memory=2148Mi +``` + +Let us validate the configuration above: + +1. `kube-reserved + system-reserved + eviction-hard(default) = reserved-memory(0) + reserved-memory(1)` +1. `4GiB + 1GiB + 100MiB = 3GiB + 2148MiB` +1. `5120MiB + 100MiB = 3072MiB + 2148MiB` +1. `5220MiB = 5220MiB` (which is correct) + +## Placing a Pod in the Guaranteed QoS class + +If the selected policy is anything other than `None`, the Memory Manager identifies pods +that are in the `Guaranteed` QoS class. +The Memory Manager provides specific topology hints to the Topology Manager for each `Guaranteed` pod. +For pods in a QoS class other than `Guaranteed`, the Memory Manager provides default topology hints +to the Topology Manager. + +The following excerpts from pod manifests assign a pod to the `Guaranteed` QoS class. + +Pod with integer CPU(s) runs in the `Guaranteed` QoS class, when `requests` are equal to `limits`: + +```yaml +spec: + containers: + - name: nginx + image: nginx + resources: + limits: + memory: "200Mi" + cpu: "2" + example.com/device: "1" + requests: + memory: "200Mi" + cpu: "2" + example.com/device: "1" +``` + +Also, a pod sharing CPU(s) runs in the `Guaranteed` QoS class, when `requests` are equal to `limits`. + +```yaml +spec: + containers: + - name: nginx + image: nginx + resources: + limits: + memory: "200Mi" + cpu: "300m" + example.com/device: "1" + requests: + memory: "200Mi" + cpu: "300m" + example.com/device: "1" +``` + +Notice that both CPU and memory requests must be specified for a Pod to lend it to Guaranteed QoS class. + +## Troubleshooting + +The following means can be used to troubleshoot the reason why a pod could not be deployed or +became rejected at a node: + +- pod status - indicates topology affinity errors +- system logs - include valuable information for debugging, e.g., about generated hints +- state file - the dump of internal state of the Memory Manager + (includes [Node Map and Memory Maps][2]) +- starting from v1.22, the [device plugin resource API](#device-plugin-resource-api) can be used + to retrieve information about the memory reserved for containers + +### Pod status (TopologyAffinityError) {#TopologyAffinityError} + +This error typically occurs in the following situations: + +* a node has not enough resources available to satisfy the pod's request +* the pod's request is rejected due to particular Topology Manager policy constraints + +The error appears in the status of a pod: + +```shell +kubectl get pods +``` + +```none +NAME READY STATUS RESTARTS AGE +guaranteed 0/1 TopologyAffinityError 0 113s +``` + +Use `kubectl describe pod ` or `kubectl get events` to obtain detailed error message: + +```none +Warning TopologyAffinityError 10m kubelet, dell8 Resources cannot be allocated with Topology locality +``` + +### System logs + +Search system logs with respect to a particular pod. + +The set of hints that Memory Manager generated for the pod can be found in the logs. +Also, the set of hints generated by CPU Manager should be present in the logs. + +Topology Manager merges these hints to calculate a single best hint. +The best hint should be also present in the logs. + +The best hint indicates where to allocate all the resources. +Topology Manager tests this hint against its current policy, and based on the verdict, +it either admits the pod to the node or rejects it. + +Also, search the logs for occurrences associated with the Memory Manager, +e.g. to find out information about `cgroups` and `cpuset.mems` updates. + +### Examine the memory manager state on a node + +Let us first deploy a sample `Guaranteed` pod whose specification is as follows: + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: guaranteed +spec: + containers: + - name: guaranteed + image: consumer + imagePullPolicy: Never + resources: + limits: + cpu: "2" + memory: 150Gi + requests: + cpu: "2" + memory: 150Gi + command: ["sleep","infinity"] +``` + +Next, let us log into the node where it was deployed and examine the state file in +`/var/lib/kubelet/memory_manager_state`: + +```json +{ + "policyName":"Static", + "machineState":{ + "0":{ + "numberOfAssignments":1, + "memoryMap":{ + "hugepages-1Gi":{ + "total":0, + "systemReserved":0, + "allocatable":0, + "reserved":0, + "free":0 + }, + "memory":{ + "total":134987354112, + "systemReserved":3221225472, + "allocatable":131766128640, + "reserved":131766128640, + "free":0 + } + }, + "nodes":[ + 0, + 1 + ] + }, + "1":{ + "numberOfAssignments":1, + "memoryMap":{ + "hugepages-1Gi":{ + "total":0, + "systemReserved":0, + "allocatable":0, + "reserved":0, + "free":0 + }, + "memory":{ + "total":135286722560, + "systemReserved":2252341248, + "allocatable":133034381312, + "reserved":29295144960, + "free":103739236352 + } + }, + "nodes":[ + 0, + 1 + ] + } + }, + "entries":{ + "fa9bdd38-6df9-4cf9-aa67-8c4814da37a8":{ + "guaranteed":[ + { + "numaAffinity":[ + 0, + 1 + ], + "type":"memory", + "size":161061273600 + } + ] + } + }, + "checksum":4142013182 +} +``` + +It can be deduced from the state file that the pod was pinned to both NUMA nodes, i.e.: + +```json +"numaAffinity":[ + 0, + 1 +], +``` + +Pinned term means that pod's memory consumption is constrained (through `cgroups` configuration) +to these NUMA nodes. + +This automatically implies that Memory Manager instantiated a new group that +comprises these two NUMA nodes, i.e. `0` and `1` indexed NUMA nodes. + +Notice that the management of groups is handled in a relatively complex manner, and +further elaboration is provided in Memory Manager KEP in [this][1] and [this][3] sections. + +In order to analyse memory resources available in a group,the corresponding entries from +NUMA nodes belonging to the group must be added up. + +For example, the total amount of free "conventional" memory in the group can be computed +by adding up the free memory available at every NUMA node in the group, +i.e., in the `"memory"` section of NUMA node `0` (`"free":0`) and NUMA node `1` (`"free":103739236352`). +So, the total amount of free "conventional" memory in this group is equal to `0 + 103739236352` bytes. + +The line `"systemReserved":3221225472` indicates that the administrator of this node reserved +`3221225472` bytes (i.e. `3Gi`) to serve kubelet and system processes at NUMA node `0`, +by using `--reserved-memory` flag. + +### Device plugin resource API + +By employing the [API](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/), +the information about reserved memory for each container can be retrieved, which is contained +in protobuf `ContainerMemory` message. +This information can be retrieved solely for pods in Guaranteed QoS class. + +## {{% heading "whatsnext" %}} + +- [Memory Manager KEP: Design Overview][4] +- [Memory Manager KEP: Memory Maps at start-up (with examples)][5] +- [Memory Manager KEP: Memory Maps at runtime (with examples)][6] +- [Memory Manager KEP: Simulation - how the Memory Manager works? (by examples)][1] +- [Memory Manager KEP: The Concept of Node Map and Memory Maps][2] +- [Memory Manager KEP: How to enable the guaranteed memory allocation over many NUMA nodes?][3] + +[1]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#simulation---how-the-memory-manager-works-by-examples +[2]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#the-concept-of-node-map-and-memory-maps +[3]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#how-to-enable-the-guaranteed-memory-allocation-over-many-numa-nodes +[4]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#design-overview +[5]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#memory-maps-at-start-up-with-examples +[6]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1769-memory-manager#memory-maps-at-runtime-with-examples + + diff --git a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md index 1553787301..f0fefe975a 100644 --- a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md +++ b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md @@ -248,7 +248,7 @@ To try the gRPC liveness check, create a Pod using the command below. In the example below, the etcd pod is configured to use gRPC liveness probe. ```shell -kubectl apply -f https://k8s.io/examples/pods/probe/content/en/examples/pods/probe/grpc-liveness.yaml +kubectl apply -f https://k8s.io/examples/pods/probe/grpc-liveness.yaml ``` After 15 seconds, view Pod events to verify that the liveness check has not failed: diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md index 79e9b92216..fe5b34f480 100644 --- a/content/en/docs/tasks/debug-application-cluster/audit.md +++ b/content/en/docs/tasks/debug-application-cluster/audit.md @@ -165,6 +165,7 @@ and finally configure the `hostPath`: ```yaml ... +volumes: - name: audit hostPath: path: /etc/kubernetes/audit-policy.yaml @@ -174,7 +175,6 @@ and finally configure the `hostPath`: hostPath: path: /var/log/kubernetes/audit/ type: DirectoryOrCreate - ``` ### Webhook backend diff --git a/content/en/docs/tasks/debug-application-cluster/debug-application.md b/content/en/docs/tasks/debug-application-cluster/debug-application.md index 477c9b8248..f3c8ea5269 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-application.md +++ b/content/en/docs/tasks/debug-application-cluster/debug-application.md @@ -57,7 +57,7 @@ If a Pod is stuck in the `Waiting` state, then it has been scheduled to a worker Again, the information from `kubectl describe ...` should be informative. The most common cause of `Waiting` pods is a failure to pull the image. There are three things to check: * Make sure that you have the name of the image correct. -* Have you pushed the image to the repository? +* Have you pushed the image to the registry? * Run a manual `docker pull ` on your machine to see if the image can be pulled. #### My pod is crashing or otherwise unhealthy diff --git a/content/en/docs/tasks/debug-application-cluster/local-debugging.md b/content/en/docs/tasks/debug-application-cluster/local-debugging.md index d00c1398eb..68088ac85a 100644 --- a/content/en/docs/tasks/debug-application-cluster/local-debugging.md +++ b/content/en/docs/tasks/debug-application-cluster/local-debugging.md @@ -5,57 +5,57 @@ content_type: task -Kubernetes applications usually consist of multiple, separate services, each running in its own container. Developing and debugging these services on a remote Kubernetes cluster can be cumbersome, requiring you to [get a shell on a running container](/docs/tasks/debug-application-cluster/get-shell-running-container/) and running your tools inside the remote shell. - -`telepresence` is a tool to ease the process of developing and debugging services locally, while proxying the service to a remote Kubernetes cluster. Using `telepresence` allows you to use custom tools, such as a debugger and IDE, for a local service and provides the service full access to ConfigMap, secrets, and the services running on the remote cluster. +{{% thirdparty-content %}} +Kubernetes applications usually consist of multiple, separate services, each running in its own container. Developing and debugging these services on a remote Kubernetes cluster can be cumbersome, requiring you to [get a shell on a running container](/docs/tasks/debug-application-cluster/get-shell-running-container/) in order to run debugging tools. + +`telepresence` is a tool to ease the process of developing and debugging services locally while proxying the service to a remote Kubernetes cluster. Using `telepresence` allows you to use custom tools, such as a debugger and IDE, for a local service and provides the service full access to ConfigMap, secrets, and the services running on the remote cluster. + This document describes using `telepresence` to develop and debug services running on a remote cluster locally. - - - ## {{% heading "prerequisites" %}} - * Kubernetes cluster is installed * `kubectl` is configured to communicate with the cluster -* [Telepresence](https://www.telepresence.io/reference/install) is installed - +* [Telepresence](https://www.telepresence.io/docs/latest/install/) is installed -## Getting a shell on a remote cluster +## Connecting your local machine to a remote Kubernetes cluster + +After installing `telepresence`, run `telepresence connect` to launch it's Daemon and connect your local workstation to the cluster. -Open a terminal and run `telepresence` with no arguments to get a `telepresence` shell. This shell runs locally, giving you full access to your local filesystem. - -The `telepresence` shell can be used in a variety of ways. For example, write a shell script on your laptop, and run it directly from the shell in real time. You can do this on a remote shell as well, but you might not be able to use your preferred code editor, and the script is deleted when the container is terminated. - -Enter `exit` to quit and close the shell. +``` +$ telepresence connect + +Launching Telepresence Daemon +... +Connected to context default (https://) +``` +You can curl services using the Kubernetes syntax e.g. `curl -ik https://kubernetes.default` + ## Developing or debugging an existing service When developing an application on Kubernetes, you typically program or debug a single service. The service might require access to other services for testing and debugging. One option is to use the continuous deployment pipeline, but even the fastest deployment pipeline introduces a delay in the program or debug cycle. + +Use the `telepresence intercept $SERVICE_NAME --port $LOCAL_PORT:REMOTE_PORT` command to create an "intercept" for rerouting remote service traffic. + +Where: -Use the `--swap-deployment` option to swap an existing deployment with the Telepresence proxy. Swapping allows you to run a service locally and connect to the remote Kubernetes cluster. The services in the remote cluster can now access the locally running instance. +- `$SERVICE_NAME` is the name of your local service +- `$LOCAL_PORT` is the port that your service is running on your local workstation +- And `$REMOTE_PORT` is the port your service listens to in the cluster -To run telepresence with `--swap-deployment`, enter: - -`telepresence --swap-deployment $DEPLOYMENT_NAME` - -where $DEPLOYMENT_NAME is the name of your existing deployment. - -Running this command spawns a shell. In the shell, start your service. You can then make edits to the source code locally, save, and see the changes take effect immediately. You can also run your service in a debugger, or any other local development tool. +Running this command tells Telepresence to send remote traffic to your local service instead of the service in the remote Kubernetes cluster. Make edits to your service source code locally, save, and see the corresponding changes when accessing your remote application take effect immediately. You can also run your local service using a debugger or any other local development tool. +## How does Telepresence work? +Telepresence installs a traffic-agent sidecar next to your existing application's container running in the remote cluster. It then captures all traffic requests going into the Pod, and instead of forwarding this to the application in the remote cluster, it routes all traffic (when you create a [global intercept](https://www.getambassador.io/docs/telepresence/latest/concepts/intercepts/#global-intercept)) or a subset of the traffic (when you create a [personal intercept](https://www.getambassador.io/docs/telepresence/latest/concepts/intercepts/#personal-intercept)) to your local development environment. ## {{% heading "whatsnext" %}} - - + If you're interested in a hands-on tutorial, check out [this tutorial](https://cloud.google.com/community/tutorials/developing-services-with-k8s) that walks through locally developing the Guestbook application on Google Kubernetes Engine. - -Telepresence has [numerous proxying options](https://www.telepresence.io/reference/methods), depending on your situation. - -For further reading, visit the [Telepresence website](https://www.telepresence.io). - - + +For further reading, visit the [Telepresence website](https://www.telepresence.io). \ No newline at end of file diff --git a/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md b/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md index b0e9ec4690..adfc42b545 100644 --- a/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md +++ b/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md @@ -67,8 +67,8 @@ Learn more about the metrics server in [the design doc](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/instrumentation/metrics-server.md). ### Summary API Source -The [Kubelet](/docs/reference/command-line-tools-reference/kubelet/) gathers stats at node, volume, pod and container level, and omits -them in the [Summary API](https://github.com/kubernetes/kubernetes/blob/7d309e0104fedb57280b261e5677d919cb2a0e2d/staging/src/k8s.io/kubelet/pkg/apis/stats/v1alpha1/types.go) +The [Kubelet](/docs/reference/command-line-tools-reference/kubelet/) gathers stats at node, volume, pod and container level, and emits their statistics in +the [Summary API](https://github.com/kubernetes/kubernetes/blob/7d309e0104fedb57280b261e5677d919cb2a0e2d/staging/src/k8s.io/kubelet/pkg/apis/stats/v1alpha1/types.go) for consumers to read. Pre-1.23, these resources have been primarily gathered from [cAdvisor](https://github.com/google/cadvisor). However, in 1.23 with the diff --git a/content/en/docs/tasks/inject-data-application/define-command-argument-container.md b/content/en/docs/tasks/inject-data-application/define-command-argument-container.md index faaffc52a2..0de57b864f 100644 --- a/content/en/docs/tasks/inject-data-application/define-command-argument-container.md +++ b/content/en/docs/tasks/inject-data-application/define-command-argument-container.md @@ -36,8 +36,7 @@ If you define args, but do not define a command, the default command is used with your new arguments. {{< note >}} -The `command` field corresponds to `entrypoint` in some container -runtimes. Refer to the [Notes](#notes) below. +The `command` field corresponds to `entrypoint` in some container runtimes. {{< /note >}} In this exercise, you create a Pod that runs one container. The configuration @@ -111,50 +110,9 @@ command: ["/bin/sh"] args: ["-c", "while true; do echo hello; sleep 10;done"] ``` -## Notes - -This table summarizes the field names used by Docker and Kubernetes. - -| Description | Docker field name | Kubernetes field name | -|----------------------------------------|------------------------|-----------------------| -| The command run by the container | Entrypoint | command | -| The arguments passed to the command | Cmd | args | - -When you override the default Entrypoint and Cmd, these rules apply: - -* If you do not supply `command` or `args` for a Container, the defaults defined -in the Docker image are used. - -* If you supply a `command` but no `args` for a Container, only the supplied -`command` is used. The default EntryPoint and the default Cmd defined in the Docker -image are ignored. - -* If you supply only `args` for a Container, the default Entrypoint defined in -the Docker image is run with the `args` that you supplied. - -* If you supply a `command` and `args`, the default Entrypoint and the default -Cmd defined in the Docker image are ignored. Your `command` is run with your -`args`. - -Here are some examples: - -| Image Entrypoint | Image Cmd | Container command | Container args | Command run | -|--------------------|------------------|---------------------|--------------------|------------------| -| `[/ep-1]` | `[foo bar]` | <not set> | <not set> | `[ep-1 foo bar]` | -| `[/ep-1]` | `[foo bar]` | `[/ep-2]` | <not set> | `[ep-2]` | -| `[/ep-1]` | `[foo bar]` | <not set> | `[zoo boo]` | `[ep-1 zoo boo]` | -| `[/ep-1]` | `[foo bar]` | `[/ep-2]` | `[zoo boo]` | `[ep-2 zoo boo]` | - - - - ## {{% heading "whatsnext" %}} * Learn more about [configuring pods and containers](/docs/tasks/). * Learn more about [running commands in a container](/docs/tasks/debug-application-cluster/get-shell-running-container/). * See [Container](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#container-v1-core). - - - - diff --git a/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md b/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md index f7af3d864d..b192579970 100644 --- a/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md +++ b/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md @@ -28,7 +28,7 @@ This guide demonstrates how to configure the kubelet's image credential provider ## {{% heading "prerequisites" %}} * The kubelet image credential provider is introduced in v1.20 as an alpha feature. As with other alpha features, -a feature gate `KubeletCredentialProviders` must be enabled on only the kubelet for the feature to work. + a feature gate `KubeletCredentialProviders` must be enabled on only the kubelet for the feature to work. * A working implementation of a credential provider exec plugin. You can build your own plugin or use one provided by cloud providers. @@ -41,17 +41,19 @@ every node in your cluster and stored in a known directory. The directory will b ## Configuring the Kubelet In order to use this feature, the kubelet expects two flags to be set: + * `--image-credential-provider-config` - the path to the credential provider plugin config file. * `--image-credential-provider-bin-dir` - the path to the directory where credential provider plugin binaries are located. ### Configure a kubelet credential provider The configuration file passed into `--image-credential-provider-config` is read by the kubelet to determine which exec plugins -should be invoked for which container images. Here's an example configuration file you may end up using if you are using the [ECR](https://aws.amazon.com/ecr/)-based plugin: +should be invoked for which container images. Here's an example configuration file you may end up using if you are using the +[ECR](https://aws.amazon.com/ecr/)-based plugin: ```yaml -kind: CredentialProviderConfig apiVersion: kubelet.config.k8s.io/v1alpha1 +kind: CredentialProviderConfig # providers is a list of credential provider plugins that will be enabled by the kubelet. # Multiple providers may match against a single image, in which case credentials # from all providers will be returned to the kubelet. If multiple providers are called @@ -86,11 +88,11 @@ providers: # - *.*.registry.io # - registry.io:8080/path matchImages: - - "*.dkr.ecr.*.amazonaws.com" - - "*.dkr.ecr.*.amazonaws.cn" - - "*.dkr.ecr-fips.*.amazonaws.com" - - "*.dkr.ecr.us-iso-east-1.c2s.ic.gov" - - "*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov" + - "*.dkr.ecr.*.amazonaws.com" + - "*.dkr.ecr.*.amazonaws.cn" + - "*.dkr.ecr-fips.*.amazonaws.com" + - "*.dkr.ecr.us-iso-east-1.c2s.ic.gov" + - "*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov" # defaultCacheDuration is the default duration the plugin will cache credentials in-memory # if a cache duration is not provided in the plugin response. This field is required. defaultCacheDuration: "12h" @@ -101,23 +103,28 @@ providers: # Arguments to pass to the command when executing it. # +optional args: - - get-credentials + - get-credentials # Env defines additional environment variables to expose to the process. These # are unioned with the host's environment, as well as variables client-go uses # to pass argument to the plugin. # +optional env: - - name: AWS_PROFILE - value: example_profile + - name: AWS_PROFILE + value: example_profile ``` The `providers` field is a list of enabled plugins used by the kubelet. Each entry has a few required fields: -* `name`: the name of the plugin which MUST match the name of the executable binary that exists in the directory passed into `--image-credential-provider-bin-dir`. -* `matchImages`: a list of strings used to match against images in order to determine if this provider should be invoked. More on this below. -* `defaultCacheDuration`: the default duration the kubelet will cache credentials in-memory if a cache duration was not specified by the plugin. -* `apiVersion`: the api version that the kubelet and the exec plugin will use when communicating. -Each credential provider can also be given optional args and environment variables as well. Consult the plugin implementors to determine what set of arguments and environment variables are required for a given plugin. +* `name`: the name of the plugin which MUST match the name of the executable binary that exists + in the directory passed into `--image-credential-provider-bin-dir`. +* `matchImages`: a list of strings used to match against images in order to determine + if this provider should be invoked. More on this below. +* `defaultCacheDuration`: the default duration the kubelet will cache credentials in-memory + if a cache duration was not specified by the plugin. +* `apiVersion`: the API version that the kubelet and the exec plugin will use when communicating. + +Each credential provider can also be given optional args and environment variables as well. +Consult the plugin implementors to determine what set of arguments and environment variables are required for a given plugin. #### Configure image matching @@ -134,8 +141,15 @@ A match exists between an image name and a `matchImage` entry when all of the be * If the imageMatch contains a port, then the port must match in the image as well. Some example values of `matchImages` patterns are: + * `123456789.dkr.ecr.us-east-1.amazonaws.com` * `*.azurecr.io` * `gcr.io` * `*.*.registry.io` * `foo.registry.io:8080/path` + +## {{% heading "whatsnext" %}} + +* Read the details about `CredentialProviderConfig` in the + [kubelet configuration API (v1alpha1) reference](/docs/reference/config-api/kubelet-config.v1alpha1/). + diff --git a/content/en/docs/tasks/manage-kubernetes-objects/kustomization.md b/content/en/docs/tasks/manage-kubernetes-objects/kustomization.md index fa7c59ec90..f391b37e09 100644 --- a/content/en/docs/tasks/manage-kubernetes-objects/kustomization.md +++ b/content/en/docs/tasks/manage-kubernetes-objects/kustomization.md @@ -86,12 +86,20 @@ metadata: name: example-configmap-1-8mbdf7882g ``` -To generate a ConfigMap from an env file, add an entry to the `envs` list in `configMapGenerator`. Here is an example of generating a ConfigMap with a data item from a `.env` file: +To generate a ConfigMap from an env file, add an entry to the `envs` list in `configMapGenerator`. This can also be used to set values from local environment variables by omitting the `=` and the value. + +{{< note >}} +It's recommended to use the local environment variable population functionality sparingly - an overlay with a patch is often more maintainable. Setting values from the environment may be useful when they cannot easily be predicted, such as a git SHA. +{{< /note >}} + +Here is an example of generating a ConfigMap with a data item from a `.env` file: ```shell # Create a .env file +# BAZ will be populated from the local environment variable $BAZ cat <.env FOO=Bar +BAZ EOF cat <./kustomization.yaml @@ -105,7 +113,7 @@ EOF The generated ConfigMap can be examined with the following command: ```shell -kubectl kustomize ./ +BAZ=Qux kubectl kustomize ./ ``` The generated ConfigMap is: @@ -113,10 +121,11 @@ The generated ConfigMap is: ```yaml apiVersion: v1 data: + BAZ: Qux FOO: Bar kind: ConfigMap metadata: - name: example-configmap-1-42cfbf598f + name: example-configmap-1-892ghb99c8 ``` {{< note >}} @@ -748,8 +757,8 @@ Since the Service name may change as `namePrefix` or `nameSuffix` is added in th not recommended to hard code the Service name in the command argument. For this usage, Kustomize can inject the Service name into containers through `vars`. ```shell -# Create a deployment.yaml file -cat < deployment.yaml +# Create a deployment.yaml file (quoting the here doc delimiter) +cat <<'EOF' > deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: diff --git a/content/en/docs/tasks/tools/install-kubectl-linux.md b/content/en/docs/tasks/tools/install-kubectl-linux.md index 5e3ce1b76b..dcb6e2d6c9 100644 --- a/content/en/docs/tasks/tools/install-kubectl-linux.md +++ b/content/en/docs/tasks/tools/install-kubectl-linux.md @@ -52,7 +52,7 @@ For example, to download version {{< param "fullversion" >}} on Linux, type: Validate the kubectl binary against the checksum file: ```bash - echo "$(}} and create a simple cluster using Minikube. + diff --git a/content/en/docs/tutorials/security/cluster-level-pss.md b/content/en/docs/tutorials/security/cluster-level-pss.md index e2d37b765a..fb610f99a9 100644 --- a/content/en/docs/tutorials/security/cluster-level-pss.md +++ b/content/en/docs/tutorials/security/cluster-level-pss.md @@ -93,7 +93,7 @@ that are most appropriate for your configuration, do the following: 1. Privileged ```shell - kubectl label --dry-run=server --overwrite ns --all \ + kubectl label --dry-run=server --overwrite ns --all \ pod-security.kubernetes.io/enforce=privileged ``` The output is similar to this: @@ -304,8 +304,8 @@ following: ## Clean up -Run `kind delete cluster -name psa-with-cluster-pss` and -`kind delete cluster -name psa-wo-cluster-pss` to delete the clusters you +Run `kind delete cluster --name psa-with-cluster-pss` and +`kind delete cluster --name psa-wo-cluster-pss` to delete the clusters you created. ## {{% heading "whatsnext" %}} diff --git a/content/en/examples/application/job/cronjob.yaml b/content/en/examples/application/job/cronjob.yaml index da905a9048..9f06ca7bd6 100644 --- a/content/en/examples/application/job/cronjob.yaml +++ b/content/en/examples/application/job/cronjob.yaml @@ -3,7 +3,7 @@ kind: CronJob metadata: name: hello spec: - schedule: "*/1 * * * *" + schedule: "* * * * *" jobTemplate: spec: template: diff --git a/content/en/examples/examples_test.go b/content/en/examples/examples_test.go index a31d01b130..ac50cdfe4c 100644 --- a/content/en/examples/examples_test.go +++ b/content/en/examples/examples_test.go @@ -160,10 +160,6 @@ func validateObject(obj runtime.Object) (errors field.ErrorList) { AllowPodAffinityNamespaceSelector: true, } - pspValidationOptions := policy_validation.PodSecurityPolicyValidationOptions{ - AllowEphemeralVolumeType: true, - } - // Enable CustomPodDNS for testing // feature.DefaultFeatureGate.Set("CustomPodDNS=true") switch t := obj.(type) { @@ -283,11 +279,7 @@ func validateObject(obj runtime.Object) (errors field.ErrorList) { if t.Namespace == "" { t.Namespace = api.NamespaceDefault } - gv := schema.GroupVersion{ - Group: networking.GroupName, - Version: legacyscheme.Scheme.PrioritizedVersionsForGroup(networking.GroupName)[0].Version, - } - errors = networking_validation.ValidateIngressCreate(t, gv) + errors = networking_validation.ValidateIngressCreate(t) case *networking.IngressClass: /* if t.Namespace == "" { @@ -301,7 +293,7 @@ func validateObject(obj runtime.Object) (errors field.ErrorList) { errors = networking_validation.ValidateIngressClass(t) case *policy.PodSecurityPolicy: - errors = policy_validation.ValidatePodSecurityPolicy(t, pspValidationOptions) + errors = policy_validation.ValidatePodSecurityPolicy(t) case *apps.ReplicaSet: if t.Namespace == "" { t.Namespace = api.NamespaceDefault @@ -405,7 +397,7 @@ func TestExampleObjectSchemas(t *testing.T) { }, "admin/dns": { "busybox": {&api.Pod{}}, - "dns-horizontal-autoscaler": {&apps.Deployment{}}, + "dns-horizontal-autoscaler": {&api.ServiceAccount{}, &rbac.ClusterRole{}, &rbac.ClusterRoleBinding{}, &apps.Deployment{}}, "dnsutils": {&api.Pod{}}, }, "admin/logging": { @@ -453,7 +445,7 @@ func TestExampleObjectSchemas(t *testing.T) { }, "admin/sched": { "clusterrole": {&rbac.ClusterRole{}}, - "my-scheduler": {&api.ServiceAccount{}, &rbac.ClusterRoleBinding{}, &rbac.ClusterRoleBinding{}, &apps.Deployment{}}, + "my-scheduler": {&api.ServiceAccount{}, &rbac.ClusterRoleBinding{}, &rbac.ClusterRoleBinding{}, &api.ConfigMap{}, &apps.Deployment{}}, "pod1": {&api.Pod{}}, "pod2": {&api.Pod{}}, "pod3": {&api.Pod{}}, @@ -592,6 +584,7 @@ func TestExampleObjectSchemas(t *testing.T) { }, "pods/probe": { "exec-liveness": {&api.Pod{}}, + "grpc-liveness": {&api.Pod{}}, "http-liveness": {&api.Pod{}}, "pod-with-http-healthcheck": {&api.Pod{}}, "pod-with-tcp-socket-healthcheck": {&api.Pod{}}, @@ -620,11 +613,15 @@ func TestExampleObjectSchemas(t *testing.T) { "security-context-4": {&api.Pod{}}, }, "pods/storage": { - "projected": {&api.Pod{}}, - "pv-claim": {&api.PersistentVolumeClaim{}}, - "pv-pod": {&api.Pod{}}, - "pv-volume": {&api.PersistentVolume{}}, - "redis": {&api.Pod{}}, + "projected": {&api.Pod{}}, + "projected-secret-downwardapi-configmap": {&api.Pod{}}, + "projected-secrets-nondefault-permission-mode": {&api.Pod{}}, + "projected-service-account-token": {&api.Pod{}}, + "pv-claim": {&api.PersistentVolumeClaim{}}, + "pv-duplicate": {&api.Pod{}}, + "pv-pod": {&api.Pod{}}, + "pv-volume": {&api.PersistentVolume{}}, + "redis": {&api.Pod{}}, }, "policy": { "baseline-psp": {&policy.PodSecurityPolicy{}}, diff --git a/content/en/examples/pods/storage/projected-service-account-token.yaml b/content/en/examples/pods/storage/projected-service-account-token.yaml index 353271a067..3ad06b5dc7 100644 --- a/content/en/examples/pods/storage/projected-service-account-token.yaml +++ b/content/en/examples/pods/storage/projected-service-account-token.yaml @@ -10,6 +10,7 @@ spec: - name: token-vol mountPath: "/service-account" readOnly: true + serviceAccountName: default volumes: - name: token-vol projected: diff --git a/content/en/examples/pods/storage/pv-duplicate.yaml b/content/en/examples/pods/storage/pv-duplicate.yaml index 15a48acbed..e5a0e6ff69 100644 --- a/content/en/examples/pods/storage/pv-duplicate.yaml +++ b/content/en/examples/pods/storage/pv-duplicate.yaml @@ -8,13 +8,15 @@ spec: - name: test image: nginx volumeMounts: - - name: site-data + # a mount for site-data + - name: config mountPath: /usr/share/nginx/html subPath: html + # another mount for nginx config - name: config mountPath: /etc/nginx/nginx.conf subPath: nginx.conf volumes: - name: config persistentVolumeClaim: - claimName: test-nfs-claim \ No newline at end of file + claimName: test-nfs-claim diff --git a/content/en/releases/patch-releases.md b/content/en/releases/patch-releases.md index b53adbc175..f241692009 100644 --- a/content/en/releases/patch-releases.md +++ b/content/en/releases/patch-releases.md @@ -78,21 +78,32 @@ releases may also occur in between these. | Monthly Patch Release | Cherry Pick Deadline | Target date | | --------------------- | -------------------- | ----------- | -| December 2021 | 2021-12-10 | 2021-12-15 | -| January 2022 | 2021-01-14 | 2021-01-19 | -| February 2022 | 2021-02-11 | 2021-02-16 | -| March 2022 | 2021-03-11 | 2021-03-16 | +| January 2022 | 2022-01-14 | 2022-01-19 | +| February 2022 | 2022-02-11 | 2022-02-16 | +| March 2022 | 2022-03-11 | 2022-03-16 | ## Detailed Release History for Active Branches +### 1.23 + +**1.23** enters maintenance mode on **2022-12-28**. + +End of Life for **1.23** is **2023-02-28**. + +| Patch Release | Cherry Pick Deadline | Target Date | Note | +|---------------|----------------------|-------------|------| +| 1.23.2 | 2022-01-14 | 2022-01-19 | | +| 1.23.1 | 2021-12-14 | 2021-12-16 | | + ### 1.22 **1.22** enters maintenance mode on **2022-08-28** End of Life for **1.22** is **2022-10-28** -| PATCH RELEASE | CHERRY PICK DEADLINE | TARGET DATE | NOTE | +| Patch Release | Cherry Pick Deadline | Target Date | Note | |---------------|----------------------|-------------|------| +| 1.22.6 | 2022-01-14 | 2022-01-19 | | | 1.22.5 | 2021-12-10 | 2021-12-15 | | | 1.22.4 | 2021-11-12 | 2021-11-17 | | | 1.22.3 | 2021-10-22 | 2021-10-27 | | @@ -105,8 +116,9 @@ End of Life for **1.22** is **2022-10-28** End of Life for **1.21** is **2022-06-28** -| PATCH RELEASE | CHERRY PICK DEADLINE | TARGET DATE | NOTE | +| Patch Release | Cherry Pick Deadline | Target Date | Note | | ------------- | -------------------- | ----------- | ---------------------------------------------------------------------- | +| 1.21.9 | 2022-01-14 | 2022-01-19 | | | 1.21.8 | 2021-12-10 | 2021-12-15 | | | 1.21.7 | 2021-11-12 | 2021-11-17 | | | 1.21.6 | 2021-10-22 | 2021-10-27 | | @@ -122,8 +134,9 @@ End of Life for **1.21** is **2022-06-28** End of Life for **1.20** is **2022-02-28** -| PATCH RELEASE | CHERRY PICK DEADLINE | TARGET DATE | NOTE | +| Patch Release | Cherry Pick Deadline | Target Date | Note | | ------------- | -------------------- | ----------- | ----------------------------------------------------------------------------------- | +| 1.20.15 | 2022-01-14 | 2022-01-19 | | | 1.20.14 | 2021-12-10 | 2021-12-15 | | | 1.20.13 | 2021-11-12 | 2021-11-17 | | | 1.20.12 | 2021-10-22 | 2021-10-27 | | @@ -144,7 +157,7 @@ End of Life for **1.20** is **2022-02-28** These releases are no longer supported. -| MINOR VERSION | FINAL PATCH RELEASE | EOL DATE | NOTE | +| Minor Version | Final Patch Release | EOL Date | Note | | ------------- | ------------------- | ---------- | ---------------------------------------------------------------------- | | 1.19 | 1.19.16 | 2021-10-28 | | | 1.18 | 1.18.20 | 2021-06-18 | Created to resolve regression introduced in 1.18.19 | diff --git a/content/en/releases/release-managers.md b/content/en/releases/release-managers.md index 59cb789142..e45c2858d6 100644 --- a/content/en/releases/release-managers.md +++ b/content/en/releases/release-managers.md @@ -89,6 +89,7 @@ GitHub Mentions: [@kubernetes/release-engineering](https://github.com/orgs/kuber - Adolfo García Veytia ([@puerco](https://github.com/puerco)) - Carlos Panato ([@cpanato](https://github.com/cpanato)) - Marko Mudrinić ([@xmudrii](https://github.com/xmudrii)) +- Nabarun Pal ([@palnabarun](https://github.com/palnabarun)) - Sascha Grunert ([@saschagrunert](https://github.com/saschagrunert)) - Stephen Augustus ([@justaugustus](https://github.com/justaugustus)) - Verónica López ([@verolop](https://github.com/verolop)) @@ -135,7 +136,6 @@ GitHub Mentions: @kubernetes/release-engineering - Jim Angel ([@jimangel](https://github.com/jimangel)) - Joyce Kung ([@thejoycekung](https://github.com/thejoycekung)) - Max Körbächer ([@mkorbi](https://github.com/mkorbi)) -- Nabarun Pal ([@palnabarun](https://github.com/palnabarun)) - Seth McCombs ([@sethmccombs](https://github.com/sethmccombs)) - Taylor Dolezal ([@onlydole](https://github.com/onlydole)) - Wilson Husin ([@wilsonehusin](https://github.com/wilsonehusin)) diff --git a/content/en/releases/version-skew-policy.md b/content/en/releases/version-skew-policy.md index 56a7afda10..87f6cf2c62 100644 --- a/content/en/releases/version-skew-policy.md +++ b/content/en/releases/version-skew-policy.md @@ -28,9 +28,9 @@ The Kubernetes project maintains release branches for the most recent three mino Applicable fixes, including security fixes, may be backported to those three release branches, depending on severity and feasibility. Patch releases are cut from those branches at a [regular cadence](https://git.k8s.io/sig-release/releases/patch-releases.md#cadence), plus additional urgent releases, when required. -The [Release Managers](https://git.k8s.io/sig-release/release-managers.md) group owns this decision. +The [Release Managers](/releases/release-managers/) group owns this decision. -For more information, see the Kubernetes [patch releases](https://git.k8s.io/sig-release/releases/patch-releases.md) page. +For more information, see the Kubernetes [patch releases](/releases/patch-releases/) page. ## Supported version skew diff --git a/content/es/docs/concepts/security/controlling-access.md b/content/es/docs/concepts/security/controlling-access.md new file mode 100644 index 0000000000..8d33ac49b4 --- /dev/null +++ b/content/es/docs/concepts/security/controlling-access.md @@ -0,0 +1,179 @@ +--- +reviewers: +- electrocucaracha +- raelga +title: Controlando el Acceso a la API de Kubernetes +content_type: concept +--- + + +Esta página proporciona información sobre cómo controlar el acceso a la API de Kubernetes. + + + +Los usuarios acceden a la [API de Kubernetes](/docs/concepts/overview/kubernetes-api/) usando `kubectl`, +bibliotecas de cliente, o haciendo peticiones REST. Usuarios y +[Kubernetes service accounts](/docs/tasks/configure-pod-container/configure-service-account/) pueden ser +autorizados para acceder a la API. +Cuando una petición llega a la API, pasa por varias etapas, están ilustradas en el +siguiente diagrama: + +![Diagrama de pasos para una petición a la API de Kubernetes](/images/docs/admin/access-control-overview.svg) + +## Seguridad en la capa de transporte + +En un {{< glossary_tooltip term_id="cluster" text="cluster" >}} típico de Kubernetes, la API sirve peticiones en el puerto 443, protegida por TLS. +El {{< glossary_tooltip term_id="kube-apiserver" text="API Server" >}} presenta un certificado. Este certificado puede ser firmando usando +un certificado de autoridad privada (CA) o basado en una llave pública relacionada +generalmente a un CA reconocido. + +Si el cluster usa un certificado de autoridad privado, se necesita copiar este certificado +CA configurado dentro de su `~/.kube/config` en el cliente, entonces se podrá +confiar en la conexión y estar seguro que no será comprometida. + +El cliente puede presentar un certificado TLS de cliente en esta etapa. + +## Autenticación + +Una vez que se estableció la conexión TLS, las peticiones HTTP avanzan a la etapa de autenticación. +Esto se muestra en el paso 1 del diagrama. +El script de creación del cluster o el administrador del cluster puede configurar el {{< glossary_tooltip term_id="kube-apiserver" text="API Server" >}} para ejecutar +uno o mas módulos de autenticación. +Los Autenticadores están descritos con más detalle en +[Authentication](/docs/reference/access-authn-authz/authentication/). + +La entrada al paso de autenticación es la petición HTTP completa, aun así, esta tipicamente +examina las cabeceras y/o el certificado del cliente. + +Los modulos de autenticación incluyen certificado de cliente, contraseña, tokens planos, +tokens de inicio y JSON Web Tokens (usados para los service accounts). + +Múltiples módulos de autenticación puede ser especificados, en este caso cada uno es probado secuencialmente, +hasta que uno de ellos tiene éxito. + +Si la petición no puede ser autenticada, la misma es rechazada con un código HTTP 401. +Si la autenticación tiene éxito, el usuario es validado con el `username` específico, y el nombre de usuario +esta disponible para los pasos siguientes. Algunos autenticadores +también proporcionan membresías de grupo al usuario, mientras que otros +no lo hacen. + +Aunque Kubernetes utiliza los nombres de usuario para tomar decisiones durante el control de acceso y para registrar las peticiones de entrada, no tiene un objeto `User` ni tampoco almacena información sobre los usuarios en la API. + +## Autorización + +Después de autenticar la petición como proveniente de un usuario específico, la petición debe ser autorizada. Esto se muestra en el paso 2 del diagrama. + +Una petición debe incluir el nombre de usuario solicitante, la acción solicitada y el objeto afectado por la acción. La petición es autorizada si hay una política existente que declare que el usuario tiene permisos para la realizar la acción. + +Por ejemplo, si el usuario Bob tiene la siguiente política, entonces puede leer pods solamente en el namespace `projectCaribou`: + +```json +{ + "apiVersion": "abac.authorization.kubernetes.io/v1beta1", + "kind": "Policy", + "spec": { + "user": "bob", + "namespace": "projectCaribou", + "resource": "pods", + "readonly": true + } +} +``` +Si Bob hace la siguiente petición, será autorizada dado que tiene permitido leer los objetos en el namespace `projectCaribou` : + +```json +{ + "apiVersion": "authorization.k8s.io/v1beta1", + "kind": "SubjectAccessReview", + "spec": { + "resourceAttributes": { + "namespace": "projectCaribou", + "verb": "get", + "group": "unicorn.example.org", + "resource": "pods" + } + } +} +``` +En cambio, si Bob en su petición intenta escribir (`create` o `update`) en los objetos del namespace `projectCaribou`, la petición será denegada. Del mismo modo, si Bob hace una petición para leer (`get`) objetos en otro namespace como `projectFish`, la autorización también será denegada. + +Las autorizaciones en Kubernetes requieren que se usen atributos REST comunes para interactuar con el existente sistema de control de toda la organización o del proveedor cloud. Es importante usar formatos REST porque esos sistemas de control pueden interactuar con otras APIs además de la API de Kubernetes. + +Kubernetes soporta múltiples módulos de autorización, como el modo ABAC, el modo RBAC y el modo Webhook. Cuando un administrador crea un cluster, se realiza la configuración de los módulos de autorización que deben ser usados con la API del server. Si más de uno módulo de autorización es configurado, Kubernetes verificada cada uno y si alguno de ellos autoriza la petición