From 58c3f18336c326dbdcce06db6b1d74f5f3d3478f Mon Sep 17 00:00:00 2001 From: sahadat_hossain Date: Fri, 12 Feb 2021 12:36:36 +0600 Subject: [PATCH 01/10] fixed some typos and grammatical mistakes --- content/en/docs/reference/using-api/api-concepts.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index 5f8f8337d1..fd7162994d 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -130,9 +130,9 @@ To retrieve a single list in chunks, two new parameters `limit` and `continue` a Like a watch operation, a `continue` token will expire after a short amount of time (by default 5 minutes) and return a `410 Gone` if more results cannot be returned. In this case, the client will need to start from the beginning or omit the `limit` parameter. -For example, if there are 1,253 pods on the cluster and the client wants to receive chunks of 500 pods at a time, they would request those chunks as follows: +For example, if there are 1,253 pods on the cluster, and the client wants to receive chunks of 500 pods at a time, they would request those chunks as follows: -1. List all of the pods on a cluster, retrieving up to 500 pods each time. +1. List all the pods on a cluster, retrieving up to 500 pods each time. ```console GET /api/v1/pods?limit=500 @@ -258,7 +258,7 @@ Accept: application/json;as=Table;g=meta.k8s.io;v=v1beta1, application/json ## Alternate representations of resources -By default Kubernetes returns objects serialized to JSON with content type `application/json`. This is the default serialization format for the API. However, clients may request the more efficient Protobuf representation of these objects for better performance at scale. The Kubernetes API implements standard HTTP content type negotiation: passing an `Accept` header with a `GET` call will request that the server return objects in the provided content type, while sending an object in Protobuf to the server for a `PUT` or `POST` call takes the `Content-Type` header. The server will return a `Content-Type` header if the requested format is supported, or the `406 Not acceptable` error if an invalid content type is provided. +By default, Kubernetes returns objects serialized to JSON with content type `application/json`. This is the default serialization format for the API. However, clients may request the more efficient Protobuf representation of these objects for better performance at scale. The Kubernetes API implements standard HTTP content type negotiation: passing an `Accept` header with a `GET` call will request that the server return objects in the provided content type, while sending an object in Protobuf to the server for a `PUT` or `POST` call takes the `Content-Type` header. The server will return a `Content-Type` header if the requested format is supported, or the `406 Not acceptable` error if an invalid content type is provided. See the API documentation for a list of supported content types for each API. @@ -560,4 +560,4 @@ If you request a a resourceVersion outside the applicable limit then, depending ### Unavailable resource versions -Servers are not required to serve unrecognized resource versions. List and Get requests for unrecognized resource versions may wait briefly for the resource version to become available, should timeout with a `504 (Gateway Timeout)` if the provided resource versions does not become available in a resonable amount of time, and may respond with a `Retry-After` response header indicating how many seconds a client should wait before retrying the request. Currently the kube-apiserver also identifies these responses with a "Too large resource version" message. Watch requests for a unrecognized resource version may wait indefinitely (until the request timeout) for the resource version to become available. +Servers are not required to serve unrecognized resource versions. List and Get requests for unrecognized resource versions may wait briefly for the resource version to become available, should timeout with a `504 (Gateway Timeout)` if the provided resource versions does not become available in a reasonable amount of time, and may respond with a `Retry-After` response header indicating how many seconds a client should wait before retrying the request. Currently, the kube-apiserver also identifies these responses with a "Too large resource version" message. Watch requests for an unrecognized resource version may wait indefinitely (until the request timeout) for the resource version to become available. From d053563e8b91ffa94c41b798feff75dccf96bf66 Mon Sep 17 00:00:00 2001 From: sahadat_hossain Date: Fri, 12 Feb 2021 14:53:34 +0600 Subject: [PATCH 02/10] fixed some typos and grammatical mistakes --- content/en/docs/concepts/security/controlling-access.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/security/controlling-access.md b/content/en/docs/concepts/security/controlling-access.md index 62dc273cf7..997376b984 100644 --- a/content/en/docs/concepts/security/controlling-access.md +++ b/content/en/docs/concepts/security/controlling-access.md @@ -28,7 +28,7 @@ a private certificate authority (CA), or based on a public key infrastructure li to a generally recognized CA. If your cluster uses a private certificate authority, you need a copy of that CA -certifcate configured into your `~/.kube/config` on the client, so that you can +certificate configured into your `~/.kube/config` on the client, so that you can trust the connection and be confident it was not intercepted. Your client can present a TLS client certificate at this stage. @@ -101,7 +101,7 @@ If Bob makes a request to write (`create` or `update`) to the objects in the `pr Kubernetes authorization requires that you use common REST attributes to interact with existing organization-wide or cloud-provider-wide access control