* Add no_proxy settings one might need to use minikube and kubectl behind a proxy.
* add extra line before shell block for formatting
* include suggestions from chenopis
* Fix installing autocompletion documentation
The written solution did not work for me with the error `-bash: __git_ps1: command not found`. Since the auto-completion is already installed you can simply add the Kubernetes autocompletion to it.
* Remove sourcing bash-completion in .bash_profile
* Removed -fs from troubleshooting command
* Add YAML file for configmaps in concepts
* Add new topic for configmaps in concepts
* Add configuration entry for understanding configmaps
* Move Understanding Configmaps to a separate concept file
* Revert "Move Understanding Configmaps to a separate concept file"
This reverts commit 71bd80d7bccd090d0aa1829ae9e4db6cc4dc590c.
* Revert "Add configuration entry for understanding configmaps"
This reverts commit c27fc13f56453dff6e6b8b8f1f9641cbad8ace53.
* Revert "Add new topic for configmaps in concepts"
This reverts commit 3d535f59170a4b5cb290975871f167217484e7ab.
* Revert "Add YAML file for configmaps in concepts"
This reverts commit 8ecabd6d106647631819441be8bf7e834f0dbb54.
In copyCode function, removes target.value from if (succeed) sweetAlert function.
Sometimes target.value is too long, which causes the sweetAlert box to be cut off from the page. The confirmation button also gets cut off, which means that the user can't close the box, which means they need to refresh the page to continue.
Instead, the alert tells the user which file was copied.
Addresses the work described at #4134.
- Remove /docs/samples page: This page mostly had links to examples on
kubernetes/kubernetes (examples dir) which is now at kubernetes/examples
repository. It was linking to README.md files for tutorials. Now removing
this page as we are moving tutorials from kubernetes/examples to here:
- Create redirects from /docs/samples/ to /docs/tutorials/ (both JS and
redirect_from).
- Deprecate "MEAN Stack" tutorial: This tutorial overlaps quite a bit with
existing "maintained" examples and has been out-of-date for a while.
Creating an external redirect to its original and more up-to-date location:
https://medium.com/google-cloud/running-a-mean-stack-on-google-cloud-platform-with-app-engine-and-mongolab-4bbd2040ea75
- Import README.md files of maintained examples (guestbook, wordpress+mysql and
cassandra) to this repository and serve them under /docs/tutorial.
- Update /docs/tutorials ToC:
- Link to imported tutorials.
- Fix missing articles on sidebar (_data/tutorials.yml) and make the tutorials
listed on tutorials/index.md available on the sidebar (closes#4007).
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
Document kubeadm KUBELET_DNS_ARGS issue
CronJobs aren't enabled in 1.6 by default
Fix typo
Document pod-template-hash label
Rename last remaining reference of kargo to kubespray
* Update installation instructions with snap
Update installation instructions with snap - the package manager for Ubuntu and other Linux distributions.
* fix md formatting
* fix shell formating
* fix shell block
* fix shell for Check the kubectl configuration
* switch to full width shell
* Update scratch.md: include download binary tarball
As `kubernetes-server-linux-amd64.tar.gz` is not provided with the tarball now, an extra step is required.
* Updated scratch.md to follow review comments
* rename kargo to kubespray in getting started docs
* remove old kargo guide, update link to kubespray doc
* update setup.yml with new kubespray pointer
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
whatisk8s - Chinese version (#3243)
split rows and nest to stack columns (#4129)
Updates to docs/admin/kubelet-tls-bootstrapping (#3617)
Replace "Pod Injection Policy" with "Pod Preset" (#3667)
Change example PersistentVolumeClaim
add PodNodeSelector to admission-controllers (#3691)
Get pods using a label selector instead of hardcoded indexes. Use JsonPath instead of go-template.
correct_init_container_state (#3972)
kubernetes.github.io/docs/tasks/administer-cluster: operating etcd clusters
Remove --no-check-certificate flag in bare_metal_offline.md
Document the use of verb if set resourceNames
If a default storage class exists, it is going to create a new persistent volume to bind to that claim instead of using our example one, which will make the tutorial fail. In particular, this happens on minikube.
Specifying an empty storageClassName will prevent the storage class to be used, and force our volume to be selected.
Using `--no-check-certificate` is, frankly, dangerous and we shouldn't be recommending that users use it. Not without a good reason, anyway.
If a user's system is sufficiently broken that they are getting certificate validation problems during this step, I fail to see how it is our problem to tell the user to overcome that. Let's focus on installing Kubernetes here.
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
networkpolicies.md --> network-policies.md for SEO
Added link (#4161)
Use "sudo -i" instead of "sudo su -"
Create a section for kubeadm topics
Consolidate SecurityContext topics. (#4005)
Typo fix in "Adding ConfigMap data to a Volume" section (#3966)
`sudo su -` is redundant, as you are asking the system to elevate you after you have already elevated.
If what you actually want is to get a login environment, the `sudo -i` flag is designed exactly for that.
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
bump openstack cli tools versions to working values
fix header size for sub-sections under Services
Finish #4036
Be more specific about cpu-shares passed to Docker (#4016)
Clarify the required uniqueness of Label Key
Add --show-all to documentation
docs(service): remove invalid `,` from example
Add "remove" example for kubectl patch (#4042)
Fix wrong link to create a ConfigMap
Fix a typo in the High Availability docs (#4048)
Remove ports from ExternalName Service example
remove extra that
update kops installation instructions
fixes typos and corrects links in the minikube guide (#4051)
Use native patch functionality instead of JQ
add the introduce of using wildcard '*' in nonResourceURL
Rephrase doc about Deployment .spec.rollbackTo field
create-cluster-kubeadm: add ToC using task template
install-kubeadm: fix What's Next link text
Docker documentation (https://docs.docker.com/engine/reference/run/) reads:
"To modify the proportion from the default of 1024, use the -c or --cpu-shares flag to set the weighting to 2 or higher. If 0 is set, the system will ignore the value and use the default of 1024."
So the Kubernetes documentation gives the impression that if requests.cpu is zero, Docker would end up applying a value of 1024, which isn't the case.
This change makes the explanation more precise, hopefully without making it much more difficult to read.
* Remove extraneous files from autogeneration of ref pages.
* Revert "Remove extraneous files from autogeneration of ref pages."
This reverts commit 39ec47ee44354c96070f89064374eb729d6da5ec.
* update pod persistent volume example storage class
When binding to a manually created PersistentVolume, the claim must
disable dynamic provisioning by specifying an empty storage class.
Fixes#2803
* use specific storageclass
* revert gibibytes -> gigabytes change
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
fixed the line giving the template for creating configmap, should include the word configmap as part of the creation process.
Fixes issue #3939
Add CRI runtime support
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
Updaated install-kubeadm.md, removed redundant kubectl installation (#4006)
Add Chocolatey Package Manager for Windows (#4000)
Make issue title automatically a link
Update directions for macOS bash completion
e.g. "Issue with k8s.io/docs/getting-started-guides/kubeadm/" when people
open issues on the repo. This way we can just select the text, right-click
and say Go to Link.
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
* Remove spurious cluster-status role description
* Indicate controller-manager must be granted controller roles when not run with --use-service-account-credentials
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
Changes "Mac OS" to macOS, "bootcamp" to tutorial (#3955)
Remove apply/edit warning now that edit is fixed
Two minor fixes
Cleanup robots.txt
Readability: Split first paragraph into two (#3957)
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
networking.md: Add reference to the Cilium network plugin
Fix typo in cluster api docs
[Kubeadm] bugfix in the index listing
Fix log rotation description in the logging doc (#3918)
Add colon to #3897
add prompt about KUBE_REPO_PREFIX (#3597)
Warn against managing ReplicaSets owned by Deployments
Update small typo in components page (#3930)
change the service name to pod ip (#3926)
* 'master' of https://github.com/kubernetes/kubernetes.github.io: (627 commits)
Fixed a minor mistake
docs/concepts/policy/pod-security-policy.md: add projected to list of allowed types.