entonces la misma se ejecuta. Si todos los modules deniegan la petición, entonces la misma es denegada (Con un error HTTP con código 403). + +Para leer más acerca de las autorizaciones en Kubernetes, incluyendo detalles sobre cómo crear politicas usando los módulos de autorización soportados, vea [Authorization](/docs/reference/access-authn-authz/authorization/). + + +## Control de Admisión + +Los módulos de Control de Admisión son módulos de software que solo pueden modificar o rechazar peticiones. +Adicionalmente a los atributos disponibles en los módulos de Autorización, los de +Control de Admisión pueden acceder al contenido del objeto que esta siendo creado o modificado. + +Los Controles de Admisión actúan en las peticiones que crean, modifican, borran o se conectan (proxy) a un objeto. +Cuando múltiples módulos de control de admisión son configurados, son llamados en orden. + +Esto se muestra en el paso 3 del diagrama. + +A diferencia de los módulos de Autorización y Autenticación, si uno de los módulos de control de admisión +rechaza la petición, entonces es inmediatamente rechazada. + +Adicionalmente a rechazar objetos, los controles de admisión también permiten establecer +valores predeterminados complejos. + +Los módulos de Control de Admisión disponibles están descritos en [Admission Controllers](/docs/reference/access-authn-authz/admission-controllers/). + +Cuando una petición pasa todos los controles de admisión, esta es validada usando la rutinas de validación +para el objeto API correspondiente y luego es escrita en el objeto. + + +## Puertos e IPs del API server + +La discusión previa aplica a peticiones enviadas a un puerto seguro del servidor API +(el caso típico). El servidor API puede en realidad servir en 2 puertos: + +Por defecto, la API de Kubernetes entrega HTTP en 2 puertos: + + 1. puerto `localhost`: + + - debe usarse para testeo e iniciar el sistema y para otros componentes del nodo maestro + (scheduler, controller-manager) para hablar con la API + - no se usa TLS + - el puerto predeterminado es el `8080` + - la IP por defecto es localhost, la puede cambiar con el flag `--insecure-bind-address`. + - la petición no pasa por los mecanismos de autenticación ni autorización + - peticiones controladas por los modulos de control de admisión. + - protegidas por necesidad para tener acceso al host + + 2. “Puerto seguro”: + + - usar siempre que sea posible + - usa TLS. Se configura el certificado con el flag `--tls-cert-file` y la clave con `--tls-private-key-file`. + - el puerto predeterminado es `6443`, se cambia con el flag `--secure-port`. + - la IP por defecto es la primer interface que no es la localhost. se cambia con el flag `--bind-address`. + - peticiones controladas por los módulos de autenticación y autorización. + - peticiones controladas por los módulos de control de admisión. + +## {{% heading "whatsnext" %}} + +En los siguientes enlaces, encontrará mucha más documentación sobre autenticación, autorización y el control de acceso a la API: + +- [Authenticating](/docs/reference/access-authn-authz/authentication/) + - [Authenticating with Bootstrap Tokens](/docs/reference/access-authn-authz/bootstrap-tokens/) +- [Admission Controllers](/docs/reference/access-authn-authz/admission-controllers/) + - [Dynamic Admission Control](/docs/reference/access-authn-authz/extensible-admission-controllers/) +- [Authorization](/docs/reference/access-authn-authz/authorization/) + - [Role Based Access Control](/docs/reference/access-authn-authz/rbac/) + - [Attribute Based Access Control](/docs/reference/access-authn-authz/abac/) + - [Node Authorization](/docs/reference/access-authn-authz/node/) + - [Webhook Authorization](/docs/reference/access-authn-authz/webhook/) +- [Certificate Signing Requests](/docs/reference/access-authn-authz/certificate-signing-requests/) + - including [CSR approval](/docs/reference/access-authn-authz/certificate-signing-requests/#approval-rejection) + and [certificate signing](/docs/reference/access-authn-authz/certificate-signing-requests/#signing) +- Service accounts + - [Developer guide](/docs/tasks/configure-pod-container/configure-service-account/) + - [Administration](/docs/reference/access-authn-authz/service-accounts-admin/) + +- Como los pods pueden usar + [Secrets](/docs/concepts/configuration/secret/#service-accounts-automatically-create-and-attach-secrets-with-api-credentials) + para obtener credenciales para la API. diff --git a/content/es/docs/concepts/services-networking/service.md b/content/es/docs/concepts/services-networking/service.md index 0879e7f20a..5ef231df3a 100644 --- a/content/es/docs/concepts/services-networking/service.md +++ b/content/es/docs/concepts/services-networking/service.md @@ -393,7 +393,7 @@ Los `ServiceTypes` de Kubernetes permiten especificar qué tipo de Service quier Los valores `Type` y sus comportamientos son: - `ClusterIP`: Expone el Service en una dirección IP interna del clúster. Al escoger este valor el Service solo es alcanzable desde el clúster. Este es el `ServiceType` por defecto. -- [`NodePort`](#nodeport): Expone el Service en cada IP del nodo en un puerto estático (el `NodePort`). Automáticamente se crea un Service `ClusterIP`, al cual enruta el `NodePort`del Service. Podrás alcanzar el Service `NodePort` desde fuera del clúster, haciendo una petición a `:`. +- [`NodePort`](#tipo-nodeport): Expone el Service en cada IP del nodo en un puerto estático (el `NodePort`). Automáticamente se crea un Service `ClusterIP`, al cual enruta el `NodePort`del Service. Podrás alcanzar el Service `NodePort` desde fuera del clúster, haciendo una petición a `:`. - [`LoadBalancer`](#loadbalancer): Expone el Service externamente usando el balanceador de carga del proveedor de la nube. Son creados automáticamente Services `NodePort`y `ClusterIP`, a los cuales el apuntará el balanceador externo. - [`ExternalName`](#externalname): Mapea el Service al contenido del campo `externalName` (ej. `foo.bar.example.com`), al devolver un registro `CNAME` con su valor. No se configura ningún tipo de proxy. @@ -403,7 +403,7 @@ Los valores `Type` y sus comportamientos son: También puedes usar un [Ingress](/docs/concepts/services-networking/ingress/) para exponer tu Service. Ingress no es un tipo de Service, pero actúa como el punto de entrada de tu clúster. Te permite consolidar tus reglas de enrutamiento en un único recurso, ya que puede exponer múltiples servicios bajo la misma dirección IP. -### Tipo NodePort {#nodeport} +### Tipo NodePort {#tipo-nodeport} Si estableces el campo `type` a `NodePort`, el plano de control de Kubernetes asigna un puerto desde un rango especificado por la bandera `--service-node-port-range` (por defecto: 30000-32767). Cada nodo es un proxy de ese puerto (el mismo número de puerto en cada nodo) hacia tu Service. Tu Service reporta al puerto asignado en el campo `.spec.ports[*].nodePort` diff --git a/content/es/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md b/content/es/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md index b1398e2faa..9e7097ffbc 100644 --- a/content/es/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md +++ b/content/es/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md @@ -44,7 +44,7 @@ de datos de uso de recursos de todo el clúster. A partir de Kubernetes 1.8, el servidor de métricas se despliega por defecto como un objeto de tipo [Deployment](https://github.com/docs/concepts/workloads/controllers/deployment/) en clústeres creados con el script `kube-up.sh`. Si usas otro mecanismo de configuración de Kubernetes, puedes desplegarlo -usando los [yamls de despliegue](https://github.com/kubernetes-incubator/metrics-server/tree/master/deploy) +usando los [yamls de despliegue](https://github.com/kubernetes-sigs/metrics-server/releases) proporcionados. Está soportado a partir de Kubernetes 1.7 (más detalles al final). El servidor reune métricas de la Summary API, que es expuesta por el [Kubelet](/docs/admin/kubelet/) en cada nodo. diff --git a/content/fr/docs/concepts/services-networking/service.md b/content/fr/docs/concepts/services-networking/service.md index 3360c48428..f1cec8633f 100644 --- a/content/fr/docs/concepts/services-networking/service.md +++ b/content/fr/docs/concepts/services-networking/service.md @@ -363,7 +363,7 @@ Les valeurs de `Type` et leurs comportements sont: * `ClusterIP`: Expose le service sur une IP interne au cluster. Le choix de cette valeur rend le service uniquement accessible à partir du cluster. Il s'agit du `ServiceType` par défaut. - * [`NodePort`](#nodeport): Expose le service sur l'IP de chaque nœud sur un port statique (le `NodePort`). + * [`NodePort`](#type-nodeport): Expose le service sur l'IP de chaque nœud sur un port statique (le `NodePort`). Un service `ClusterIP`, vers lequel le service` NodePort` est automatiquement créé. Vous pourrez contacter le service `NodePort`, depuis l'extérieur du cluster, en demandant `: `. * [`LoadBalancer`](#loadbalancer): Expose le service en externe à l'aide de l'équilibreur de charge d'un fournisseur de cloud. @@ -378,7 +378,7 @@ Vous pouvez également utiliser [Ingress](/fr/docs/concepts/services-networking/ Ingress n'est pas un type de service, mais il sert de point d'entrée pour votre cluster. Il vous permet de consolider vos règles de routage en une seule ressource car il peut exposer plusieurs services sous la même adresse IP. -### Type NodePort {#nodeport} +### Type NodePort {#type-nodeport} Si vous définissez le champ `type` sur` NodePort`, le plan de contrôle Kubernetes alloue un port à partir d'une plage spécifiée par l'indicateur `--service-node-port-range` (par défaut: 30000-32767). Chaque nœud assure le proxy de ce port (le même numéro de port sur chaque nœud) vers votre service. diff --git a/content/id/docs/concepts/cluster-administration/addons.md b/content/id/docs/concepts/cluster-administration/addons.md index e8a52a4910..5d44364314 100644 --- a/content/id/docs/concepts/cluster-administration/addons.md +++ b/content/id/docs/concepts/cluster-administration/addons.md @@ -29,7 +29,7 @@ Laman ini akan menjabarkan beberapa *add-ons* yang tersedia serta tautan instruk * [Contrail](http://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/), yang berbasis dari [Tungsten Fabric](https://tungsten.io), merupakan sebuah proyek *open source* yang menyediakan virtualisasi jaringan *multi-cloud* serta platform manajemen *policy*. Contrail dan Tungsten Fabric terintegrasi dengan sistem orkestrasi lainnya seperti Kubernetes, OpenShift, OpenStack dan Mesos, serta menyediakan mode isolasi untuk mesin virtual (VM), kontainer/pod dan *bare metal*. * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually) merupakan penyedia jaringan *overlay* yang dapat digunakan pada Kubernetes. * [Knitter](https://github.com/ZTE/Knitter/) merupakan solusi jaringan yang mendukung multipel jaringan pada Kubernetes. -* [Multus](https://github.com/Intel-Corp/multus-cni) merupakan sebuah multi *plugin* agar Kubernetes mendukung multipel jaringan secara bersamaan sehingga dapat menggunakan semua *plugin* CNI (contoh: Calico, Cilium, Contiv, Flannel), ditambah pula dengan SRIOV, DPDK, OVS-DPDK dan VPP pada *workload* Kubernetes. +* Multus merupakan sebuah multi *plugin* agar Kubernetes mendukung multipel jaringan secara bersamaan sehingga dapat menggunakan semua *plugin* CNI (contoh: Calico, Cilium, Contiv, Flannel), ditambah pula dengan SRIOV, DPDK, OVS-DPDK dan VPP pada *workload* Kubernetes. * [NSX-T](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf) Container Plug-in (NCP) menyediakan integrasi antara VMware NSX-T dan orkestrator kontainer seperti Kubernetes, termasuk juga integrasi antara NSX-T dan platform CaaS/PaaS berbasis kontainer seperti *Pivotal Container Service* (PKS) dan OpenShift. * [Nuage](https://github.com/nuagenetworks/nuage-kubernetes/blob/v5.1.1-1/docs/kubernetes-1-installation.rst) merupakan platform SDN yang menyediakan *policy-based* jaringan antara Kubernetes Pods dan non-Kubernetes *environment* dengan *monitoring* visibilitas dan keamanan. * [Romana](http://romana.io) merupakan solusi jaringan *Layer* 3 untuk jaringan pod yang juga mendukung [*NetworkPolicy* API](/id/docs/concepts/services-networking/network-policies/). Instalasi Kubeadm *add-on* ini tersedia [di sini](https://github.com/romana/romana/tree/master/containerize). diff --git a/content/id/docs/concepts/cluster-administration/networking.md b/content/id/docs/concepts/cluster-administration/networking.md index 6bcd78d7ef..114f960d49 100644 --- a/content/id/docs/concepts/cluster-administration/networking.md +++ b/content/id/docs/concepts/cluster-administration/networking.md @@ -195,10 +195,6 @@ Multus mendukung semua [plugin referensi](https://github.com/containernetworking Platform Nuage menggunakan _overlay_ untuk menyediakan jaringan berbasis kebijakan yang mulus antara Kubernetes Pod-Pod dan lingkungan non-Kubernetes (VM dan server _bare metal_). Model abstraksi kebijakan Nuage dirancang dengan mempertimbangkan aplikasi dan membuatnya mudah untuk mendeklarasikan kebijakan berbutir halus untuk aplikasi. Mesin analisis _real-time_ platform memungkinkan pemantauan visibilitas dan keamanan untuk aplikasi Kubernetes. -### OpenVSwitch - -[OpenVSwitch](https://www.openvswitch.org/) adalah cara yang agak lebih dewasa tetapi juga rumit untuk membangun jaringan _overlay_. Ini didukung oleh beberapa "Toko Besar" untuk jaringan. - ### OVN (Open Virtual Networking) OVN adalah solusi virtualisasi jaringan opensource yang dikembangkan oleh komunitas Open vSwitch. Ini memungkinkan seseorang membuat switch logis, router logis, ACL stateful, load-balancers dll untuk membangun berbagai topologi jaringan virtual. Proyek ini memiliki plugin dan dokumentasi Kubernetes spesifik di [ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes). diff --git a/content/id/docs/concepts/configuration/overview.md b/content/id/docs/concepts/configuration/overview.md index 51fb10f5ef..cb8f460381 100644 --- a/content/id/docs/concepts/configuration/overview.md +++ b/content/id/docs/concepts/configuration/overview.md @@ -21,7 +21,7 @@ Dokumentasi ini terbuka. Jika Anda menemukan sesuatu yang tidak ada dalam daftar - Tulis file konfigurasi Anda menggunakan YAML tidak dengan JSON. Meskipun format ini dapat digunakan secara bergantian di hampir semua skenario, YAML cenderung lebih ramah pengguna. -- Kelompokkan objek terkait ke dalam satu file yang memungkinkan. Satu file seringkali lebih mudah dikelola daripada beberapa file. Lihat pada [guestbook-all-in-one.yaml](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/all-in-one/guestbook-all-in-one.yaml) sebagai contoh file sintaks ini. +- Kelompokkan objek terkait ke dalam satu file yang memungkinkan. Satu file seringkali lebih mudah dikelola daripada beberapa file. Lihat pada [guestbook-all-in-one.yaml](https://github.com/kubernetes/examples/tree/master/guestbook/all-in-one/guestbook-all-in-one.yaml) sebagai contoh file sintaks ini. - Perhatikan juga bahwa banyak perintah `kubectl` dapat dipanggil pada direktori. Misalnya, Anda dapat memanggil `kubectl apply` pada direktori file konfigurasi. diff --git a/content/id/docs/concepts/services-networking/service.md b/content/id/docs/concepts/services-networking/service.md index 3c85c5abbf..f464e26468 100644 --- a/content/id/docs/concepts/services-networking/service.md +++ b/content/id/docs/concepts/services-networking/service.md @@ -387,7 +387,7 @@ _Value_ dan perilaku dari tipe `Service` dijelaskan sebagai berikut: * `ClusterIP`: Mengekspos `Service` ke _range_ alamat IP di dalam klaster. Apabila kamu memilih _value_ ini `Service` yang kamu miliki hanya dapat diakses secara internal. tipe ini adalah _default_ _value_ dari _ServiceType_. - * [`NodePort`](#nodeport): Mengekspos `Service` pada setiap IP *node* pada _port_ statis + * [`NodePort`](#type-nodeport): Mengekspos `Service` pada setiap IP *node* pada _port_ statis atau _port_ yang sama. Sebuah `Service` `ClusterIP`, yang mana `Service` `NodePort` akan di-_route_ , dibuat secara otomatis. Kamu dapat mengakses `Service` dengan tipe ini, dari luar klaster melalui `:`. @@ -399,7 +399,7 @@ _Value_ dan perilaku dari tipe `Service` dijelaskan sebagai berikut: catatan `CNAME` beserta _value_-nya. Tidak ada metode _proxy_ apa pun yang diaktifkan. Mekanisme ini setidaknya membutuhkan `kube-dns` versi 1.7. -### Type NodePort {#nodeport} +### Type NodePort {#type-nodeport} Jika kamu menerapkan _value_ `NodePort` pada _field_ _type_, master Kubernetes akan mengalokasikan _port_ dari _range_ yang dispesifikasikan oleh penanda `--service-node-port-range` (secara _default_, 30000-32767) diff --git a/content/it/docs/concepts/cluster-administration/addons.md b/content/it/docs/concepts/cluster-administration/addons.md index 8bd3c154af..5c2568ac60 100644 --- a/content/it/docs/concepts/cluster-administration/addons.md +++ b/content/it/docs/concepts/cluster-administration/addons.md @@ -28,7 +28,7 @@ I componenti aggiuntivi in ogni sezione sono ordinati alfabeticamente - l'ordine * [Contiv](http://contiv.github.io) offre networking configurabile (L3 nativo con BGP, overlay con vxlan, L2 classico e Cisco-SDN / ACI) per vari casi d'uso e un ricco framework di policy. Il progetto Contiv è completamente [open source](http://github.com/contiv). Il [programma di installazione](http://github.com/contiv/install) fornisce sia opzioni di installazione basate su kubeadm che non su Kubeadm. * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually) è un provider di reti sovrapposte che può essere utilizzato con Kubernetes. * [Knitter](https://github.com/ZTE/Knitter/) è una soluzione di rete che supporta più reti in Kubernetes. -* [Multus](https://github.com/Intel-Corp/multus-cni) è un multi-plugin per il supporto di più reti in Kubernetes per supportare tutti i plugin CNI (es. Calico, Cilium, Contiv, Flannel), oltre a SRIOV, DPDK, OVS-DPDK e carichi di lavoro basati su VPP in Kubernetes. +* Multus è un multi-plugin per il supporto di più reti in Kubernetes per supportare tutti i plugin CNI (es. Calico, Cilium, Contiv, Flannel), oltre a SRIOV, DPDK, OVS-DPDK e carichi di lavoro basati su VPP in Kubernetes. * [NSX-T](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf) Container Plug-in (NCP) fornisce l'integrazione tra VMware NSX-T e orchestratori di contenitori come Kubernetes, oltre all'integrazione tra NSX-T e piattaforme CaaS / PaaS basate su container come Pivotal Container Service (PKS) e OpenShift. * [Nuage](https://github.com/nuagenetworks/nuage-kubernetes/blob/v5.1.1/docs/kubernetes-1-installation.rst) è una piattaforma SDN che fornisce una rete basata su policy tra i pod di Kubernetes e non Kubernetes con visibilità e monitoraggio della sicurezza. * [Romana](http://romana.io) è una soluzione di rete Layer 3 per pod network che supporta anche [API NetworkPolicy](/docs/concepts/services-networking/network-policies/). Dettagli di installazione del componente aggiuntivo di Kubeadm disponibili [qui](https://github.com/romana/romana/tree/master/containerize). diff --git a/content/it/docs/concepts/cluster-administration/networking.md b/content/it/docs/concepts/cluster-administration/networking.md index 4c83d201e0..af99f91735 100644 --- a/content/it/docs/concepts/cluster-administration/networking.md +++ b/content/it/docs/concepts/cluster-administration/networking.md @@ -292,12 +292,6 @@ Nuage è stato progettato pensando alle applicazioni e semplifica la dichiarazio applicazioni. Il motore di analisi in tempo reale della piattaforma consente la visibilità e il monitoraggio della sicurezza per le applicazioni Kubernetes. -### OpenVSwitch - -[OpenVSwitch](https://www.openvswitch.org/) è un po 'più maturo ma anche -modo complicato per costruire una rete di sovrapposizione. Questo è approvato da molti dei -"Grandi negozi" per il networking. - ### OVN (Apri rete virtuale) OVN è una soluzione di virtualizzazione della rete opensource sviluppata da diff --git a/content/ja/docs/concepts/cluster-administration/addons.md b/content/ja/docs/concepts/cluster-administration/addons.md index c07cfce07c..b2d97790b4 100644 --- a/content/ja/docs/concepts/cluster-administration/addons.md +++ b/content/ja/docs/concepts/cluster-administration/addons.md @@ -25,7 +25,7 @@ content_type: concept * [Contrail](https://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/)は、[Tungsten Fabric](https://tungsten.io)をベースにしている、オープンソースでマルチクラウドに対応したネットワーク仮想化およびポリシー管理プラットフォームです。ContrailおよびTungsten Fabricは、Kubernetes、OpenShift、OpenStack、Mesosなどのオーケストレーションシステムと統合されており、仮想マシン、コンテナ/Pod、ベアメタルのワークロードに隔離モードを提供します。 * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually)は、Kubernetesで使用できるオーバーレイネットワークプロバイダーです。 * [Knitter](https://github.com/ZTE/Knitter/)は、1つのKubernetes Podで複数のネットワークインターフェイスをサポートするためのプラグインです。 -* [Multus](https://github.com/Intel-Corp/multus-cni)は、すべてのCNIプラグイン(たとえば、Calico、Cilium、Contiv、Flannel)に加えて、SRIOV、DPDK、OVS-DPDK、VPPをベースとするKubernetes上のワークロードをサポートする、複数のネットワークサポートのためのマルチプラグインです。 +* Multus は、すべてのCNIプラグイン(たとえば、Calico、Cilium、Contiv、Flannel)に加えて、SRIOV、DPDK、OVS-DPDK、VPPをベースとするKubernetes上のワークロードをサポートする、複数のネットワークサポートのためのマルチプラグインです。 * [OVN-Kubernetes](https://github.com/ovn-org/ovn-kubernetes/)は、Open vSwitch(OVS)プロジェクトから生まれた仮想ネットワーク実装である[OVN(Open Virtual Network)](https://github.com/ovn-org/ovn/)をベースとする、Kubernetesのためのネットワークプロバイダです。OVN-Kubernetesは、OVSベースのロードバランサーおよびネットワークポリシーの実装を含む、Kubernetes向けのオーバーレイベースのネットワーク実装を提供します。 * [OVN4NFV-K8S-Plugin](https://github.com/opnfv/ovn4nfv-k8s-plugin)は、クラウドネイティブベースのService function chaining(SFC)、Multiple OVNオーバーレイネットワーク、動的なサブネットの作成、動的な仮想ネットワークの作成、VLANプロバイダーネットワーク、Directプロバイダーネットワークを提供し、他のMulti-networkプラグインと付け替え可能なOVNベースのCNIコントローラープラグインです。 * [NSX-T](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf) Container Plug-in(NCP)は、VMware NSX-TとKubernetesなどのコンテナオーケストレーター間のインテグレーションを提供します。また、NSX-Tと、Pivotal Container Service(PKS)とOpenShiftなどのコンテナベースのCaaS/PaaSプラットフォームとのインテグレーションも提供します。 diff --git a/content/ja/docs/concepts/cluster-administration/networking.md b/content/ja/docs/concepts/cluster-administration/networking.md index 49daa2d42d..393829cf2e 100644 --- a/content/ja/docs/concepts/cluster-administration/networking.md +++ b/content/ja/docs/concepts/cluster-administration/networking.md @@ -243,7 +243,7 @@ Lars Kellogg-Stedman. ### Multus (a Multi Network plugin) -[Multus](https://github.com/Intel-Corp/multus-cni) is a Multi CNI plugin to support the Multi Networking feature in Kubernetes using CRD based network objects in Kubernetes. +Multus is a Multi CNI plugin to support the Multi Networking feature in Kubernetes using CRD based network objects in Kubernetes. Multus supports all [reference plugins](https://github.com/containernetworking/plugins) (eg. [Flannel](https://github.com/containernetworking/plugins/tree/master/plugins/meta/flannel), [DHCP](https://github.com/containernetworking/plugins/tree/master/plugins/ipam/dhcp), [Macvlan](https://github.com/containernetworking/plugins/tree/master/plugins/main/macvlan)) that implement the CNI specification and 3rd party plugins (eg. [Calico](https://github.com/projectcalico/cni-plugin), [Weave](https://github.com/weaveworks/weave), [Cilium](https://github.com/cilium/cilium), [Contiv](https://github.com/contiv/netplugin)). In addition to it, Multus supports [SRIOV](https://github.com/hustcat/sriov-cni), [DPDK](https://github.com/Intel-Corp/sriov-cni), [OVS-DPDK & VPP](https://github.com/intel/vhost-user-net-plugin) workloads in Kubernetes with both cloud native and NFV based applications in Kubernetes. diff --git a/content/ja/docs/concepts/extend-kubernetes/_index.md b/content/ja/docs/concepts/extend-kubernetes/_index.md index 07cf8b2af2..b1aaaadf3f 100644 --- a/content/ja/docs/concepts/extend-kubernetes/_index.md +++ b/content/ja/docs/concepts/extend-kubernetes/_index.md @@ -30,7 +30,7 @@ Kubernetesは柔軟な設定が可能で、高い拡張性を持っています ホスティングされたKubernetesサービスやマネージドなKubernetesでは、フラグと設定ファイルが常に変更できるとは限りません。変更可能な場合でも、通常はクラスターの管理者のみが変更できます。また、それらは将来のKubernetesバージョンで変更される可能性があり、設定変更にはプロセスの再起動が必要になるかもしれません。これらの理由により、この方法は他の選択肢が無いときにのみ利用するべきです。 -[ResourceQuota](/docs/concepts/policy/resource-quotas/)、[PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/)、[NetworkPolicy](/docs/concepts/services-networking/network-policies/)、そしてロールベースアクセス制御([RBAC](/docs/reference/access-authn-authz/rbac/))といった *ビルトインポリシーAPI* は、ビルトインのKubernetes APIです。APIは通常、ホスティングされたKubernetesサービスやマネージドなKubernetesで利用されます。これらは宣言的で、Podのような他のKubernetesリソースと同じ慣例に従っています。そのため、新しいクラスターの設定は繰り返し再利用することができ、アプリケーションと同じように管理することが可能です。さらに、安定版(stable)を利用している場合、他のKubernetes APIのような[定義済みのサポートポリシー](/docs/reference/deprecation-policy/)を利用することができます。これらの理由により、この方法は、適切な用途の場合、 *設定ファイル* や *フラグ* よりも好まれます。 +[ResourceQuota](/ja/docs/concepts/policy/resource-quotas/)、[PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/)、[NetworkPolicy](/ja/docs/concepts/services-networking/network-policies/)、そしてロールベースアクセス制御([RBAC](/ja/docs/reference/access-authn-authz/rbac/))といった *ビルトインポリシーAPI* は、ビルトインのKubernetes APIです。APIは通常、ホスティングされたKubernetesサービスやマネージドなKubernetesで利用されます。これらは宣言的で、Podのような他のKubernetesリソースと同じ慣例に従っています。そのため、新しいクラスターの設定は繰り返し再利用することができ、アプリケーションと同じように管理することが可能です。さらに、安定版(stable)を利用している場合、他のKubernetes APIのような[定義済みのサポートポリシー](/docs/reference/deprecation-policy/)を利用することができます。これらの理由により、この方法は、適切な用途の場合、 *設定ファイル* や *フラグ* よりも好まれます。 ## 拡張 @@ -115,7 +115,7 @@ Kubdernetesはいくつかのビルトイン認証方式をサポートしてい [認証](/ja/docs/reference/access-authn-authz/authentication/)は、全てのリクエストのヘッダーまたは証明書情報を、リクエストを投げたクライアントのユーザー名にマッピングします。 -Kubernetesはいくつかのビルトイン認証方式と、それらが要件に合わない場合、[認証Webhook](/docs/reference/access-authn-authz/authentication/#webhook-token-authentication)を提供します。 +Kubernetesはいくつかのビルトイン認証方式と、それらが要件に合わない場合、[認証Webhook](/ja/docs/reference/access-authn-authz/authentication/#webhook-token-authentication)を提供します。 ### 認可 @@ -161,4 +161,4 @@ Kubernetesはいくつかのビルトイン認証方式と、それらが要件 * [ネットワークプラグイン](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) * [デバイスプラグイン](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/) * [kubectlプラグイン](/docs/tasks/extend-kubectl/kubectl-plugins/)について学ぶ -* [オペレーターパターン](/docs/concepts/extend-kubernetes/operator/)について学ぶ +* [オペレーターパターン](/ja/docs/concepts/extend-kubernetes/operator/)について学ぶ diff --git a/content/ja/docs/concepts/extend-kubernetes/api-extension/custom-resources.md b/content/ja/docs/concepts/extend-kubernetes/api-extension/custom-resources.md index 85c1c4a77f..9fea0905c6 100644 --- a/content/ja/docs/concepts/extend-kubernetes/api-extension/custom-resources.md +++ b/content/ja/docs/concepts/extend-kubernetes/api-extension/custom-resources.md @@ -118,7 +118,7 @@ CRDオブジェクトの名前は[DNSサブドメイン名](/ja/docs/concepts/ov 通常、Kubernetes APIの各リソースは、RESTリクエストとオブジェクトの永続的なストレージを管理するためのコードが必要です。メインのKubernetes APIサーバーは *Pod* や *Service* のようなビルトインのリソースを処理し、またカスタムリソースも[CRD](#customresourcedefinition)を通じて同じように管理することができます。 -[アグリゲーションレイヤー](/ja/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/)は、独自のスタンドアローンAPIサーバーを書き、デプロイすることで、カスタムリソースに特化した実装の提供を可能にします。メインのAPIサーバーが、処理したいカスタムリソースへのリクエストを委譲することで、他のクライアントからも利用できるようにします。 +[アグリゲーションレイヤー](/ja/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/)は、独自のAPIサーバーを書き、デプロイすることで、カスタムリソースに特化した実装の提供を可能にします。メインのAPIサーバーが、処理したいカスタムリソースへのリクエストを独自のAPIサーバーに委譲することで、他のクライアントからも利用できるようにします。 ## カスタムリソースの追加方法を選択する diff --git a/content/ja/docs/concepts/extend-kubernetes/operator.md b/content/ja/docs/concepts/extend-kubernetes/operator.md index 62e38d6ddb..34e5aa9095 100644 --- a/content/ja/docs/concepts/extend-kubernetes/operator.md +++ b/content/ja/docs/concepts/extend-kubernetes/operator.md @@ -26,7 +26,7 @@ Kubernetes上でワークロードを稼働させている人は、しばしば Kubernetesは自動化のために設計されています。追加の作業、設定無しに、Kubernetesのコア機能によって多数のビルトインされた自動化機能が提供されます。 ワークロードのデプロイおよび稼働を自動化するためにKubernetesを使うことができます。 *さらに* Kubernetesがそれをどのように行うかの自動化も可能です。 -Kubernetesの{{< glossary_tooltip text="コントローラー" term_id="controller" >}}コンセプトは、Kubernetesのソースコードを修正すること無く、クラスターの振る舞いを拡張することを可能にします。 +Kubernetesの{{< glossary_tooltip text="オペレーターパターン" term_id="operator-pattern" >}}コンセプトは、Kubernetesのソースコードを修正すること無く、一つ以上のカスタムリソースに{{< glossary_tooltip text="カスタムコントローラー" term_id="controller" >}}をリンクすることで、クラスターの振る舞いを拡張することを可能にします。 オペレーターはKubernetes APIのクライアントで、[Custom Resource](/docs/concepts/extend-kubernetes/api-extension/custom-resources/)にとっての、コントローラーのように振る舞います。 ## オペレーターの例 {#example} diff --git a/content/ja/docs/concepts/storage/persistent-volumes.md b/content/ja/docs/concepts/storage/persistent-volumes.md index b22ed7d8eb..1ce9e79d67 100644 --- a/content/ja/docs/concepts/storage/persistent-volumes.md +++ b/content/ja/docs/concepts/storage/persistent-volumes.md @@ -376,9 +376,19 @@ PersistentVolumeは、リソースプロバイダーがサポートする方法 アクセスモードは次の通りです。 -* ReadWriteOnce –ボリュームは単一のNodeで読み取り/書き込みとしてマウントできます -* ReadOnlyMany –ボリュームは多数のNodeで読み取り専用としてマウントできます -* ReadWriteMany –ボリュームは多数のNodeで読み取り/書き込みとしてマウントできます +`ReadWriteOnce` +: ボリュームは単一のNodeで読み取り/書き込みとしてマウントできます + +`ReadOnlyMany` +: ボリュームは多数のNodeで読み取り専用としてマウントできます + +`ReadWriteMany` +: ボリュームは多数のNodeで読み取り/書き込みとしてマウントできます + +`ReadWriteOncePod` +: ボリュームは、単一のPodで読み取り/書き込みとしてマウントできます。クラスタ全体で1つのPodのみがそのPVCの読み取りまたは書き込みを行えるようにする場合は、ReadWriteOncePodアクセスモードを使用します。これは、CSIボリュームとKubernetesバージョン1.22以降でのみサポートされます。 + +これについてはブログ[Introducing Single Pod Access Mode for PersistentVolumes](/blog/2021/09/13/read-write-once-pod-access-mode-alpha/)に詳細が記載されています。 CLIではアクセスモードは次のように略されます。 diff --git a/content/ja/docs/setup/best-practices/cluster-large.md b/content/ja/docs/setup/best-practices/cluster-large.md index 5a1f45b662..4f99e1b551 100644 --- a/content/ja/docs/setup/best-practices/cluster-large.md +++ b/content/ja/docs/setup/best-practices/cluster-large.md @@ -1,123 +1,98 @@ --- -title: 大規模クラスタの構築 +title: 大規模クラスターの構築 weight: 20 --- -## サポート -At {{< param "version" >}}, Kubernetes supports clusters with up to 5000 nodes. More specifically, we support configurations that meet *all* of the following criteria: +クラスターはKubernetesのエージェントが動作する(物理もしくは仮想の){{< glossary_tooltip text="ノード" term_id="node" >}}の集合で、{{< glossary_tooltip text="コントロールプレーン" term_id="control-plane" >}}によって管理されます。 +Kubernetes {{< param "version" >}} では、最大5000ノードから構成されるクラスターをサポートします。 +具体的には、Kubernetesは次の基準を *全て* 満たす構成に対して適用できるように設計されています。 -* No more than 110 pods per node -* No more than 5000 nodes -* No more than 150000 total pods -* No more than 300000 total containers +* 1ノードにつきPodが110個以上存在しない +* 5000ノード以上存在しない +* Podの総数が150000個以上存在しない +* コンテナの総数が300000個以上存在しない + +ノードを追加したり削除したりすることによって、クラスターをスケールできます。 +これを行う方法は、クラスターがどのようにデプロイされたかに依存します。 -## 構築 +## クラウドプロバイダーのリソースクォータ {#クォータの問題} -A cluster is a set of nodes (physical or virtual machines) running Kubernetes agents, managed by a "master" (the cluster-level control plane). +クラウドプロバイダーのクォータの問題に遭遇することを避けるため、多数のノードを使ったクラスターを作成するときには次のようなことを考慮してください。 -Normally the number of nodes in a cluster is controlled by the value `NUM_NODES` in the platform-specific `config-default.sh` file (for example, see [GCE's `config-default.sh`](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/gce/config-default.sh)). +* 次のようなクラウドリソースの増加をリクエストする + * コンピューターインスタンス + * CPU + * ストレージボリューム + * 使用中のIPアドレス + * パケットフィルタリングのルールセット + * ロードバランサーの数 + * ネットワークサブネット + * ログストリーム +* クラウドプロバイダーによる新しいインスタンスの作成に対するレート制限のため、バッチで新しいノードを立ち上げるようなクラスターのスケーリング操作を通すためには、バッチ間ですこし休止を入れます。 -Simply changing that value to something very large, however, may cause the setup script to fail for many cloud providers. A GCE deployment, for example, will run in to quota issues and fail to bring the cluster up. -When setting up a large Kubernetes cluster, the following issues must be considered. +## コントロールプレーンのコンポーネント -### クォータの問題 +大きなクラスターでは、十分な計算とその他のリソースを持ったコントロールプレーンが必要になります。 -To avoid running into cloud provider quota issues, when creating a cluster with many nodes, consider: +特に故障ゾーンあたり1つまたは2つのコントロールプレーンインスタンスを動かす場合、最初に垂直方向にインスタンスをスケールし、垂直方向のスケーリングの効果が低下するポイントに達したら水平方向にスケールします。 -* Increase the quota for things like CPU, IPs, etc. - * In [GCE, for example,](https://cloud.google.com/compute/docs/resource-quotas) you'll want to increase the quota for: - * CPUs - * VM instances - * Total persistent disk reserved - * In-use IP addresses - * Firewall Rules - * Forwarding rules - * Routes - * Target pools -* Gating the setup script so that it brings up new node VMs in smaller batches with waits in between, because some cloud providers rate limit the creation of VMs. +フォールトトレランスを備えるために、1つの故障ゾーンに対して最低1インスタンスを動かすべきです。 +Kubernetesノードは、同一故障ゾーン内のコントロールプレーンエンドポイントに対して自動的にトラフィックが向かないようにします。 +しかし、クラウドプロバイダーはこれを実現するための独自の機構を持っているかもしれません。 -### Etcdのストレージ +例えばマネージドなロードバランサーを使うと、故障ゾーン _A_ にあるkubeletやPodから発生したトラフィックを、同じく故障ゾーン _A_ にあるコントロールプレーンホストに対してのみ送るように設定します。もし1つのコントロールプレーンホストまたは故障ゾーン _A_ のエンドポイントがオフラインになった場合、ゾーン _A_ にあるノードについてすべてのコントロールプレーンのトラフィックはゾーンを跨いで送信されます。それぞれのゾーンで複数のコントロールプレーンホストを動作させることは、結果としてほとんどありません。 -To improve performance of large clusters, we store events in a separate dedicated etcd instance. -When creating a cluster, existing salt scripts: +## etcdストレージ -* start and configure additional etcd instance -* configure api-server to use it for storing events +大きなクラスターの性能を向上させるために、他の専用のetcdインスタンスにイベントオブジェクトを保存できます。 -### マスターのサイズと構成要素 +クラスターを作るときに、(カスタムツールを使って)以下のようなことができます。 -On GCE/Google Kubernetes Engine, and AWS, `kube-up` automatically configures the proper VM size for your master depending on the number of nodes -in your cluster. On other providers, you will need to configure it manually. For reference, the sizes we use on GCE are +* 追加のetcdインスタンスを起動または設定する +* イベントを保存するために{{< glossary_tooltip term_id="kube-apiserver" text="APIサーバ" >}}を設定する -* 1-5 nodes: n1-standard-1 -* 6-10 nodes: n1-standard-2 -* 11-100 nodes: n1-standard-4 -* 101-250 nodes: n1-standard-8 -* 251-500 nodes: n1-standard-16 -* more than 500 nodes: n1-standard-32 +大きなクラスターのためにetcdを設定・管理する詳細については、[Operating etcd clusters for Kubernetes](/docs/tasks/administer-cluster/configure-upgrade-etcd/)または[kubeadmを使用した高可用性etcdクラスターの作成](/ja/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm/)を見てください。 -And the sizes we use on AWS are -* 1-5 nodes: m3.medium -* 6-10 nodes: m3.large -* 11-100 nodes: m3.xlarge -* 101-250 nodes: m3.2xlarge -* 251-500 nodes: c4.4xlarge -* more than 500 nodes: c4.8xlarge +## アドオンのリソース -{{< note >}} -On Google Kubernetes Engine, the size of the master node adjusts automatically based on the size of your cluster. For more information, see [this blog post](https://cloudplatform.googleblog.com/2017/11/Cutting-Cluster-Management-Fees-on-Google-Kubernetes-Engine.html). +Kubernetesの[リソース制限](/ja/docs/concepts/configuration/manage-resources-containers/)は、メモリリークの影響やPodやコンテナが他のコンポーネントに与える他の影響を最小化することに役立ちます。 +これらのリソース制限は、アプリケーションのワークロードに適用するのと同様に、{{< glossary_tooltip text="アドオン" term_id="addons" >}}のリソースにも適用されます。 -On AWS, master node sizes are currently set at cluster startup time and do not change, even if you later scale your cluster up or down by manually removing or adding nodes or using a cluster autoscaler. -{{< /note >}} - -### アドオンのリソース - -To prevent memory leaks or other resource issues in [cluster addons](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons) from consuming all the resources available on a node, Kubernetes sets resource limits on addon containers to limit the CPU and Memory resources they can consume (See PR [#10653](https://pr.k8s.io/10653/files) and [#10778](https://pr.k8s.io/10778/files)). - -For example: +例えば、ロギングコンポーネントに対してCPUやメモリ制限を設定できます。 ```yaml + ... containers: - name: fluentd-cloud-logging - image: k8s.gcr.io/fluentd-gcp:1.16 + image: fluent/fluentd-kubernetes-daemonset:v1 resources: limits: cpu: 100m memory: 200Mi ``` -Except for Heapster, these limits are static and are based on data we collected from addons running on 4-node clusters (see [#10335](https://issue.k8s.io/10335#issuecomment-117861225)). The addons consume a lot more resources when running on large deployment clusters (see [#5880](http://issue.k8s.io/5880#issuecomment-113984085)). So, if a large cluster is deployed without adjusting these values, the addons may continuously get killed because they keep hitting the limits. +アドオンのデフォルト制限は、アドオンを小～中規模のKubernetesクラスターで動作させたときの経験から得られたデータに基づきます。 +大規模のクラスターで動作させる場合は、アドオンはデフォルト制限よりも多くのリソースを消費することが多いです。 +これらの値を調整せずに大規模のクラスターをデプロイした場合、メモリー制限に達し続けるため、アドオンが継続的に停止されるかもしれません。 +あるいは、CPUのタイムスライス制限により性能がでない状態で動作するかもしれません。 -To avoid running into cluster addon resource issues, when creating a cluster with many nodes, consider the following: +クラスターのアドオンのリソース制限に遭遇しないために、多くのノードで構成されるクラスターを構築する場合は次のことを考慮します。 -* Scale memory and CPU limits for each of the following addons, if used, as you scale up the size of cluster (there is one replica of each handling the entire cluster so memory and CPU usage tends to grow proportionally with size/load on cluster): - * [InfluxDB and Grafana](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml) - * [kubedns, dnsmasq, and sidecar](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/dns/kube-dns/kube-dns.yaml.in) - * [Kibana](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/fluentd-elasticsearch/kibana-deployment.yaml) -* Scale number of replicas for the following addons, if used, along with the size of cluster (there are multiple replicas of each so increasing replicas should help handle increased load, but, since load per replica also increases slightly, also consider increasing CPU/memory limits): - * [elasticsearch](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/fluentd-elasticsearch/es-statefulset.yaml) -* Increase memory and CPU limits slightly for each of the following addons, if used, along with the size of cluster (there is one replica per node but CPU/memory usage increases slightly along with cluster load/size as well): - * [FluentD with ElasticSearch Plugin](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/fluentd-elasticsearch/fluentd-es-ds.yaml) - * [FluentD with GCP Plugin](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/fluentd-gcp/fluentd-gcp-ds.yaml) +* いくつかのアドオンは垂直方向にスケールします - クラスターに1つのレプリカ、もしくは故障ゾーン全体にサービングされるものがあります。このようなアドオンでは、クラスターをスケールアウトしたときにリクエストと制限を増やす必要があります。 +* 数多くのアドオンは、水平方向にスケールします - より多くのPod数を動作させることで性能を向上できます - ただし、とても大きなクラスターではCPUやメモリの制限も少し引き上げる必要があるかもしれません。VerticalPodAutoscalerは、提案されたリクエストや制限の数値を提供する `_recommender_` モードで動作可能です。 +* いくつかのアドオンは{{< glossary_tooltip text="DaemonSet" term_id="daemonset" >}}によって制御され、1ノードに1つ複製される形で動作します: 例えばノードレベルのログアグリゲーターです。水平方向にスケールするアドオンの場合と同様に、CPUやメモリ制限を少し引き上げる必要があるかもしれません。 -Heapster's resource limits are set dynamically based on the initial size of your cluster (see [#16185](http://issue.k8s.io/16185) -and [#22940](http://issue.k8s.io/22940)). If you find that Heapster is running -out of resources, you should adjust the formulas that compute heapster memory request (see those PRs for details). -For directions on how to detect if addon containers are hitting resource limits, see the -[Troubleshooting section of Compute Resources](/docs/concepts/configuration/manage-resources-containers/#troubleshooting). +## {{% heading "whatsnext" %}} -### 少数のノードの起動の失敗を許容する +`VerticalPodAutoscaler` は、リソースのリクエストやPodの制限についての管理を手助けするためにクラスターへデプロイ可能なカスタムリソースです。 +`VerticalPodAutoscaler` やクラスターで致命的なアドオンを含むクラスターコンポーネントをスケールする方法についてさらに知りたい場合は[Vertical Pod Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler#readme)をご覧ください。 -For various reasons (see [#18969](https://github.com/kubernetes/kubernetes/issues/18969) for more details) running -`kube-up.sh` with a very large `NUM_NODES` may fail due to a very small number of nodes not coming up properly. -Currently you have two choices: restart the cluster (`kube-down.sh` and then `kube-up.sh` again), or before -running `kube-up.sh` set the environment variable `ALLOWED_NOTREADY_NODES` to whatever value you feel comfortable -with. This will allow `kube-up.sh` to succeed with fewer than `NUM_NODES` coming up. Depending on the -reason for the failure, those additional nodes may join later or the cluster may remain at a size of -`NUM_NODES - ALLOWED_NOTREADY_NODES`. +[cluster autoscaler](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#readme)は、クラスターで要求されるリソース水準を満たす正確なノード数で動作できるよう、いくつかのクラウドプロバイダーと統合されています。 + +[addon resizer](https://github.com/kubernetes/autoscaler/tree/master/addon-resizer#readme)は、クラスターのスケールが変化したときにアドオンの自動的なリサイズをお手伝いします。 diff --git a/content/ja/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/ja/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 01fdd3a29a..f442096833 100644 --- a/content/ja/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/ja/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -231,7 +231,7 @@ curl -L "https://github.com/containernetworking/plugins/releases/download/${CNI_ crictlをインストールする (kubeadm / Kubelet Container Runtime Interface (CRI)に必要です) ```bash -CRICTL_VERSION="v1.17.0" +CRICTL_VERSION="v1.22.0" ARCH="amd64" curl -L "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz" | sudo tar -C $DOWNLOAD_DIR -xz ``` diff --git a/content/ko/docs/concepts/cluster-administration/addons.md b/content/ko/docs/concepts/cluster-administration/addons.md index 270063a737..2c06588988 100644 --- a/content/ko/docs/concepts/cluster-administration/addons.md +++ b/content/ko/docs/concepts/cluster-administration/addons.md @@ -25,7 +25,7 @@ content_type: concept * [Contrail](https://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/)은 [Tungsten Fabric](https://tungsten.io)을 기반으로 하며, 오픈소스이고, 멀티 클라우드 네트워크 가상화 및 폴리시 관리 플랫폼이다. Contrail과 Tungsten Fabric은 쿠버네티스, OpenShift, OpenStack 및 Mesos와 같은 오케스트레이션 시스템과 통합되어 있으며, 가상 머신, 컨테이너/파드 및 베어 메탈 워크로드에 대한 격리 모드를 제공한다. * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually)은 쿠버네티스와 함께 사용할 수 있는 오버레이 네트워크 제공자이다. * [Knitter](https://github.com/ZTE/Knitter/)는 쿠버네티스 파드에서 여러 네트워크 인터페이스를 지원하는 플러그인이다. -* [Multus](https://github.com/Intel-Corp/multus-cni)는 쿠버네티스에서 SRIOV, DPDK, OVS-DPDK 및 VPP 기반 워크로드 외에 모든 CNI 플러그인(예: Calico, Cilium, Contiv, Flannel)을 지원하기 위해 쿠버네티스에서 다중 네트워크 지원을 위한 멀티 플러그인이다. +* Multus 는 쿠버네티스에서 SRIOV, DPDK, OVS-DPDK 및 VPP 기반 워크로드 외에 모든 CNI 플러그인(예: Calico, Cilium, Contiv, Flannel)을 지원하기 위해 쿠버네티스에서 다중 네트워크 지원을 위한 멀티 플러그인이다. * [OVN-Kubernetes](https://github.com/ovn-org/ovn-kubernetes/)는 Open vSwitch(OVS) 프로젝트에서 나온 가상 네트워킹 구현인 [OVN(Open Virtual Network)](https://github.com/ovn-org/ovn/)을 기반으로 하는 쿠버네티스용 네트워킹 제공자이다. OVN-Kubernetes는 OVS 기반 로드 밸런싱과 네트워크 폴리시 구현을 포함하여 쿠버네티스용 오버레이 기반 네트워킹 구현을 제공한다. * [OVN4NFV-K8S-Plugin](https://github.com/opnfv/ovn4nfv-k8s-plugin)은 OVN 기반의 CNI 컨트롤러 플러그인으로 클라우드 네이티브 기반 서비스 기능 체인(Service function chaining(SFC)), 다중 OVN 오버레이 네트워킹, 동적 서브넷 생성, 동적 가상 네트워크 생성, VLAN 공급자 네트워크, 직접 공급자 네트워크와 멀티 클러스터 네트워킹의 엣지 기반 클라우드 등 네이티브 워크로드에 이상적인 멀티 네티워크 플러그인이다. * [NSX-T](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf) 컨테이너 플러그인(NCP)은 VMware NSX-T와 쿠버네티스와 같은 컨테이너 오케스트레이터 간의 통합은 물론 NSX-T와 PKS(Pivotal 컨테이너 서비스) 및 OpenShift와 같은 컨테이너 기반 CaaS/PaaS 플랫폼 간의 통합을 제공한다. diff --git a/content/ko/docs/concepts/cluster-administration/networking.md b/content/ko/docs/concepts/cluster-administration/networking.md index 545c26f420..5922bf3ef3 100644 --- a/content/ko/docs/concepts/cluster-administration/networking.md +++ b/content/ko/docs/concepts/cluster-administration/networking.md @@ -246,7 +246,7 @@ Lars Kellogg-Stedman이 제공하는 ### Multus(멀티 네트워크 플러그인) -[Multus](https://github.com/Intel-Corp/multus-cni)는 쿠버네티스의 CRD 기반 네트워크 오브젝트를 사용하여 쿠버네티스에서 멀티 네트워킹 기능을 지원하는 멀티 CNI 플러그인이다. +Multus 는 쿠버네티스의 CRD 기반 네트워크 오브젝트를 사용하여 쿠버네티스에서 멀티 네트워킹 기능을 지원하는 멀티 CNI 플러그인이다. Multus는 CNI 명세를 구현하는 모든 [레퍼런스 플러그인](https://github.com/containernetworking/plugins)(예: [플라넬](https://github.com/containernetworking/cni.dev/blob/main/content/plugins/v0.9/meta/flannel.md), [DHCP](https://github.com/containernetworking/plugins/tree/master/plugins/ipam/dhcp), [Macvlan](https://github.com/containernetworking/plugins/tree/master/plugins/main/macvlan)) 및 써드파티 플러그인(예: [캘리코](https://github.com/projectcalico/cni-plugin), [위브(Weave)](https://github.com/weaveworks/weave), [실리움](https://github.com/cilium/cilium), [콘티브](https://github.com/contiv/netplugin))을 지원한다. 