systems. It is important to use REST formatting because these control systems might interact with other APIs besides the Kubernetes API. -Kubernetes supports multiple authorization modules, such as ABAC mode, RBAC Mode, and Webhook mode. When an administrator creates a cluster, they configure the authorization modules that should be used in the API server. If more than one authorization modules are configured, Kubernetes checks each module, and if any module authorizes the request, then the request can proceed. If all of the modules deny the request, then the request is denied (HTTP status code 403). +Kubernetes supports multiple authorization modules, such as ABAC mode, RBAC Mode, and Webhook mode. When an administrator creates a cluster, they configure the authorization modules that should be used in the API server. If more than one authorization modules are configured, Kubernetes checks each module, and if any module authorizes the request, then the request can proceed. If all the modules deny the request, then the request is denied (HTTP status code 403). To learn more about Kubernetes authorization, including details about creating policies using the supported authorization modules, see [Authorization](/docs/reference/access-authn-authz/authorization/). From 2c942aeb79bacf85a915690e2fb5a32fb260a333 Mon Sep 17 00:00:00 2001 From: sahadat_hossain Date: Fri, 12 Feb 2021 15:27:01 +0600 Subject: [PATCH 03/10] fixed grammatical mistake --- content/en/docs/concepts/security/controlling-access.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/security/controlling-access.md b/content/en/docs/concepts/security/controlling-access.md index 997376b984..47a9c70131 100644 --- a/content/en/docs/concepts/security/controlling-access.md +++ b/content/en/docs/concepts/security/controlling-access.md @@ -135,7 +135,7 @@ for the corresponding API object, and then written to the object store (shown as The previous discussion applies to requests sent to the secure port of the API server (the typical case). The API server can actually serve on 2 ports: -By default the Kubernetes API server serves HTTP on 2 ports: +By default, the Kubernetes API server serves HTTP on 2 ports: 1. `localhost` port: From c0770869ff394436cb3d89a540b71492a16423af Mon Sep 17 00:00:00 2001 From: sahadat_hossain Date: Fri, 12 Feb 2021 16:57:50 +0600 Subject: [PATCH 04/10] fixed some grammatical mistakes --- .../docs/reference/access-authn-authz/authentication.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index c385a15fda..504908cf9d 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -205,7 +205,7 @@ spec: ``` Service account bearer tokens are perfectly valid to use outside the cluster and -can be used to create identities for long standing jobs that wish to talk to the +can be used to create identities for long-standing jobs that wish to talk to the Kubernetes API. To manually create a service account, simply use the `kubectl create serviceaccount (NAME)` command. This creates a service account in the current namespace and an associated secret. @@ -233,7 +233,7 @@ secrets: - name: jenkins-token-1yvwg ``` -The created secret holds the public CA of the API server and a signed JSON Web +The created secret holds the public CA of the API server, and a signed JSON Web Token (JWT). ```bash @@ -320,7 +320,7 @@ sequenceDiagram 8. Once authorized the API server returns a response to `kubectl` 9. `kubectl` provides feedback to the user -Since all of the data needed to validate who you are is in the `id_token`, Kubernetes doesn't need to +Since all the data needed to validate who you are is in the `id_token`, Kubernetes doesn't need to "phone home" to the identity provider. In a model where every request is stateless this provides a very scalable solution for authentication. It does offer a few challenges: @@ -733,7 +733,7 @@ to the impersonated user info. The following HTTP headers can be used to performing an impersonation request: * `Impersonate-User`: The username to act as. -* `Impersonate-Group`: A group name to act as. Can be provided multiple times to set multiple groups. Optional. Requires "Impersonate-User" +* `Impersonate-Group`: A group name to act as. Can be provided multiple times to set multiple groups. Optional. Requires "Impersonate-User". * `Impersonate-Extra-( extra name )`: A dynamic header used to associate extra fields with the user. Optional. Requires "Impersonate-User". In order to be preserved consistently, `( extra name )` should be lower-case, and any characters which aren't [legal in HTTP header labels](https://tools.ietf.org/html/rfc7230#section-3.2.6) MUST be utf8 and [percent-encoded](https://tools.ietf.org/html/rfc3986#section-2.1). {{< note >}} From a93938b00ec6127617a6deb273b7f50c656c39a5 Mon Sep 17 00:00:00 2001 From: Sahadat Hossain Date: Fri, 12 Feb 2021 22:33:16 +0600 Subject: [PATCH 05/10] Update content/en/docs/reference/using-api/api-concepts.md Co-authored-by: Irvi Aini <7439590+irvifa@users.noreply.github.com> --- content/en/docs/reference/using-api/api-concepts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index 2d7b940408..cc681a0647 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -130,7 +130,7 @@ To retrieve a single list in chunks, two new parameters `limit` and `continue` a Like a watch operation, a `continue` token will expire after a short amount of time (by default 5 minutes) and return a `410 Gone` if more results cannot be returned. In this case, the client will need to start from the beginning or omit the `limit` parameter. -For example, if there are 1,253 pods on the cluster, and the client wants to receive chunks of 500 pods at a time, they would request those chunks as follows: +For example, if there are 1,253 pods on the cluster then the client wants to