Init container exists beta in 1.6.
fix typo (#3895)
add unit of --ttl duration (#3915)
Fixes broken links
Prototype of custom description meta tags. (#3928)
Site URL for canonical URLs. (#3927)
Warn about implications on selector updates
grammar patch to #3922 (#3923)
add calico to the table of solution
Minor grammatical change
Add deprecation tag (#3922)
Fix sentence
Minor grammatical correction
Remove beta as K8s support on Bluemix Container Service is live
Fix some output
replace REASON with STATUS
column IP is missed
replace kubectl.sh with kubectl
...
# Conflicts:
# docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md
I Created a deployment yaml file tomcatdp.yaml， and did not set the .spec.strategy，then run
kubectl create -f tomcatdp.yaml,
and then run
kubectl get deployment tomcat-deployment -o yaml,
the tomcat-deployment is the name of the deployment,found that the MaxUnavailable and MaxSurge default value is 25%
The GPU path is not permissive by default and requires a bit of
additional setup if the operator does not allow for privileged
containers.
Related kubernetes/kubernetes#46007
Signed-off-by: Christopher M. Luciano <cmluciano@us.ibm.com>
* Update projected volume task
- Rename file
- Build out steps
- Create separate yaml file for pod configuration
- Add new page to the sidenav
* Add projected volume type to volumes concept page
https://kubernetes.io/docs/home/ suggests:
Concepts, Tasks, and Tutorials
> The Kubernetes documentation contains a number of resources to help you understand and work with Kubernetes.
> Concepts provide a deep understanding of how Kubernetes works.
> Tasks contain step-by-step instructions for common Kubernetes tasks.
> Tutorials contain detailed walkthroughs of the Kubernetes workflow.
This is a logical order and I've rearranged the header to match.
* WtD: Picking the Right Solution, edit
Fixes content of overview sitting too close to next section's heading.
* Update pick-right-solution.md
* Update pick-right-solution.md
* access-clusters docs revamp
Fix the accessing clusters docs, bring them into the right templates
and put them in the right parts of the site.
* Update proxies.md
* Update concepts.yml
* Update tasks.yml
* Update install-kubectl.md
Write the Docs:
Added Task template to the document.
Edited for clarity.
* Update install-kubectl.md
Write the Docs. Responded to review feedback: https://github.com/kubernetes/kubernetes.github.io/pull/3760#pullrequestreview-38008755
* Update install-kubectl.md
Write the Docs. Seeing if this makes the bulleted list render correctly.
* Update install-kubectl.md
Write the Docs. Markdown really doesn't seem to like that bulleted list there, so we'll just do it in sentence flow.
- edit /docs/tasks/configure-pod-container/configmap.md to use the task template
- move the Consuming ConfigMap in pods section to its own doc (coming in a separate PR)
Now that we have new repositories to house RPMs for other architectures,
and are populating them with new releases, we should advertise them in
the kubeadm getting started instructions.
* NetworkPolicy clarifications
- For clarity, only use the word "policy" in reference to
NetworkPolicies, not in reference to the isolation annotation.
- Drop a bunch of text related to the isolation annotation since
there's only one interesting value so there's no reason to
complicate things.
- Fix bad YAML indentation
- Misc rewording
* Update NetworkPolicy docs for v1
Similar to the pod-network-cird= issue, with no = there is no immediate problem but it causes trouble along the way (i.e. I wasn't able to access the dashboard via kubectl proxy)
Wasted hours today trying to get kubeadm working on a Ubuntu VM. The culprit is a missing = for the pod-network-cidr parameter to the kubeadm init command when using calico. Without it kube-dns refused to start, oddly enough pods had 10.244.0.0 network setup but somehow it was failing sending a request to destroy and recreate the pod.
Here's the events for the kube-dns pods if someone's interested.
Events:
FirstSeen LastSeen Count From SubObjectPath Type Reason Message
--------- -------- ----- ---- ------------- -------- ------ -------
2m 2m 1 default-scheduler Normal Scheduled Successfully assigned kube-dns-3913472980-5xfzt to kube-master
1m 1m 1 kubelet, kube-master Warning FailedSync Error syncing pod, skipping: failed to "CreatePodSandbox" for "kube-dns-3913472980-5xfzt_kube-system(3bd90f8c-33a8-11e7-8a23-080027ac04f3)" with CreatePodSandboxError: "CreatePodSandbox for pod \"kube-dns-3913472980-5xfzt_kube-system(3bd90f8c-33a8-11e7-8a23-080027ac04f3)\" failed: rpc error: code = 2 desc = NetworkPlugin cni failed to set up pod \"kube-dns-3913472980-5xfzt_kube-system\" network: Get https://10.96.0.1:443/api/v1/namespaces/kube-system/pods/kube-dns-3913472980-5xfzt: dial tcp 10.96.0.1:443: i/o timeout"
1m 50s 6 kubelet, kube-master Warning FailedSync Error syncing pod, skipping: failed to "KillPodSandbox" for "3bd90f8c-33a8-11e7-8a23-080027ac04f3" with KillPodSandboxError: "rpc error: code = 2 desc = NetworkPlugin cni failed to teardown pod \"kube-dns-3913472980-5xfzt_kube-system\" network: connection is unauthorized"
1m 9s 9 kubelet, kube-master Normal SandboxChanged Pod sandbox changed, it will be killed and re-created.
37s 9s 3 kubelet, kube-master Warning FailedSync Error syncing pod, skipping: failed to "KillPodSandbox" for "3bd90f8c-33a8-11e7-8a23-080027ac04f3" with KillPodSandboxError: "rpc error: code = 2 desc = NetworkPlugin cni failed to teardown pod \"kube-dns-3913472980-5xfzt_kube-system\" network: netplugin failed but error parsing its diagnostic message \"\": unexpected end of JSON input"
* Refactor tabs implementation
* tidy head.html
* test jquery-ui tabs
* Initial tabs code refactor
* test liquid parsing
* test liquid stack
* move into tabs.html
* test jekyll tabs
* construct array
* test cleaner way
* add example content
* test split hack
* fix md
* add site.emptyArray
* set good defaults
* fix CSS
* cleanup li
* fix a href
* fix content tabs
* add space to default
* remove a href underline
* rename docs/tab-test.md to docs/tab-example.md
* fix skip toc check
* add assignees
* add comment to reference example
* add documentation to example
* escape md
* move demo to top, pretty it up
* add word
* tweak wording
Fixes#3357. I'm removing this statement as it's not clear where it should
actually be pointing to...
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
This table of contents is redundant (it's also available from the side nav) and confusing (not clear if it's a copy of the side nav or contains additional information). Plus, it was out of sync with the actual table of contents (last section on GPU was missing). So, I think it's best to just remove it.
* Update link to Adding ImagePullSecrets to a service account
* Link to appropriate docs for Automatic Mounting of Manually Created Secrets
* Replace here w/ title of pages
* Syntax for Kubernetes version 1.6
Included 1.6 syntax change for declaration of init containers.
* Reorder services.yaml & add 1.5 syntax still works
* Corrected YAML headings & add syntax explanation
When -w option is not available for base64, for example, when using alpine Docker image.