또한, Multus는 쿠버네티스의 클라우드 네이티브 애플리케이션과 NFV 기반 애플리케이션을 통해 쿠버네티스의 [SRIOV](https://github.com/hustcat/sriov-cni), [DPDK](https://github.com/Intel-Corp/sriov-cni), [OVS-DPDK 및 VPP](https://github.com/intel/vhost-user-net-plugin) 워크로드를 지원한다. diff --git a/content/ko/docs/setup/production-environment/container-runtimes.md b/content/ko/docs/setup/production-environment/container-runtimes.md index 18c8a9cbb1..97be57a3c4 100644 --- a/content/ko/docs/setup/production-environment/container-runtimes.md +++ b/content/ko/docs/setup/production-environment/container-runtimes.md @@ -79,7 +79,7 @@ systemd가 기본적으로 cgroup v2를 사용하지 않는 경우, 커널 명 # dnf install -y grubby && \ sudo grubby \ --update-kernel=ALL \ - --args=”systemd.unified_cgroup_hierarchy=1" + --args="systemd.unified_cgroup_hierarchy=1" ``` 구성을 적용하려면 노드를 재부팅해야 한다. diff --git a/content/no/docs/contribute/_index.md b/content/no/docs/contribute/_index.md old mode 100755 new mode 100644 diff --git a/content/no/docs/reference/glossary/container.md b/content/no/docs/reference/glossary/container.md old mode 100755 new mode 100644 diff --git a/content/pt-br/docs/concepts/cluster-administration/addons.md b/content/pt-br/docs/concepts/cluster-administration/addons.md index 79b62bf832..f3a00ae26d 100644 --- a/content/pt-br/docs/concepts/cluster-administration/addons.md +++ b/content/pt-br/docs/concepts/cluster-administration/addons.md @@ -25,7 +25,7 @@ Esta página lista alguns dos complementos disponíveis e links com suas respect * [Contrail](http://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/) é uma plataforma open source baseada no [Tungsten Fabric](https://tungsten.io) que oferece virtualização de rede multi-nuvem e gerenciamento de políticas de rede. O Contrail e o Tungsten Fabric são integrados a sistemas de orquestração de contêineres, como Kubernetes, OpenShift, OpenStack e Mesos, e fornecem modos de isolamento para cargas de trabalho executando em máquinas virtuais, contêineres/pods e servidores físicos. * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually) é um provedor de redes _overlay_ (sobrepostas) que pode ser usado com o Kubernetes. * [Knitter](https://github.com/ZTE/Knitter/) é um plug-in para suporte de múltiplas interfaces de rede em Pods do Kubernetes. -* [Multus](https://github.com/Intel-Corp/multus-cni) é um plugin para suporte a várias interfaces de rede em Pods no Kubernetes. Este plug-in pode agir como um "meta-plug-in", ou um plug-in CNI que se comunica com múltiplos outros plug-ins CNI (por exemplo, Calico, Cilium, Contiv, Flannel), além das cargas de trabalho baseadas em SRIOV, DPDK, OVS-DPDK e VPP no Kubernetes. +* Multus é um plugin para suporte a várias interfaces de rede em Pods no Kubernetes. Este plug-in pode agir como um "meta-plug-in", ou um plug-in CNI que se comunica com múltiplos outros plug-ins CNI (por exemplo, Calico, Cilium, Contiv, Flannel), além das cargas de trabalho baseadas em SRIOV, DPDK, OVS-DPDK e VPP no Kubernetes. * [NSX-T](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf) Container Plug-in (NCP) fornece integração entre o VMware NSX-T e sistemas de orquestração de contêineres como o Kubernetes. Além disso, oferece também integração entre o NSX-T e as plataformas CaaS/PaaS baseadas em contêiner, como o Pivotal Container Service (PKS) e o OpenShift. * [Nuage](https://github.com/nuagenetworks/nuage-kubernetes/blob/v5.1.1-1/docs/kubernetes-1-installation.rst) é uma plataforma de rede definida por software que fornece serviços de rede baseados em políticas entre os Pods do Kubernetes e os ambientes não-Kubernetes, com visibilidade e monitoramento de segurança. * [OVN-Kubernetes](https://github.com/ovn-org/ovn-kubernetes/) é um provedor de rede para o Kubernetes baseado no [OVN (Open Virtual Network)](https://github.com/ovn-org/ovn/), uma implementação de redes virtuais que surgiu através do projeto Open vSwitch (OVS). O OVN-Kubernetes fornece uma implementação de rede baseada em _overlay_ (sobreposição) para o Kubernetes, incluindo uma implementação baseada em OVS para serviços de balanceamento de carga e políticas de rede. diff --git a/content/pt-br/docs/concepts/configuration/overview.md b/content/pt-br/docs/concepts/configuration/overview.md index 66f369c03b..67ef561605 100644 --- a/content/pt-br/docs/concepts/configuration/overview.md +++ b/content/pt-br/docs/concepts/configuration/overview.md @@ -23,7 +23,7 @@ Isso permite que você reverta rapidamente uma alteração de configuração, ca - Escreva seus arquivos de configuração usando YAML ao invés de JSON. Embora esses formatos possam ser usados alternadamente em quase todos os cenários, YAML tende a ser mais amigável. - Agrupe objetos relacionados em um único arquivo sempre que fizer sentido. Geralmente, um arquivo é mais fácil de -gerenciar do que vários. Veja o [guestbook-all-in-one.yaml](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/all-in-one/guestbook-all-in-one.yaml) como exemplo dessa sintaxe. +gerenciar do que vários. Veja o [guestbook-all-in-one.yaml](https://github.com/kubernetes/examples/tree/master/guestbook/all-in-one/guestbook-all-in-one.yaml) como exemplo dessa sintaxe. - Observe também que vários comandos `kubectl` podem ser chamados em um diretório. Por exemplo, você pode chamar `kubectl apply` em um diretório de arquivos de configuração. diff --git a/content/pt-br/docs/concepts/extend-kubernetes/operator.md b/content/pt-br/docs/concepts/extend-kubernetes/operator.md index 627bcbfbb8..f92b86b607 100644 --- a/content/pt-br/docs/concepts/extend-kubernetes/operator.md +++ b/content/pt-br/docs/concepts/extend-kubernetes/operator.md @@ -130,7 +130,7 @@ que pode atuar como um [cliente da API do Kubernetes](/docs/reference/using-api/ * usando [kubebuilder](https://book.kubebuilder.io/) * usando [Metacontroller](https://metacontroller.github.io/metacontroller/intro.html) juntamente com WebHooks que implementa você mesmo - * usando o [Operator Framework](https://github.com/operator-framework/getting-started) + * usando o [Operator Framework](https://operatorframework.io/) * [Publique](https://operatorhub.io/) o seu operador para que outras pessoas o possam usar * Leia o [artigo original da CoreOS](https://coreos.com/blog/introducing-operators.html) que introduz o padrão Operador * Leia um [artigo](https://cloud.google.com/blog/products/containers-kubernetes/best-practices-for-building-kubernetes-operators-and-stateful-apps) da Google Cloud sobre as melhores práticas para contruir Operadores diff --git a/content/ru/docs/concepts/cluster-administration/addons.md b/content/ru/docs/concepts/cluster-administration/addons.md index 82c8ab1695..7d6777621e 100644 --- a/content/ru/docs/concepts/cluster-administration/addons.md +++ b/content/ru/docs/concepts/cluster-administration/addons.md @@ -25,7 +25,7 @@ content_type: concept * [Contrail](https://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/), основан на [Tungsten Fabric](https://tungsten.io), представляет собой платформу для виртуализации мультиоблачных сетей с открытым исходным кодом и управления политиками. Contrail и Tungsten Fabric are интегрированы с системами оркестровки, такими как Kubernetes, OpenShift, OpenStack и Mesos, и обеспечивают режимы изоляции для виртуальных машин, контейнеров/pod-ов и рабочих нагрузок без операционной системы. * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually) - это поставщик оверлейной сети, который можно использовать с Kubernetes. * [Knitter](https://github.com/ZTE/Knitter/) - это плагин для поддержки нескольких сетевых интерфейсов Kubernetes pod-ов. -* [Multus](https://github.com/Intel-Corp/multus-cni) - это плагин Multi для поддержки нексольких сетейв Kubernetes для поддержки всех CNI плагинов (наприме: Calico, Cilium, Contiv, Flannel), в дополнение к рабочим нагрузкам основанных на SRIOV, DPDK, OVS-DPDK и VPP в Kubernetes. +* Multus - это плагин Multi для поддержки нексольких сетейв Kubernetes для поддержки всех CNI плагинов (наприме: Calico, Cilium, Contiv, Flannel), в дополнение к рабочим нагрузкам основанных на SRIOV, DPDK, OVS-DPDK и VPP в Kubernetes. * [OVN-Kubernetes](https://github.com/ovn-org/ovn-kubernetes/) - это сетевой провайдер для Kubernetes основанный на [OVN (Open Virtual Network)](https://github.com/ovn-org/ovn/), реализация виртуалной сети a появившейся в результате проекта Open vSwitch (OVS). OVN-Kubernetes обеспечивает сетевую реализацию на основе наложения для Kubernetes, включая реализацию балансировки нагрузки и сетевой политики на основе OVS. * [OVN4NFV-K8S-Plugin](https://github.com/opnfv/ovn4nfv-k8s-plugin) - это подключаемый модуль контроллера CNI на основе OVN для обеспечения облачной цепочки сервисных функций (SFC), несколько наложеных сетей OVN, динамического создания подсети, динамического создания виртуальных сетей, сети поставщика VLAN, сети прямого поставщика и подключаемого к другим Multi Сетевые плагины, идеально подходящие для облачных рабочих нагрузок на периферии в сети с несколькими кластерами. * [NSX-T](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf) плагин для контейнера (NCP) обеспечивающий интеграцию между VMware NSX-T и контейнерами оркестраторов, таких как Kubernetes, а так же интеграцию между NSX-T и контейнеров на основе платформы CaaS/PaaS, таких как Pivotal Container Service (PKS) и OpenShift. diff --git a/content/ru/docs/concepts/overview/kubernetes-api.md b/content/ru/docs/concepts/overview/kubernetes-api.md index c669cb973a..e2523c5191 100644 --- a/content/ru/docs/concepts/overview/kubernetes-api.md +++ b/content/ru/docs/concepts/overview/kubernetes-api.md @@ -77,7 +77,7 @@ GET /swagger-2.0.0.pb-v1.gz | GET /openapi/v2 **Accept**: application/com.github - Названия версий включают надпись `beta` (например, `v2beta3`). - Код хорошо протестирован. Активация этой функциональности — безопасно. Поэтому она включена по умолчанию. - Поддержка функциональности в целом не будет прекращена, хотя кое-что может измениться. - - Схема и/или семантика объектов может стать несовместимой с более поздними бета-версиями или стабильными выпусками. Когда это случится, мы даим инструкции по миграции на следующую версию. Это обновление может включать удаление, редактирование и повторного создание API-объектов. Этот процесс может потребовать тщательного анализа. Кроме этого, это может привести к простою приложений, которые используют данную функциональность. + - Схема и/или семантика объектов может стать несовместимой с более поздними бета-версиями или стабильными выпусками. Когда это случится, мы даем инструкции по миграции на следующую версию. Это обновление может включать удаление, редактирование и повторного создание API-объектов. Этот процесс может потребовать тщательного анализа. Кроме этого, это может привести к простою приложений, которые используют данную функциональность. - Рекомендуется только для неосновного производственного использования из-за риска возникновения возможных несовместимых изменений с будущими версиями. Если у вас есть несколько кластеров, которые возможно обновить независимо, вы можете снять это ограничение. - **Пожалуйста, попробуйте в действии бета-версии функциональности и поделитесь своими впечатлениями! После того, как функциональность выйдет из бета-версии, нам может быть нецелесообразно что-то дальше изменять.** - Стабильные версии: diff --git a/content/ru/docs/templates/feature-state-beta.txt b/content/ru/docs/templates/feature-state-beta.txt index 7e4f0d91b6..2d3786020d 100644 --- a/content/ru/docs/templates/feature-state-beta.txt +++ b/content/ru/docs/templates/feature-state-beta.txt @@ -3,6 +3,6 @@ * Названия версий включают надпись "beta" (например, v2beta3). * Код хорошо протестирован. Активация этой функциональности — безопасно. Поэтому она включена по умолчанию. * Поддержка функциональности в целом не будет прекращена, хотя детали могут измениться. -* Схема и/или семантика объектов может стать несовместимой с более поздними бета-версиями или стабильными выпусками. Когда это случится, мы даим инструкции по миграции на следующую версию. Это обновление может включать удаление, редактирование и повторного создание API-объектов. Этот процесс может потребовать тщательного анализа. Кроме этого, он может привести к простою приложений, которые используют данную функциональность. +* Схема и/или семантика объектов может стать несовместимой с более поздними бета-версиями или стабильными выпусками. Когда это случится, мы даем инструкции по миграции на следующую версию. Это обновление может включать удаление, редактирование и повторного создание API-объектов. Этот процесс может потребовать тщательного анализа. Кроме этого, он может привести к простою приложений, которые используют данную функциональность. * Рекомендуется только для неосновного производственного использования из-за риска возникновения возможных несовместимых изменений с будущими версиями. Если у вас есть несколько кластеров, которые возможно обновить независимо, вы можете снять это ограничение. * **Пожалуйста, попробуйте в действии бета-версии функциональности и поделитесь своими впечатлениями! После того, как функциональность выйдет из бета-версии, нам может быть нецелесообразно что-то дальше изменять.** diff --git a/content/zh/blog/_posts/2021-12-10-csi-migration-status.md b/content/zh/blog/_posts/2021-12-10-csi-migration-status.md new file mode 100644 index 0000000000..f133bac6bf --- /dev/null +++ b/content/zh/blog/_posts/2021-12-10-csi-migration-status.md @@ -0,0 +1,294 @@ +--- +layout: blog +title: "Kubernetes 1.23：树内存储向 CSI 卷迁移工作的进展更新" +date: 2021-12-10 +slug: storage-in-tree-to-csi-migration-status-update +--- + + + +**作者**: Jiawei Wang（谷歌） + + +自 Kubernetes v1.14 引入容器存储接口（[Container Storage Interface, CSI](/blog/2019/01/15/container-storage-interface-ga/)）的工作达到 alpha 阶段后，自 v1.17 起，Kubernetes 树内存储插件（in-tree storage plugin）向 CSI 的迁移基础设施已步入 [beta 阶段](/blog/2019/12/09/kubernetes-1-17-feature-csi-migration-beta/)。 + + +自那时起，Kubernetes 存储特别兴趣组（special interest groups, SIG）及其他 Kubernetes 特别兴趣组就在努力确保这一功能的稳定性和兼容性，为正式发布做准备。 +本文旨在介绍该功能的最新开发进展，以及 Kubernetes v1.17 到 v1.23 之间的变化。此外，我还将介绍每个存储插件的 CSI 迁移功能达到正式发布阶段的未来路线图。 + + +## 快速回顾：CSI 迁移功能是什么？为什么要迁移？ {#quick-recap-what-is-csi-migration-and-why-migrate} + +容器存储接口旨在帮助 Kubernetes 取代其现有的树内存储驱动机制──特别是供应商的特定插件。自 v1.13 起，Kubernetes 对[容器存储接口](https://github.com/container-storage-interface/spec/blob/master/spec.md#README)的支持工作已达到[正式发布阶段](/blog/2019/01/15/container-storage-interface-ga/)。引入对 CSI 驱动的支持，将使得 Kubernetes 和存储后端技术之间的集成工作更易建立和维护。使用 CSI 驱动可以实现更好的可维护性（驱动作者可以决定自己的发布周期和支持生命周期）、减少出现漏洞的机会（得益于更少的树内代码，出现错误的风险会降低。另外，集群操作员可以只选择集群需要的存储驱动）。 + + +随着更多的 CSI 驱动诞生并进入生产就绪阶段，Kubernetes 存储特别兴趣组希望所有 Kubernetes 用户都能从 CSI 模型中受益──然而，我们不应破坏与现有存储 API 类型的 API 兼容性。对此，我们给出的解决方案是 CSI 迁移：该功能实现将树内存储 API 翻译成等效的 CSI API，并把操作委托给一个替换的 CSI 驱动来完成。 + + +CSI 迁移工作使存储后端现有的树内存储插件（如 `kubernetes.io/gce-pd` 或 `kubernetes.io/aws-ebs`）能够被相应的 [CSI 驱动](https://kubernetes-csi.github.io/docs/introduction.html) 所取代。如果 CSI 迁移功能正确发挥作用，Kubernetes 终端用户应该不会注意到有什么变化。现有的 `StorageClass`、`PersistentVolume` 和 `PersistentVolumeClaim` 对象应继续工作。当 Kubernetes 集群管理员更新集群以启用 CSI 迁移功能时，利用到 PVCs[^1]（由树内存储插件支持）的现有工作负载将继续像以前一样运作──不过在幕后，Kubernetes 将所有存储管理操作（以前面向树内存储驱动的）交给 CSI 驱动控制。 + + +举个例子。假设你是 `kubernetes.io/gce-pd` 用户，在启用 CSI 迁移功能后，你仍然可以使用 `kubernetes.io/gce-pd` 来配置新卷、挂载现有的 GCE-PD 卷或删除现有卷。所有现有的 API/接口 仍将正常工作──只不过，底层功能调用都将通向 [GCE PD CSI 驱动](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver)，而不是 Kubernetes 的树内存储功能。 + + +这使得 Kubernetes 终端用户可以顺利过渡。另外，对于存储插件的开发者，我们可以减少他们维护树内存储插件的负担，并最终将这些插件从 Kubernetes 核心的二进制中移除。 + + +## 改进与更新 {#what-has-been-changed-and-what-s-new} +在 Kubernetes v1.17 及更早的工作基础上，此后的发布有了以下一系列改变： + + +### 新的特性门控（feature gate） {#new-feature-gates} +Kubernetes v1.21 弃用了 `CSIMigration{provider}Complete` 特性参数（feature flag），它们不再生效。取而代之的是名为 `InTreePlugin{vendor}Unregister` 的新特性参数，它们保留了 `CSIMigration{provider}Complete` 提供的所有功能。 + + +`CSIMigration{provider}Complete` 是作为 CSI 迁移功能在所有节点上启用后的补充特性门控于之前引入的。这个参数可注销参数名称中 `{provider}` 部分所指定的树内存储插件。 + + +当你启用该特性门控时，你的集群不再使用树内驱动代码，而是直接选择并使用相应的 CSI 驱动。同时，集群并不检查节点上 CSI 迁移功能是否启用，以及 CSI 驱动是否实际部署。 + + +虽然这一特性门控是一个很好的帮手，但 Kubernetes 存储特别兴趣组（以及，我相信还有很多集群操作员）同样希望有一个特性门控可以让你即使在不启用 CSI 迁移功能时，也能禁用树内存储插件。例如，你可能希望在一个 GCE 集群上禁用 EBS 存储插件，因为 EBS 卷是其他供应商的云（AWS）所专有的。 + + +为了使这成为可能，Kubernetes v1.21 引入了一个新的特性参数集合：`InTreePlugin{vendor}Unregister`。 + +`InTreePlugin{vendor}Unregister` 是一种特性门控，可以独立于 CSI 迁移功能来启用或禁用。当启用此种特性门控时，组件将不会把相应的树内存储插件注册到支持的列表中。如果集群操作员只启用了这种参数，终端用户将在使用该插件的 PVC[^1] 处遇到错误，提示其找不到插件。如果集群操作员不想支持过时的树内存储 API，只支持 CSI，那么他们可能希望启用这种特性门控而不考虑 CSI 迁移功能。 + + + +### 可观察性 {#observability} + +Kubernetes v1.21 引入了跟踪 CSI 迁移功能的[指标](https://github.com/kubernetes/kubernetes/issues/98279)。你可以使用这些指标来观察你的集群是如何使用存储服务的，以及对该存储的访问使用的是传统的树内驱动还是基于 CSI 的替代。 + + +| 组件 | 指标 | 注释 | +| ---- | ---- | ---- | +| Kube-Controller-Manager | storage_operation_duration_seconds | 一个新的标签 `migrated` 被添加到指标中，以表明该存储操作是否由 CSI 迁移功能操作（字符串值为 `true` 表示启用，`false` 表示未启用）。 | +| Kubelet | csi_operations_seconds | 新的指标提供的标签包括 `driver_name`、`method_name`、`grpc_status_code` 和 `migrated`。这些标签的含义与 `csi_sidecar_operations_seconds` 相同。 | +| CSI Sidecars(provisioner, attacher, resizer) | csi_sidecar_operations_seconds | 一个新的标签 `migrated` 被添加到指标中，以表明该存储操作是否由 CSI 迁移功能操作（字符串值为 `true` 表示启用，`false` 表示未启用）。 | + + +### 错误修复和功能改进 {#bug-fixes-and-feature-improvement} + +籍由 beta 测试人员的帮助，我们修复了许多错误──如悬空附件、垃圾收集、拓扑标签错误等。 + + +### 与 Kubernetes 云提供商特别兴趣组、集群生命周期特别兴趣组的合作 {#cloud-provider-cluster-lifecycle-collaboration} + +Kubernetes 存储特别兴趣组与云提供商特别兴趣组和集群生命周期特别兴趣组，正为了 CSI 迁移功能上线而密切合作。 + +如果你采用托管 Kubernetes 服务，请询问你的供应商是否有什么工作需要完成。在许多情况下，供应商将管理迁移，你不需要做额外的工作。 + + +如果你使用的是 Kubernetes 的发行版，请查看其官方文档，了解对该功能的支持情况。对于已进入正式发布阶段的 CSI 迁移功能，Kubernetes 存储特别兴趣组正与Kubernetes 集群生命周期特别兴趣组合作，以便在这些功能于 Kubernetes 中可用时，使迁移机制也进入到周边工具（如 kubeadm）中。 + + +## 时间计划及当前状态 {#timeline-and-status} + +各驱动的当前发布及目标发布如下表所示： + + +| 驱动 | Alpha | Beta（启用树内插件） | Beta（默认启用） | 正式发布 | 目标：移除“树内存储插件” | +| ---------------- | ----- | ------------------------- | -------------------- | ------------- | ------------------------------- | +| AWS EBS | 1.14 | 1.17 | 1.23 | 1.24 (Target) | 1.26 (Target) | +| GCE PD | 1.14 | 1.17 | 1.23 | 1.24 (Target) | 1.26 (Target) | +| OpenStack Cinder | 1.14 | 1.18 | 1.21 | 1.24 (Target) | 1.26 (Target) | +| Azure Disk | 1.15 | 1.19 | 1.23 | 1.24 (Target) | 1.26 (Target) | +| Azure File | 1.15 | 1.21 | 1.24 (Target) | 1.25 (Target) | 1.27 (Target) | +| vSphere | 1.18 | 1.19 | 1.24 (Target) | 1.25 (Target) | 1.27 (Target) | +| Ceph RBD | 1.23 | +| Portworx | 1.23 | + + +以下存储驱动将不会支持 CSI 迁移功能。其中 ScaleIO 驱动已经被移除；其他驱动都被弃用，并将从 Kubernetes 核心中删除。 + + +| 驱动 | 被弃用 | 代码移除 | +| ---- | ---- | ---- | +| ScaleIO | 1.16 | 1.22 | +| Flocker | 1.22 | 1.25 (Target) | +| Quobyte | 1.22 | 1.25 (Target) | +| StorageOS | 1.22 | 1.25 (Target) | + + +## 下一步的计划 {#what-s-next} + +随着更多的 CSI 驱动进入正式发布阶段，我们希望尽快将整个 CSI 迁移功能标记为正式发布状态。我们计划在 Kubernetes v1.26 和 v1.27 之前移除云提供商树内存储插件的代码。 + + +## 作为用户，我应该做什么？ {#what-should-i-do-as-a-user} + +请注意，Kubernetes 存储系统的所有新功能（如卷快照）将只被添加到 CSI 接口。因此，如果你正在启动一个新的集群、首次创建有状态的应用程序，或者需要这些新功能，我们建议你在本地使用 CSI 驱动（而不是树内卷插件 API）。遵循[最新的 CSI 驱动用户指南](https://kubernetes-csi.github.io/docs/drivers.html)并使用新的 CSI API。 + + +然而，如果您选择沿用现有集群或继续使用传统卷 API 的规约，CSI 迁移功能将确保我们通过新 CSI 驱动继续支持这些部署。但是，如果您想利用快照等新功能，则需要进行手动迁移，将现有的树内持久卷重新导入为 CSI 持久卷。 + + +## 我如何参与其中？ {#how-do-i-get-involved} +Kubernetes Slack 频道 [#csi-migration](https://kubernetes.slack.com/messages/csi-migration) 以及任何一个标准的 [SIG Storage 通信频道](https://github.com/kubernetes/community/blob/master/sig-storage/README.md#contact)都是与 Kubernetes 存储特别兴趣组和迁移工作组团队联系的绝佳媒介。 + + +该项目，和其他所有 Kubernetes 项目一样，是许多来自不同背景的贡献者共同努力的结果。我们非常感谢在过去几个季度里挺身而出帮助推动项目发展的贡献者们： + +* Michelle Au (msau42) +* Jan Šafránek (jsafrane) +* Hemant Kumar (gnufied) + + +特别感谢以下人士对 CSI 迁移功能的精辟评论、全面考虑和宝贵贡献： + +* Andy Zhang (andyzhangz) +* Divyen Patel (divyenpatel) +* Deep Debroy (ddebroy) +* Humble Devassy Chirammal (humblec) +* Jing Xu (jingxu97) +* Jordan Liggitt (liggitt) +* Matthew Cary (mattcary) +* Matthew Wong (wongma7) +* Neha Arora (nearora-msft) +* Oksana Naumov (trierra) +* Saad Ali (saad-ali) +* Tim Bannister (sftim) +* Xing Yang (xing-yang) + + +有兴趣参与 CSI 或 Kubernetes 存储系统任何部分的设计和开发的人，请加入 [Kubernetes 存储特别兴趣组](https://github.com/kubernetes/community/tree/master/sig-storage)。我们正在迅速成长，并一直欢迎新的贡献者。 + + +[^1]: 持久卷申领（PersistentVolumeClaim，PVC） \ No newline at end of file diff --git a/content/zh/docs/concepts/architecture/cloud-controller.md b/content/zh/docs/concepts/architecture/cloud-controller.md index 3a0a6c42f7..b08edad800 100644 --- a/content/zh/docs/concepts/architecture/cloud-controller.md +++ b/content/zh/docs/concepts/architecture/cloud-controller.md @@ -72,18 +72,18 @@ The controllers inside the cloud controller manager include: ### 节点控制器 {#node-controller} -节点控制器负责在云基础设施中创建了新服务器时为之 创建 +节点控制器负责在云基础设施中创建了新服务器时为之 更新 {{< glossary_tooltip text="节点（Node）" term_id="node" >}}对象。 节点控制器从云提供商获取当前租户中主机的信息。节点控制器执行以下功能： -1. 针对控制器通过云平台驱动的 API 所发现的每个服务器初始化一个 Node 对象； +1. 使用从云平台 API 获取的对应服务器的唯一标识符更新 Node 对象； 2. 利用特定云平台的信息为 Node 对象添加注解和标签，例如节点所在的 区域（Region）和所具有的资源（CPU、内存等等）； 3. 获取节点的网络地址和主机名； diff --git a/content/zh/docs/concepts/cluster-administration/addons.md b/content/zh/docs/concepts/cluster-administration/addons.md index adadc7954f..c579cacc17 100644 --- a/content/zh/docs/concepts/cluster-administration/addons.md +++ b/content/zh/docs/concepts/cluster-administration/addons.md @@ -35,7 +35,7 @@ Add-ons 扩展了 Kubernetes 的功能。 * [Contrail](http://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/), based on [Tungsten Fabric](https://tungsten.io), is an open source, multi-cloud network virtualization and policy management platform. Contrail and Tungsten Fabric are integrated with orchestration systems such as Kubernetes, OpenShift, OpenStack and Mesos, and provide isolation modes for virtual machines, containers/pods and bare metal workloads. * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually) is an overlay network provider that can be used with Kubernetes. * [Knitter](https://github.com/ZTE/Knitter/) is a network solution supporting multiple networking in Kubernetes. -* [Multus](https://github.com/Intel-Corp/multus-cni) is a Multi plugin for multiple network support in Kubernetes to support all CNI plugins (e.g. Calico, Cilium, Contiv, Flannel), in addition to SRIOV, DPDK, OVS-DPDK and VPP based workloads in Kubernetes. +* Multus is a Multi plugin for multiple network support in Kubernetes to support all CNI plugins (e.g. Calico, Cilium, Contiv, Flannel), in addition to SRIOV, DPDK, OVS-DPDK and VPP based workloads in Kubernetes. * [OVN-Kubernetes](https://github.com/ovn-org/ovn-kubernetes/) is a networking provider for Kubernetes based on [OVN (Open Virtual Network)](https://github.com/ovn-org/ovn/), a virtual networking implementation that came out of the Open vSwitch (OVS) project. OVN-Kubernetes provides an overlay based networking implementation for Kubernetes, including an OVS based implementation of load balancing and network policy. * [OVN4NFV-K8S-Plugin](https://github.com/opnfv/ovn4nfv-k8s-plugin) is OVN based CNI controller plugin to provide cloud native based Service function chaining(SFC), Multiple OVN overlay networking, dynamic subnet creation, dynamic creation of virtual networks, VLAN Provider network, Direct provider network and pluggable with other Multi-network plugins, ideal for edge based cloud native workloads in Multi-cluster networking * [NSX-T](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf) Container Plug-in (NCP) provides integration between VMware NSX-T and container orchestrators such as Kubernetes, as well as integration between NSX-T and container-based CaaS/PaaS platforms such as Pivotal Container Service (PKS) and OpenShift. @@ -66,7 +66,7 @@ Add-ons 扩展了 Kubernetes 的功能。 * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually) 是一个可以用于 Kubernetes 的 overlay 网络提供者。 * [Knitter](https://github.com/ZTE/Knitter/) 是为 kubernetes 提供复合网络解决方案的网络组件。 -* [Multus](https://github.com/Intel-Corp/multus-cni) 是一个多插件，可在 Kubernetes 中提供多种网络支持， +* Multus 是一个多插件，可在 Kubernetes 中提供多种网络支持， 以支持所有 CNI 插件（例如 Calico，Cilium，Contiv，Flannel）， 而且包含了在 Kubernetes 中基于 SRIOV、DPDK、OVS-DPDK 和 VPP 的工作负载。 * [OVN-Kubernetes](https://github.com/ovn-org/ovn-kubernetes/) 是一个 Kubernetes 网络驱动， @@ -116,11 +116,19 @@ Add-ons 扩展了 Kubernetes 的功能。 ## Infrastructure * [KubeVirt](https://kubevirt.io/user-guide/#/installation/installation) is an add-on to run virtual machines on Kubernetes. Usually run on bare-metal clusters. +* The + [node problem detector](https://github.com/kubernetes/node-problem-detector) + runs on Linux nodes and reports system issues as either + [Events](/docs/reference/kubernetes-api/cluster-resources/event-v1/) or + [Node conditions](/docs/concepts/architecture/nodes/#condition). --> ## 基础设施 * [KubeVirt](https://kubevirt.io/user-guide/#/installation/installation) 是可以让 Kubernetes 运行虚拟机的 add-ons。通常运行在裸机集群上。 +* [节点问题检测器](https://github.com/kubernetes/node-problem-detector) 在 Linux 节点上运行， + 并将系统问题报告为[事件](/docs/reference/kubernetes-api/cluster-resources/event-v1/) + 或[节点状况](/zh/docs/concepts/architecture/nodes/#condition)。 + 有关 TracingConfiguration 结构体的更多信息，请参阅 -[API 服务器配置 API (v1alpha1)](/docs/reference/config-api/apiserver-config.v1alpha1/#apiserver-k8s-io-v1alpha1-TracingConfiguration)。 +[API 服务器配置 API (v1beta1)](/docs/reference/config-api/apiserver-config.v1beta1/#apiserver-k8s-io-v1beta1-TracingConfiguration)。 @@ -65,10 +63,11 @@ a [Custom Resource](/docs/concepts/extend-kubernetes/api-extension/custom-resour Kubernetes 为自动化而生。无需任何修改，你即可以从 Kubernetes 核心中获得许多内置的自动化功能。 你可以使用 Kubernetes 自动化部署和运行工作负载， *甚至* 可以自动化 Kubernetes 自身。 -Kubernetes 的 {{< glossary_tooltip text="Operator 模式" term_id="operator-pattern" >}}概念 -使你无需修改 Kubernetes 自身的代码，通过把定制控制器关联到一个以上的定制资源上，即可以扩展集群的行为。 +Kubernetes 的 {{< glossary_tooltip text="Operator 模式" term_id="operator-pattern" >}}概念允许你在不修改 +Kubernetes 自身代码的情况下，通过为一个或多个自定义资源关联{{< glossary_tooltip text="控制器" term_id="controller" >}} +来扩展集群的能力。 Operator 是 Kubernetes API 的客户端，充当 -[定制资源](/zh/docs/concepts/extend-kubernetes/api-extension/custom-resources/) +[自定义资源](/zh/docs/concepts/extend-kubernetes/api-extension/custom-resources/) 的控制器。 @@ -66,10 +66,8 @@ It is implemented as an extension API server and a controller, using etcd for st 与服务代理进行通信，并作为 Kubernetes API 服务器的中介，以便协商启动部署和获取 应用程序使用托管服务时必须的凭据。 -服务目录实现为一个扩展 API 服务器和一个控制器，使用 Etcd 提供存储。 -它还使用了 Kubernetes 1.7 之后版本中提供的 -[聚合层](/zh/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) -来呈现其 API。 +它是[基于 CRDs](/zh/docs/concepts/extend-kubernetes/api-extension/custom-resources/#custom-resources) +架构实现的。 ![服务目录架构](/images/docs/service-catalog-architecture.svg) diff --git a/content/zh/docs/concepts/policy/pid-limiting.md b/content/zh/docs/concepts/policy/pid-limiting.md index 9e69357b13..85b1c531aa 100644 --- a/content/zh/docs/concepts/policy/pid-limiting.md +++ b/content/zh/docs/concepts/policy/pid-limiting.md @@ -197,7 +197,7 @@ Eviction signal value is calculated periodically and does NOT enforce the limit. 你可以配置 kubelet 使之在 Pod 行为不正常或者消耗不正常数量资源的时候将其终止。 这一特性称作驱逐。你可以针对不同的驱逐信号 -[配置资源不足的处理](/zh/docs/tasks/administer-cluster/out-of-resource)。 +[配置资源不足的处理](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/)。 使用 `pid.available` 驱逐信号来配置 Pod 使用的 PID 个数的阈值。 你可以设置硬性的和软性的驱逐策略。不过，即使使用硬性的驱逐策略， 如果 PID 个数增长过快，节点仍然可能因为触及节点 PID 限制而进入一种不稳定状态。 diff --git a/content/zh/docs/concepts/services-networking/service-traffic-policy.md b/content/zh/docs/concepts/services-networking/service-traffic-policy.md index f52f073d2e..7fbbad454e 100644 --- a/content/zh/docs/concepts/services-networking/service-traffic-policy.md +++ b/content/zh/docs/concepts/services-networking/service-traffic-policy.md @@ -119,10 +119,10 @@ kube-proxy 基于 `spec.internalTrafficPolicy` 的设置来过滤路由的目标 ## {{% heading "whatsnext" %}} -* 请阅读[启用拓扑感知提示](/zh/docs/tasks/administer-cluster/enabling-topology-aware-hints) +* 请阅读[拓扑感知提示](/zh/docs/concepts/services-networking/topology-aware-hints) * 请阅读[Service 的外部流量策略](/zh/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip) * 请阅读[用 Service 连接应用](/zh/docs/concepts/services-networking/connect-applications-service/) diff --git a/content/zh/docs/concepts/services-networking/service.md b/content/zh/docs/concepts/services-networking/service.md index 722d5e1c70..530a1de324 100644 --- a/content/zh/docs/concepts/services-networking/service.md +++ b/content/zh/docs/concepts/services-networking/service.md @@ -936,7 +936,7 @@ Kubernetes `ServiceTypes` 允许指定你所需要的 Service 类型，默认是 * `ClusterIP`: Exposes the Service on a cluster-internal IP. Choosing this value makes the Service only reachable from within the cluster. This is the default `ServiceType`. -* [`NodePort`](#nodeport): Exposes the Service on each Node's IP at a static port +* [`NodePort`](#type-nodeport): Exposes the Service on each Node's IP at a static port (the `NodePort`). A `ClusterIP` Service, to which the `NodePort` Service routes, is automatically created. You'll be able to contact the `NodePort` Service, from outside the cluster, @@ -953,7 +953,7 @@ Kubernetes `ServiceTypes` 允许指定你所需要的 Service 类型，默认是 --> * `ClusterIP`：通过集群的内部 IP 暴露服务，选择该值时服务只能够在集群内部访问。 这也是默认的 `ServiceType`。 -* [`NodePort`](#nodeport)：通过每个节点上的 IP 和静态端口（`NodePort`）暴露服务。 +* [`NodePort`](#type-nodeport)：通过每个节点上的 IP 和静态端口（`NodePort`）暴露服务。 `NodePort` 服务会路由到自动创建的 `ClusterIP` 服务。 通过请求 `<节点 IP>:<节点端口>`，你可以从集群的外部访问一个 `NodePort` 服务。 * [`LoadBalancer`](#loadbalancer)：使用云提供商的负载均衡器向外部暴露服务。 @@ -974,7 +974,7 @@ Ingress 不是一种服务类型，但它充当集群的入口点。 它可以将路由规则整合到一个资源中，因为它可以在同一IP地址下公开多个服务。 -### NodePort 类型 {#nodeport} +### NodePort 类型 {#type-nodeport} 如果你将 `type` 字段设置为 `NodePort`，则 Kubernetes 控制平面将在 `--service-node-port-range` 标志指定的范围内分配端口（默认值：30000-32767）。 @@ -1718,6 +1718,13 @@ in those modified security groups. 如果节点具有公共 IP 地址，请注意，非 NLB 流量也可以到达那些修改后的安全组中的所有实例。 {{< /note >}} + +有关弹性 IP 注解和更多其他常见用例， +请参阅[AWS负载均衡控制器文档](https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/service/annotations/)。 + -{{< feature-state for_k8s_version="v1.21" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} -如果你已经[启用](/zh/docs/tasks/administer-cluster/enabling-topology-aware-hints)了整个特性， -就可以通过把注解 `service.kubernetes.io/topology-aware-hints` 的值设置为 `auto`， + +你可以通过把注解 `service.kubernetes.io/topology-aware-hints` 的值设置为 `auto`， 来激活服务的拓扑感知提示功能。 这告诉 EndpointSlice 控制器在它认为安全的时候来设置拓扑提示。 重要的是，这并不能保证总会设置提示（hints）。 @@ -278,8 +277,7 @@ Kubernetes 控制平面和每个节点上的 kube-proxy，在使用拓扑感知 ## {{% heading "whatsnext" %}} -* 参阅[启用拓扑感知提示](/zh/docs/tasks/administer-cluster/enabling-topology-aware-hints/) + * 参阅[通过服务连通应用](/zh/docs/concepts/services-networking/connect-applications-service/) diff --git a/content/zh/docs/concepts/workloads/pods/disruptions.md b/content/zh/docs/concepts/workloads/pods/disruptions.md index a85f37ff03..d94bf9121a 100644 --- a/content/zh/docs/concepts/workloads/pods/disruptions.md +++ b/content/zh/docs/concepts/workloads/pods/disruptions.md @@ -253,11 +253,12 @@ Pod 控制器的 `.spec.replicas` 计算“预期的” Pod 数量。 根据 Pod 对象的 `.metadata.ownerReferences` 字段来发现控制器。 -PDB 不能阻止[非自愿干扰](#voluntary-and-involuntary-disruptions)的发生，但是确实会计入 -预算。 + +PDB 无法防止[非自愿干扰](#voluntary-and-involuntary-disruptions)； +但它们确实计入预算。 -{{< feature-state state="alpha" for_k8s_version="v1.22" >}} +{{< feature-state state="beta" for_k8s_version="v1.23" >}} -临时容器处于 Alpha 阶段，不适用于生产环境集群。 -根据 [Kubernetes 弃用政策](/zh/docs/reference/using-api/deprecation-policy/)， -此 Alpha 功能将来可能发生重大变化或被完全删除。 -{{< /warning >}} - 本页讨论 Kubernetes 文档的样式指南。 @@ -34,7 +34,7 @@ discussion. 样式指南的变更是 SIG Docs 团队集体决定。 如要提议更改或新增条目，请先将其添加到下一次 SIG Docs 例会的 -[议程表](https://docs.google.com/document/d/1ddHwLK3kUMX1wVFIwlksjTk0MsqitBnWPe1LRa1Rx5A/edit) +[议程表](https://bit.ly/sig-docs-agenda) 上，并按时参加会议讨论。 @@ -123,7 +123,7 @@ For managing confidential data, consider using the Secret API. | For managing co {{< table caption = "使用 Pascal 风格大小写来给出 API 对象的约定" >}} 可以 | 不可以 :--| :----- -该 HorizontalPodAutoscaler 负责... | 该 HorizontalPodAutoscaler 负责... +该 HorizontalPodAutoscaler 负责... | 该 Horizontal pod autoscaler 负责... 每个 PodList 是一个 Pod 组成的列表。 | 每个 Pod List 是一个由 pods 组成的列表。 该 Volume 对象包含一个 `hostPath` 字段。 | 此卷对象包含一个 hostPath 字段。 每个 ConfigMap 对象都是某个名字空间的一部分。| 每个 configMap 对象是某个名字空间的一部分。 diff --git a/content/zh/docs/reference/access-authn-authz/abac.md b/content/zh/docs/reference/access-authn-authz/abac.md index 789e1cd3db..f025efb881 100644 --- a/content/zh/docs/reference/access-authn-authz/abac.md +++ b/content/zh/docs/reference/access-authn-authz/abac.md @@ -38,7 +38,7 @@ Attribute-based access control (ABAC) defines an access control paradigm whereby To enable `ABAC` mode, specify `--authorization-policy-file=SOME_FILENAME` and `--authorization-mode=ABAC` on startup. The file format is [one JSON object per line](http://jsonlines.org/). There -should be no enclosing list or map, just one map per line. +should be no enclosing list or map, only one map per line. Each line is a "policy object", where each such object is a map with the following properties: @@ -73,7 +73,7 @@ properties: 基于 `ABAC` 模式，可以这样指定策略文件 `--authorization-policy-file=SOME_FILENAME`。 -此文件格式是 [JSON Lines](https://jsonlines.org/)，不应存在封闭的列表或映射，每行一个映射。 +此文件格式是 [JSON Lines](https://jsonlines.org/)，不应存在外层的列表或映射，每行应只有一个映射。 每一行都是一个策略对象，策略对象是具有以下属性的映射： @@ -258,7 +258,7 @@ Kubectl 使用 api-server 的 `/api` 和 `/apis` 端点来发现服务资源类 ``` -[完整文件示例](https://releases.k8s.io/{{< param "githubbranch" >}}/pkg/auth/authorizer/abac/example_policy_file.jsonl) +[完整文件示例](https://releases.k8s.io/{{< param "fullversion" >}}/pkg/auth/authorizer/abac/example_policy_file.jsonl) ## 服务帐户的快速说明 diff --git a/content/zh/docs/reference/access-authn-authz/admission-controllers.md b/content/zh/docs/reference/access-authn-authz/admission-controllers.md index d7d612af16..7007e9bc23 100644 --- a/content/zh/docs/reference/access-authn-authz/admission-controllers.md +++ b/content/zh/docs/reference/access-authn-authz/admission-controllers.md @@ -1171,8 +1171,30 @@ PodNodeSelector 允许 Pod 强制在特定标签的节点上运行。 另请参阅 PodTolerationRestriction 准入插件，该插件可防止 Pod 在特定污点的节点上运行。 {{< /note >}} +### PodSecurity {#podsecurity} + +{{< feature-state for_k8s_version="v1.22" state="alpha" >}} + + +这是下节已被废弃的 [PodSecurityPolicy](#podsecuritypolicy) 准入控制器的替代品。 +此准入控制器负责在创建和修改 Pod 时根据请求的安全上下文和 +[Pod 安全标准](/zh/docs/concepts/security/pod-security-standards/) +来确定是否可以执行请求。 + +更多信息请参阅 [Pod 安全性准入控制器](/zh/docs/concepts/security/pod-security-admission/)。 + ### PodSecurityPolicy {#podsecuritypolicy} +{{< feature-state for_k8s_version="v1.21" state="deprecated" >}} + +输出类似于： + ``` yes ``` @@ -231,6 +235,10 @@ yes ```shell kubectl auth can-i create deployments --namespace prod ``` + + +输出类似于： + ``` no ``` @@ -246,16 +254,39 @@ to determine what action other users can perform. ```bash kubectl auth can-i list secrets --namespace dev --as dave ``` + + +输出类似于： + ``` no ``` + +类似地，检查名字空间 `dev` 里的 `dev-sa` 服务账号是否可以列举名字空间 `target` 里的 Pod： + +```bash +kubectl auth can-i list pods \ + --namespace target \ + --as system:serviceaccount:dev:dev-sa +``` + + +输出类似于： + +``` +yes +``` + -## 通过创建 Pod 提升权限 +## 通过创建或编辑工作负载提升权限 {#privilege-escalation-via-pod-creation} -能够在名字空间中创建 Pod 的用户可能会提升其在该名字空间内的权限。 -他们可以创建在该名字空间内访问其权限的 Pod。 -他们可以创建 Pod 访问用户自己无法读取的 Secret，或者在具有不同/更高权限的 -服务帐户下运行的 Pod 。 +能够在名字空间中创建或者编辑 Pod 的用户， +无论是直接操作还是通过[控制器](/zh/docs/concepts/architecture/controller/)（例如，一个 Operator）来操作， +都可以提升他们在该名字空间内的权限。 {{< caution >}} -系统管理员在授予对 Pod 创建的访问权限时要小心。 -被授予在名字空间中创建 Pod（或创建 Pod 的控制器）的权限的用户可以： -读取名字空间中的所有 Secret；读取名字空间中的所有 ConfigMap； -并模拟名字空间中的任意服务账号并执行账号可以执行的任何操作。 -无论采用何种鉴权方式，这都适用。 +系统管理员在授予对工作负载的创建或编辑的权限时要小心。 +关于这些权限如何被误用的详细信息请参阅 +[提升途径](#escalation-paths) {{< /caution >}} + +### 提升途径 {#escalation-paths} +- 挂载该名字空间内的任意 Secret + - 可以用来访问其他工作负载专用的 Secret + - 可以用来获取权限更高的服务账号的令牌 +- 使用该名字空间内的任意服务账号 + - 可以用另一个工作负载的身份来访问 Kubernetes API（伪装） + - 可以执行该服务账号的任意特权操作 +- 挂载该名字空间里其他工作负载专用的 ConfigMap + - 可以用来获取其他工作负载专用的信息，例如数据库主机名。 +- 挂载该名字空间里其他工作负载的卷 + - 可以用来获取其他工作负载专用的信息，并且更改它。 + +{{< caution >}} + +系统管理员在部署改变以上部分的 CRD 的时候要小心。 +它们可能会打开权限提升的途径。 +在决定你的 RBAC 控制时应该考虑这方面的问题。 +{{< /caution >}} + + ## {{% heading "whatsnext" %}} @@ -159,8 +160,9 @@ ClusterRole 可以和 Role 相同完成授权。 * 集群范围资源（比如 {{< glossary_tooltip text="节点（Node）" term_id="node" >}}） * 非资源端点（比如 `/healthz`） -* 跨名字空间访问的名字空间作用域的资源（如 Pods），比如，你可以使用 - ClusterRole 来允许某特定用户执行 `kubectl get pods --all-namespaces` +* 跨名字空间访问的名字空间作用域的资源（如 Pods） + + 比如，你可以使用 ClusterRole 来允许某特定用户执行 `kubectl get pods --all-namespaces` -你不能针对 `create` 或者 `deletecollection` 请求来实施 resourceName 限制。 -对于 `create` 操作而言，这是因为在鉴权时还不知道对象名称。 +你不能使用资源名字来限制 `create` 或者 `deletecollection` 请求。 +对于 `create` 请求而言，这是因为在鉴权时可能还不知道新对象的名字。 +如果你使用 resourceName 来限制 `list` 或者 `watch` 请求， +客户端必须在它们的 `list` 或者 `watch` 请求里包含一个与指定的 resourceName 匹配的 `metadata.name` 字段选择器。 +例如，`kubectl get configmaps --field-selector=metadata.name=my-configmap` {{< /note >}} -如果你创建一个与某现有聚合 ClusterRole 的标签选择算符匹配的 ClusterRole， +如果你创建一个与某个已存在的聚合 ClusterRole 的标签选择算符匹配的 ClusterRole， 这一变化会触发新的规则被添加到聚合 ClusterRole 的操作。 下面的例子中，通过创建一个标签同样为 `rbac.example.com/aggregate-to-monitoring: true` 的 ClusterRole，新的规则可被添加到 "monitoring" ClusterRole 中。 @@ -1051,12 +1058,18 @@ When used in a RoleBinding, it gives full control over every resource in Allows admin access, intended to be granted within a namespace using a RoleBinding. If used in a RoleBinding, allows read/write access to most resources in a namespace, including the ability to create roles and rolebindings within the namespace. -It does not allow write access to resource quota or to the namespace itself. +This role does not allow write access to resource quota or to the namespace itself. +This role also does not allow write access to Endpoints in clusters created +using Kubernetes v1.22+. More information is available in the +["Write Access for Endpoints" section](#write-access-for-endpoints). --> 允许管理员访问权限，旨在使用 RoleBinding 在名字空间内执行授权。 + 如果在 RoleBinding 中使用，则可授予对名字空间中的大多数资源的读/写权限， 包括创建角色和角色绑定的能力。 -但是它不允许对资源配额或者名字空间本身进行写操作。 +此角色不允许对资源配额或者名字空间本身进行写操作。 +此角色也不允许对 Kubernetes v1.22+ 创建的 Endpoints 进行写操作。 +更多信息参阅[“Endpoints 写权限”小节](#write-access-for-endpoints)。 @@ -1071,12 +1084,17 @@ Allows read/write access to most objects in a namespace. This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in -the namespace. +the namespace. This role also does not allow write access to Endpoints in +clusters created using Kubernetes v1.22+. More information is available in the +["Write Access for Endpoints" section](#write-access-for-endpoints). --> 允许对名字空间的大多数对象进行读/写操作。 + 它不允许查看或者修改角色或者角色绑定。 不过，此角色可以访问 Secret，以名字空间中任何 ServiceAccount 的身份运行 Pods， 所以可以用来了解名字空间内所有服务账户的 API 访问级别。 +此角色也不允许对 Kubernetes v1.22+ 创建的 Endpoints 进行写操作。 +更多信息参阅[“Endpoints 写操作”小节](#write-access-for-endpoints)。 @@ -1327,10 +1345,10 @@ Role for the node- 无 允许访问大部分 -动态卷驱动 +动态卷驱动 所需要的资源。 @@ -1957,6 +1975,40 @@ In order from most secure to least secure, the approaches are: --group=system:serviceaccounts ``` + +## Endpoints 写权限 {#write-access-for-endpoints} + +在 Kubernetes v1.22 之前版本创建的集群里， +"edit" 和 "admin" 聚合角色包含对 Endpoints 的写权限。 +作为 [CVE-2021-25740](https://github.com/kubernetes/kubernetes/issues/103675) 的缓解措施， +此访问权限不包含在 Kubernetes 1.22 以及更高版本集群的聚合角色里。 + +升级到 Kubernetes v1.22 版本的现有集群不会包括此变化。 +[CVE 公告](https://github.com/kubernetes/kubernetes/issues/103675) +包含了在现有集群里限制此访问权限的指引。 + +如果你希望在新集群的聚合角色里保留此访问权限，你可以创建下面的 ClusterRole： + +{{< codenew file="access/endpoints-aggregated.yaml" >}} + + +## 资源类型 {#resource-types} - [Event](#audit-k8s-io-v1-Event) - [EventList](#audit-k8s-io-v1-EventList) - [Policy](#audit-k8s-io-v1-Policy) - [PolicyList](#audit-k8s-io-v1-PolicyList) - - - ## `Event` {#audit-k8s-io-v1-Event} - - - + +**出现在：** - [EventList](#audit-k8s-io-v1-EventList) - + +Event 结构包含可出现在 API 审计日志中的所有信息。 - + - - - - + + 生成事件所对应的审计级别。 + - - + + 为每个请求所生成的唯一审计 ID。 + - - + + 生成此事件时请求的处理阶段。 + - - + + requestURI 是客户端发送到服务器端的请求 URI。 + - + + verb 是与请求对应的 Kubernetes 动词。对于非资源请求，此字段为 HTTP 方法的小写形式。 + - - + + 关于认证用户的信息。 + - - + + + 关于所伪装（impersonated）的用户的信息。 + - - + + + 发起请求和中间代理的源 IP 地址。 + - - + + + + userAgent 中记录客户端所报告的用户代理（User Agent）字符串。 + 注意 userAgent 信息是由客户端提供的，一定不要信任。 + - - + + + 此请求所指向的对象引用。对于 List 类型的请求或者非资源请求，此字段可忽略。 + - - + + + 响应的状态，当 responseObject 不是 Status 类型时被赋值。 + 对于成功的请求，此字段仅包含 code 和 statusSuccess。 + 对于非 Status 类型的错误响应，此字段会被自动赋值为出错信息。 + - - + @@ -147,470 +173,502 @@ Omitted for non-resource requests. Only logged at Request Level and higher.k8s.io/apimachinery/pkg/runtime.Unknown - - + + + 请求到达 API 服务器时的时间。 + - - + + + 请求到达当前审计阶段时的时间。 + - - + + + annotations 是一个无结构的键-值映射，其中保存的是一个审计事件。 + 该事件可以由请求处理链路上的插件来设置，包括身份认证插件、鉴权插件以及 + 准入控制插件等。 + 注意这些注解是针对审计事件本身的，与所提交的对象中的 metadata.annotations + 之间不存在对应关系。 + 映射中的键名应该唯一性地标识生成该事件的组件，从而避免名字上的冲突 + （例如 podsecuritypolicy.admission.k8s.io/policy）。 + 映射中的键值应该比较简洁。 + 当审计级别为 Metadata 时会包含 annotations 字段。 + - -
FieldDescription
字段描述
apiVersion
string		audit.k8s.io/v1
kind
string		Event
level [Required]
+
level [必需]
Level 		- AuditLevel at which event was generated
auditID [Required]
+
auditID [必需]
k8s.io/apimachinery/pkg/types.UID 		- Unique audit ID, generated for each request.
stage [Required]
+
stage [必需]
Stage 		- Stage of the request handling when this event instance was generated.
requestURI [Required]
+
requestURI [必需]
string 		- RequestURI is the request URI as sent by the client to a server.
verb [Required]
+
verb [必需]
string 		- Verb is the kubernetes verb associated with the request. -For non-resource requests, this is the lower-cased HTTP method.
user [Required]
-authentication/v1.UserInfo +
user [必需]
+authentication/v1.UserInfo 		- Authenticated user information.
impersonatedUser
-authentication/v1.UserInfo +authentication/v1.UserInfo 		- Impersonated user information.
sourceIPs
[]string 		- Source IPs, from where the request originated and intermediate proxies.
userAgent
string 		- UserAgent records the user agent string reported by the client. -Note that the UserAgent is provided by the client, and must not be trusted.
objectRef
ObjectReference 		- Object reference this request is targeted at. -Does not apply for List-type requests, or non-resource requests.
responseStatus
-meta/v1.Status +meta/v1.Status 		- The response status, populated even when the ResponseObject is not a Status type. -For successful responses, this will only include the Code and StatusSuccess. -For non-status type error responses, this will be auto-populated with the error Message.
requestObject
k8s.io/apimachinery/pkg/runtime.Unknown 		- API object from the request, in JSON format. The RequestObject is recorded as-is in the request + + 来自请求的 API 对象，以 JSON 格式呈现。requestObject 在请求中按原样记录 + （可能会采用 JSON 重新编码），之后会进入版本转换、默认值填充、准入控制以及 + 配置信息合并等阶段。此对象为外部版本化的对象类型，甚至其自身可能并不是一个 + 合法的对象。对于非资源请求，此字段被忽略。 + 只有当审计级别为 Request 或更高的时候才会记录。 +
- API object returned in the response, in JSON. The ResponseObject is recorded after conversion + + 响应中包含的 API 对象，以 JSON 格式呈现。requestObject 是在被转换为外部类型 + 并序列化为 JSON 格式之后才被记录的。 + 对于非资源请求，此字段会被忽略。 + 只有审计级别为 Response 时才会记录。 +
requestReceivedTimestamp
-meta/v1.MicroTime +meta/v1.MicroTime 		- Time the request reached the apiserver.
stageTimestamp
-meta/v1.MicroTime +meta/v1.MicroTime 		- Time the request reached current audit stage.
annotations
map[string]string 		- Annotations is an unstructured key value map stored with an audit event that may be set by -plugins invoked in the request serving chain, including authentication, authorization and -admission plugins. Note that these annotations are for the audit event, and do not correspond -to the metadata.annotations of the submitted object. Keys should uniquely identify the informing -component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values -should be short. Annotations are included in the Metadata level.
- - ## `EventList` {#audit-k8s-io-v1-EventList} - - - - + +EventList 是审计事件（Event）的列表。 - + - + - - - - - - - -
FieldDescription
字段描述
apiVersion
string		audit.k8s.io/v1
kind
string		EventList
metadata
-meta/v1.ListMeta +meta/v1.ListMeta 		- No description provided. + 列表结构元数据
items [Required]
+ +
items [必需]
[]Event 		- No description provided. + 事件对象列表
- - ## `Policy` {#audit-k8s-io-v1-Policy} - - - + +**出现在：** - [PolicyList](#audit-k8s-io-v1-PolicyList) - + +Policy 定义的是审计日志的配置以及不同类型请求的日志记录规则。 - + - + - - - + + 包含 metadata 字段是为了便于与 API 基础设施之间实现互操作。 + 参考 Kubernetes API 文档了解 metadata 字段的详细信息。 + - - - - - + + + 字段 omitStages 是一个阶段（Stage）列表，其中包含无须生成事件的阶段。 + 注意这一选项也可以通过每条规则来设置。 + 审计组件最终会忽略出现在 omitStages 中阶段，也会忽略规则中的阶段。 + - -
FieldDescription
字段描述
apiVersion
string		audit.k8s.io/v1
kind
string		Policy
metadata
-meta/v1.ObjectMeta +meta/v1.ObjectMeta 		- ObjectMeta is included for interoperability with API infrastructure.Refer to the Kubernetes API documentation for the fields of the metadata field.
rules [Required]
+ +
rules [必需]
[]PolicyRule 		- Rules specify the audit Level a request should be recorded at. + + 字段 rules 设置请求要被记录的审计级别（level）。 + 每个请求可能会与多条规则相匹配；发生这种状况时遵从第一条匹配规则。 + 默认的审计级别是 None，不过可以在列表的末尾使用一条全抓（catch-all）规则 + 重载其设置。 + 列表中的规则（PolicyRule）是严格有序的。 +
omitStages
[]Stage 		- OmitStages is a list of stages for which no events are created. Note that this can also -be specified per rule in which case the union of both are omitted.
- - ## `PolicyList` {#audit-k8s-io-v1-PolicyList} - - - - + +PolicyList 是由审计策略（Policy）组成的列表。 - + - - - - - - - -
FieldDescription
字段描述
apiVersion
string		audit.k8s.io/v1
kind
string		PolicyList
metadata
-meta/v1.ListMeta +meta/v1.ListMeta 		- No description provided. + 列表结构元数据。
items [Required]
+ +
items [必需]
[]Policy 		- No description provided. + 策略（Policy）对象列表。
- - ## `GroupResources` {#audit-k8s-io-v1-GroupResources} - - - + +**出现在：** - [PolicyRule](#audit-k8s-io-v1-PolicyRule) - + +GroupResources 代表的是某 API 组中的资源类别。 - + - - + + 字段 group 给出包含资源的 API 组的名称。 + 空字符串代表 core API 组。 + - - + - - + + + 字段 resourceNames 是策略将匹配的资源实例名称列表。 + 使用此字段时，resources 必须指定。 + 空的 resourceNames 列表意味着资源的所有实例都会匹配到此策略。 + - -
FieldDescription
字段描述
group
string 		- Group is the name of the API group that contains the resources. -The empty string represents the core API group.
resources
[]string 		- Resources is a list of resources this rule applies to. + + 字段 resources 是此规则所适用的资源的列表。
+ 例如：
+ 'pods' 匹配 Pods；
+ 'pods/log' 匹配 Pods 的 log 子资源；
+ '∗' 匹配所有资源及其子资源；
+ 'pods/∗' 匹配 Pods 的所有子资源；
+ '∗/scale' 匹配所有的 scale 子资源。