receive chunks of 500 pods at a time, they would request those chunks as follows: 1. List all the pods on a cluster, retrieving up to 500 pods each time. From 5ad27062f6c7623e3e312bc79a70f2b095e7deb6 Mon Sep 17 00:00:00 2001 From: Sahadat Hossain Date: Fri, 12 Feb 2021 22:33:37 +0600 Subject: [PATCH 06/10] Update content/en/docs/reference/access-authn-authz/authentication.md Co-authored-by: Irvi Aini <7439590+irvifa@users.noreply.github.com> --- content/en/docs/reference/access-authn-authz/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index ee093483a1..de6bb7d755 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -235,7 +235,7 @@ secrets: - name: jenkins-token-1yvwg ``` -The created secret holds the public CA of the API server, and a signed JSON Web +The created secret holds the public CA of the API server and a signed JSON Web Token (JWT). ```bash From 11f542a599a421a833bc2735e71217d400d195c0 Mon Sep 17 00:00:00 2001 From: Sahadat Hossain Date: Fri, 12 Feb 2021 22:38:11 +0600 Subject: [PATCH 07/10] Update authentication.md --- content/en/docs/reference/access-authn-authz/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index de6bb7d755..56ab5c691a 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -206,7 +206,7 @@ spec: Service account bearer tokens are perfectly valid to use outside the cluster and -can be used to create identities for long-standing jobs that wish to talk to the +can be used to create identities for long standing jobs that wish to talk to the Kubernetes API. To manually create a service account, simply use the `kubectl create serviceaccount (NAME)` command. This creates a service account in the From ee8e67ce9aa68ac7203ebdfff347c87c47927ec8 Mon Sep 17 00:00:00 2001 From: Sahadat Hossain Date: Sat, 13 Feb 2021 17:18:20 +0600 Subject: [PATCH 08/10] Update controlling-access.md --- content/en/docs/concepts/security/controlling-access.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/security/controlling-access.md b/content/en/docs/concepts/security/controlling-access.md index 47a9c70131..e025ac10e3 100644 --- a/content/en/docs/concepts/security/controlling-access.md +++ b/content/en/docs/concepts/security/controlling-access.md @@ -101,7 +101,7 @@ If Bob makes a request to write (`create` or `update`) to the objects in the `pr Kubernetes authorization requires that you use common REST attributes to interact with existing organization-wide or cloud-provider-wide access control systems. It is important to use REST formatting because these control systems might interact with other APIs besides the Kubernetes API. -Kubernetes supports multiple authorization modules, such as ABAC mode, RBAC Mode, and Webhook mode. When an administrator creates a cluster, they configure the authorization modules that should be used in the API server. If more than one authorization modules are configured, Kubernetes checks each module, and if any module authorizes the request, then the request can proceed. If all the modules deny the request, then the request is denied (HTTP status code 403). +Kubernetes supports multiple authorization modules, such as ABAC mode, RBAC Mode, and Webhook mode. When an administrator creates a cluster, they configure the authorization modules that should be used in the API server. If more than one authorization modules are configured, Kubernetes checks each module, and if any module authorizes the request, then the request can proceed. If all of the modules deny the request, then the request is denied (HTTP status code 403). To learn more about Kubernetes authorization, including details about creating policies using the supported authorization modules, see [Authorization](/docs/reference/access-authn-authz/authorization/). From 4a0574a083ef1128033a73a8a252b93c44d04133 Mon Sep 17 00:00:00 2001 From: Sahadat Hossain Date: Sat, 13 Feb 2021 17:19:13 +0600 Subject: [PATCH 09/10] Update authentication.md --- content/en/docs/reference/access-authn-authz/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index 56ab5c691a..fc76cbb2f4 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -207,7 +207,7 @@ spec: Service account bearer tokens are perfectly valid to use outside the cluster and can be used to create identities for long standing jobs that wish to talk to the -Kubernetes API. To manually create a service account, simply use the `kubectl +Kubernetes API. To manually create a service account, simply use the `kubectl` create serviceaccount (NAME)` command. This creates a service account in the current namespace and an associated secret. From 0c7f918653b27876473756116a1f17b93dbe102a Mon Sep 17 00:00:00 2001 From: Sahadat Hossain Date: Sat, 13 Feb 2021 17:26:38 +0600 Subject: [PATCH 10/10] Update api-concepts.md --- content/en/docs/reference/using-api/api-concepts.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index cc681a0647..e517a13d52 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -130,9 +130,9 @@ To retrieve a single list in chunks, two new parameters `limit` and `continue` a Like a watch operation, a `continue` token will expire after a short amount of time (by default 5 minutes) and return a `410 Gone` if more results cannot be returned. In this case, the client will need to start from the beginning or omit the `limit` parameter. -For example, if there are 1,253 pods on the cluster then the client wants to receive chunks of 500 pods at a time, they would request those chunks as follows: +For example, if there are 1,253 pods on the cluster and the client wants to receive chunks of 500 pods at a time, they would request those chunks as follows: -1. List all the pods on a cluster, retrieving up to 500 pods each time. +1. List all of the pods on a cluster, retrieving up to 500 pods each time. ```console GET /api/v1/pods?limit=500