`echo -n "<text>" | base64 | tr -d '\n'` should be used, it works better.
* Remove bash completion from gce.md
Bash completion instructions do not belong to this guide. (ref: #3476)
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
* Update kubectl installation instructions on gce.md
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
This topic is not yet important enough to list exhaustively on /docs/reference.
Also the links are broken anyway. Fixes#3535.
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
* Update federation setup guide link to kubefed
We no longer support federation setup scripts `federation.sh` and
`deploy.sh`. Update the main federation guide setup link accordingly, by
making kubefed guide the way to go.
* Update federation.md
* initial commit for structure
* migrate Container Lifecycle Hooks and related files to Concepts
* update Concepts ToC
* fix formatting
* Formatting tweaks
* comment out What's next
* remove What's next
* Begin rewrite of container-lifecycle-hooks.md
* incremental update to edit
* Split Container Lifecycle Hooks into container-lifecycle-hooks.md and container-environment.md; change all referring links.
* Add concept template to volumes.md and images.md
* Apply changes for steveperry-53 feedback.
* fix format issue
* tweak formatting
* fix Concepts ToC
* update links
* add back changes to Concepts ToC
* fix a link
* update links
* adding documentation for TCP checks, replacing "discussion" section with more detailed "configuration" section, other small tweaks
* some line breaks and a small tweak
* tweaking config section
* fixing problems with http get field descriptions, more detailed TCP example
* Added note about Docker credentials store
Docker might use a credentials store when logging in to docker repositories, see https://docs.docker.com/engine/reference/commandline/login/#credentials-store. In that case you don't find the `auth` token in the `config.json` file. I added a note that this might happen, in order to prevent confusion.
* added "NOTE:" to the Docker credentials store note
as suggested in PR review
- avoiding cloning the full history of k8s repo, there doesn't seem to be any
difference (--depth=1 gives the same result and fetched branches are not
used in this script)
- quoting around variables and add '--' to some commands to separate positional
arguments
- using subshells instead of pushd/popd stuff, easier to read IMO
- added 'set -o errexit', couldn't add 'set -o pipefail'. For some reason when
I enable pipefail, it produces a vastly different output but I don't see any
errors in the output.
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
Create a documentation link for IBM Bluemix Container Service similar to
GCE and Azure. Also rename Softlayer references to Bluemix.
Co-Authored-By: Xavier Loup <xavier.loup@fr.ibm.com>
* Update links to outdated user-guide and admin docs
* Add script for updating outdated links.
* Update regex to include init-containers file.
* Pull upstream, rewrite links in and to namespaces walkthrough.
Currently kubefed does not create the default namespace, therefore anyone
following this doc today will hit this issue. Adding a few comments to bridge
that gap until the bug is fixed.
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
This is the only place in all of the documentation where addon(s) is used
instead of addons. Even though with brackets it can be read as one or more
addons, it looks strange and inconsistent with the rest of the documentation.
Signed-off-by: Brad Topol <btopol@us.ibm.com>
* Massive updates to expose-intro.html
Updates to the non-interactive tutorial on exposing apps via services
* more updates to expose-intro
* fixed broken link
* fixed some wording
* removed extra space
* sub backticks for code and newline
* added small legend to fist svg
* fixed svg scaling
* removed extra div
Kubernetes release .tar.gz no longer provides binaries. So the existing
instructions are invalid (#2815).
User has to get the .tar.gz file and then run a script, only to download them
from storage.googleapis.com/kubernetes-release. That's already what's documented
in the "install via curl" section.
Therefore deleting "Extract kubectl from Release .tar.gz" section.
Signed-off-by: Ahmet Alp Balkan <ahmetalpbalkan@gmail.com>
People are hitting issues copy-pasting the complicated way to install
`kubectl` and we're suggesting them to `sudo mv` binaries to /usr/local/bin.
That is not very ideal. Instead suggesting users to use Homebrew. I think it's
ok for this tutorial, as the tutorial already uses Homebrew to install
other stuff, plus it's a much better way than `sudo mv`ing.
Closes#2478.
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
- Pods do not start with missing ConfigMaps or Secrets
- Pods do not start with missing keys in ConfigMaps or Secrets
- Pods start with invalid keys when referring to entire ConfigMaps or
Secrets. An event documents the skipped keys from said resource.
This replaces the two buttons on the right of the footer.
It does not seem like get.k8s.io is useful to anyone. Replacing it with the
installation guide and avoiding K8s abbreviation in these buttons.
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
* Updates ZooKeeper example to use the Anti-Affinity field instead of the
1.5 annotation.
* Changed podAntiAffinity field references to lower case
Changed references to PodAntiAffinity object/concept to plain text
Changed link to PodAntiAffinity to reference subsection
* 'master' of https://github.com/kubernetes/kubernetes.github.io: (21 commits)
revert issue URL, turn into link
docs/admin/authorization: remove duplicated phrase (#3045)
update urls
Fix a typo and update one url
update urls
update a url
update urls
update invalid links
update some urls
modify the url of RestartPolicy (#3034)
Fix the url
amend the url
amend the readiness probes (#3031)
modify the link url (#3030)
change the url (#3029)
Fix the typo.
Fix the link url
delete redundant example
fix typo
change a link's url
...
# Conflicts:
# docs/admin/authorization/index.md
The example does not offer other aspects about the hostPath, it's some kind of duplicate to the preceding one. So, maybe only the preceding one is enough.
Manually uploaded a :1.1 tag for the staging container, now it's alpine based
(1/4th in image size) and no longer has the warning mentioned in #2837.
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
s/Wildard/Wildcard/
rephrase the sentence
Fix the number of processes on Kubernetes master (#2985)
Pod Security Policy doc improvements (#3010)
docs/admin: document OpenID Connect plugin "extra-scopes" field
# Conflicts:
# docs/admin/kubelet.md
# docs/user-guide/pod-security-policy/index.md
* Fix the number of processes on Kubernetes master
According to https://kubernetes.io/docs/getting-started-guides/centos/centos_manual_config/, we can know that there are only three processes of Kubernetes running on the master. etcd and flannel are three-party softwares. These are kube-apiserver, kube-controller-manager, and kube-scheduler. If we want to deploy pod on master, we need to start other two processes: kube-proxy and kubelet. So Three or Five is correct. In this case, I perfer Three. Pure master without Pod is fine.
* fix the pr
fix the pr
* Fix the pr
Fix the pr
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
fix the command output
delete invalid link
Revert "fix the command output"
fix the command output
Delete the useless spaces
Dollar signs used before commands without showing output
bare-url-used
Fix typo in authorization docs
Update networking.md
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
change the link icon
fix command kubectl get serviceAccounts output
Flannel is not longer the only network addon that supports ARM
# Conflicts:
# docs/getting-started-guides/kubeadm.md
The link now is a page of kubernetes.io, not a github's .md file any more.
So I think use the link page's title( Building High-Availability Clusters) is fine.
"high-availability.md" may be the older edition's link icon.
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
Update some description about secrets
[Federation] Add a note about DNS API scopes to the Federation tutorial (#2943)
Delete the useless spaces in html files
Fix typo
update resource-usage-monitoring.md
* [Federation] Add a note about DNS API scopes to the Federation tutorial
Not sure this is the right place for this, but I wanted to get the text out somewhere before I forgot about it.
* Update set-up-cluster-federation-kubefed.md
* Update set-up-cluster-federation-kubefed.md
* Fix formatting of code blocks.