-If wildcard is present, the validation rule will ensure resources do not -overlap with each other. + + 如果存在通配符，则合法性检查逻辑会确保 resources 中的条目不会彼此重叠。
+ 空的列表意味着规则适用于该 API 组中的所有资源及其子资源。 +
resourceNames
[]string 		- ResourceNames is a list of resource instance names that the policy matches. -Using this field requires Resources to be specified. -An empty list implies that every instance of the resource is matched.
- - ## `Level` {#audit-k8s-io-v1-Level} - + + +string 数据类型的别名。 - + +**出现在：** - [Event](#audit-k8s-io-v1-Event) - - [PolicyRule](#audit-k8s-io-v1-PolicyRule) - + +Level 定义的是审计过程中在日志内记录的信息量。 ## `ObjectReference` {#audit-k8s-io-v1-ObjectReference} - - - + +**出现在：** - [Event](#audit-k8s-io-v1-Event) - + +ObjectReference 包含的是用来检查或修改所引用对象时将需要的全部信息。 - + - - - - + - - + - - + - - + + + 字段 apiGroup 给出包含所引用对象的 API 组的名称。 + 空字符串代表 core API 组。 + - - + + + 字段 apiVersion 是包含所引用对象的 API 组的版本。 + - - + - - + - -
FieldDescription
字段描述
resource
string 		- No description provided. + 资源类别。
namespace
string 		- No description provided. + 资源对象所在名字空间。
name
string 		- No description provided. + 资源对象名称。
uid
k8s.io/apimachinery/pkg/types.UID 		- No description provided. + 资源对象的唯一标识（UID）。
apiGroup
string 		- APIGroup is the name of the API group that contains the referred object. -The empty string represents the core API group.
apiVersion
string 		- APIVersion is the version of the API group that contains the referred object.
resourceVersion
string 		- No description provided. + 资源对象自身的版本值。
subresource
string 		- No description provided. + 子资源的类别。
- - ## `PolicyRule` {#audit-k8s-io-v1-PolicyRule} - - - + +**出现在：** - [Policy](#audit-k8s-io-v1-Policy) - + +PolicyRule 包含一个映射，基于元数据将请求映射到某审计级别。 +请求必须与每个字段所定义的规则都匹配（即 rules 的交集）才被视为匹配。 - + - - - + + 与此规则匹配的请求所对应的日志记录级别（Level）。 + - - + + + 根据身份认证所确定的用户名的列表，给出此规则所适用的用户。 + 空列表意味着适用于所有用户。 + - - + + + 此规则所适用的用户组的列表。如果用户是所列用户组中任一用户组的成员，则视为匹配。 + 空列表意味着适用于所有用户组。 + - - + + + 此规则所适用的动词（verb）列表。 + 空列表意味着适用于所有动词。 + - - + + + 此规则所适用的资源类别列表。 + 空列表意味着适用于 API 组中的所有资源类别。 + - - + + + + 此规则所适用的名字空间列表。 + 空字符串（""）意味着适用于非名字空间作用域的资源。 + 空列表意味着适用于所有名字空间。 - - + + + 字段 nonResourceURLs 给出一组需要被审计的 URL 路径。 + 允许使用 ∗，但只能作为路径中最后一个完整分段。
+ 例如：
+ "/metrics" - 记录对 API 服务器度量值（metrics）的所有请求；
+ "/healthz∗" - 记录所有健康检查请求。 + - - + + + 字段 omitStages 是一个阶段（Stage）列表，针对所列的阶段服务器不会生成审计事件。 + 注意这一选项也可以在策略（Policy）级别指定。服务器审计组件会忽略 + omitStages 中给出的阶段，也会忽略策略中给出的阶段。 + 空列表意味着不对阶段作任何限制。 + - -
FieldDescription
字段描述
level [Required]
+
level [必需]
Level 		- The Level that requests matching this rule are recorded at.
users
[]string 		- The users (by authenticated user name) this rule applies to. -An empty list implies every user.
userGroups
[]string 		- The user groups this rule applies to. A user is considered matching -if it is a member of any of the UserGroups. -An empty list implies every user group.
verbs
[]string 		- The verbs that match this rule. -An empty list implies every verb.
resources
[]GroupResources 		- Resources that this rule matches. An empty list implies all kinds in all API groups.
namespaces
[]string 		- Namespaces that this rule matches. -The empty string "" matches non-namespaced resources. -An empty list implies every namespace.
nonResourceURLs
[]string 		- NonResourceURLs is a set of URL paths that should be audited. -∗s are allowed, but only as the full, final step in the path. -Examples: - "/metrics" - Log requests for apiserver metrics - "/healthz∗" - Log all health checks
omitStages
[]Stage 		- OmitStages is a list of stages for which no events are created. Note that this can also -be specified policy wide in which case the union of both are omitted. -An empty list means no restrictions will apply.
- - ## `Stage` {#audit-k8s-io-v1-Stage} - + + +string 数据类型的别名。 - + +**出现在：** - [Event](#audit-k8s-io-v1-Event) - - [Policy](#audit-k8s-io-v1-Policy) - - [PolicyRule](#audit-k8s-io-v1-PolicyRule) - + +Stage 定义在请求处理过程中可以生成审计事件的阶段。 + diff --git a/content/zh/docs/reference/config-api/apiserver-webhookadmission.v1.md b/content/zh/docs/reference/config-api/apiserver-webhookadmission.v1.md index fb45ca7b1a..e577e497c6 100644 --- a/content/zh/docs/reference/config-api/apiserver-webhookadmission.v1.md +++ b/content/zh/docs/reference/config-api/apiserver-webhookadmission.v1.md @@ -1,46 +1,52 @@ --- -title: WebhookAdmission Configuration (v1) +title: WebhookAdmission 配置 (v1) content_type: tool-reference package: apiserver.config.k8s.io/v1 auto_generated: true --- + + + + +此 API 的版本是 v1。 +## 资源类型 {#resource-types} - [WebhookAdmission](#apiserver-config-k8s-io-v1-WebhookAdmission) - - - ## `WebhookAdmission` {#apiserver-config-k8s-io-v1-WebhookAdmission} - - - - + +WebhookAdmission 为 Webhook 准入控制器提供配置信息。 - + - - - + + 字段 kubeConfigFile 包含指向 kubeconfig 文件的路径。 + -
FieldDescription
字段描述
apiVersion
string		apiserver.config.k8s.io/v1
kind
string		WebhookAdmission
kubeConfigFile [Required]
+
kubeConfigFile [必需]
string 		- KubeConfigFile is the path to the kubeconfig file.
- - + diff --git a/content/zh/docs/reference/config-api/client-authentication.v1.md b/content/zh/docs/reference/config-api/client-authentication.v1.md new file mode 100644 index 0000000000..e3b919b9c4 --- /dev/null +++ b/content/zh/docs/reference/config-api/client-authentication.v1.md @@ -0,0 +1,280 @@ +--- +title: 客户端身份认证（Client Authentication） (v1) +content_type: tool-reference +package: client.authentication.k8s.io/v1 +auto_generated: true +--- + + + + +## 资源类型 {#resource-types} + +- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential) + +## `ExecCredential` {#client-authentication-k8s-io-v1-ExecCredential} + + +ExecCredential 由基于 exec 的插件使用，与 HTTP 传输组件沟通凭据信息。 + + + + + + + + + + + + + + + + +
字段描述
apiVersion
string		client.authentication.k8s.io/v1
kind
string		ExecCredential
spec [必需]
+ExecCredentialSpec +		 + + 字段 spec 包含由 HTTP 传输组件传递给插件的信息。 +
status
+ExecCredentialStatus +		 + + 字段 status 由插件填充，包含传输组件与 API 服务器连接时需要提供的凭据。 +
+ +## `Cluster` {#client-authentication-k8s-io-v1-Cluster} + + +**出现在：** + +- [ExecCredentialSpec](#client-authentication-k8s-io-v1-ExecCredentialSpec) + + +Cluster 中包含允许 exec 插件与 Kubernetes 集群进行通信身份认证时所需 +的信息。 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
字段描述
server [必需]
+string +		 + + 字段 server 是 Kubernetes 集群的地址（https://hostname:port）。 +
tls-server-name
+string +		 + + tls-server-name 是用来提供给服务器用作 SNI 解析的，客户端以此检查服务器的证书。 + 如此字段为空，则使用链接服务器时使用的主机名。 +
insecure-skip-tls-verify
+bool +		 + + 设置此字段之后，会令客户端跳过对服务器端证书的合法性检查。 + 这会使得你的 HTTPS 链接不再安全。 +
certificate-authority-data
+[]byte +		 + + 此字段包含 PEM 编码的证书机构（CA）证书。 + 如果为空，则使用系统的根证书。 +
proxy-url
+string +		 + + 此字段用来设置向集群发送所有请求时要使用的代理服务器。 +
config
+k8s.io/apimachinery/pkg/runtime.RawExtension +		 + +