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
Replace the tab with 4 spaces in md files (#2797)
fix link error
Replace the tab with 4 spaces in html files
hitting the `ClusterIP` from a pod (#2826)
# Conflicts:
# docs/admin/accessing-the-api.md
# docs/api-reference/extensions/v1beta1/definitions.html
# docs/getting-started-guides/kubeadm.md
# docs/user-guide/kubectl/index.md
* hitting the `ClusterIP` from a pod
when client pod and server pod in the same node,client_address is the client pod ip address
when client pod and server pod in different node,client_address is the client pod's node flannel ip address
* Update source-ip.md
* Update source-ip.md
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
rephrase the expression of configmap/index.md
Do not link to org/team links on GitHub
Fixed typos (#2721)
Revert "update init-containers.md"
Fix doc sentence
Add Minikube reference in the Kubectl configuration doc
Mention Minikube in the Kubectl configuration doc
# Conflicts:
# docs/tasks/index.md
* Fix incorrect sentence
The changes removes an unnecessary word to correct doc sentence.
* Fix incorrect sentence
Remove an extra incorrect word from the sentence.
* 'release-1.6' of https://github.com/kubernetes/kubernetes.github.io:
* 'master' of https://github.com/kubernetes/kubernetes.github.io: (23 commits)
Apply changes from PR #2787
rephrase the sentence to make expression clear (#2789)
update index.md (#2788)
Apply changes from PR #2784 (#2950)
The link URL of [kube-controller-manager] is wrong
Added pod name in run command
Fix grammar in docs/admin/daemon.md
update index.md (#2755)
Update garbage-collection.md (#2732)
Fix typo (#2842)
Fix typo
Fix the typos
Apply typo fixes from #2791 (#2949)
Fix typo in kubectl_completion.md
fix typeo (#2856)
Use kubectl config current-context to simplify the instructions
fix a typo in /docs/user-guide/configmap/index.md
Fix monitor-node-health.md
amend monitor-node-health.md
Update manage-compute-resources-container.md
...
# Conflicts:
# docs/tools/index.md
A sentence in the "What is a DaemonSet" section had an extra "would be
used" which made the sentence grammatically incorrect.
Signed-off-by: Steven Erenst <stevenerenst@gmail.com>
* update index.md
add one word "be".
* update index.md
change "to help users familiar with Docker Compose move to Kubernetes" to "to help Docker Compose users move to Kubernetes".
This is much better. Thank you! At first i misunderstand the meaning of this sentence.
* Delete the parameter "--google-json-key string"
Delete the parameter "--google-json-key string"
* Fix apimachinery vendored dependencies in examples_test.
* package apt-transport-https should be installed
Ubuntu default install not include apt-transport-https. so if you want to download package from https repo, you need install apt-transport-https package first
* doc-walkthrough-content
modify
* limitrange-update
I think it's redundant that the second to ,in order to do sth and do
sth!thanks!
* fix command kubectl get svc,pod output
fix command kubectl get svc,pod output
* Fix typo: federation-controller-mananger => federation-controller-manager
* Fix typo: federation-controller-mananger => federation-controller-manager
* Clarify minimum version of kubernetes supporting PSP authz
* Provide correct location for KUBE_ETCD_SERVERS
Provide correct location for KUBE_ETCD_SERVERS configuration key. It was
previously listed as being in /etc/kubernetes/config but is actually in
/etc/kubernetes/apiserver.
Related: https://github.com/kubernetes/kubernetes.github.io/issues/1600
* Move Compute Resources topic to Concepts. (#2410)
* Delete the parameter "--google-json-key string"
“# kube-scheduler -help”can not find --google-json-key option
# kubectl version
Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-23T00:04:39Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
Server Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-22T23:56:57Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
* Add diagnose tips when you face problem.
* Update grammar for kubeadm.md, thanks @chenopis
* Merge two pieces to one words
* add http proxy infomation in kubeadm
* Update landing pages for Tasks and Tutorials. (#2634)
* Update static-pods.md
It works. Please review it again.
* Move Guide Topic: Multi-container pods. (#2642)
* fix link to go to pod-lifecycle page
* fix the command output
fix the command output
* mirantis_logo.png
,/images/community_logos/mirantis_logo.png updated per Mirantis request
* kubeadm reference -- /
set up/manage mean set up or manage ? it's better use or?
* Prototype for deprecating User Guide topic.
* missing word
The return of the OCD.
* Move Guide topic: Using Environment Variables. (#2645)
* fix typo (#2656)
fix typo
* Move Guide topic: Using Port Forwarding. (#2661)
* Move Guide topic: Bootstrapping Pet Sets. (#2662)
* Move Guide topic: Bootstrapping Pet Sets.
* Add TOC entry.
* Move Guide topic: Connect with Proxies. (#2663)
* Move Guide topic: Connect with Proxies.
* Fix link.
* add DefaultTolerationSeconds admission controller
* getting-started-guides: add CoreOS Tectonic
* Correct the certificate name
* Update index.md
* Update installation.md
* Update validation.md
* Update backups.md
* Update backups.md
* Spell fixes
* Using it vs Juju Kubernetes
* Q1 update to k8s tech and service partner list
New partners registered to K8s Partner Ecosystem sign-up form. Logo updates companion to this edit still WIP
* Logo file updates for new registrants
Logos for new registrants
* The attribute [allowfullscree] must have a value
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* Remove newline before passing to base64
* Use single quote to avoid string interpolation, update output
* Update command as files contain no newline
* Remove all dead links, use just filename
As user can guess that it is file copied from the shown content
* Fix link to dev guide.
* Add --leader-elect=false
Second scheduler could not start without disabling leader-elect.
* cluster-components-could be running
could be doing sth
* update cluster-components.md
In theory,Master components can be run....
* update cluster-components--add a space
add a space after the comma: "In theory, Master components..."
* Highlighted command --kubectl describe
In web page ,there is no space ,need some empty space,thanks!
* Revert "Highlighted command --kubectl describe"
This reverts commit a70d0a3e3537c3f91b197b23f949e1e506c951d1.
* Add example show how to configure proxy for kube
* Revision as the suggestion describe
* move ha-master-gce.png to images/docs
Signed-off-by: Xiuyu Li <nickleefly@gmail.com>
* use relative path for ha-master-gce image
Signed-off-by: Xiuyu Li <nickleefly@gmail.com>
* The attribute [calendarWrapper] must be unique
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* add required images in kubeadm init step
* Add links to Docker/rtk in cluster-intro.html
* s/acomplish/accomplish/
* Modify the link URL of [kubelet eviction design doc]
[kubelet eviction design doc] should be linked to kubernetes.github.io
instead of community/design-proposal.
* fix CronJob object name
fix CronJob object name
* remove redundant a
Signed-off-by: Xiuyu Li <nickleefly@gmail.com>
* kubeadm reference--change any to some (#2683)
* modify one word
examples to example
* doc-walkthrough-content
modify
* limitrange-update
I think it's redundant that the second to ,in order to do sth and do
sth!thanks!
* cluster-components-could be running
could be doing sth
* update cluster-components.md
In theory,Master components can be run....
* update cluster-components--add a space
add a space after the comma: "In theory, Master components..."
* Highlighted command --kubectl describe
In web page ,there is no space ,need some empty space,thanks!
* Revert "Highlighted command --kubectl describe"
This reverts commit a70d0a3e3537c3f91b197b23f949e1e506c951d1.
* kubeadm reference--change any to some
kubeadm can install any add-on ?
* Move Guide topics: Logging (#2687)
* Disallow indexing for liveness/index (#2689)
* Deprecate Guide topics. (#2691)
* Wrong label and kubectl get completed pods
The label `app=jobexample` should be `jobgroup=jobexample`.
Also, for get completed pods the flag `--show-all` is necessary.
* Update garbage-collection.md
change “any” to "every"
* Deprecate Guide topic: Persistent Volume Walkthrough. (#2692)
* Reimplement PR #2525
Fixes typo by removing the word "controller"
* remove extra space
* Update multiple-schedulers doc (#2063)
* Update tutorial
* Fix md formatting.
* Remove extraneous space
* Deprecate Guide topic: Secrets Walkthrough. (#2695)
* Deprecate Guide topics: quick-start ... (#2696)
* Update Tasks landing page. (#2697)
* Remove redundant section in deployments
The status of the deployment is already covered in a later section in
this doc.
* Repair Spotinst logo
Corrected size
* fixed ASM blurb
* Correct ASM logo filename
* Highlighted command for `kubectl proxy`.
* Update ubuntu install instructions.
* Update local instructions to new method.
* update init-containers.md
add one word.
* Minor spelling correction -- "rtk" to "rkt"
* fixing typo
* Doc formatting update
Corrected indentation for the `nonResourcePath` and got a bit zealous with restructuring that section...
* Repair Spotinst logo
Corrected size
* fixed ASM blurb
* Correct ASM logo filename
* Update garbage-collection.md
change "any" to "every"
* Update Weave Net's title.
* fix unsupported parameter of wget command
* update to be retained
change "retain" to "to be retained".
* Update pod.md
* update init-containers.md
change "a different filesystem view" to "different filesystem views".
different init container should have different filesystem.
* Highlighted command --kubectl describe
In web page ,there is no space ,need some empty space,thanks!
* cluster-management--3
change 3 to three is better or not ?thanks!
* fix typo
1、Parameters “--allow-verification-with-non-compliant-keys” is missed.
2、Delete the parameter "--google-json-key string";
see the "# kube-controller-manager -help"
# kubectl version
Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-23T00:04:39Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
Server Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-22T23:56:57Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
* fix typo
1、Delete the parameter "--google-json-key string";
2、Parameters "--ir-data-source string"、"--ir-dbname string"、"--ir-hawkular string"、"--ir-influxdb-host string"、"--ir-namespace-only"、"--ir-password string"、"--ir-percentile int"、"--ir-user string" is missed.
see the "# kube-prxoy -help"
# kubectl version
Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-23T00:04:39Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
Server Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-22T23:56:57Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
* Update garbage-collection.md
modify the url and link
* update garbage-collection.md
change the url to relative path.
* update out-of-resource.md
change "in cases when" to "in case that"
* update out-of-resource.md
use a shorter and simpler expression.
* update out-of-resource.md
change "support" to "supports"
* Create a top-level CN directory to hold future md files for the Chinese kubernetes site
* Removed `=` at the end of the flags.
* Remove autogenerate todo
- This should be captured via a GitHub issue
and not a TODO in the README documentation
which leads to confusion.
* Move Guide topics: Federation Tasks. (#2799)
* Move Guide topics: Federation tutorial and concept. (#2802)
* Move Guide topics: Federation tutorial and concept.
* Add title.
* Fix link.
* Move kubectl Concept topics to Tutorials. (#2804)
* Move kubectl Concept topics to Tutorials.
* Add redirects and update links.
* The calendarWrapper attribute should be unique
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* Fix links. (#2808)
* Fix link. (#2806)
* Move topic from clusters to cluster-administration. (#2812)
* Move a batch of cluster admin topics. (#2813)
* Move Guide topic: Limit storage consumption. (#2814)
* Move Guide topic: Limit storage consumption.
* Add title.
* Move Guide topic: Networking. (#2816)
* Move Guide topic: Network Plugins. (#2819)
* Move Guide topic: Network Plugins.
* Fix link.
* Move Guide topic: Static Pods. (#2820)
* User Guide content migration: post notice (#2818)
* Add User Guide content migration notice.
* Fix formatting
* Tweek formatting to block highlight text in light gray.
* Try table instead of code block
* remove extra lines
* try table format
* fix links
* incorporate @ddonnelly feedback
* Move Guide topic: Out of Resource. (#2821)
* Move Guide topic: Monitoring Node Health. (#2822)
* Move Guide topic: Monitoring Node Health.
* Move to Tasks.
* Move Guide topic: AppArmor. (#2823)
* Apparmor (#2825)
* Move Guide topic: AppArmor.
* Add included files.
* Move Guide topic: Audit. (#2824)
* Added 1.6 Upgrade notes to outline changes for etcd 3.
* Move Guide topic: Disruption Budget. (#2834)
* Move Guide topic: Limit range. (#2835)
* Quota (#2836)
* Move Guide topic: Limit range.
* Move Guide topic: Resource Quota and Limits.
* Quota2 (#2838)
* Move Guide topic: Limit range.
* Move Guide topic: Resource Quota concept.
* Dns (#2839)
* Move Guide topic: Limit range.
* Move Guide topic: DNS.
* Delete CNAME
* Create CNAME
* Delete CNAME
* Create CNAME
* Move docs/user-guide/managing-deployments.md to /docs/concepts/cluster-administration/manage-deployment.md
* add nginx-app.yaml file
* add back missing /
* fix link
* Move Guide topic: Replication Controller Operations
* Move Guide topic: Resizing a replication controller
* Concepts toc (#2840)
* Move Guide topic: Limit range.
* Adjust Concepts Overview TOC.
* Move Guide topic: Rolling Updates
* Move Kubernetes API page. (#2849)
* Move What is Kubernetes topic. (#2851)
* Move Guide topic: Rolling Update Demo (#2850)
* Move Guide topic: Rolling Update Demo
* rename file
* Move Guide topic: Configuration Best Practices
* Move Guide topic: Jobs (#2853)
* Move Guide topic: Jobs
* add job.yaml file
* change title
* Move Pod overview. (#2865)
* Move Pod overview.
* Fix redirection.
* Move Guide topic: Parallel Processing using Expansions (#2867)
* Move Guide topic: Parallel Processing using Expansions
* fix links to /docs/user-guide/jobs/
* Move Init Containers topic. (#2866)
* Move Guide topic: Coarse Parallel Processing Using a Work Queue
* Move Guide topic: Fine Parallel Processing using a Work Queue (#2870)
* Move Guide topic: Fine Parallel Processing using a Work Queue
* add migration notice
* fixed capitalization
* Rename /docs/tasks/job/work-queue-1/
* Move StatefulSets topic. (#2869)
* Move StatefulSets topic.
* Fix TOC.
* Move Guide topic: Pod Templates (#2872)
* Move Guide topic: Pod Templates
* tweak header level and capitalization
* Move PetSets topic. (#2873)
* Move Garbage Collection topic. (#2874)
* Move Garbage Collection topic.
* Fix included file.
* Move Guide topic: Prereqs
* Move Guide topic: Sharing Clusters
* Move Accessing Clusters topic to Concepts. (#2875)
* Move Accessing Clusters topic to Concepts.
* Update concepts.yml
* Move Guide topic: Kubeconfig File
* Move Guide topic: Config Provider Firewalls. (#2883)
* Move Guide topic: Federation Service Discovery. (#2884)
* Move Guide topic: Connecting Apps with Services. (#2885)
* Added example and docu for hostPort ranges
* Move Guide topic: Service. (#2891)
* Move Guide topic: Service.
* Move Guide topic: External Load Balancer.
* Fix TOC.
* Move Guide topic: Resource Monitoring. (#2895)
* docs/admin: document OpenID Connect plugin's claim prefixing
* Move Guide topic: Admin Guide
* fix the command output
fix the command output
* Update manage-compute-resources-container.md
Change "he" to "The"
* update out-of-resource.md
change "thresholds" to "threshold"
* update init-containers.md
change "apply" to "application"
* amend monitor-node-health.md
Amend the url link.