此字段包含一些额外的、特定于 exec 插件和所连接的集群的数据，

+

此字段来自于 clientcmd 集群对象的 extensions[client.authentication.k8s.io/exec] + 字段：

+
+clusters:
+- name: my-cluster
+  cluster:
+    ...
+    extensions:
+    - name: client.authentication.k8s.io/exec  # 针对每个集群 exec 配置所预留的扩展名称
+      extension:
+        audience: 06e3fbd18de8  # 任意配置信息
+
+ + +

在某些环境中，用户配置可能对很多集群而言都完全一样（即调用同一个 exec 插件）， + 只是针对不同集群会有一些细节上的差异，例如 audience。 + 此字段使得特定于集群的配置可以直接使用集群信息来设置。 + 不建议使用此字段来保存 Secret 数据，因为 exec 插件的主要优势之一是不需要在 + kubeconfig 中保存 Secret 数据。 +

+ +## `ExecCredentialSpec` {#client-authentication-k8s-io-v1-ExecCredentialSpec} + + +**出现在：** + +- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential) + + +ExecCredentialSpec 保存传输组件所提供的特定于请求和运行时的信息。 + + + + + + + + + + + + + +
字段描述
cluster
+Cluster +		 + + 此字段中包含的信息使得 exec 插件能够与要访问的 Kubernetes 集群通信。 + 注意，cluster 字段只有在 exec 驱动的配置中 provideClusterInfo + （即：ExecConfig.ProvideClusterInfo）被设置为 true 时才不能为空。 +
interactive [必需]
+bool +		 + + 此字段用来标明标准输出信息是否已传递给 exec 插件。 +
+ +## `ExecCredentialStatus` {#client-authentication-k8s-io-v1-ExecCredentialStatus} + + + +- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential) + + +

ExecCredentialStatus 中包含传输组件要使用的凭据。

+

字段 token 和 clientKeyData 都是敏感字段。此数据只能在 +客户端与 exec 插件进程之间使用内存来传递。exec 插件本身至少 +应通过文件访问许可来实施保护。

》 + + + + + + + + + + + + + + + + + + + + +
字段描述
expirationTimestamp
+meta/v1.Time +		 + + 给出所提供的凭据到期的时间。 +
token [必需]
+string +		 + + 客户端用做请求身份认证的持有者令牌。 +
clientCertificateData [必需]
+string +		 + + PEM 编码的客户端 TLS 证书（如果有临时证书，也会包含）。 +
clientKeyData [必需]
+string +		 + + 与上述证书对应的、PEM 编码的私钥。 +
+ diff --git a/content/zh/docs/reference/config-api/kubeadm-config.v1beta3.md b/content/zh/docs/reference/config-api/kubeadm-config.v1beta3.md new file mode 100644 index 0000000000..c51bf4a3ef --- /dev/null +++ b/content/zh/docs/reference/config-api/kubeadm-config.v1beta3.md @@ -0,0 +1,1867 @@ +--- +title: kubeadm 配置 (v1beta3) +content_type: tool-reference +package: kubeadm.k8s.io/v1beta3 +auto_generated: true +--- + + + + +

概述

+ +

包 v1beta3 定义 kubeadm 配置文件格式的 v1beta3 版本。 +此版本改进了 v1beta2 的格式，修复了一些小问题并添加了一些新的字段。

+ +

从 v1beta2 版本以来的变更列表：

+ + +
    +
  • 已弃用的字段 "ClusterConfiguration.useHyperKubeImage" 现在被移除。 + kubeadm 不再支持 hyperkube 镜像。
    • +
  • 字段 "ClusterConfiguration.dns.type" 已经被移除，因为 CoreDNS 是 kubeadm 所支持 + 的唯一 DNS 服务器类型。
    • +
  • 保存私密信息的字段现在包含了 "datapolicy" 标记（tag）。 +这一标记会导致 API 结构通过 klog 打印输出时，会忽略这些字段的值。
    • +
  • 添加了 "InitConfiguration.skipPhases", "JoinConfiguration.skipPhases"， +以允许在执行 kubeadm init/join 命令时略过某些阶段。
    • + +
  • 添加了 "InitConfiguration.nodeRegistration.imagePullPolicy" 和 +"JoinConfiguration.nodeRegistration.imagePullPolicy" +以允许在 kubeadm init 和 kubeadm join 期间指定镜像拉取策略。 +这两个字段的值必须是 "Always"、"Never" 或 "IfNotPresent" 之一。 +默认值是 "IfNotPresent"，也是添加此字段之前的默认行为。
    • +
  • 添加了 "InitConfiguration.patches.directory", +"JoinConfiguration.patches.directory" 以允许用户配置一个目录， +kubeadm 将从该目录中提取组件的补丁包。
    • +
  • BootstrapToken∗ API 和相关的工具被从 "kubeadm" API 组中移出， +放到一个新的 "bootstraptoken" 组中。kubeadm API 版本 v1beta3 不再包含 +BootstrapToken∗ 结构。
    • +
+ +

从老的 kubeadm 配置版本迁移：

+
    +
  • kubeadm v1.15.x 及更新的版本可以用来从 v1beta1 迁移到 v1beta2 版本；
    • +
  • kubeadm v1.22.x 及更新的版本不再支持 v1beta1 和更老的 API，但可以用来 +从 v1beta2 迁移到 v1beta3。
    • + + +

    基础知识

    + +

    配置 kubeadm 的推荐方式是使用 --config 选项向其传递一个 YAML 配置文件。 +kubeadm 配置文件中定义的某些配置选项也可以作为命令行标志来使用，不过这种 +方法所支持的都是一些最常见的、最简单的使用场景。

    + +

    一个 kubeadm 配置文件中可以包含多个配置类型，使用三根横线（---）作为分隔符。

    + +

    kubeadm 支持以下配置类型：

    + +
    apiVersion: kubeadm.k8s.io/v1beta3
+kind: InitConfiguration
+
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: ClusterConfiguration
+
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+
+apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: JoinConfiguration
+
    + + + +

    要输出 "init" 和 "join" 动作的默认值，可以使用下面的命令：

    + +
    kubeadm config print init-defaults
+kubeadm config print join-defaults
+
    + + +

    配置文件中必须包含的配置类型列表取决于你在执行的动作（init 或 join）， +也取决于你要使用的配置选项（默认值或者高级定制）。

    + +

    如果某些配置类型没有提供，或者仅部分提供，kubeadm 将使用默认值； +kubeadm 所提供的默认值在必要时也会保证其在多个组件之间是一致的 +（例如控制器管理器上的 --cluster-cidr 参数和 kube-proxy 上的 +clusterCIDR）。

    + + +

    用户总是可以重载默认配置值，唯一的例外是一小部分与安全性相关联的配置 +（例如在 API 服务器上强制实施 Node 和 RBAC 鉴权模式）。

    + +

    如果用户所提供的配置类型并非你所执行的操作需要的，kubeadm 会忽略这些配置类型 +并打印警告信息。

    + + +

    kubeadm init 配置类型

    + +

    当带有 --config 选项来执行 kubeadm init 命令时，可以使用下面的配置类型： +`InitConfiguration`、`ClusterConfiguration`、`KubeProxyConfiguration`、`KubeletConfiguration`， +但 `InitConfiguration` 和 `ClusterConfiguration` +之间只有一个是必须提供的。

    + +
    apiVersion: kubeadm.k8s.io/v1beta3
+kind: InitConfiguration
+bootstrapTokens:
+  ...
+nodeRegistration:
+  ...
+
    + + +

    类型 InitConfiguration 用来配置运行时设置，就 kubeadm init 命令而言，包括 +启动引导令牌以及所有与 kubeadm 所在节点相关的设置，包括：

    + +
      +
    • nodeRegistration：其中包含与向集群注册新节点相关的字段；使用这个类型来 +定制节点名称、要使用的 CRI 套接字或者其他仅对当前节点起作用的设置 +（例如节点 IP 地址）。
      • +
    • localAPIEndpoint：代表的是要部署到此节点上的 API 服务器示例的端点； +使用这个类型可以完成定制 API 服务器公告地址这类操作。
      • +
    + +
    apiVersion: kubeadm.k8s.io/v1beta3
+kind: ClusterConfiguration
+networking:
+  ...
+etcd:
+  ...
+apiServer:
+  extraArgs:
+    ...
+  extraVolumes:
+    ...
+...
+
    + + +

    类型 `ClusterConfiguration` 用来定制集群范围的设置，具体包括以下设置：

    + +
      +
    • networking：其中包含集群的网络拓扑配置。使用这一部分可以定制 Pod 的 +子网或者 Service 的子网。
      • + +
    • etcd：etcd 数据库的配置。例如使用这个部分可以定制本地 etcd 或者配置 API 服务器 +使用一个外部的 etcd 集群。
      • +
    • kube-apiserver、kube-scheduler、kube-controller-manager +配置：这些部分可以通过添加定制的设置或者重载 kubeadm 的默认设置来定制控制面组件。
      • +
    + +
    apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+  ...
+
    + + +

    KubeProxyConfiguration 类型用来更改传递给在集群中部署的 kube-proxy 实例 +的配置。如果此对象没有提供，或者仅部分提供，kubeadm 使用默认值。

    + +

    关于 kube-proxy 的官方文档，可参阅 +https://kubernetes.io/zh/docs/reference/command-line-tools-reference/kube-proxy/ +或者 https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration。 +

    + +
    apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+  ...
+
    + + +

    KubeletConfiguration 类型用来更改传递给在集群中部署的 kubelet 实例的配置。 +如果此对象没有提供，或者仅部分提供，kubeadm 使用默认值。

    + +

    关于 kubelet 的官方文档，可参阅 +https://kubernetes.io/zh/docs/reference/command-line-tools-reference/kubelet/ +或者 +https://godoc.org/k8s.io/kubelet/config/v1beta1#KubeletConfiguration。

    + +

    下面是一个为执行 kubeadm init 而提供的、包含多个配置类型的单一 YAML 文件， +其中填充了很多部分。

    + +
    apiVersion: kubeadm.k8s.io/v1beta3
+kind: InitConfiguration
+bootstrapTokens:
+- token: "9a08jv.c0izixklcxtmnze7"
+  description: "kubeadm bootstrap token"
+  ttl: "24h"
+- token: "783bde.3f89s0fje9f38fhf"
+  description: "another bootstrap token"
+  usages:
+  - authentication
+  - signing
+  groups:
+  - system:bootstrappers:kubeadm:default-node-token
+nodeRegistration:
+  name: "ec2-10-100-0-1"
+  criSocket: "/var/run/dockershim.sock"
+  taints:
+  - key: "kubeadmNode"
+    value: "master"
+    effect: "NoSchedule"
+  kubeletExtraArgs:
+    v: 4
+ignorePreflightErrors:
+- IsPrivilegedUser
+   imagePullPolicy: "IfNotPresent"
+localAPIEndpoint:
+  advertiseAddress: "10.100.0.1"
+  bindPort: 6443
+certificateKey: "e6a2eb8581237ab72a4f494f30285ec12a9694d750b9785706a83bfcbbbd2204"
+ skipPhases:
+ - addon/kube-proxy
+---
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: ClusterConfiguration
+etcd:
+  # one of local or external
+  local:
+    imageRepository: "k8s.gcr.io"
+    imageTag: "3.2.24"
+    dataDir: "/var/lib/etcd"
+    extraArgs:
+      listen-client-urls: "http://10.100.0.1:2379"
+    serverCertSANs:
+    -  "ec2-10-100-0-1.compute-1.amazonaws.com"
+    peerCertSANs:
+    - "10.100.0.1"
+  # external:
+    # endpoints:
+    # - "10.100.0.1:2379"
+    # - "10.100.0.2:2379"
+    # caFile: "/etcd/kubernetes/pki/etcd/etcd-ca.crt"
+    # certFile: "/etcd/kubernetes/pki/etcd/etcd.crt"
+    # keyFile: "/etcd/kubernetes/pki/etcd/etcd.key"
+networking:
+  serviceSubnet: "10.96.0.0/16"
+  podSubnet: "10.244.0.0/24"
+  dnsDomain: "cluster.local"
+kubernetesVersion: "v1.21.0"
+controlPlaneEndpoint: "10.100.0.1:6443"
+apiServer:
+  extraArgs:
+    authorization-mode: "Node,RBAC"
+  extraVolumes:
+  - name: "some-volume"
+    hostPath: "/etc/some-path"
+    mountPath: "/etc/some-pod-path"
+    readOnly: false
+    pathType: File
+  certSANs:
+  - "10.100.1.1"
+  - "ec2-10-100-0-1.compute-1.amazonaws.com"
+  timeoutForControlPlane: 4m0s
+controllerManager:
+  extraArgs:
+    "node-cidr-mask-size": "20"
+  extraVolumes:
+  - name: "some-volume"
+    hostPath: "/etc/some-path"
+    mountPath: "/etc/some-pod-path"
+    readOnly: false
+    pathType: File
+scheduler:
+  extraArgs:
+    address: "10.100.0.1"
+  extraVolumes:
+  - name: "some-volume"
+    hostPath: "/etc/some-path"
+    mountPath: "/etc/some-pod-path"
+    readOnly: false
+    pathType: File
+certificatesDir: "/etc/kubernetes/pki"
+imageRepository: "k8s.gcr.io"
+clusterName: "example-cluster"
+---
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+# kubelet specific options here
+---
+apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+# kube-proxy specific options here
+
    + + +

    kubeadm join 配置类型

    + +

    当带有 --config 选项来执行 kubeadm join 操作时， +需要提供 JoinConfiguration 类型。

    + +
    apiVersion: kubeadm.k8s.io/v1beta3
+kind: JoinConfiguration
+  ...
+
    + + +

    JoinConfiguration 类型用来配置运行时设置，就 kubeadm join 而言包括 +用来访问集群信息的发现方法，以及所有特定于 kubeadm 执行所在节点的设置，包括：

    + +
      +
    • nodeRegistration：其中包含向集群注册新节点相关的配置字段； +使用这个类型可以定制节点名称、用使用的 CRI 套接字和所有其他仅适用于当前节点的设置 +（例如节点 IP 地址）。
      • +
    • apiEndpoint：用来代表最终要部署到此节点上的 API +服务器实例的端点。
      • +
    + + +## 资源类型 {#resource-types} + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) +- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) +- [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) + +## `ClusterConfiguration` {#kubeadm-k8s-io-v1beta3-ClusterConfiguration} + + +

    ClusterConfiguration 包含一个 kubadm 集群的集群范围配置信息。

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    字段描述
    apiVersion
    string    		kubeadm.k8s.io/v1beta3
    kind
    string    		ClusterConfiguration
    etcd
    +Etcd +    		 + +

    etcd 中包含 etcd 服务的配置。

    +
    networking
    +Networking +    		 + + networking 字段包含集群的网络拓扑配置。 +
    kubernetesVersion
    +string +    		 + +

    kubernetesVersion 设置控制面的目标版本。

    +
    controlPlaneEndpoint
    +string +    		 + +

    controlPlaneEndpoint 为控制面设置一个稳定的 IP 地址或 DNS 名称。 +取值可以是一个合法的 IP 地址或者 RFC-1123 形式的 DNS 子域名，二者均可以带一个 +可选的 TCP 端口号。 +如果 controlPlaneEndpoint 未设置，则使用 advertiseAddress ++ bindPort。 +如果设置了 controlPlaneEndpoint，但未指定 TCP 端口号，则使用 +bindPort。

    +

    可能的用法有：

    + +
      +
    • 在一个包含不止一个控制面实例的集群中，该字段应该设置为放置在控制面 +实例之前的外部负载均衡器的地址。
      • +
    • 在带有强制性节点回收的环境中，controlPlaneEndpoint 可以用来 +为控制面设置一个稳定的 DNS。
      • +
    +
    apiServer
    +APIServer +    		 + +

    apiServer 包含 API 服务器的一些额外配置。

    +
    controllerManager
    +ControlPlaneComponent +    		 + +

    controllerManager 中包含控制器管理器的额外配置。

    +
    scheduler
    +ControlPlaneComponent +    		 + +

    scheduler 包含调度器的额外配置。

    +
    dns
    +DNS +    		 + +

    dns 定义在集群中安装的 DNS 插件的选项。

    +
    certificatesDir
    +string +    		 + +

    certificatesDir 设置在何处存放或者查找所需证书。

    +
    imageRepository
    +string +    		 + +

    imageRepository 设置用来拉取镜像的容器仓库。 +如果此字段为空，默认使用 k8s.gcr.io。 +当 Kubernetes 用来执行 CI 构造时（Kubernetes 版本以 ci/ 开头）， +将默认使用 gcr.io/k8s-staging-ci-images 来拉取控制面组件镜像， +而使用 k8s.gcr.io 来拉取所有其他镜像。

    +
    featureGates
    +map[string]bool +    		 + +

    featureGates 包含用户所启用的特性门控。

    +
    clusterName
    +string +    		 + +

    集群名称。

    +
    + +## `InitConfiguration` {#kubeadm-k8s-io-v1beta3-InitConfiguration} + + +

    InitConfiguration 包含一组特定于 "kubeadm init" 的运行时元素。 +这里的字段仅用于第一次运行 kubeadm init 命令。 +之后，此结构中的字段信息不会再被上传到 kubeadm upgrade 所要使用的 +kubeadm-config ConfigMap 中。 +这些字段必须设置 "omitempty"

    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    字段描述
    apiVersion
    string    		kubeadm.k8s.io/v1beta3
    kind
    string    		InitConfiguration
    bootstrapTokens
    +[]BootstrapToken +    		 + +

    bootstrapTokens 在 kubeadm init 执行时会被用到， +其中描述了一组要创建的启动引导令牌（Bootstrap Tokens）。 +这里的信息不会被上传到 kubeadm 在集群中保存的 ConfigMap 中，部分原因是由于信息 +本身比较敏感。