* Fix monitor-node-health.md
The url link does not exist.
* fix a typo in /docs/user-guide/configmap/index.md
change "value" to "values"
* View $PAGE on Github without forking the repo
Adding a "View docs/bla-bla.md on GitHub" button next to the
"Edit docs/bla-bla.md" button so that people can view the file
first without clicking the Edit button (which does not work without
forking the repository).
I did not need this because I was trying to do something without
forking. I just found it to be bit difficult to view source of a page
on GitHub.
I'm open to ideas, perhaps we can instead add an article footer button
named "View on GitHub" next to the "Edit this Page".
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
* Move Guide topics: Container Lifestyle Hooks, Images, Volumes
* fix to taint the master node
* Add files via upload
* fix the link of ogging-elasticsearch-kibana.md
fix the link of url
* Remove from TOC/Search: pods/init-containers ... (#2694)
* Fix typo
* Add files via upload
* Create hyperlink
Create hyperlink for kubernetes repo link.
* updated PSP documentation with RBAC (#2552)
Added info about controller manager setup and current implementation when using PSP with RBAC support.
* Use kubectl config current-context to simplify the instructions
* fix typeo (#2856)
* fix typeo
* Update kargo.md
* Fix typo in kubectl_completion.md
evaluation --> evaluated
* Apply typo fixes from #2791 (#2949)
* Apply typo fixes from #2791
* remove style typos
* Fix the typos
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* Fix typo
* Fix typo (#2842)
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
fix the link of ogging-elasticsearch-kibana.md
View $PAGE on Github without forking the repo
update init-containers.md
update out-of-resource.md
This updates the horizontal pod autoscaling documention to cover the new
autosclaing/v2alpha1 API version. It also notes the removal of the old
alpha annotations for autoscaling on custom metrics, and reccomends
against using the alpha collection method.
Adding a "View docs/bla-bla.md on GitHub" button next to the
"Edit docs/bla-bla.md" button so that people can view the file
first without clicking the Edit button (which does not work without
forking the repository).
I did not need this because I was trying to do something without
forking. I just found it to be bit difficult to view source of a page
on GitHub.
I'm open to ideas, perhaps we can instead add an article footer button
named "View on GitHub" next to the "Edit this Page".
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
* Word wrap paragraphs
* Switch to fenced code blocks for all code samples
* Render programs as plain text
* Separate out program invocation from program output
Much of this is to follow the style guide: https://kubernetes.io/docs/contribute/style-guide/
Signed-off-by: Joe Beda <joe.github@bedafamily.com>
Update node-selection documentation with information about taints, tolerations, and alpha support for per-pod-configurable behavior when there are node problems
Provide reference of Minikube along with kube-up.sh on creating cluster. This
will give convey message to first time users of the Minikube that they should
make sure Minikube is installed before running this step of
$ kubectl cluster-info
fixes#2863
* modify one word
examples to example
* doc-walkthrough-content
modify
* limitrange-update
I think it's redundant that the second to ,in order to do sth and do
sth!thanks!
* cluster-components-could be running
could be doing sth
* update cluster-components.md
In theory,Master components can be run....
* update cluster-components--add a space
add a space after the comma: "In theory, Master components..."
* Highlighted command --kubectl describe
In web page ,there is no space ,need some empty space,thanks!
* Revert "Highlighted command --kubectl describe"
This reverts commit a70d0a3e3537c3f91b197b23f949e1e506c951d1.
* kubeadm reference--change any to some
kubeadm can install any add-on ?
Ubuntu default install not include apt-transport-https. so if you want to download package from https repo, you need install apt-transport-https package first
- Proposing a different way to run curl without proxy, without touching current environment
- There's a formatting problem and the whole thing is being displayed in a single line
It not necessary to mention where the functions are implemented in
document. Further more, the directories recorded here is out of date.
Now they are in:
staging/src/k8s.io/apiserver/plugin/pkg/authenticator/...
Actually according to the command in example:
kubectl create secret generic ssh-key-secret --from-file=ssh-privatekey=/path/to/.ssh/id_rsa --from-file=ssh-publickey=/path/to/.ssh/id_rsa.pub
The keys will be available with names ssh-publickey and ssh-privatekey.
When I test this command, if the configmap has a label, it just delete the configmaps which has the same label key and that are not in the file.
kubectl apply --prune -f manifest.yaml --all --prune-whitelist=core/v1/ConfigMap
So I advise change the description like this:
"Apply the configuration in manifest.yaml and delete all the other configmaps with the same label key that are not in the file."
The file 'blob/master/docs/devel/api-conventions.md' has moved to
'community/blob/master/contributors/devel/api-conventions.md'
Updates the links associated with these file.
The key-value "optional:true" doesn't work in 1.5.2 yet.
So should we add a note here? "The key-value "optional:true" will be work after kubernetes 1.5.2."
So that it is above "Accessing the Cluster" article which describes
more advanced topics and does not look coherent when it is read
linearly.
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
Increase the font-size and line-height CSS
properties for the paragraph and list items
within the documentation body content.
Adjusting these properties will make the
information a little easier to read.
* Initial commit for Init Containers migration to Concepts section
* Add 1.5 beta include file
* Change include to renamed user-guide-content-moved.md file
* Fix Concepts/KO/Pods ToC
* reformat examples to bullet points
* fix formatting
* Add back Detailed Behavior, Support and compatibility
* Adjust formatting issues
* revised based on feedback from Steve
* complete sentence rewrite
When the namespace name only contains number, such as "10", the pod can't be created in this kind of namespace, the pod will be put in default namespace.
1. fix unreachable federated resources links
2. federation proposal doc has been relocated, so i fix this link
3. make federation resources supporting cascading deletion clickable
4. make link to `Kubernetes Scaling and Performance Goals` clickable
5. other typo fixes
Former: The namespace name may contain a maximum of 63 alphanumeric characters and dashes (-) , can not contain capital letters.
Now: The namespace name may contain a maximum of 63 alphanumeric characters and dashes (-) but can not contain capital letters.
1. Namespace can not contain capital letter.
2. For service, internal endpoints for cluster connections and external endpoints for external users. Here, it lost "external".
- Proposing a different way to run curl without proxy, without touching current environment
- There's a formatting problem and the whole thing is being displayed in a single line
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
Revert "Updated description for kubeadm init --kubernetes-version"
Updated description for kubeadm init --kubernetes-version
Remove details about where authenticator is implemented
replace petset with statefulsets
Updated result of command
replace argumment with argument
Highlight some keyworks in garbage-collection.md.
Fixed typos in persistent volume index.md
Remove reference to port-forward to services
add an example
fix typo
Fix typo in concepts
Parallel Jobs with a *work queue*:
Add more options for self-registration.
dedent yaml code blocks
Add kubelet eviction in GC doc (#2484)
It not necessary to mention where the functions are implemented in
document. Further more, the directories recorded here is out of date.
Now they are in:
staging/src/k8s.io/apiserver/plugin/pkg/authenticator/...
Actually according to the command in example:
kubectl create secret generic ssh-key-secret --from-file=ssh-privatekey=/path/to/.ssh/id_rsa --from-file=ssh-publickey=/path/to/.ssh/id_rsa.pub
The keys will be available with names ssh-publickey and ssh-privatekey.