    +
    nodeRegistration
    +NodeRegistrationOptions +    		 + +

    nodeRegistration 中包含与向集群中注册新的控制面节点相关的字段。

    +
    localAPIEndpoint
    +APIEndpoint +    		 + +

    localAPIEndpoint 所代表的的是在此控制面节点上要部署的 API 服务器 +的端点。在高可用（HA）配置中，此字段与 ClusterConfiguration.controlPlaneEndpoint +的取值不同：后者代表的是整个集群的全局端点，该端点上的请求会被负载均衡到每个 +API 服务器。 +此配置对象允许你定制本地 API 服务器所公布的、可访问的 IP/DNS 名称和端口。 +默认情况下，kubeadm 会尝试自动检测默认接口上的 IP 并使用该地址。 +不过，如果这种检测失败，你可以在此字段中直接设置所期望的值。

    +
    certificateKey
    +string +    		 + +

    certificateKey 用来设置一个秘钥，该秘钥将对 uploadcerts init +阶段上传到集群中某 Secret 内的秘钥和证书加密。

    +
    skipPhases
    +[]string +    		 + +

    skipPhases 是命令执行过程中药略过的阶段（Phases）。 +通过执行命令 kubeadm init --help 可以获得阶段的列表。 +参数标志 "--skip-phases" 优先于此字段的设置。

    +
    patches
    +Patches +    		 + +

    patches 包含与 kubeadm init 阶段 kubeadm 所部署 +的组件上要应用的补丁相关的信息。

    +
    + +## `JoinConfiguration` {#kubeadm-k8s-io-v1beta3-JoinConfiguration} + +

    + +JoinConfiguration 包含描述特定节点的元素。 +

    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    字段描述
    apiVersion
    string    		kubeadm.k8s.io/v1beta3
    kind
    string    		JoinConfiguration
    nodeRegistration
    +NodeRegistrationOptions +    		 +

    + + nodeRegistration 包含与向集群注册控制面节点相关的字段。 +

    +
    caCertPath
    +string +    		 +

    + + caCertPath 是指向 SSL 证书机构的路径，该证书包用来加密 +节点与控制面之间的通信。默认值为 "/etc/kubernetes/pki/ca.crt"。 +

    +
    discovery [必需]-->[必需]
    +Discovery +    		 +

    + + discovery 设置 TLS 引导过程中 kubelet 要使用的选项。 +

    +
    controlPlane
    +JoinControlPlane +    		 +

    + + controlPlane 定义要在正被加入到集群中的节点上部署的额外 +控制面实例。此字段为 null 时，不会再上面部署额外的控制面实例。 +

    +
    skipPhases
    +[]string +    		 +

    + + 此字段包含在命令执行过程中要略过的阶段。通过 kubeadm join --help +命令可以查看阶段的列表。参数 --skip-phases 优先于此字段。 +

    +
    patches
    +Patches +    		 +

    + + 此字段包含 kubeadm join 阶段向 kubeadm 所部署的组件打补丁 +的选项。 +

    +
    + +## `APIEndpoint` {#kubeadm-k8s-io-v1beta3-APIEndpoint} + + +**出现在：** + +- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) + +- [JoinControlPlane](#kubeadm-k8s-io-v1beta3-JoinControlPlane) + +

    + +APIEndpoint 结构包含某节点上部署的 API 服务器的配置元素。 +

    + + + + + + + + + + + + +
    字段描述
    advertiseAddress
    +string +    		 +

    + + advertiseAddress 设置 API 服务器要公布的 IP 地址。 +

    +
    bindPort
    +int32 +    		 +

    + + bindPort 设置 API 服务器要绑定到的安全端口。默认值为 6443。 +

    +
    + +## `APIServer` {#kubeadm-k8s-io-v1beta3-APIServer} + + +**出现在：** + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) + +

    + +APIServer 包含集群中 API 服务器部署所必需的设置。 +

    + + + + + + + + + + + + + + + +
    字段描述
    ControlPlaneComponent [必需]-->[必需]
    +ControlPlaneComponent +    		（ControlPlaneComponent 结构的字段被嵌入到此类型中） + 无描述. +
    certSANs
    +[]string +    		 +

    + + certSANs 设置 API 服务器签署证书所用的额外主题替代名（Subject Alternative Name，SAN）。 +

    +
    timeoutForControlPlane
    +meta/v1.Duration +    		 +

    + + timeoutForControlPlane 用来控制我们等待 API 服务器开始运行的超时时间。 +

    +
    + +## `BootstrapTokenDiscovery` {#kubeadm-k8s-io-v1beta3-BootstrapTokenDiscovery} + + +**出现在：** + +- [Discovery](#kubeadm-k8s-io-v1beta3-Discovery) + +

    + +BootstrapTokenDiscovery 用来设置基于引导令牌的服务发现选项。 +

    + + + + + + + + + + + + + + + + + + +
    字段描述
    token [必需]-->[必需]
    +string +    		 +

    + + token 用来验证从控制面获得的集群信息。 +

    +
    apiServerEndpoint
    +string +    		 +

    + + apiServerEndpoint

    为 API 服务器的 IP 地址或者域名，从该端点可以获得集群信息。 +

    +
    caCertHashes
    +[]string +    		 +

    + + caCertHashes 设置一组在基于令牌来发现服务时要验证的公钥指纹。 +发现过程中获得的根 CA 必须与这里的数值之一匹配。 +设置为空集合意味着禁用根 CA 指纹，因而可能是不安全的。 +每个哈希值的形式为 "<type>:<value>"，当前唯一支持的 type 为 +"sha256"。 +哈希值为主体公钥信息（Subject Public Key Info，SPKI）对象的 SHA-256 +哈希值（十六进制编码），形式为 DER 编码的 ASN.1。 +例如，这些哈希值可以使用 OpenSSL 来计算。 +

    +
    unsafeSkipCAVerification
    +bool +    		 +

    + + unsafeSkipCAVerification 允许在使用基于令牌的服务发现时 +不使用 caCertHashes 来执行 CA 验证。这会弱化 kubeadm 的安全性， +因为其他节点可以伪装成控制面。 +

    +
    + +## `ControlPlaneComponent` {#kubeadm-k8s-io-v1beta3-ControlPlaneComponent} + + +**出现在：** + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) +- [APIServer](#kubeadm-k8s-io-v1beta3-APIServer) + + +ControlPlaneComponent 中包含对集群中所有控制面组件都适用的设置。 + + + + + + + + + + + + +
    字段描述
    extraArgs
    +map[string]string +    		 +

    + + extraArgs 是要传递给控制面组件的一组额外的参数标志。 +此映射中的每个键对应命令行上使用的标志名称，只是没有其引导连字符。 +

    +
    extraVolumes
    +[]HostPathMount +    		 +

    + + extraVolumes 是一组额外的主机卷，需要挂载到控制面组件中。 +

    +
    + +## `DNS` {#kubeadm-k8s-io-v1beta3-DNS} + + +**出现在：** + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) + + +DNS 结构定义要在集群中使用的 DNS 插件。 + + + + + + + + + +
    字段描述
    ImageMeta [必需]-->[必需]
    +ImageMeta +    		（ImageMeta 的成员被内嵌到此类型中）。 +

    + + imageMeta 允许对 DNS 组件所使用的的镜像作定制。 +

    +
    + +## `Discovery` {#kubeadm-k8s-io-v1beta3-Discovery} + + +**出现在：** + +- [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) + + +Discovery 设置 TLS 启动引导过程中 kubelet 要使用的配置选项。 + + + + + + + + + + + + + + + + + + +
    字段描述
    bootstrapToken
    +BootstrapTokenDiscovery +    		 +

    + + bootstrapToken 设置基于启动引导令牌的服务发现选项。 +bootstrapToken 与 file 是互斥的。 +

    +
    file
    +FileDiscovery +    		 +

    + + 用来设置一个文件或者 URL 路径，指向一个 kubeconfig 文件；该配置文件 +中包含集群信息。 +bootstrapToken 与 file 是互斥的。 +

    +
    tlsBootstrapToken
    +string +    		 +

    + + tlsBootstrapToken 是 TLS 启动引导过程中使用的令牌。 +如果设置了 bootstrapToken，则此字段默认值为 .bootstrapToken.token，不过可以被重载。 +如果设置了 file，此字段必须被设置，以防 kubeconfig 文件 +中不包含其他身份认证信息。 +

    +
    timeout
    +meta/v1.Duration +    		 +

    + + timeout 用来修改发现过程的超时时长。 +

    +
    + +## `Etcd` {#kubeadm-k8s-io-v1beta3-Etcd} + + +**出现在：** + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) + + +Etcd 包含用来描述 etcd 配置的元素。 + + + + + + + + + + + + +
    字段描述
    local
    +LocalEtcd +    		 +

    + + local 提供配置本地 etcd 实例的选项。local 和 +external 是互斥的。 +

    +
    external
    +ExternalEtcd +    		 +

    + + external 描述如何连接到外部的 etcd 集群。 +external 是互斥的。 +

    +
    + +## `ExternalEtcd` {#kubeadm-k8s-io-v1beta3-ExternalEtcd} + + +**出现在：** + +- [Etcd](#kubeadm-k8s-io-v1beta3-Etcd) + + +ExternalEtcd 描述外部 etcd 集群。 +kubeadm 不清楚证书文件的存放位置，因此必须单独提供证书信息。 + + + + + + + + + + + + + + + + + + +
    字段描述
    endpoints [必需]-->[必需]
    +[]string +    		 + +

    endpoints 包含一组 etcd 成员的列表。

    +
    caFile [必需]-->[必需]
    +string +    		 + +

    caFile 是一个 SSL 证书机构（CA）文件，用来加密 etcd 通信。 +如果使用 TLS 连接，此字段为必需字段。

    +
    certFile [必需]
    +string +    		 + +

    certFile 是一个 SSL 证书文件，用来加密 etcd 通信。 +如果使用 TLS 连接，此字段为必需字段。

    +
    keyFile [必需]
    +string +    		 + +

    keyFile 是一个用来加密 etcd 通信的 SSL 秘钥文件。 +此字段在使用 TLS 连接时为必填字段。

    +
    + +## `FileDiscovery` {#kubeadm-k8s-io-v1beta3-FileDiscovery} + + +**出现在：** + +- [Discovery](#kubeadm-k8s-io-v1beta3-Discovery) + + +

    FileDiscovery 用来指定一个文件或者 URL 路径，指向一个 kubeconfig 文件；该配置文件 +可用来加载集群信息。

    + + + + + + + + + +
    字段描述
    kubeConfigPath [必需]
    +string +    		 + +

    kubeConfigPath 用来指定一个文件或者 URL 路径，指向一个 kubeconfig 文件； +该配置文件可用来加载集群信息。

    +
    + +## `HostPathMount` {#kubeadm-k8s-io-v1beta3-HostPathMount} + + +**出现在：** + +- [ControlPlaneComponent](#kubeadm-k8s-io-v1beta3-ControlPlaneComponent) + + +

    HostPathMount 包含从宿主节点挂载的卷的信息。 + + + + + + + + + + + + + + + + + + + + + +
    字段描述
    name [必需]
    +string +    		 + +

    name 为卷在 Pod 模板中的名称。

    +
    hostPath [必需]
    +string +    		 + +

    hostPath 是要在 Pod 中挂载的卷在宿主系统上的路径。

    +
    mountPath [必需]
    +string +    		 + +

    mountPath 是 hostPath 在 Pod 内挂载的路径。

    +
    readOnly
    +bool +    		 + +

    readOnly 控制卷的读写访问模式。

    +
    pathType
    +core/v1.HostPathType +    		 + +

    pathType 是 hostPath 的类型。

    +
    + +## `ImageMeta` {#kubeadm-k8s-io-v1beta3-ImageMeta} + + +**出现在：** + +- [DNS](#kubeadm-k8s-io-v1beta3-DNS) +- [LocalEtcd](#kubeadm-k8s-io-v1beta3-LocalEtcd) + + +

    ImageMeta 用来配置来源不是 Kubernetes/kubernetes +发布过程的组件所使用的镜像。

    + + + + + + + + + + + + +
    字段描述
    imageRepository
    +string +    		 + +

    imageRepository 设置镜像拉取所用的容器仓库。 +若未设置，则使用 ClusterConfiguration 中的 imageRepository。

    +
    imageTag
    +string +    		 + +

    imageTag 允许用户设置镜像的标签。 +如果设置了此字段，则 kubeadm 不再在集群升级时自动更改组件的版本。

    +
    + +## `JoinControlPlane` {#kubeadm-k8s-io-v1beta3-JoinControlPlane} + + +**出现在：** + +- [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) + + +

    JoinControlPlane 包含在正在加入集群的节点上要部署的额外的控制面组件的 +设置。

    + + + + + + + + + + + + +
    字段描述
    localAPIEndpoint
    +APIEndpoint +    		 + +

    localAPIEndpoint 代表的是将在此节点上部署的 API 服务器实例 +的端点。

    +
    certificateKey
    +string +    		 + +

    certificateKey 是在添加新的控制面节点时用来解密所下载的 +Secret 中的证书的秘钥。对应的加密秘钥在 InitConfiguration 结构中。

    +
    + +## `LocalEtcd` {#kubeadm-k8s-io-v1beta3-LocalEtcd} + + +**出现在：** + +- [Etcd](#kubeadm-k8s-io-v1beta3-Etcd) + + +

    LocalEtcd 描述的是 kubeadm 要使用的本地 etcd 集群。

    + + + + + + + + + + + + + + + + + + + + + +
    字段描述
    ImageMeta [必需]
    +ImageMeta +    		（ImageMeta 结构的字段被嵌入到此类型中。） + +

    ImageMeta 允许用户为 etcd 定制要使用的容器。

    +
    dataDir [必需]
    +string +    		 + +

    dataDir 是 etcd 用来存放数据的目录。 +默认值为 "/var/lib/etcd"。

    +
    extraArgs
    +map[string]string +    		 + +

    extraArgs 是为 etcd 可执行文件提供的额外参数，用于在静态 +Pod 中运行 etcd。映射中的每一个键对应命令行上的一个标志参数，只是去掉了 +前置的连字符。

    +
    serverCertSANs
    +[]string +    		 + +

    serverCertSANs 为 etcd 服务器的签名证书设置额外的 +主体替代名（Subject Alternative Names，SAN）。

    +
    peerCertSANs
    +[]string +    		 + +

    peerCertSANs 为 etcd 的对等端签名证书设置额外的 +主体替代名（Subject Alternative Names，SAN）。

    +
    + +## `Networking` {#kubeadm-k8s-io-v1beta3-Networking} + + +**出现在：** + +- [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) + + +

    Networking 中包含描述集群网络配置的元素。

    + + + + + + + + + + + + + + + +
    字段描述
    serviceSubnet
    +string +    		 + +

    serviceSubnet 是 Kubernetes 服务所使用的的子网。 +默认值为 "10.96.0.0/12"。

    +
    podSubnet
    +string +    		 + +

    podSubnet 为 Pod 所使用的子网。

    +
    dnsDomain
    +string +    		 + +

    dnsDomain 是 Kubernetes 服务所使用的的 DNS 域名。 +默认值为 "cluster.local"。

    +
    + +## `NodeRegistrationOptions` {#kubeadm-k8s-io-v1beta3-NodeRegistrationOptions} + + +**出现在：** + +- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) +- [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) + + +

    NodeRegistrationOptions 包含向集群中注册新的控制面或节点所需要的信息； +节点注册可能通过 "kubeadm init" 或 "kubeadm join" 完成。

    + + + + + + + + + + + + + + + + + + + + + + + + +
    字段描述
    name
    +string +    		 + +

    name 是 Node API 对象的 .metadata.name 字段值； +该 API 对象会在此 kubeadm init 或 kubeadm join 操作期间创建。 +在提交给 API 服务器的 kubelet 客户端证书中，此字段也用作其 CommonName。 +如果未指定则默认为节点的主机名。

    +
    criSocket
    +string +    		 + +

    criSocket 用来读取容器运行时的信息。 +此信息会被以注解的方式添加到 Node API 对象至上，用于后续用途。

    +
    taints [必需]
    +[]core/v1.Taint +    		 + +

    tains 设定 Node API 对象被注册时要附带的污点。 +若未设置此字段（即字段值为 null）, 在 kubeadm init 期间，节点与控制面之间的通信。默认值为污点默认设置为 taints: ["node-role.kubernetes.io/master:""]。 +如果你不希望为控制面节点设置污点，可以在 YAML 中将此字段设置为空的列表，即 +taints: []。 此字段仅用在 Node 注册期间。

    +
    kubeletExtraArgs
    +map[string]string +    		 + +

    kubeletExtraArgs 用来向 kubelet 传递额外参数。 +这里的参数会通过 kubeadm 在运行时写入的、由 kubelet 来读取的环境文件来 +传递给 kubelet 命令行。 +这里的设置会覆盖掉 'kubelet-config-1.X' ConfigMap 中包含的一般性的配置。 +命令行标志在解析时优先级更高。 +这里的设置值仅作用于 kubeadm 运行所在的节点。 +映射中的每个键对应命令行中的一个标志参数，只是去掉了前置的连字符。

    +
    ignorePreflightErrors
    +[]string +    		 + +

    ignorePreflightErrors 提供一组在当前节点被注册时可以 +忽略掉的预检错误。

    +
    imagePullPolicy
    +core/v1.PullPolicy +    		 + +

    imagePullPolicy 设定 "kubeadm init" 和 "kubeadm join" +操作期间的镜像拉取策略。此字段的取值可以是 "Always"、"IfNotPresent" 或 +"Never" 之一。 +若此字段未设置，则 kubeadm 使用 "IfNotPresent" 作为其默认值，换言之， +当镜像在主机上不存在时才执行拉取操作。

    +
    + +## `Patches` {#kubeadm-k8s-io-v1beta3-Patches} + + +**出现在：** + +- [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) + + +

    Patches 包含要向 kubeadm 所部署的组件应用的补丁信息。

    + + + + + + + + + +
    字段描述
    directory
    +string +    		 + +

    directory 是指向某目录的路径，该目录中包含名为 +"target[suffix][+patchtype].extension" 的文件。 +例如，"kube-apiserver0+merge.yaml" 或者 "etcd.json"。 +"target" 可以是 "kube-apiserver"、"kube-controller-manager"、 +"kube-scheduler"、"etcd" 之一。 +"patchtype" 可以是 "strategic"、"merge" 或者 "json"， +其取值对应 kubectl 所支持的补丁形式。 +"patchtype" 的默认值是 "strategic"。 +"extension" 必须是 "json" 或者 "yaml"。 +"suffix" 是一个可选的字符串，用来确定按字母表顺序来应用时，哪个补丁最先被应用。

    +
    + +## `BootstrapToken` {#BootstrapToken} + + +**出现在：** + +- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) + + +

    BootstrapToken 描述的是一个启动引导令牌，以 Secret 形式存储在集群中。

    + + + + + + + + + + + + + + + + + + + + + + + + +
    字段描述
    token [必需]
    +BootstrapTokenString +    		 + +

    token 用来在节点与控制面之间建立双向的信任关系。 +在向集群中添加节点时使用。

    +
    description
    +string +    		 + +

    description 设置一个对人友好的消息，说明为什么此令牌 +会存在以及其目标用途，这样其他管理员能够知道其目的。

    +
    ttl
    +meta/v1.Duration +    		 + +

    ttl 定义此令牌的声明周期。默认为 24h。 +expires 和 ttl 是互斥的。

    +
    expires
    +meta/v1.Time +    		 + +

    expires 设置此令牌过期的时间戳。默认为在运行时基于 +ttl 来决定。 +expires 和 ttl 是互斥的。

    +
    usages
    +[]string +    		 + +

    usages 描述此令牌的可能使用方式。默认情况下，令牌可用于 +建立双向的信任关系；不过这里可以改变默认用途。

    +
    groups
    +[]string +    		 + +

    groups 设定此令牌被用于身份认证时对应的附加用户组。

    +
    + +## `BootstrapTokenString` {#BootstrapTokenString} + + +**出现在：** + +- [BootstrapToken](#BootstrapToken) + + +

    BootstrapTokenString 形式为 abcdef.abcdef0123456789 的一个令牌， +用来从加入集群的节点角度验证 API 服务器的身份，或者 "kubeadm join" +在节点启动引导是作为一种身份认证方法。 +此令牌的生命期是短暂的，并且应该如此。