* 'master' of https://github.com/kubernetes/kubernetes.github.io: (22 commits)
Revert "Document new optional support for ConfigMap and Secret"
Revert "mend"
modify one word
fix typo
Fix typos in running zookeeper article
Add note about moved content. (#2563)
Move Guide topic to Tasks: Downward API (#2439)
modify typora
fix etcd disaster-recovery hyperlink
replace kubernetes.d with kubelet.d
remove its name from file content
Let's put kubectl in ~/bin.
Move Guide toic to Tasks: kubectl exec.
Fix travis and add comments
Move Pod Lifecycle to Concepts. (#2420)
Update deployment completeness documentation
rollback PR #2522
kubectl_apply.md-change it for label key
Update the links of Deployment User Guide
#2534 mark openstack-heat as standalone-salt-conf
...
# Conflicts:
# docs/user-guide/configmap/index.md
When I test this command, if the configmap has a label, it just delete the configmaps which has the same label key and that are not in the file.
kubectl apply --prune -f manifest.yaml --all --prune-whitelist=core/v1/ConfigMap
So I advise change the description like this:
"Apply the configuration in manifest.yaml and delete all the other configmaps with the same label key that are not in the file."
The file 'blob/master/docs/devel/api-conventions.md' has moved to
'community/blob/master/contributors/devel/api-conventions.md'
Updates the links associated with these file.
The key-value "optional:true" doesn't work in 1.5.2 yet.
So should we add a note here? "The key-value "optional:true" will be work after kubernetes 1.5.2."
* 'master' of https://github.com/kubernetes/kubernetes.github.io:
Fix travis.yml
re: issue #2034; fix docker image link (#2532)
re: issue #1671; update to direct link
Update cheatsheet for multi-container handling
add "--show-all" to kubectl get pods
Fix broken/outdated links in the ingress.md file
column READY is missed
fix Kubenetes typo
Update overview.md
Update pod.md
Update multiple-schedulers.md
Fix the standard storageClass for GCE
fix typo
fix typo
Update index.md
doc(kubeadm.md) - change base64 decode option to '--decode'
Update links to ingress repository
Updated dead links
Fix unmatched closing paren
Some of the serial numbers of the ordered list in the "Static pod creation" section are incorrect because items in the list are segmented by code blocks. I think this can be solved in at least the following ways:
1.Remove the ordered list style and just use plain text each beginning with "1", "2"，...,or "step 1", "step 2"，... (My modofication adopts this one)
2.Replace the ordered list with an unordered list in which each item beginning with "step 1", "step 2"，...
3.Use HTML tags, such as <ol>,<li> to give the lists involved
Are there any other better ways for this problem? I would be appreciated to know.
So that it is above "Accessing the Cluster" article which describes
more advanced topics and does not look coherent when it is read
linearly.
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
Increase the font-size and line-height CSS
properties for the paragraph and list items
within the documentation body content.
Adjusting these properties will make the
information a little easier to read.
* Initial commit for Init Containers migration to Concepts section
* Add 1.5 beta include file
* Change include to renamed user-guide-content-moved.md file
* Fix Concepts/KO/Pods ToC
* reformat examples to bullet points
* fix formatting
* Add back Detailed Behavior, Support and compatibility
* Adjust formatting issues
* revised based on feedback from Steve
* complete sentence rewrite
When the namespace name only contains number, such as "10", the pod can't be created in this kind of namespace, the pod will be put in default namespace.
1. fix unreachable federated resources links
2. federation proposal doc has been relocated, so i fix this link
3. make federation resources supporting cascading deletion clickable
4. make link to `Kubernetes Scaling and Performance Goals` clickable
5. other typo fixes
Former: The namespace name may contain a maximum of 63 alphanumeric characters and dashes (-) , can not contain capital letters.
Now: The namespace name may contain a maximum of 63 alphanumeric characters and dashes (-) but can not contain capital letters.
1. Namespace can not contain capital letter.
2. For service, internal endpoints for cluster connections and external endpoints for external users. Here, it lost "external".
Netlify will redirect with a 301 status to the right places without the
need of a custom javascript file.
The current redirects.js is not removed so production can keep working
as it is for now.
Signed-off-by: David Calavera <david.calavera@gmail.com>
* adding Operational Considerations section
modified: docs/getting-started-guides/ubuntu/logging.md
* Moving logging section from operational-considerations.md to logging.md
renamed: docs/getting-started-guides/ubuntu/operations.md -> docs/getting-started-guides/ubuntu/operational-considerations.md
* mapping to the proposed name
* ditched CDK naming in favor of k8s or cluster
* add whitelines for titles
Beginners don't know the details for troubleshooting, better instruction will save time for beginners to trouble shoot logs in minikube complaining gcr.io not reachable and etc.
I installed gcr.io/google_containers/kubernetes-dashboard-amd64:v1.5.0. When I deploy a containerized app through dashboad ui, the appname can be "dxltest1" . The "dxltest1" can be deployed successfully. so the appname can be end with a number.
The data dir should not be at the root of the volume, because many
volume types create files or directories there automatically.
The database initialization script requires the data dir to be empty,
and we shouldn't try to guess which files may exist.
In particular, by retaining lost+found, it also becomes possible
to recover files that end up there.
This page previously included instructions to use curl to download and install
Kubectl via http, rather than with https. This exposed the end user to
man-in-the-middle attacks.
Additionally, the instructions given here are slightly different from the
authoritative page at https://kubernetes.io/docs/getting-started-guides/kubectl/
- which covers useful things like getting the latest release and setting up tab
autocompletion.
Rather than just change 'http' to 'https' in the URLs here, I've updated the
minikube setup page to include a reference to the kubectl setup page.
"Action use IaaS providers reliable storage (e.g. GCE PD or AWS EBS volume) for VMs with apiserver+etcd" did not follow the same format as other actions in this section.
1. Update the script to skip checking a whole folder
2. Skip checking auto-generated kubectl docs since they already work without title
3. Remove some skipped files in skip_toc_check.txt since we can now skip a folder
- This supercedes PR #1770
- This breaks up the section from one huge installation page into:
- A new index page.
- New support grid with commercial and community support options.
- Move to lifecycle-based pages based on operational tasks.
- Add support for local deployments via LXD.
- Added screenshots to images/docs/ubuntu
- Add backup page.
- Add decommissioning page.
- Add a glossary of terms page.
- Rewritten installation page.
- Add logging page.
- Add monitoring page.
- Add networking page, flannel only for now, calico in progress.
- Add a scaling page.
- Add a security page.
- Add a storage page.
- Add a troubleshooting page.
- Add an upgrade page.
- Add a cluster validation page.
- Add new ubuntu content to the index page.
- Add Ubuntu to _data TOC.
- Add warning about choosing ipv6 with LXD, thanks Ed Baluf.
- Template-ize all the pages per jaredb's review.