    + + + + + + + + + + + +
    字段描述
    id [必需]
    +string +    		 + + 无描述 + +
    secret [必需]
    +string +    		 + + 无描述 +
    + diff --git a/content/zh/docs/reference/glossary/affinity.md b/content/zh/docs/reference/glossary/affinity.md new file mode 100644 index 0000000000..b3450ed02f --- /dev/null +++ b/content/zh/docs/reference/glossary/affinity.md @@ -0,0 +1,50 @@ +--- +title: 亲和性（Affinity） +id: affinity +date: 2019-01-11 +full_link: zh/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity +short_description: > + 调度程序用于确定在何处放置 Pods（亲和性）的规则 +aka: +tags: +- fundamental +--- + + + +在 Kubernetes 中，_亲和性（affinity）_是一组规则，它们为调度程序提供在何处放置 Pods 提示信息。 + + +亲和性有两种： + +* [节点亲和性](/zh/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity) +* [Pod 间亲和性](/zh/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity) + + +这些规则是使用 Kubernetes {{< glossary_tooltip term_id="label" text="标签">}}（label） +和 {{< glossary_tooltip term_id="pod" text="pods" >}} 中指定的 +{{< glossary_tooltip term_id="selector" text="选择算符">}}定义的， +这些规则可以是必需的或首选的，这取决于你希望调度程序执行它们的严格程度。 diff --git a/content/zh/docs/setup/production-environment/container-runtimes.md b/content/zh/docs/setup/production-environment/container-runtimes.md index 655db08c84..03380bae14 100644 --- a/content/zh/docs/setup/production-environment/container-runtimes.md +++ b/content/zh/docs/setup/production-environment/container-runtimes.md @@ -147,7 +147,7 @@ Kubernetes 仅支持使用同一 cgroup 版本来管理所有控制器。 # dnf install -y grubby && \ sudo grubby \ --update-kernel=ALL \ - --args=”systemd.unified_cgroup_hierarchy=1" + --args="systemd.unified_cgroup_hierarchy=1" ``` 几秒钟后，当你在控制平面节点上执行 `kubectl get nodes`，你会注意到该节点出现在输出中。 + + +{{< note >}} +由于集群节点通常是按顺序初始化的，CoreDNS Pods 很可能都运行在第一个控制面节点上。 +为了提供更高的可用性，请在加入至少一个新节点后 +使用 `kubectl -n kube-system rollout restart deployment coredns` 命令，重新平衡 CoreDNS Pods。 +{{< /note >}} + diff --git a/content/zh/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/zh/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index ae32302cb1..459d74eb07 100644 --- a/content/zh/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/zh/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -115,63 +115,25 @@ For more details please see the [Network Plugin Requirements](/docs/concepts/ext + ## 检查所需端口{#check-required-ports} -### 控制平面节点 +启用这些[必要的端口](/zh/docs/reference/ports-and-protocols/)后才能使 Kubernetes 的各组件相互通信。可以使用 telnet 来检查端口是否启用，例如： -| 协议 | 方向 | 端口范围 | 作用 | 使用者 | -|----------|--------|------------|-------------------------|------------------------------| -| TCP | 入站 | 6443 | Kubernetes API 服务器 | 所有组件 | -| TCP | 入站 | 2379-2380 | etcd 服务器客户端 API | kube-apiserver, etcd | -| TCP | 入站 | 10250 | Kubelet API | kubelet 自身、控制平面组件 | -| TCP | 入站 | 10251 | kube-scheduler | kube-scheduler 自身 | -| TCP | 入站 | 10252 | kube-controller-manager | kube-controller-manager 自身 | +```shell +telnet 127.0.0.1 6443 +``` -### 工作节点 - -| 协议 | 方向 | 端口范围 | 作用 | 使用者 | -|------|--------|-------------|-------------------|-----------------------------| -| TCP | 入站 | 10250 | Kubelet API | kubelet 自身、控制平面组件 | -| TCP | 入站 | 30000-32767 | NodePort 服务† | 所有组件 | - -† [NodePort 服务](/zh/docs/concepts/services-networking/service/) 的默认端口范围。 - -使用 * 标记的任意端口号都可以被覆盖，所以你需要保证所定制的端口是开放的。 - -虽然控制平面节点已经包含了 etcd 的端口，你也可以使用自定义的外部 etcd 集群，或是指定自定义端口。 - -你使用的 Pod 网络插件 (见下) 也可能需要某些特定端口开启。由于各个 Pod 网络插件都有所不同， +你使用的 Pod 网络插件 (详见后续章节) 也可能需要开启某些特定端口。由于各个 Pod 网络插件的功能都有所不同， 请参阅他们各自文档中对端口的要求。 +### 当使用 `kubeadm join`时的工作流程 + +当运行 `kubeadm join` 时，kubeadm 使用 Bootstrap Token 证书执行 TLS 引导，该引导会获取一份证书， +该证书需要下载 `kubelet-config-1.X` ConfigMap 并把它写入 `/var/lib/kubelet/config.yaml` 中。 +动态环境文件的生成方式恰好与 `kubeadm init` 完全相同。 + + +接下来，`kubeadm` 运行以下两个命令将新配置加载到 kubelet 中： ```bash systemctl daemon-reload && systemctl restart kubelet ``` + -### 当使用 `kubeadm join`时的工作流程 - -当运行 `kubeadm join` 时，kubeadm 使用 Bootstrap Token 证书执行 TLS 引导，该引导会获取一份证书，该证书需要下载 `kubelet-config-1.X` ConfigMap 并把它写入 `/var/lib/kubelet/config.yaml` 中。 -动态环境文件的生成方式恰好与 `kubeadm init` 相同。 - -接下来，kubeadm 运行以下两个命令将新配置加载到 kubelet 中： - -```bash -systemctl daemon-reload && systemctl restart kubelet -``` 在 kubelet 加载新配置后，kubeadm 将写入 `/etc/kubernetes/bootstrap-kubelet.conf` KubeConfig 文件中， 该文件包含 CA 证书和引导程序令牌。 kubelet 使用这些证书执行 TLS 引导程序并获取唯一的凭据，该凭据被存储在 `/etc/kubernetes/kubelet.conf` 中。 -当此文件被写入后，kubelet 就完成了执行 TLS 引导程序。 + + + +当 `/etc/kubernetes/kubelet.conf` 文件被写入后，kubelet 就完成了 TLS 引导过程。 +Kubeadm 在完成 TLS 引导过程后将删除 `/etc/kubernetes/bootstrap-kubelet.conf` 文件。 + ## `HostPort` 服务无法工作 @@ -242,7 +242,7 @@ services](/docs/concepts/services-networking/service/#nodeport) or use `HostNetw 有关更多信息，请参考 [CNI portmap 文档](https://github.com/containernetworking/plugins/blob/master/plugins/meta/portmap/README.md). 如果你的网络提供商不支持 portmap CNI 插件，你或许需要使用 -[NodePort 服务的功能](/zh/docs/concepts/services-networking/service/#nodeport) +[NodePort 服务的功能](/zh/docs/concepts/services-networking/service/#type-nodeport) 或者使用 `HostNetwork=true`。 +5. 手动编辑 `kubelet.conf` 指向轮换的 kubelet 客户端证书，方法是将 `client-certificate-data` 和 `client-key-data` 替换为： + + ```yaml + client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem + client-key: /var/lib/kubelet/pki/kubelet-client-current.pem + ``` + + -5. 在故障节点上运行 `kubeadm init phase kubelet-finalize all`。 - 这将使新的 `kubelet.conf` 文件使用 `/var/lib/kubelet/pki/kubelet-client-current.pem` 并将重新启动 kubelet。 -6. 确保节点状况变为 `Ready`。 +6. 重新启动 kubelet。 +7. 确保节点状况变为 `Ready`。 ## 在 Vagrant 中使用 flannel 作为 pod 网络时的默认 NIC @@ -667,6 +676,7 @@ For [flex-volume support](https://github.com/kubernetes/community/blob/ab55d85/c Kubernetes components like the kubelet and kube-controller-manager use the default path of `/usr/libexec/kubernetes/kubelet-plugins/volume/exec/`, yet the flex-volume directory _must be writeable_ for the feature to work. +(**Note**: FlexVolume was deprecated in the Kubernetes v1.23 release) --> ## 节点上的 `/usr` 被以只读方式挂载 {#usr-mounted-read-only} @@ -676,6 +686,7 @@ for the feature to work. 类似 kubelet 和 kube-controller-manager 这类 Kubernetes 组件使用默认路径 `/usr/libexec/kubernetes/kubelet-plugins/volume/exec/`， 而 FlexVolume 的目录 _必须是可写入的_，该功能特性才能正常工作。 +（**注意**：FlexVolume 在 Kubernetes v1.23 版本中已被弃用） * 在将运行 Ansible 命令的计算机上安装 Ansible v2.9 和 python-netaddr * **运行 Ansible Playbook 需要 Jinja 2.11（或更高版本）** * 目标服务器必须有权访问 Internet 才能拉取 Docker 镜像。否则， 需要其他配置（[请参见离线环境](https://github.com/kubernetes-sigs/kubespray/blob/master/docs/offline-environment.md)） * 目标服务器配置为允许 IPv4 转发 -* **你的 SSH 密钥必须复制**到清单中的所有服务器部分 -* 防火墙不受管理，你将需要按照以前的方式实施自己的规则。 - 为了避免在部署过程中出现任何问题，你应该禁用防火墙 -* 如果从非 root 用户帐户运行 kubespray，则应在目标服务器中配置正确的特权升级方法。 - 然后应指定“ansible_become” 标志或命令参数 “--become” 或 “-b” +* **你的 SSH 密钥必须复制**到部署集群的所有服务器中 +* **防火墙不是由 kubespray 管理的**。你需要根据需求设置适当的规则策略。为了避免部署过程中出现问题，可以禁用防火墙。 +* 如果从非 root 用户帐户运行 kubespray，则应在目标服务器中配置正确的特权升级方法 +并指定 `ansible_become` 标志或命令参数 `--become` 或 `-b` ### （5/5）验证部署 Kubespray 提供了一种使用 [Netchecker](https://github.com/kubernetes-sigs/kubespray/blob/master/docs/netcheck.md) 验证 Pod 间连接和 DNS 解析的方法。 -Netchecker 确保 netchecker-agents pod 可以解析。 -DNS 请求并在默认名称空间内对每个请求执行 ping 操作。 -这些 Pods 模仿其余工作负载的类似行为，并用作集群运行状况指示器。 +Netchecker 确保 netchecker-agents Pods 可以解析 DNS 请求， +并在默认命名空间内对每个请求执行 ping 操作。 +这些 Pod 模仿其他工作负载类似的行为，并用作集群运行状况指示器。 -## 访问集群中正在运行的服务 {#accessing-services-running-on-the-cluster} -上一节介绍了如何连接 Kubernetes API 服务。本节介绍如何连接到 Kubernetes -集群上运行的其他服务。 -在 Kubernetes 中，[节点](/zh/docs/concepts/architecture/nodes/)、 -[pods](/zh/docs/concepts/workloads/pods/) 和 -[服务](/zh/docs/concepts/services-networking/service/) 都有自己的 IP。 -在许多情况下，集群上的节点 IP、Pod IP 和某些服务 IP 将无法路由， -因此无法从集群外部的计算机（例如桌面计算机）访问它们。 +## 访问集群上运行的服务 {#accessing-services-running-on-the-cluster} - -### 连接的方法 {#ways-to-connect} - -有多种方式可以从集群外部连接节点、Pod 和服务： - -- 通过公共 IP 访问服务。 - - - 类型为 `NodePort` 或 `LoadBalancer` 的服务，集群外部可以访问。 - 请参阅 [服务](/zh/docs/concepts/services-networking/service/) 和 - [kubectl expose](/docs/reference/generated/kubectl/kubectl-commands/#expose) 文档。 - - 取决于你的集群环境，该服务可能仅暴露给你的公司网络，或者也可能暴露给 - 整个互联网。 - 请考虑公开该服务是否安全。它是否进行自己的身份验证？ - - 在服务后端放置 Pod。要从一组副本中访问一个特定的 Pod，例如进行调试， - 请在 Pod 上设置一个唯一的标签，然后创建一个选择此标签的新服务。 - - 在大多数情况下，应用程序开发人员不应该通过其 nodeIP 直接访问节点。 - - -- 使用 proxy 动词访问服务、节点或者 Pod。 - - 在访问远程服务之前进行 apiserver 身份验证和授权。 - 如果服务不能够安全地暴露到互联网，或者服务不能获得节点 IP 端口的 - 访问权限，或者是为了调试，那么请使用此选项。 - - 代理可能会给一些 web 应用带来问题。 - - 只适用于 HTTP/HTTPS。 - - 更多详细信息在[这里](#manually-constructing-apiserver-proxy-urls)。 - - -- 从集群中的节点或者 Pod 中访问。 - - - 运行一个 Pod，然后使用 [kubectl exec](/docs/reference/generated/kubectl/kubectl-commands/#exec) - 来连接 Pod 里的 Shell。 - 然后从 Shell 中连接其它的节点、Pod 和服务。 - - 有些集群可能允许你通过 SSH 连接到节点，从那你可能可以访问集群的服务。 - 这是一个非正式的方式，可能可以运行在个别的集群上。 - 浏览器和其它一些工具可能没有被安装。集群的 DNS 可能无法使用。 - - -### 发现内建服务 - -通常来说，集群中会有 kube-system 创建的一些运行的服务。 - -通过 `kubectl cluster-info` 命令获得这些服务列表： - -```shell -kubectl cluster-info -``` - -``` -Kubernetes master is running at https://104.197.5.247 -elasticsearch-logging is running at https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy -kibana-logging is running at https://104.197.5.247/api/v1/namespaces/kube-system/services/kibana-logging/proxy -kube-dns is running at https://104.197.5.247/api/v1/namespaces/kube-system/services/kube-dns/proxy -grafana is running at https://104.197.5.247/api/v1/namespaces/kube-system/services/monitoring-grafana/proxy -heapster is running at https://104.197.5.247/api/v1/namespaces/kube-system/services/monitoring-heapster/proxy -``` - - -这展示了访问每个服务的 proxy-verb URL。 -例如，如果集群启动了集群级别的日志（使用 Elasticsearch），并且传递合适的凭证， -那么可以通过 -`https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/` -进行访问。日志也能通过 kubectl 代理获取，例如： -`http://localhost:8080/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/`。 -（参阅[使用 Kubernetes API 访问集群](/zh/docs/tasks/administer-cluster/access-cluster-api/) -了解如何传递凭据，或者使用 kubectl proxy） - -#### 手动构建 apiserver 代理 URL {#manually-constructing-apiserver-proxy-urls} - -如上所述，你可以使用 `kubectl cluster-info` 命令来获得服务的代理 URL。 -要创建包含服务端点、后缀和参数的代理 URL，需添加到服务的代理 URL： -`http://`*`kubernetes_master_address`*`/api/v1/namespaces/`*`namespace_name`*`/services/`*`service_name[:port_name]`*`/proxy` - -如果尚未为端口指定名称，则不必在 URL 中指定 *port_name*。 -对于已命名和未命名的端口，也可以使用端口号代替 *port_name*。 - -默认情况下，API server 使用 HTTP 代理你的服务。 -要使用 HTTPS，请在服务名称前加上 `https:`： -`http://`*`kubernetes_master_address`*`/api/v1/namespaces/`*`namespace_name`*`/services/`*`https:service_name:[port_name]`*`/proxy` - -URL 名称段支持的格式为： - -* `` - 使用 http 代理到默认或未命名的端口 -* `:` - 使用 http 代理到指定的端口名称或端口号 -* `https::` - 使用 https 代理到默认或未命名的端口（注意后面的冒号） -* `https::` - 使用 https 代理到指定的端口名称或端口号 - - -##### 示例 - -* 要访问 Elasticsearch 服务端点 `_search?q=user:kimchy`，你需要使用： - `http://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_search?q=user:kimchy` -* 要访问 Elasticsearch 集群健康信息 `_cluster/health?pretty=true`，你需要使用： - `https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_cluster/health?pretty=true` - -```json - { - "cluster_name" : "kubernetes_logging", - "status" : "yellow", - "timed_out" : false, - "number_of_nodes" : 1, - "number_of_data_nodes" : 1, - "active_primary_shards" : 5, - "active_shards" : 5, - "relocating_shards" : 0, - "initializing_shards" : 0, - "unassigned_shards" : 5 - } -``` - - -### 使用 web 浏览器访问运行在集群上的服务 - -你可以在浏览器地址栏中输入 apiserver 代理 URL。但是： - -- Web 浏览器通常不能传递令牌，因此你可能需要使用基本（密码）身份验证。 - Apiserver 可以配置为接受基本身份验证，但你的集群可能未进行配置。 -- 某些 Web 应用程序可能无法运行，尤其是那些使用客户端 javascript - 以不知道代理路径前缀的方式构建 URL 的应用程序。 本任务使用[外部负载均衡服务](/zh/docs/tasks/access-application-cluster/create-external-load-balancer/)， 所以需要对应的可支持此功能的环境。如果你的环境不能支持，你可以使用 -[NodePort](/zh/docs/concepts/services-networking/service/#nodeport) +[NodePort](/zh/docs/concepts/services-networking/service/#type-nodeport) 类型的服务代替。 diff --git a/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md b/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md index 01fba70e92..139123e8e2 100644 --- a/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md +++ b/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md @@ -2,11 +2,13 @@ title: 在 Minikube 环境中使用 NGINX Ingress 控制器配置 Ingress content_type: task weight: 100 +min-kubernetes-server-version: 1.19 --- @@ -25,31 +27,26 @@ This page shows you how to set up a simple Ingress which routes requests to Serv 本节为你展示如何配置一个简单的 Ingress，根据 HTTP URI 将服务请求路由到 服务 `web` 或 `web2`。 + ## {{% heading "prerequisites" %}} + {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} +如果你使用的是较早的 Kubernetes 版本，请切换到该版本的文档。 -## 创建一个 Minikube 集群 +### 创建一个 Minikube 集群 -1. 点击 **Launch Terminal** +使用 Katacoda +: {{< kat-button >}} - {{< kat-button >}} - - -2. （可选操作）如果你在本地安装了 Minikube，运行下面的命令： - - ```shell - minikube start - ``` +本地 +: 如果已经在本地[安装Minikube](/zh/docs/tasks/tools/#minikube)， +请运行 `minikube start` 创建一个集群。 2. 检查验证 NGINX Ingress 控制器处于运行状态： - ```shell - kubectl get pods -n kube-system - ``` - - {{< note >}} - 这一操作可能需要近一分钟时间。 - {{< /note >}} + {{< tabs name="tab_with_md" >}} + {{% tab name="minikube v1.19 或更高版本" %}} +```shell +kubectl get pods -n ingress-nginx +``` + + {{< note >}}最多可能需要等待一分钟才能看到这些 Pod 运行正常。{{< /note >}} - 输出： + + 输出类似于： - ``` - NAME READY STATUS RESTARTS AGE - default-http-backend-59868b7dd6-xb8tq 1/1 Running 0 1m - kube-addon-manager-minikube 1/1 Running 0 3m - kube-dns-6dcb57bcc8-n4xd4 3/3 Running 0 2m - kubernetes-dashboard-5498ccf677-b8p5h 1/1 Running 0 2m - nginx-ingress-controller-5984b97644-rnkrg 1/1 Running 0 1m - storage-provisioner 1/1 Running 0 2m - ``` +``` +NAME READY STATUS RESTARTS AGE +ingress-nginx-admission-create-g9g49 0/1 Completed 0 11m +ingress-nginx-admission-patch-rqp78 0/1 Completed 1 11m +ingress-nginx-controller-59b45fb494-26npt 1/1 Running 0 11m +``` + {{% /tab %}} + {{% tab name="minikube v1.18.1 或更早版本" %}} +```shell +kubectl get pods -n kube-system +``` + + {{< note >}}最多可能需要等待一分钟才能看到这些 Pod 运行正常。{{< /note >}} + + + 输出类似于： + +``` +NAME READY STATUS RESTARTS AGE +default-http-backend-59868b7dd6-xb8tq 1/1 Running 0 1m +kube-addon-manager-minikube 1/1 Running 0 3m +kube-dns-6dcb57bcc8-n4xd4 3/3 Running 0 2m +kubernetes-dashboard-5498ccf677-b8p5h 1/1 Running 0 2m +nginx-ingress-controller-5984b97644-rnkrg 1/1 Running 0 1m +storage-provisioner 1/1 Running 0 2m +``` + + + 请确保可以在输出中看到一个名称以 `nginx-ingress-controller-` 为前缀的 Pod。 + {{% /tab %}} + {{< /tabs >}} + 输出： ``` @@ -120,7 +142,7 @@ This page shows you how to set up a simple Ingress which routes requests to Serv kubectl expose deployment web --type=NodePort --port=8080 ``` - + 输出： ``` @@ -136,8 +158,8 @@ This page shows you how to set up a simple Ingress which routes requests to Serv kubectl get service web ``` - - 输出： + + 输出类似于： ```shell NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE @@ -153,8 +175,8 @@ This page shows you how to set up a simple Ingress which routes requests to Serv minikube service web --url ``` - - 输出： + + 输出类似于： ```shell http://172.17.0.15:31637 @@ -169,8 +191,8 @@ This page shows you how to set up a simple Ingress which routes requests to Serv 输入节点和端口号（这里是`31637`），之后点击 **Display Port**。 {{< /note >}} - - 输出： + + 输出类似于： ```shell Hello, world! @@ -186,15 +208,15 @@ This page shows you how to set up a simple Ingress which routes requests to Serv 下一步是让自己能够通过 Ingress 资源来访问应用。 -## 创建一个 Ingress 资源 +## 创建一个 Ingress -下面是一个 Ingress 资源的配置文件，负责通过 `hello-world.info` 将服务请求 +下面是一个定义 Ingress 的配置文件，负责通过 `hello-world.info` 将请求 转发到你的服务。 1. 根据下面的 YAML 创建文件 `example-ingress.yaml`： @@ -202,15 +224,15 @@ The following file is an Ingress resource that sends traffic to your Service via {{< codenew file="service/networking/example-ingress.yaml" >}} -2. 通过运行下面的命令创建 Ingress 资源： +2. 通过运行下面的命令创建 Ingress 对象： ```shell kubectl apply -f https://k8s.io/examples/service/networking/example-ingress.yaml ``` - + 输出： ``` @@ -231,15 +253,19 @@ The following file is an Ingress resource that sends traffic to your Service via 此操作可能需要几分钟时间。 {{< /note >}} + + 接下来你将会在ADDRESS列中看到IPv4地址，例如： + ``` NAME CLASS HOSTS ADDRESS PORTS AGE example-ingress hello-world.info 172.17.0.15 80 38s ``` -4. 在 `/etc/hosts` 文件的末尾添加以下内容： +4. 在 `/etc/hosts` 文件的末尾添加以下内容（需要管理员访问权限）： - 此设置使得来自 `hello-world.info` 的请求被发送到 Minikube。 + + 添加完成后，在浏览器中访问URL `hello-world.info`，请求将被发送到 Minikube。 - 输出： + + 你应该看到类似输出： ``` Hello, world! @@ -281,18 +310,19 @@ The following file is an Ingress resource that sends traffic to your Service via {{< /note >}} ## 创建第二个 Deployment -1. 使用下面的命令创建 v2 的 Deployment： +1. 使用下面的命令创建第二个 Deployment： ```shell kubectl create deployment web2 --image=gcr.io/google-samples/hello-app:2.0 ``` - + + 输出： ``` @@ -300,15 +330,15 @@ The following file is an Ingress resource that sends traffic to your Service via ``` -2. 将 Deployment 暴露出来： +2. 将第二个 Deployment 暴露出来： ```shell kubectl expose deployment web2 --port=8080 --type=NodePort ``` - + 输出： ``` @@ -316,13 +346,14 @@ The following file is an Ingress resource that sends traffic to your Service via ``` -## 编辑 Ingress +## 编辑现有的 Ingress {#edit-ingress} -1. 编辑现有的 `example-ingress.yaml`，添加以下行： +1. 编辑现有的 `example-ingress.yaml`，在文件最后添加以下行： ```yaml @@ -338,13 +369,13 @@ The following file is an Ingress resource that sends traffic to your Service via -2. 应用所作变更： +2. 应用变更： ```shell kubectl apply -f example-ingress.yaml ``` - + 输出： ``` @@ -364,8 +395,8 @@ The following file is an Ingress resource that sends traffic to your Service via curl hello-world.info ``` - - 输出： + + 输出类似于： ``` Hello, world! @@ -382,8 +413,8 @@ The following file is an Ingress resource that sends traffic to your Service via curl hello-world.info/v2 ``` - - 输出： + + 输出类似于： ``` Hello, world! @@ -392,7 +423,7 @@ The following file is an Ingress resource that sends traffic to your Service via ``` {{< note >}} 如果你在本地运行 Minikube 环境，你可以使用浏览器来访问 @@ -409,5 +440,4 @@ The following file is an Ingress resource that sends traffic to your Service via * 进一步了解 [Ingress](/zh/docs/concepts/services-networking/ingress/)。 * 进一步了解 [Ingress 控制器](/zh/docs/concepts/services-networking/ingress-controllers/) -* 进一步了解[服务](/zh/docs/concepts/services-networking/service/) - +* 进一步了解 [服务](/zh/docs/concepts/services-networking/service/) diff --git a/content/zh/docs/tasks/access-application-cluster/list-all-running-container-images.md b/content/zh/docs/tasks/access-application-cluster/list-all-running-container-images.md index bf205350dd..6459875aeb 100644 --- a/content/zh/docs/tasks/access-application-cluster/list-all-running-container-images.md +++ b/content/zh/docs/tasks/access-application-cluster/list-all-running-container-images.md @@ -107,17 +107,17 @@ Pod is returned instead of a list of items. {{< /note >}} -## 列出 Pod 中的容器 +## 按 Pod 列出容器镜像 可以使用 `range` 操作进一步控制格式化，以单独操作每个元素。 ```shell -kubectl get pods --all-namespaces -o=jsonpath='{range .items[*]}{"\n"}{.metadata.name}{":\t"}{range .spec.containers[*]}{.image}{", "}{end}{end}' |\ +kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{"\n"}{.metadata.name}{":\t"}{range .spec.containers[*]}{.image}{", "}{end}{end}' |\ sort ``` @@ -132,7 +132,7 @@ following matches only Pods with labels matching `app=nginx`. 要获取匹配特定标签的 Pod，请使用 -l 参数。以下匹配仅与标签 `app=nginx` 相符的 Pod。 ```shell -kubectl get pods --all-namespaces -o=jsonpath="{.items[*].spec.containers[*].image}" -l app=nginx +kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec.containers[*].image}" -l app=nginx ``` - - -{{< feature-state for_k8s_version="v1.21" state="alpha" >}} - - -_拓扑感知提示_ 启用具有拓扑感知能力的路由，其中拓扑感知信息包含在 -{{< glossary_tooltip text="EndpointSlices" term_id="endpoint-slice" >}} 中。 -此功能尽量将流量限制在它的发起区域附近； -可以降低成本，或者提高网络性能。 - -## {{% heading "prerequisites" %}} - - {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} - - -为了启用拓扑感知提示，先要满足以下先决条件： - -* 配置 {{< glossary_tooltip text="kube-proxy" term_id="kube-proxy" >}} - 以 iptables 或 IPVS 模式运行 -* 确保未禁用 EndpointSlices - - -## 启动拓扑感知提示 {#enable-topology-aware-hints} - - -要启用服务拓扑感知，请启用 kube-apiserver、kube-controller-manager、和 kube-proxy 的 -[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/) -`TopologyAwareHints`。 - -``` ---feature-gates="TopologyAwareHints=true" -``` - -## {{% heading "whatsnext" %}} - - -* 参阅面向服务的[拓扑感知提示](/zh/docs/concepts/services-networking/topology-aware-hints) -* 参阅[用服务连通应用](/zh/docs/concepts/services-networking/connect-applications-service/) diff --git a/content/zh/docs/tasks/administer-cluster/highly-available-master.md b/content/zh/docs/tasks/administer-cluster/highly-available-master.md deleted file mode 100644 index 6144a634c8..0000000000 --- a/content/zh/docs/tasks/administer-cluster/highly-available-master.md +++ /dev/null @@ -1,396 +0,0 @@ ---- -title: 搭建高可用的 Kubernetes Masters -content_type: task ---- - - - - - -{{< feature-state for_k8s_version="1.5" state="alpha" >}} - - -你可以在谷歌计算引擎（GCE）的 `kubeup` 或 `kube-down` 脚本中复制 Kubernetes Master。 -本文描述了如何使用 kube-up/down 脚本来管理高可用（HA）的 Master， -以及如何使用 GCE 实现高可用控制节点。 - -## {{% heading "prerequisites" %}} - -{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} - - - -## 启动一个兼容高可用的集群 - -要创建一个新的兼容高可用的集群，你必须在 `kubeup` 脚本中设置以下标志: - - -* `MULTIZONE=true` - 为了防止从不同于服务器的默认区域的区域中删除 kubelets 副本。 - 如果你希望在不同的区域运行副本，那么这一项是必需并且推荐的。 - -* `ENABLE_ETCD_QUORUM_READ=true` - 确保从所有 API 服务器读取数据时将返回最新的数据。 - 如果为 true，读操作将被定向到主 etcd 副本。可以选择将这个值设置为 true， - 那么读取将更可靠，但也会更慢。 - -你还可以指定一个 GCE 区域，在这里创建第一个主节点副本。设置以下标志: - -* `KUBE_GCE_ZONE=zone` - 将运行第一个主节点副本的区域。 - -下面的命令演示在 GCE europe-west1-b 区域中设置一个兼容高可用的集群: - -```shell -MULTIZONE=true KUBE_GCE_ZONE=europe-west1-b ENABLE_ETCD_QUORUM_READS=true ./cluster/kube-up.sh -``` - -注意，上面的命令创建一个只有单一主节点的集群; -但是，你可以使用后续命令将新的主节点副本添加到集群中。 - - -## 增加一个新的主节点副本 - -在创建了兼容高可用的集群之后，可以向其中添加主节点副本。 -你可以使用带有如下标记的 `kubeup` 脚本添加主节点副本: - -* `KUBE_REPLICATE_EXISTING_MASTER=true` - 创建一个已经存在的主节点的副本。 - -* `KUBE_GCE_ZONE=zone` -主节点副本将运行的区域。必须与其他副本位于同一区域。 - -你无需设置 `MULTIZONE` 或 `ENABLE_ETCD_QUORUM_READS` 标志，因为他们可以从兼容高可用的集群中继承。 - -使用下面的命令可以复制现有兼容高可用的集群上的 Master: - -```shell -KUBE_GCE_ZONE=europe-west1-c KUBE_REPLICATE_EXISTING_MASTER=true ./cluster/kube-up.sh -``` - -## 删除主节点副本 - -你可以使用一个 `kube-down` 脚本从高可用集群中删除一个主节点副本，并可以使用以下标记: - -* `KUBE_DELETE_NODES=false` - 限制删除 kubelets。 - -* `KUBE_GCE_ZONE=zone` - 将移除主节点副本的区域。 - -* `KUBE_REPLICA_NAME=replica_name` - （可选）要删除的主节点副本的名称。 -如果为空：将删除给定区域中的所有副本。 - -使用下面的命令可以从一个现有的高可用集群中删除一个 Master副本: - -```shell -KUBE_DELETE_NODES=false KUBE_GCE_ZONE=europe-west1-c ./cluster/kube-down.sh -``` - -## 处理主节点副本失败 - -如果高可用集群中的一个主节点副本失败，最佳实践是从集群中删除副本， -并在相同的区域中添加一个新副本。 -下面的命令演示了这个过程: - -1. 删除失败的副本: - -```shell -KUBE_DELETE_NODES=false KUBE_GCE_ZONE=replica_zone KUBE_REPLICA_NAME=replica_name ./cluster/kube-down.sh -``` - -
    1. 在原有位置增加一个新副本：
    - -```shell -KUBE_GCE_ZONE=replica-zone KUBE_REPLICATE_EXISTING_MASTER=true ./cluster/kube-up.sh -``` - - -## 高可用集群复制主节点的最佳实践 - -* 尝试将主节点副本放置在不同的区域。在某区域故障时，放置在该区域内的所有主机都将失败。 - 为了在区域故障中幸免，请同样将工作节点放置在多区域中 - （详情请见[多区域](/zh/docs/setup/best-practices/multiple-zones/)）。 - -* 不要使用具有两个主节点副本的集群。在双副本集群上达成一致需要在更改持久状态时 - 两个副本都处于运行状态。 - 因此，两个副本都是需要的，任一副本的失败都会将集群带入多数失败状态。 - 因此，就高可用而言，双副本集群不如单个副本集群。 - -* 添加主节点副本时，集群状态（etcd）会被复制到一个新实例。如果集群很大， - 可能需要很长时间才能复制它的状态。 - 这个操作可以通过迁移 etcd 数据存储来加速, 详情参见 - [这里](https://coreos.com/etcd/docs/latest/admin_guide.html#member-migration) - （我们正在考虑在未来添加对迁移 etcd 数据存储的支持）。 - - - -## 实现说明 - -![ha-master-gce](/images/docs/ha-master-gce.png) - - -### 概述 - -每个主节点副本将以以下模式运行以下组件: - -* etcd 实例： 所有实例将会以共识方式组建集群； - -* API 服务器： 每个服务器将与本地 etcd 通信——集群中的所有 API 服务器都可用; - -* 控制器、调度器和集群自动扩缩器：将使用租约机制 —— 每个集群中只有一个实例是可用的； - -* 插件管理器：每个管理器将独立工作，试图保持插件同步。 - -此外，在 API 服务器前面将有一个负载均衡器，用于将外部和内部通信路由到他们。 - - -### 负载均衡 - -启动第二个主节点副本时，将创建一个包含两个副本的负载均衡器， -并将第一个副本的 IP 地址提升为负载均衡器的 IP 地址。 -类似地，在删除倒数第二个主节点副本之后，将删除负载均衡器， -并将其 IP 地址分配给最后一个剩余的副本。 -请注意，创建和删除负载均衡器是复杂的操作，可能需要一些时间（约20分钟）来同步。 - - -### 主节点服务 & kubelets - -Kubernetes 并不试图在其服务中保持 apiserver 的列表为最新， -相反，它将将所有访问请求指向外部 IP： - -* 在拥有一个主节点的集群中，IP 指向单一的主节点， -* 在拥有多个主节点的集群中，IP 指向主节点前面的负载均衡器。 - -类似地，kubelets 将使用外部 IP 与主节点通信。 - - -### 主节点证书 - -Kubernetes 为每个副本的外部公共 IP 和本地 IP 生成主节点 TLS 证书。 -副本的临时公共 IP 没有证书； -要通过其临时公共 IP 访问副本，必须跳过 TLS 检查。 - - -### etcd 集群 - -为了允许 etcd 组建集群，需开放 etcd 实例之间通信所需的端口（用于集群内部通信）。 -为了使这种部署安全，etcd 实例之间的通信使用 SSL 进行鉴权。 - - -### API 服务器标识 - -{{< feature-state state="alpha" for_k8s_version="v1.20" >}} - - -使用 API 服务器标识功能需要启用[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)， -该功能默认不启用。 -你可以在启动 {{< glossary_tooltip text="API 服务器" term_id="kube-apiserver" >}} 的时候启用特性门控 `APIServerIdentity` 来激活 API 服务器标识： - - -```shell -kube-apiserver \ ---feature-gates=APIServerIdentity=true \ - # …其他标记照常 -``` - - -在启动引导过程中，每个 kube-apiserver 会给自己分配一个唯一 ID。 -该 ID 的格式是 `kube-apiserver-{UUID}`。 -每个 kube-apiserver 会在 _kube-system_ {{< glossary_tooltip text="名字空间" term_id="namespace">}} 里创建一个 [`Lease` 对象](/docs/reference/generated/kubernetes-api/{{< param "version" >}}//#lease-v1-coordination-k8s-io)。 - -`Lease` 对象的名字是 kube-apiserver 的唯一 ID。 -`Lease` 对象包含一个标签 `k8s.io/component=kube-apiserver`。 -每个 kube-apiserver 每过 `IdentityLeaseRenewIntervalSeconds`（默认是 10 秒）就会刷新它的 `Lease` 对象。 -每个 kube-apiserver 每过 `IdentityLeaseDurationSeconds`（默认是 3600 秒）也会检查所有 kube-apiserver 的标识 `Lease` 对象， -并且会删除超过 `IdentityLeaseDurationSeconds` 时间还没被刷新的 `Lease` 对象。 -可以在 kube-apiserver 的 `identity-lease-renew-interval-seconds` -和 `identity-lease-duration-seconds` 标记里配置 `IdentityLeaseRenewIntervalSeconds` 和 `IdentityLeaseDurationSeconds`。 - - -启用该功能是使用 HA API 服务器协调相关功能（例如，`StorageVersionAPI` 特性门控）的前提条件。 - - -## 拓展阅读 - -[自动化高可用集群部署 - 设计文档](https://git.k8s.io/community/contributors/design-proposals/cluster-lifecycle/ha_master.md) - diff --git a/content/zh/docs/tasks/administer-cluster/out-of-resource.md b/content/zh/docs/tasks/administer-cluster/out-of-resource.md deleted file mode 100644 index dd6d5afad3..0000000000 --- a/content/zh/docs/tasks/administer-cluster/out-of-resource.md +++ /dev/null @@ -1,709 +0,0 @@ ---- -title: 配置资源不足时的处理方式 -content_type: concept ---- - - - - - -本页介绍如何使用 `kubelet` 配置资源不足时的处理方式。 - -当可用计算资源较少时，`kubelet`需要保证节点稳定性。 -这在处理如内存和硬盘之类的不可压缩资源时尤为重要。 -如果任意一种资源耗尽，节点将会变得不稳定。 - - - - - -### 驱逐信号 - -`kubelet` 支持按照以下表格中描述的信号触发驱逐决定。 -每个信号的值在 description 列描述，基于 `kubelet` 摘要 API。 - - -| 驱逐信号 | 描述 | -|----------------------------|---------------------------------------------------------------------| -| `memory.available` | `memory.available` := `node.status.capacity[memory]` - `node.stats.memory.workingSet` | -| `nodefs.available` | `nodefs.available` := `node.stats.fs.available` | -| `nodefs.inodesFree` | `nodefs.inodesFree` := `node.stats.fs.inodesFree` | -| `imagefs.available` | `imagefs.available` := `node.stats.runtime.imagefs.available` | -| `imagefs.inodesFree` | `imagefs.inodesFree` := `node.stats.runtime.imagefs.inodesFree` | -| `pid.available` | `pid.available` := `node.stats.rlimit.maxpid` - `node.stats.rlimit.curproc` | - -上面的每个信号都支持字面值或百分比的值。基于百分比的值的计算与每个信号对应的总容量相关。 - - -`memory.available` 的值从 cgroupfs 获取，而不是通过类似 `free -m` 的工具。 -这很重要，因为 `free -m` 不能在容器中工作，并且如果用户使用了 -[节点可分配资源](/zh/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable) -特性，资源不足的判定将同时在本地 cgroup 层次结构的终端用户 Pod 部分和根节点做出。 -这个[脚本](/zh/examples/admin/resource/memory-available.sh) -复现了与 `kubelet` 计算 `memory.available` 相同的步骤。 -`kubelet` 将 `inactive_file`（意即活动 LRU 列表上基于文件后端的内存字节数）从计算中排除， -因为它假设内存在出现压力时将被回收。 - - - -`kubelet` 只支持两种文件系统分区。 - -1. `nodefs` 文件系统，kubelet 将其用于卷和守护程序日志等。 -2. `imagefs` 文件系统，容器运行时用于保存镜像和容器可写层。 - - -`imagefs` 可选。`kubelet` 使用 cAdvisor 自动发现这些文件系统。 -`kubelet` 不关心其它文件系统。当前不支持配置任何其它类型。 -例如，在专用 `filesytem` 中存储卷和日志是 _不可以_ 的。 - -在将来的发布中，`kubelet`将废除当前存在的 -[垃圾回收](/zh/docs/concepts/cluster-administration/kubelet-garbage-collection/) -机制，这种机制目前支持将驱逐操作作为对磁盘压力的响应。 - - -### 驱逐阈值 - -`kubelet`支持指定驱逐阈值，用于触发 `kubelet` 回收资源。 - -每个阈值形式如下： - -`[eviction-signal][operator][quantity]` - -* 合法的 `eviction-signal` 标志如上所示。 -* `operator` 是所需的关系运算符，例如 `<`。 -* `quantity` 是驱逐阈值值标志，例如 `1Gi`。合法的标志必须匹配 Kubernetes 使用的数量表示。 - 驱逐阈值也可以使用 `%` 标记表示百分比。 - -举例说明，如果一个节点有 `10Gi` 内存，希望在可用内存下降到 `1Gi` 以下时引起驱逐操作， -则驱逐阈值可以使用下面任意一种方式指定（但不是两者同时）。 - -* `memory.available<10%` -* `memory.available<1Gi` - - -#### 软驱逐阈值 - -软驱逐阈值使用一对由驱逐阈值和管理员必须指定的宽限期组成的配置对。在超过宽限期前，`kubelet`不会采取任何动作回收和驱逐信号关联的资源。如果没有提供宽限期，`kubelet`启动时将报错。 - - -此外，如果达到了软驱逐阈值，操作员可以指定从节点驱逐 pod 时，在宽限期内允许结束的 pod 的最大数量。 -如果指定了 `pod.Spec.TerminationGracePeriodSeconds` 值， -`kubelet` 将使用它和宽限期二者中较小的一个。 -如果没有指定，`kubelet`将立即终止 pod，而不会优雅结束它们。 - - -软驱逐阈值的配置支持下列标记： - -* `eviction-soft` 描述了驱逐阈值的集合（例如 `memory.available<1.5Gi`），如果在宽限期之外满足条件将触发 pod 驱逐。 -* `eviction-soft-grace-period` 描述了驱逐宽限期的集合（例如 `memory.available=1m30s`），对应于在驱逐 pod 前软驱逐阈值应该被控制的时长。 -* `eviction-max-pod-grace-period` 描述了当满足软驱逐阈值并终止 pod 时允许的最大宽限期值（秒数）。 - - -#### 硬驱逐阈值 - -硬驱逐阈值没有宽限期，一旦察觉，`kubelet` 将立即采取行动回收关联的短缺资源。 -如果满足硬驱逐阈值，`kubelet` 将立即结束 Pod 而不是体面地终止它们。 - -硬驱逐阈值的配置支持下列标记： - -* `eviction-hard` 描述了驱逐阈值的集合（例如 `memory.available<1Gi`），如果满足条件将触发 Pod 驱逐。 - -`kubelet` 有如下所示的默认硬驱逐阈值： - -* `memory.available<100Mi` -* `nodefs.available<10%` -* `imagefs.available<15%` - -在Linux节点上，默认值还包括 `nodefs.inodesFree<5％`。 - - -### 驱逐监控时间间隔 - -`kubelet` 根据其配置的整理时间间隔计算驱逐阈值。 - -* `housekeeping-interval` 是容器管理时间间隔。 - - -### 节点状态 - -`kubelet` 会将一个或多个驱逐信号映射到对应的节点状态。 - -如果满足硬驱逐阈值，或者满足独立于其关联宽限期的软驱逐阈值时，`kubelet`将报告节点处于压力下的状态。 - - -下列节点状态根据相应的驱逐信号定义。 - -| 节点状态 | 驱逐信号 | 描述 | -|-------------------------|-------------------------------|--------------------------------------------| -| `MemoryPressure` | `memory.available` | 节点上可用内存量达到逐出阈值 | -| `DiskPressure` | `nodefs.available`, `nodefs.inodesFree`, `imagefs.available`, 或 `imagefs.inodesFree` | 节点或者节点的根文件系统或镜像文件系统上可用磁盘空间和 i 节点个数达到逐出阈值 | -| `PIDPressure` | `pid.available` | 在（Linux）节点上的可用进程标识符已降至驱逐阈值以下 | - -`kubelet` 将以 `--node-status-update-frequency` 指定的频率连续报告节点状态更新，其默认值为 `10s`。 - - -### 节点状态振荡 - -如果节点在软驱逐阈值的上下振荡，但没有超过关联的宽限期时，将引起对应节点的状态持续在 -true 和 false 间跳变，并导致不好的调度结果。 - -为了防止这种振荡，可以定义下面的标志，用于控制 `kubelet` 从压力状态中退出之前必须等待的时间。 - -* `eviction-pressure-transition-period` 是 `kubelet` 从压力状态中退出之前必须等待的时长。 - -`kubelet` 将确保在设定的时间段内没有发现和指定压力条件相对应的驱逐阈值被满足时，才会将状态变回 `false`。 - - -### 回收节点层级资源 - -如果满足驱逐阈值并超过了宽限期，`kubelet`将启动回收压力资源的过程，直到它发现低于设定阈值的信号为止。 - -`kubelet` 将尝试在驱逐终端用户 pod 前回收节点层级资源。 -发现磁盘压力时，如果节点针对容器运行时配置有独占的 `imagefs`，`kubelet`回收节点层级资源的方式将会不同。 - - -#### 使用 `imagefs` - -如果 `nodefs` 文件系统满足驱逐阈值，`kubelet`通过驱逐 pod 及其容器来释放磁盘空间。 - -如果 `imagefs` 文件系统满足驱逐阈值，`kubelet`通过删除所有未使用的镜像来释放磁盘空间。 - -#### 未使用 `imagefs` - -如果 `nodefs` 满足驱逐阈值，`kubelet`将以下面的顺序释放磁盘空间： - -1. 删除停止运行的 pod/container -2. 删除全部没有使用的镜像 - - -### 驱逐最终用户的 pod - -如果 `kubelet` 在节点上无法回收足够的资源，`kubelet`将开始驱逐 pod。 - -`kubelet` 首先根据他们对短缺资源的使用是否超过请求来排除 pod 的驱逐行为， -然后通过[优先级](/zh/docs/concepts/configuration/pod-priority-preemption/)， -然后通过相对于 pod 的调度请求消耗急需的计算资源。 - - -`kubelet` 按以下顺序对要驱逐的 pod 排名： - -* `BestEffort` 或 `Burstable`，其对短缺资源的使用超过了其请求，此类 pod 按优先级排序，然后使用高于请求。 -* `Guaranteed` pod 和 `Burstable` pod，其使用率低于请求，最后被驱逐。 - `Guaranteed` Pod 只有为所有的容器指定了要求和限制并且它们相等时才能得到保证。 - 由于另一个 Pod 的资源消耗，这些 Pod 保证永远不会被驱逐。 - 如果系统守护进程（例如 `kubelet`、`docker`、和 `journald`）消耗的资源多于通过 - `system-reserved` 或 `kube-reserved` 分配保留的资源，并且该节点只有 `Guaranteed` 或 - `Burstable` Pod 使用少于剩余的请求，然后节点必须选择驱逐这样的 Pod - 以保持节点的稳定性并限制意外消耗对其他 pod 的影响。 - 在这种情况下，它将首先驱逐优先级最低的 pod。 - - -必要时，`kubelet`会在遇到 `DiskPressure` 时逐个驱逐 Pod 来回收磁盘空间。 -如果 `kubelet` 响应 `inode` 短缺，它会首先驱逐服务质量最低的 Pod 来回收 `inodes`。 -如果 `kubelet` 响应缺少可用磁盘，它会将 Pod 排在服务质量范围内，该服务会消耗大量的磁盘并首先结束这些磁盘。 - - -#### 使用 `imagefs` - -如果是 `nodefs` 触发驱逐，`kubelet`将按 `nodefs` 用量 - 本地卷 + pod 的所有容器日志的总和对其排序。 - -如果是 `imagefs` 触发驱逐，`kubelet`将按 pod 所有可写层的用量对其进行排序。 - -#### 未使用 `imagefs` - -如果是 `nodefs` 触发驱逐，`kubelet`会根据磁盘的总使用情况对 pod 进行排序 - 本地卷 + 所有容器的日志及其可写层。 - - -### 最小驱逐回收 - -在某些场景，驱逐 pod 会导致回收少量资源。这将导致 `kubelet` 反复碰到驱逐阈值。除此之外，对如 `disk` 这类资源的驱逐时比较耗时的。 - - -为了减少这类问题，`kubelet`可以为每个资源配置一个 `minimum-reclaim`。 -当 `kubelet` 发现资源压力时，`kubelet`将尝试至少回收驱逐阈值之下 `minimum-reclaim` 数量的资源。 - -例如使用下面的配置： - -``` ---eviction-hard=memory.available<500Mi,nodefs.available<1Gi,imagefs.available<100Gi ---eviction-minimum-reclaim="memory.available=0Mi,nodefs.available=500Mi,imagefs.available=2Gi"` -``` - - -如果 `memory.available` 驱逐阈值被触发，`kubelet` 将保证 `memory.available` 至少为 `500Mi`。 -对于 `nodefs.available`，`kubelet` 将保证 `nodefs.available` 至少为 `1.5Gi`。 -对于 `imagefs.available`，`kubelet` 将保证 `imagefs.available` 至少为 `102Gi`， -直到不再有相关资源报告压力为止。 - -所有资源的默认 `eviction-minimum-reclaim` 值为 `0`。 - - -### 调度器 - -当资源处于压力之下时，节点将报告状态。调度器将那种状态视为一种信号，阻止更多 pod 调度到这个节点上。 - -| 节点状态 | 调度器行为 | -| ---------------- | ------------------------------------------------ | -| `MemoryPressure` | 新的 `BestEffort` Pod 不会被调度到该节点 | -| `DiskPressure` | 没有新的 Pod 会被调度到该节点 | - - -## 节点 OOM 行为 - -如果节点在 `kubelet` 回收内存之前经历了系统 OOM（内存不足）事件，它将基于 -[oom-killer](https://lwn.net/Articles/391222/) 做出响应。 - -`kubelet` 基于 pod 的 service 质量为每个容器设置一个 `oom_score_adj` 值。 - - - -| Service 质量 | oom_score_adj | -|----------------------------|-----------------------------------------------------------------------| -| `Guaranteed` | -998 | -| `BestEffort` | 1000 | -| `Burstable` | min(max(2, 1000 - (1000 * memoryRequestBytes) / machineMemoryCapacityBytes), 999) | - - -如果 `kubelet` 在节点经历系统 OOM 之前无法回收内存，`oom_killer` 将基于它在节点上 -使用的内存百分比算出一个 `oom_score`，并加上 `oom_score_adj` 得到容器的有效 -`oom_score`，然后结束得分最高的容器。 - -预期的行为应该是拥有最低服务质量并消耗和调度请求相关内存量最多的容器第一个被结束，以回收内存。 - -和 pod 驱逐不同，如果一个 Pod 的容器是被 OOM 结束的，基于其 `RestartPolicy`， -它可能会被 `kubelet` 重新启动。 - - -## 最佳实践 - -以下部分描述了资源外处理的最佳实践。 - -### 可调度资源和驱逐策略 - -考虑以下场景： - -* 节点内存容量：`10Gi` -* 操作员希望为系统守护进程保留 10% 内存容量（内核、`kubelet`等）。 -* 操作员希望在内存用量达到 95% 时驱逐 pod，以减少对系统的冲击并防止系统 OOM 的发生。 - -为了促成这个场景，`kubelet`将像下面这样启动： - -``` ---eviction-hard=memory.available<500Mi ---system-reserved=memory=1.5Gi -``` - - -这个配置的暗示是理解系统保留应该包含被驱逐阈值覆盖的内存数量。 - -要达到这个容量，要么某些 pod 使用了超过它们请求的资源，要么系统使用的内存超过 `1.5Gi - 500Mi = 1Gi`。 - -这个配置将保证在 pod 使用量都不超过它们配置的请求值时，如果可能立即引起内存压力并触发驱逐时，调度器不会将 pod 放到这个节点上。 - - -### DaemonSet - -我们永远都不希望 `kubelet` 驱逐一个从 `DaemonSet` 派生的 Pod，因为这个 Pod 将立即被重建并调度回相同的节点。 - -目前，`kubelet`没有办法区分一个 Pod 是由 `DaemonSet` 还是其他对象创建。 -如果/当这个信息可用时，`kubelet` 可能会预先将这些 pod 从提供给驱逐策略的候选集合中过滤掉。 - -总之，强烈推荐 `DaemonSet` 不要创建 `BestEffort` 的 Pod，防止其被识别为驱逐的候选 Pod。 -相反，理想情况下 `DaemonSet` 应该启动 `Guaranteed` 的 pod。 - - -## 现有的回收磁盘特性标签已被弃用 - -`kubelet` 已经按需求清空了磁盘空间以保证节点稳定性。 - -当磁盘驱逐成熟时，下面的 `kubelet` 标志将被标记为废弃的，以简化支持驱逐的配置。 - - - -| 现有标签 | 新标签 | -| ------------- | -------- | -| `--image-gc-high-threshold` | `--eviction-hard` or `eviction-soft` | -| `--image-gc-low-threshold` | `--eviction-minimum-reclaim` | -| `--maximum-dead-containers` | deprecated | -| `--maximum-dead-containers-per-container` | deprecated | -| `--minimum-container-ttl-duration` | deprecated | -| `--low-diskspace-threshold-mb` | `--eviction-hard` or `eviction-soft` | -| `--outofdisk-transition-frequency` | `--eviction-pressure-transition-period` | - - -## 已知问题 - -以下部分描述了与资源外处理有关的已知问题。 - - -### kubelet 可能无法立即发现内存压力 - -`kubelet`当前通过以固定的时间间隔轮询 `cAdvisor` 来收集内存使用数据。如果内存使用在那个时间窗口内迅速增长，`kubelet`可能不能足够快的发现 `MemoryPressure`，`OOMKiller`将不会被调用。我们准备在将来的发行版本中通过集成 `memcg` 通知 API 来减小这种延迟。当超过阈值时，内核将立即告诉我们。 - - -如果您想处理可察觉的超量使用而不要求极端精准，可以设置驱逐阈值为大约 75% 容量作为这个问题的变通手段。这将增强这个特性的能力，防止系统 OOM，并提升负载卸载能力，以再次平衡集群状态。 - - -### kubelet 可能会驱逐超过需求数量的 pod - -由于状态采集的时间差，驱逐操作可能驱逐比所需的更多的 pod。将来可通过添加从根容器获取所需状态的能力 -[https://github.com/google/cadvisor/issues/1247](https://github.com/google/cadvisor/issues/1247) -来减缓这种状况。 - diff --git a/content/zh/docs/tasks/administer-cluster/sysctl-cluster.md b/content/zh/docs/tasks/administer-cluster/sysctl-cluster.md index d7940175d9..bc254322d7 100644 --- a/content/zh/docs/tasks/administer-cluster/sysctl-cluster.md +++ b/content/zh/docs/tasks/administer-cluster/sysctl-cluster.md @@ -21,6 +21,25 @@ interface. 本文档介绍如何通过 {{< glossary_tooltip term_id="sysctl" >}} 接口在 Kubernetes 集群中配置和使用内核参数。 + +{{< note >}} +从 Kubernetes 1.23 版本开始，kubelet 支持使用 `/` 或 `.` 作为 sysctl 参数的分隔符。 +例如，你可以使用点或者斜线作为分隔符表示相同的 sysctl 参数，以点作为分隔符表示为： `kernel.shm_rmid_forced`， +或者以斜线作为分隔符表示为：`kernel/shm_rmid_forced`。 +更多 sysctl 参数转换方法详情请参考 Linux man-pages +[sysctl.d(5)](https://man7.org/linux/man-pages/man5/sysctl.d.5.html) 。 +设置 Pod 的 Sysctl 参数 和 PodSecurityPolicy 功能尚不支持设置包含斜线的 Sysctl 参数。 +{{< /note >}} ## {{% heading "prerequisites" %}} @@ -103,6 +122,7 @@ The following sysctls are supported in the _safe_ set: - `net.ipv4.ip_local_port_range` - `net.ipv4.tcp_syncookies` - `net.ipv4.ping_group_range` （从 Kubernetes 1.18 开始） +- `net.ipv4.ip_unprivileged_port_start` (从 Kubernetes 1.22 开始). 你现在可以关闭连接到节点的 Shell。 + + +## 在两个地方挂载相同的 persistentVolume + +{{< codenew file="pods/storage/pv-duplicate.yaml" >}} + + +你可以在 nginx 容器上执行两个卷挂载: + +`/usr/share/nginx/html` 用于静态网站 +`/etc/nginx/nginx.conf` 作为默认配置 + * 进一步了解[`projected`](/zh/docs/concepts/storage/volumes/#projected) 卷。 -* 阅读[一体卷](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/node/all-in-one-volume.md)设计文档。 +* 阅读[一体卷](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/all-in-one-volume.md)设计文档。 diff --git a/content/zh/docs/tasks/configure-pod-container/configure-service-account.md b/content/zh/docs/tasks/configure-pod-container/configure-service-account.md index e7bba36668..46d1c46202 100644 --- a/content/zh/docs/tasks/configure-pod-container/configure-service-account.md +++ b/content/zh/docs/tasks/configure-pod-container/configure-service-account.md @@ -423,7 +423,7 @@ command line arguments to `kube-apiserver`: * `--service-account-issuer` * `--service-account-key-file` * `--service-account-signing-key-file` -* `--api-audiences` +* `--api-audiences` (can be omitted) --> {{< note >}} @@ -432,7 +432,7 @@ command line arguments to `kube-apiserver`: * `--service-account-issuer` * `--service-account-key-file` * `--service-account-signing-key-file` -* `--api-audiences` +* `--api-audiences`（可以省略） {{< /note >}} diff --git a/content/zh/docs/tasks/configure-pod-container/pull-image-private-registry.md b/content/zh/docs/tasks/configure-pod-container/pull-image-private-registry.md index c3b896ec35..c29009533f 100644 --- a/content/zh/docs/tasks/configure-pod-container/pull-image-private-registry.md +++ b/content/zh/docs/tasks/configure-pod-container/pull-image-private-registry.md @@ -13,20 +13,26 @@ weight: 100 -本文介绍如何使用 Secret 从私有的 Docker 镜像仓库或代码仓库拉取镜像来创建 Pod。 +本文介绍如何使用 {{< glossary_tooltip text="Secret" term_id="secret" >}} +从私有的镜像仓库或代码仓库拉取镜像来创建 Pod。 + +{{% thirdparty-content single="true" %}} ## {{% heading "prerequisites" %}} -* {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} +* {{< include "task-tutorial-prereqs.md" >}} -你需要 [Docker ID](https://docs.docker.com/docker-id/) 和密码来进行本练习。 + +要进行此练习，你需要 `docker` 命令行工具和一个知道密码的 +[Docker ID](https://docs.docker.com/docker-id/)。 @@ -44,15 +50,18 @@ docker login ``` -当出现提示时，输入 Docker 用户名和密码。 +当出现提示时，输入您的 Docker ID 和登录凭证（访问令牌、 +或 Docker ID 的密码）。 登录过程会创建或更新保存有授权令牌的 `config.json` 文件。 +查看 [Kubernetes 中如何解析这个文件](/zh/docs/concepts/containers/images#config-json)。 查看 `config.json` 文件： @@ -125,7 +134,7 @@ You have successfully set your Docker credentials in the cluster as a Secret cal * `` 是你的 Docker 密码。 * `` 是你的 Docker 邮箱。 -这样你就成功地将集群中的 Docker 凭据设置为名为 `regcred` 的 Secret。 +这样你就成功地将集群中的 Docker 凭证设置为名为 `regcred` 的 Secret。 -`.dockerconfigjson` 字段的值是 Docker 凭据的 base64 表示。 +`.dockerconfigjson` 字段的值是 Docker 凭证的 base64 表示。 要了解 `dockerconfigjson` 字段中的内容，请将 Secret 数据转换为可读格式： @@ -201,24 +210,27 @@ You have successfully set your Docker credentials as a Secret called `regcred` i --> 注意，Secret 数据包含与本地 `~/.docker/config.json` 文件类似的授权令牌。 -这样你就已经成功地将 Docker 凭据设置为集群中的名为 `regcred` 的 Secret。 +这样你就已经成功地将 Docker 凭证设置为集群中的名为 `regcred` 的 Secret。 ## 创建一个使用你的 Secret 的 Pod -下面是一个 Pod 配置文件，它需要访问 `regcred` 中的 Docker 凭据： +下面是一个 Pod 配置清单示例，该示例中 Pod 需要访问你的 Docker 凭证 `regcred`： {{< codenew file="pods/private-reg-pod.yaml" >}} - -下载上述文件： + + +将上述文件下载到你的计算机中： ```shell -wget -O my-private-reg-pod.yaml https://k8s.io/examples/pods/private-reg-pod.yaml +curl -L -O my-private-reg-pod.yaml https://k8s.io/examples/pods/private-reg-pod.yaml ``` -* 进一步了解 [Secret](/zh/docs/concepts/configuration/secret/) +* 进一步了解 [Secrets](/zh/docs/concepts/configuration/secret/) + * 或阅读 {{< api-reference page="config-and-storage-resources/secret-v1" >}} 的 API 参考 * 进一步了解 [使用私有仓库](/zh/docs/concepts/containers/images/#using-a-private-registry) -* 参考 [kubectl create secret docker-registry](/docs/reference/generated/kubectl/kubectl-commands/#-em-secret-docker-registry-em-) -* 参考 [Secret](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#secret-v1-core) -* 参考 [PodSpec](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podspec-v1-core) 中的 `imagePullSecrets` 字段 - - +* 进一步了解 [为服务账户添加拉取镜像凭证](/zh/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account) +* 查看 [kubectl 创建 docker-registry 凭证](/docs/reference/generated/kubectl/kubectl-commands/#-em-secret-docker-registry-em-) +* 查看 Pod [容器定义](/docs/reference/kubernetes-api/workload-resources/pod-v1/#containers)中的 `imagePullSecrets` 字段。 diff --git a/content/zh/docs/tasks/configure-pod-container/security-context.md b/content/zh/docs/tasks/configure-pod-container/security-context.md index f05e678392..424985b678 100644 --- a/content/zh/docs/tasks/configure-pod-container/security-context.md +++ b/content/zh/docs/tasks/configure-pod-container/security-context.md @@ -240,7 +240,7 @@ exit --> ## 为 Pod 配置卷访问权限和属主变更策略 -{{< feature-state for_k8s_version="v1.20" state="beta" >}} +{{< feature-state for_k8s_version="v1.23" state="stable" >}} ## 将卷权限和所有权更改委派给 CSI 驱动程序 -{{< feature-state for_k8s_version="v1.22" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} + +{{< note >}} +静态 Pod 的 `spec` 不能引用其他 API 对象 +（如：{{< glossary_tooltip text="ServiceAccount" term_id="service-account" >}}、 +{{< glossary_tooltip text="ConfigMap" term_id="configmap" >}}、 +{{< glossary_tooltip text="Secret" term_id="secret" >}} 等）。 +{{< /note >}} + ## {{% heading "prerequisites" %}} {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} diff --git a/content/zh/docs/tasks/debug-application-cluster/audit.md b/content/zh/docs/tasks/debug-application-cluster/audit.md index 6ba032c030..b4b4c9ee66 100644 --- a/content/zh/docs/tasks/debug-application-cluster/audit.md +++ b/content/zh/docs/tasks/debug-application-cluster/audit.md @@ -267,7 +267,7 @@ to the location of the policy file and log file, so that audit records are persi ```shell --audit-policy-file=/etc/kubernetes/audit-policy.yaml - --audit-log-path=/var/log/audit.log + --audit-log-path=/var/log/kubernetes/audit/audit.log ``` 接下来挂载数据卷： @@ -277,7 +277,7 @@ volumeMounts: - mountPath: /etc/kubernetes/audit-policy.yaml name: audit readOnly: true - - mountPath: /var/log/audit.log + - mountPath: /var/log/kubernetes/audit/ name: audit-log readOnly: false ``` @@ -288,6 +288,8 @@ and finally configure the `hostPath`: 最后配置 `hostPath`： ```yaml +... +volumes: - name: audit hostPath: path: /etc/kubernetes/audit-policy.yaml @@ -295,8 +297,8 @@ and finally configure the `hostPath`: - name: audit-log hostPath: - path: /var/log/audit.log - type: FileOrCreate + path: /var/log/kubernetes/audit/ + type: DirectoryOrCreate ``` ## 使用临时调试容器来进行调试 {#ephemeral-container} -{{< feature-state state="alpha" for_k8s_version="v1.22" >}} +{{< feature-state state="beta" for_k8s_version="v1.23" >}} 当由于容器崩溃或容器镜像不包含调试程序（例如[无发行版镜像](https://github.com/GoogleContainerTools/distroless)等） 而导致 `kubectl exec` 无法运行时，{{< glossary_tooltip text="临时容器" term_id="ephemeral-container" >}}对于排除交互式故障很有用。 @@ -128,10 +128,6 @@ https://github.com/GoogleContainerTools/distroless). ## 使用临时容器来调试的例子 {#ephemeral-container-example} -{{< note >}} -本示例需要你的集群已经开启 `EphemeralContainers` -[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)， -`kubectl` 版本为 v1.22 或者更高。 -{{< /note >}} - 你可以使用 `kubectl debug` 命令来给正在运行中的 Pod 增加一个临时容器。 首先，像示例一样创建一个 pod： diff --git a/content/zh/docs/tasks/debug-application-cluster/debug-service.md b/content/zh/docs/tasks/debug-application-cluster/debug-service.md index 469e004a5c..a6d0ea3f27 100644 --- a/content/zh/docs/tasks/debug-application-cluster/debug-service.md +++ b/content/zh/docs/tasks/debug-application-cluster/debug-service.md @@ -305,6 +305,22 @@ Services, these values might be the same. 为了突出配置范围的完整性，你在此处创建的 Service 使用的端口号与 Pods 不同。 对于许多真实的 Service，这些值可以是相同的。 + + +## 是否存在影响目标 Pod 的网络策略入站规则？ + +如果你部署了任何可能影响到 `hostnames-*` Pod 的传入流量的网络策略入站规则， +则需要对其进行检查。 + +详细信息，请参阅[网络策略](/zh/docs/concepts/services-networking/network-policies/)。 + +{{% thirdparty-content %}} + + Kubernetes 应用程序通常由多个独立的服务组成，每个服务都在自己的容器中运行。 在远端的 Kubernetes 集群上开发和调试这些服务可能很麻烦，需要 [在运行的容器上打开 Shell](/zh/docs/tasks/debug-application-cluster/get-shell-running-container/)， -然后在远端 Shell 中运行你所需的工具。 +以运行调试工具。 -`telepresence` 是一种工具，用于在本地轻松开发和调试服务，同时将服务代理到远程 Kubernetes 集群。 -使用 `telepresence` 可以为本地服务使用自定义工具（如调试器和 IDE）， + +`telepresence` 是一个工具，用于简化本地开发和调试服务的过程，同时可以将服务代理到远程 Kubernetes 集群。 +`telepresence` 允许你使用使用自定义工具（例如：调试器 和 IDE）调式服务， 并提供对 Configmap、Secret 和远程集群上运行的服务的完全访问。 + @@ -35,31 +40,38 @@ This document describes using `telepresence` to develop and debug services runni * Kubernetes 集群安装完毕 * 配置好 `kubectl` 与集群交互 -* [Telepresence](https://www.telepresence.io/reference/install) 安装完毕 +* [Telepresence](https://www.telepresence.io/docs/latest/install/) 安装完毕 -打开终端，不带参数运行 `telepresence`，以打开 `telepresence` Shell。 -这个 Shell 在本地运行，使你可以完全访问本地文件系统。 + +## 从本机连接到远程 Kubernetes 集群 + +安装 `telepresence` 后，运行 `telepresence connect` 来启动它的守护进程并将本地工作站连接到远程 Kubernetes 集群。 + +``` +$ telepresence connect + +Launching Telepresence Daemon +... +Connected to context default (https://) +``` -`telepresence` Shell 的使用方式多种多样。 -例如，在你的笔记本电脑上写一个 Shell 脚本，然后直接在 Shell 中实时运行它。 -你也可以在远端 Shell 上执行此操作，但这样可能无法使用首选的代码编辑器，并且在容器终止时脚本将被删除。 + +你可以通过 curl 使用 Kubernetes 语法访问服务，例如：`curl -ik https://kubernetes.default` -使用 `--swap-deployment` 选项将现有部署与 Telepresence 代理交换。 -交换允许你在本地运行服务并能够连接到远端的 Kubernetes 集群。 -远端集群中的服务现在就可以访问本地运行的实例。 -要运行 telepresence 并带有 `--swap-deployment` 选项，请输入： +使用 `telepresence intercept $SERVICE_NAME --port $LOCAL_PORT:REMOTE_PORT` 命令创建一个 "拦截器" 用于重新路由远程服务流量。 -`telepresence --swap-deployment $DEPLOYMENT_NAME` +环境变量： + +- `$SERVICE_NAME` 是本地服务名称 +- `$LOCAL_PORT` 是服务在本地工作站上运行的端口 +- `$REMOTE_PORT` 是服务在集群中侦听的端口 -这里的 `$DEPLOYMENT_NAME` 是你现有的部署名称。 -运行此命令将生成 Shell。在该 Shell 中，启动你的服务。 -然后，你就可以在本地对源代码进行编辑、保存并能看到更改立即生效。 -你还可以在调试器或任何其他本地开发工具中运行服务。 +运行此命令会告诉 Telepresence 将远程流量发送到的本地服务，而不是远程 Kubernetes 集群中的服务中。 +在本地编辑保存服务源代码，并在访问远程应用时查看相应变更会立即生效。 +还可以使用调试器或任何其他本地开发工具运行本地服务。 + + + +## Telepresence 是如何工作的？ + +Telepresence 会在远程集群中运行的现有应用程序容器旁边安装流量代理 sidecar。 +当它捕获进入 Pod 的所有流量请求时，不是将其转发到远程集群中的应用程序， +而是路由所有流量（当创建[全局拦截器](https://www.getambassador.io/docs/telepresence/latest/concepts/intercepts/#global-intercept)时） +或流量的一个子集（当创建[自定义拦截器](https://www.getambassador.io/docs/telepresence/latest/concepts/intercepts/#personal-intercept)时） +到本地开发环境。 ## {{% heading "whatsnext" %}} @@ -104,11 +132,7 @@ If you're interested in a hands-on tutorial, check out [this tutorial](https://c 如果你对实践教程感兴趣，请查看[本教程](https://cloud.google.com/community/tutorials/developing-services-with-k8s)，其中介绍了在 Google Kubernetes Engine 上本地开发 Guestbook 应用程序。 -Telepresence 有[多种代理选项](https://www.telepresence.io/reference/methods)，以满足你的各种情况。 - -要了解更多信息，请访问 [Telepresence 网站](https://www.telepresence.io)。 +如需进一步了解，请访问 [Telepresence 官方网站](https://www.telepresence.io)。 diff --git a/content/zh/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md b/content/zh/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md index 4906ea970f..635c8c429d 100644 --- a/content/zh/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md +++ b/content/zh/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md @@ -119,7 +119,7 @@ as a Deployment object. If you use a different Kubernetes setup mechanism you ca 是集群范围资源用量数据的聚合器。 默认情况下，在由 `kube-up.sh` 脚本创建的集群中会以 Deployment 的形式被部署。 如果你使用其他 Kubernetes 安装方法，则可以使用提供的 -[部署组件 components.yaml](https://github.com/kubernetes-incubator/metrics-server/tree/master/deploy) +[部署组件 components.yaml](https://github.com/kubernetes-sigs/metrics-server/releases) 来部署。 + +### 摘要 API 来源 + +[Kubelet](/zh/docs/reference/command-line-tools-reference/kubelet/) 在节点、卷、pod 和容器级别收集统计信息， +并在[摘要API](https://github.com/kubernetes/kubernetes/blob/7d309e0104fedb57280b261e5677d919cb2a0e2d/staging/src/k8s.io/kubelet/pkg/apis/stats/v1alpha1/types.go) +中提供它们的统计信息供消费者阅读。 + + + +在 1.23 版本前，这些资源主要来自 [cAdvisor](https://github.com/google/cadvisor)。但在 1.23 版本中 +引入了 `PodAndContainerStatsFromCRI` FeatureGate， +CRI 实现了可以收集容器和 pod 级别的统计信息。 +注意：这需要 CRI 实现的支持（containerd >= 1.6.0，CRI-O >= 1.23.0）。 diff --git a/content/zh/docs/tasks/manage-kubernetes-objects/kustomization.md b/content/zh/docs/tasks/manage-kubernetes-objects/kustomization.md index b98ec00718..2077281f9a 100644 --- a/content/zh/docs/tasks/manage-kubernetes-objects/kustomization.md +++ b/content/zh/docs/tasks/manage-kubernetes-objects/kustomization.md @@ -169,10 +169,10 @@ The generated ConfigMap is: ```yaml apiVersion: v1 data: - FOO=Bar + FOO: Bar kind: ConfigMap metadata: - name: example-configmap-1-8mbdf7882g + name: example-configmap-1-42cfbf598f ``` +{{< note >}} +虽然你可以使用较早的版本进行验证，但该功能是从 v1.23 版本进入 GA 状态并正式支持的。 +{{< /note >}} + - - -kubectl 可以作为 Google Cloud SDK 的一部分被安装。 - - -1. 安装 [Google Cloud SDK](https://cloud.google.com/sdk/)。 -1. 运行安装 `kubectl` 的命令： - - ```shell - gcloud components install kubectl - ``` - - -1. 验证一下，确保安装的是最新的版本： - - ```shell - kubectl version --client - ``` \ No newline at end of file diff --git a/content/zh/docs/tasks/tools/included/optional-kubectl-configs-pwsh.md b/content/zh/docs/tasks/tools/included/optional-kubectl-configs-pwsh.md new file mode 100644 index 0000000000..9cbf851b4f --- /dev/null +++ b/content/zh/docs/tasks/tools/included/optional-kubectl-configs-pwsh.md @@ -0,0 +1,44 @@ +--- +title: "PowerShell 自动补全" +description: "powershell 自动补全的一些可选配置。" +headless: true +--- + + + +使用命令 `kubectl completion powershell` 生成 PowerShell 的 kubectl 自动补全脚本。 + +如果需要自动补全在所有 shell 会话中生效，请将以下命令添加到 `$PROFILE` 文件中： + +```powershell +kubectl completion powershell | Out-String | Invoke-Expression +``` + + +此命令将在每次 PowerShell 启动时重新生成自动补全脚本。你还可以将生成的自动补全脚本添加到 `$PROFILE` 文件中。 + + +如果需要将自动补全脚本直接添加到 `$PROFILE` 文件中，请在 PowerShell 终端运行以下命令： + +```powershell +kubectl completion powershell >> $PROFILE +``` + + +完成上述操作后重启 shell，kubectl的自动补全就可以工作了。 diff --git a/content/zh/docs/tasks/tools/install-kubectl-linux.md b/content/zh/docs/tasks/tools/install-kubectl-linux.md index f2ce6dd263..2bd64b6315 100644 --- a/content/zh/docs/tasks/tools/install-kubectl-linux.md +++ b/content/zh/docs/tasks/tools/install-kubectl-linux.md @@ -165,49 +165,49 @@ The following methods exist for installing kubectl on Linux: ### 用原生包管理工具安装 {#install-using-native-package-management} {{< tabs name="kubectl_install" >}} -{{< tab name="Ubuntu、Debian 或 HypriotOS" codelang="bash" >}} +{{% tab name="Ubuntu、Debian 或 HypriotOS" %}} - -1. 更新 `apt` 包索引，并安装使用 Kubernetes `apt` 仓库锁需要的包： + + 1. 更新 `apt` 包索引，并安装使用 Kubernetes `apt` 仓库所需要的包： - ```shell - sudo apt-get update - sudo apt-get install -y apt-transport-https ca-certificates curl - ``` + ```shell + sudo apt-get update + sudo apt-get install -y apt-transport-https ca-certificates curl + ``` + + 2. 下载 Google Cloud 公开签名秘钥： - -2. 下载 Google Cloud 公开签名秘钥： + ```shell + sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg + ``` - ```shell - sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg - ``` + + 3. 添加 Kubernetes `apt` 仓库： - -3. 添加 Kubernetes `apt` 仓库： + ```shell + echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list + ``` - ```shell - echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list - ``` + + 4. 更新 `apt` 包索引，使之包含新的仓库并安装 kubectl： - -4. 更新 `apt` 包索引，使之包含新的仓库并安装 kubectl： + ```shell + sudo apt-get update + sudo apt-get install -y kubectl + ``` +{{% /tab %}} - ```shell - sudo apt-get update - sudo apt-get install -y kubectl - ``` +{{% tab name="基于 Red Hat 的发行版" %}} -{{< /tab >}} - -{{< tab name="基于 Red Hat 的发行版" codelang="bash" >}} +```shell cat <}} +``` + +{{% /tab %}} {{< /tabs >}} -kubectl 为 Bash 和 Zsh 提供自动补全功能，可以减轻许多输入的负担。 +kubectl 为 Bash、Zsh、Fish 和 PowerShell 提供自动补全功能，可以为你节省大量的输入。 下面是为 Bash 和 Zsh 设置自动补全功能的操作步骤。 diff --git a/content/zh/docs/tasks/tools/install-kubectl-macos.md b/content/zh/docs/tasks/tools/install-kubectl-macos.md index 4b0a4ec159..9bbc613518 100644 --- a/content/zh/docs/tasks/tools/install-kubectl-macos.md +++ b/content/zh/docs/tasks/tools/install-kubectl-macos.md @@ -249,13 +249,6 @@ If you are on macOS and using [Macports](https://macports.org/) package manager, kubectl version --client ``` - -### 作为谷歌云 SDK 的一部分，在 macOS 上安装 {#install-on-macos-as-part-of-the-google-cloud-sdk} - -{{< include "included/install-kubectl-gcloud.md" >}} - @@ -273,11 +266,11 @@ If you are on macOS and using [Macports](https://macports.org/) package manager, ### 启用 shell 自动补全功能 {#enable-shell-autocompletion} -kubectl 为 Bash 和 Zsh 提供自动补全功能，这可以节省许多输入的麻烦。 +kubectl 为 Bash、Zsh、Fish 和 PowerShell 提供自动补全功能，可以为你节省大量的输入。 下面是为 Bash 和 Zsh 设置自动补全功能的操作步骤。 diff --git a/content/zh/docs/tasks/tools/install-kubectl-windows.md b/content/zh/docs/tasks/tools/install-kubectl-windows.md index 3a59cf1185..a52e7bd375 100644 --- a/content/zh/docs/tasks/tools/install-kubectl-windows.md +++ b/content/zh/docs/tasks/tools/install-kubectl-windows.md @@ -225,16 +225,16 @@ Edit the config file with a text editor of your choice, such as Notepad. ### 启用 shell 自动补全功能 {#enable-shell-autocompletion} - -kubectl 为 Bash 和 Zsh 提供自动补全功能，可以减轻许多输入的负担。 +kubectl 为 Bash、Zsh、Fish 和 PowerShell 提供自动补全功能，可以为你节省大量的输入。 -下面是设置 Zsh 自动补全功能的操作步骤，前提是你在 Windows 上面运行的是 Zsh。 +下面是设置 PowerShell 自动补全功能的操作步骤。 -{{< include "included/optional-kubectl-configs-zsh.md" >}} +{{< include "included/optional-kubectl-configs-pwsh.md" >}} -## 基础知识 +## 基础知识 {#basics} * [Kubernetes 基础知识](/zh/docs/tutorials/Kubernetes-Basics/)是一个深入的 交互式教程，帮助您理解 Kubernetes 系统，并尝试一些基本的 Kubernetes 特性。 @@ -55,7 +55,7 @@ Kubernetes 文档的这一部分包含教程。每个教程展示了如何完成 * [Configuring Redis Using a ConfigMap](/docs/tutorials/configuration/configure-redis-using-configmap/) --> -## 配置 +## 配置 {#configuration} * [示例：配置 Java 微服务](/zh/docs/tutorials/configuration/configure-java-microservice/) @@ -68,7 +68,7 @@ Kubernetes 文档的这一部分包含教程。每个教程展示了如何完成 * [Example: Deploying PHP Guestbook application with MongoDB](/docs/tutorials/stateless-application/guestbook/) --> -## 无状态应用程序 +## 无状态应用程序 {#stateless-applications} * [公开外部 IP 地址访问集群中的应用程序](/zh/docs/tutorials/stateless-application/expose-external-ip-address/) @@ -86,7 +86,7 @@ Kubernetes 文档的这一部分包含教程。每个教程展示了如何完成 * [Running ZooKeeper, A CP Distributed System](/docs/tutorials/stateful-application/zookeeper/) --> -## 有状态应用程序 +## 有状态应用程序 {#stateful-applications} * [StatefulSet 基础](/zh/docs/tutorials/stateful-application/basic-stateful-set/) @@ -99,9 +99,13 @@ Kubernetes 文档的这一部分包含教程。每个教程展示了如何完成 -## 集群 +## 集群 {#clusters} + +* [AppArmor](/zh/docs/tutorials/clusters/apparmor/) * [seccomp](/zh/docs/tutorials/clusters/seccomp/) @@ -110,10 +114,21 @@ Kubernetes 文档的这一部分包含教程。每个教程展示了如何完成 * [Using Source IP](/docs/tutorials/services/source-ip/) --> -## 服务 +## 服务 {#services} * [使用源 IP](/zh/docs/tutorials/services/source-ip/) + +## 安全 {#security} + +* [在集群级别应用 Pod 安全标准](/zh/docs/tutorials/security/cluster-level-pss/) +* [在名字空间级别应用 Pod 安全标准](/zh/docs/tutorials/security/ns-level-pss/) + ## {{% heading "whatsnext" %}}
    -{{ T "latest_release" }}{{ printf "%s.0" $dataVersion }} + {{ T "latest_release" }}{{ printf "%s.0" $dataVersion }}{{ if isset $data "releaseDate" }} {{ T "release_date_before" }}{{ T "release_date_after" }}{{- end -}}
    - {{ T "end_of_life" }}{{ printf "%s" $data.endOfLifeDate }} + {{ T "end_of_life" }}
    {{ T "previous_patches" }} {{ T "not_applicable" }}
    -{{ end }} - -{{ if $data.previousPatches }} +{{- else -}}
    - {{ T "latest_release" }}{{ index $data.previousPatches 0 "release" }} {{ T "release_date_before" }}{{ index $data.previousPatches 0 "targetDate" }}{{ T "release_date_after" }} + {{ T "latest_release" }}{{ index $data.previousPatches 0 "release" }} {{ T "release_date_before" }}{{ T "release_date_after" }}
    - {{ T "end_of_life" }}{{ printf "%s" $data.endOfLifeDate }} + {{ T "end_of_life" }}
    {{ T "previous_patches" }} @@ -30,10 +29,10 @@ {{ if $key }}{{ T "inline_list_separator" }}{{ end }} {{ printf "%s" .release }} {{- end -}} -{{- end -}}
    +{{- end -}}

    Complete {{ $dataVersion }} Schedule diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/5binaries.png b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/5binaries.png new file mode 100644 index 0000000000..31cd364dd8 Binary files /dev/null and b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/5binaries.png differ diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/argocd01.png b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/argocd01.png new file mode 100644 index 0000000000..867ee5e925 Binary files /dev/null and b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/argocd01.png differ diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/argocd02.png b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/argocd02.png new file mode 100644 index 0000000000..3a05cf4c16 Binary files /dev/null and b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/argocd02.png differ diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/godeeper.png b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/godeeper.png new file mode 100644 index 0000000000..de1cedb217 Binary files /dev/null and b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/godeeper.png differ diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity01.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity01.svg new file mode 100644 index 0000000000..1950028dd5 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity01.svg @@ -0,0 +1,367 @@ + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + apiserver + + + + apiserver + + + + + + + + + controller-manager + + + + controller... + + + + + + + + + scheduller + + + + scheduller + + + + + + + + + + + + + + + + + + + + + Viewer does not support full SVG 1.1 + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity02.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity02.svg new file mode 100644 index 0000000000..47798b6c8c --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity02.svg @@ -0,0 +1,3 @@ + + +
    apiserver
    apiserver
    controller-manager
    controller...
    scheduller
    scheduller
    webhook
    webhook    Viewer does not support full SVG 1.1     \ No newline at end of file diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity03.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity03.svg new file mode 100644 index 0000000000..5f643e9e89 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/konnectivity03.svg @@ -0,0 +1,3 @@ + + +
    apiserver
    apiserver
    controller-manager
    controller...
    scheduller
    scheduller
    webhook
    webhook
    konnectivity-agent
    konnectivit...
    konnectivity-server
    konnectivit...    Viewer does not support full SVG 1.1     \ No newline at end of file diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/kubefarm.png b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/kubefarm.png new file mode 100644 index 0000000000..272723bae0 Binary files /dev/null and b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/kubefarm.png differ diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme01.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme01.svg new file mode 100644 index 0000000000..6fba045ae7 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme01.svg @@ -0,0 +1,410 @@ + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Compute nodes + + + Compute nodes + + + + + + + Control plane nodes + + + Control plane nodes + + + + + + + + + + DHCP + + + + [Not supported by viewer] + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme02.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme02.svg new file mode 100644 index 0000000000..7734444f59 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme02.svg @@ -0,0 +1,421 @@ + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + Compute nodes + + + Compute nodes + + + + + + + Control plane nodes + + + Control plane nodes + + + + + + + + + Netboot Servers + + + Netboot Servers + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme03.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme03.svg new file mode 100644 index 0000000000..491b52d3b4 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme03.svg @@ -0,0 +1,459 @@ + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Compute nodes + + + Compute nodes + + + + + + + Control plane nodes + + + Control plane nodes + + + + + + + + + + + + + + + + + + Kubernetes + + + Kubernetes + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme04.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme04.svg new file mode 100644 index 0000000000..7488d21ad5 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/scheme04.svg @@ -0,0 +1,3 @@ + + +
    Compute nodes
    Compute nodes
    Control plane nodes
    Control plane nodes
    Kubernetes /
    Netboot Servers
    / DHCP
    [Not supported by viewer]
    cluster1
    cluster1
    cluster2
    cluster2
    cluster3
    cluster3
    cluster4
    cluster4     \ No newline at end of file diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot01.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot01.svg new file mode 100644 index 0000000000..71b1274b91 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot01.svg @@ -0,0 +1,5238 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot02.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot02.svg new file mode 100644 index 0000000000..e7f86efd5a --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot02.svg @@ -0,0 +1,7728 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot03.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot03.svg new file mode 100644 index 0000000000..347c6cf606 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot03.svg @@ -0,0 +1,2907 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot04.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot04.svg new file mode 100644 index 0000000000..c6a164e835 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot04.svg @@ -0,0 +1,3114 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot05.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot05.svg new file mode 100644 index 0000000000..de3446716c --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot05.svg @@ -0,0 +1,5893 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot06.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot06.svg new file mode 100644 index 0000000000..bce1693871 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot06.svg @@ -0,0 +1,2444 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot07.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot07.svg new file mode 100644 index 0000000000..48ef1d7ae0 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot07.svg @@ -0,0 +1,3387 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot08.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot08.svg new file mode 100644 index 0000000000..870f854cc7 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot08.svg @@ -0,0 +1,6184 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot09.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot09.svg new file mode 100644 index 0000000000..58e25997a2 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot09.svg @@ -0,0 +1,1777 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot10.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot10.svg new file mode 100644 index 0000000000..086a8a321d --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot10.svg @@ -0,0 +1,3149 @@ + + + + + + + + + + + + + + + + h + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot11.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot11.svg new file mode 100644 index 0000000000..27085b1798 --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot11.svg @@ -0,0 +1,7008 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot12.svg b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot12.svg new file mode 100644 index 0000000000..df4443d87e --- /dev/null +++ b/static/images/blog/2021-12-22-kubernetes-in-kubernetes-and-pxe-bootable-server-farm/screenshot12.svg @@ -0,0 +1,4482 @@ + + + + + + + + + + + + root@m1c29:~# + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/static/images/docs/github_netlify_deploy_preview.png b/static/images/docs/github_netlify_deploy_preview.png new file mode 100644 index 0000000000..0a2313644e Binary files /dev/null and b/static/images/docs/github_netlify_deploy_preview.png differ diff --git a/static/js/script.js b/static/js/script.js index 929881fb34..840d76f83b 100644 --- a/static/js/script.js +++ b/static/js/script.js @@ -72,6 +72,8 @@ var kub = (function () { headlineWrapper = $('#headlineWrapper'); HEADER_HEIGHT = header.outerHeight(); + document.documentElement.classList.remove('no-js'); + resetTheView(); window.addEventListener('resize', resetTheView);