* Example of `/etc/sysconfig/flanneld` is not valid
Configuration keys were different, I got those errors when followed steps from docs:
```
[ailyin@elite ~]$ systemctl status flanneld.service
● flanneld.service - Flanneld overlay address etcd agent
Loaded: loaded (/usr/lib/systemd/system/flanneld.service; enabled; vendor preset: disabled)
Active: activating (start) since Wed 2017-01-04 19:00:21 EST; 34s ago
Main PID: 4668 (flanneld)
Memory: 3.5M
CGroup: /system.slice/flanneld.service
└─4668 /usr/bin/flanneld -etcd-endpoints= -etcd-prefix=
Jan 04 19:00:46 elite.dev flanneld[4668]: E0104 19:00:46.395562 04668 network.go:53] Failed to retrieve network config: client: etcd cluster is unavailable or misconfigured
Jan 04 19:00:47 elite.dev flanneld[4668]: E0104 19:00:47.395788 04668 network.go:53] Failed to retrieve network config: client: etcd cluster is unavailable or misconfigured
Jan 04 19:00:48 elite.dev flanneld[4668]: E0104 19:00:48.395990 04668 network.go:53] Failed to retrieve network config: client: etcd cluster is unavailable or misconfigured
Jan 04 19:00:49 elite.dev flanneld[4668]: E0104 19:00:49.396141 04668 network.go:53] Failed to retrieve network config: client: etcd cluster is unavailable or misconfigured
Jan 04 19:00:50 elite.dev flanneld[4668]: E0104 19:00:50.396306 04668 network.go:53] Failed to retrieve network config: client: etcd cluster is unavailable or misconfigured
Jan 04 19:00:51 elite.dev flanneld[4668]: E0104 19:00:51.396451 04668 network.go:53] Failed to retrieve network config: client: etcd cluster is unavailable or misconfigured
Jan 04 19:00:52 elite.dev flanneld[4668]: E0104 19:00:52.396572 04668 network.go:53] Failed to retrieve network config: client: etcd cluster is unavailable or misconfigured
Jan 04 19:00:53 elite.dev flanneld[4668]: E0104 19:00:53.396701 04668 network.go:53] Failed to retrieve network config: client: etcd cluster is unavailable or misconfigured
Jan 04 19:00:54 elite.dev flanneld[4668]: E0104 19:00:54.396855 04668 network.go:53] Failed to retrieve network config: client: etcd cluster is unavailable or misconfigured
Jan 04 19:00:55 elite.dev flanneld[4668]: E0104 19:00:55.396992 04668 network.go:53] Failed to retrieve network config: client: etcd cluster is unavailable or misconfigured
```
* Updated Flanneld configuration example for node (same as for master);
Create additional files for Kompose documentation including
architecture, development, a more extensive index and a user guide.
This also bumps Kompose up to the top on tools page to be symmetrical to
the what's listed on the side navbar.
I have assigned myself to each doc in order to get updates / any
questions regarding the updating of documentation.
The way that the document currently flows and how we typically perceive credentials, we usually set our username first followed by the password.
Seeing the configuration first set password then username seems counter-intuitive. There is nothing wrong with the docs, it is just clearer to view username=>password.
* WIP: New Docs Landing Page and ToC Organization.
* More changes to Landing Page/TOC nav.
* Debugging fixes to TOC.
* More debugging and wording changes to site nav and TOCs.
* More debugging fixes for site nav and TOC.
* Yet more debugging fixes to site nav and TOC.
* Initial edit to Docs landing page.
* Debug edit.
* Attempt at removing left-nav TOC from Docs Landing Page.
* Incremental fix for docs landing page.
* More incremental layout fixes for landing page.
* Incremental change.
* CSS fixes; fills out landing page with additional information.
* More layout fixes.
* More layout and text edits for the docs landing page.
* More tinkering with CSS and layouts; fixed a hanging <code> tag.
* Last tweak for now.
* Modified text in response to review comments.
* Removed Samples and Contribution Evangelism from docs landing page.
* Removed intro text on Docs landing page.
* Reorganized landing page to drop weird CSS formatting and reorganize "Quickstarts" into setup guidance; separated out tutorial. Corrected spelling error in main page header.
* Fixed links to major subsections (Guides/Tutorials/Tasks/Concepts).
Clarified /current/ usage of each--subject to change as Guides get deprecated and Tutorials get filled out.
Changed description for kubeadm/kops links to mention that they are newer/experimental ways to set up Kubernetes.
* Corrected Guides link.
The headless service spec example requires the attribute clusterIP: None. Without this, the service that is created is not headless and the two example pods will not be able to nslookup one another.
In Managing the ZooKeeper Process : Handling Process Failure : paragraph 4 :
"The command used as the container's entry point has PID 1, and the the ZooKeeper process, a child of the entry point, has PID 23." =>
"The command used as the container's entry point has PID 1, and the ZooKeeper process, a child of the entry point, has PID 23."
1. Make plural nouns into same style. See it is `Services` in first sentence and `Pods` in the line 286 , but others are `Service`s and `Pod`s .So change style for these plural nouns for consistency and beauty.
2. Fix minor grammar.
Provide valid --cloud-providers, vagrant and openshift were listed but is not actually a valid cloud provider in this context in the current code base while a number of other valid options were omitted including azure, cloudstack, openstack, photon and vsphere.
The original one is: "kops update cluster useast1.dev.awsdata.com --yes"
However, the previous example used useast1.dev.example.com to create configuration file.
So, the "awsdata" should be changed into example.
This commit attempts to make more clear the differences between service
types by ensuring definitions are consistent and concise. It also aims
to fix a few typos and grammatical issues.
OVN is an opensource network virtualization solution
developed by the Open vSwitch community. It lets one
create logical switches, logical routers, stateful
ACLs, load-balancers etc to build different virtual
networking topologies. The project has a specific
Kubernetes plugin and documentation at
https://github.com/openvswitch/ovn-kubernetes.
* Initial commit
* Adds section for cleanup
Corrects some spelling errors
decapitalizes liveness and readiness
* Adds test for zookeeper example
* Address enisoc review
* Remove space between shell and raw annotation
* Remove extranous inserted text
* Remove fencing statement
* Modify sentence for grammer
* refocus to zookeeper with some loss of generality
* Spelling, Grammar, DNS link
* update to address foxish comments
This commit moves the site to use the official Jekyll SEO Tag
plugin (https://github.com/jekyll/jekyll-seo-tag) to generate the
search-engine meta in the HEAD of each page. The title and canonical
URL output should be largely the same as before, but with additional
metadata, such as JSON-LD (for richer indexing), Twitter card
metadat, etc.
Like the other plugins, this should largely work out-of-the-box,
with no additional day-to-day configuration, but is customizable
where desired.
Starting with Jekyll v3.3, Jekyll ships with `relative_url` and
`absolute_url` filters. Rather than manual concatenating strings,
we can rely on Jekyll to handle the logic in Ruby land, which
takes into account the site's URL (locally and in production), and
handles things like double "/"s.
Remove baseurl from the config for three reasons:
1. It's not used anyplace within the site
2. The site’s base URL is only to be used when the resulting site
lives at a subpath of the domain. Otherwise, the subpath should be
nil, not /.
3. When the Pages Gem is loaded as part of the :jekyll_plugins
group, baseurl and url are set automatically.
Although the title already has a "name" entry, this commit replicates
the name as "title", and adds a "description" entry, both of which
are shared across common, official Jekyll plugins like jekyll-feed
and jekyll-sitemap.
This allows the feed and sitemap to properly output the title and
description in various places.
Jekyll Sitemap (https://github.com/jekyll/jekyll-sitemap) is an
official Jekyll plugin, which should serve as a drop-in replacement
for the existing sitemap.xml. The resulting sitemap should be largely
similar to the existing sitemap, but with a shared, battle-tested
template that accounts for all sorts of edge cases, handles collections
and static files, etc.
Jekyll Feed (https://github.com/jekyll/jekyll-feed) is an official
Jekyll plugin which should replicate the existing feed nearly
identically, but with a shared, battle-tested template that
accounts for all sorts of edge cases like relative links in feed
entries.
It should be a drop in replacement and "just work" without any
additional configuration.
The GitHub Pages Gem (https://github.com/github/pages-gem)
is a meta-gem that does two things:
1. It locks dependencies to the same version used by GitHub Pages
ensuring that when you build the site locally, you're using the same
version of plugins and other dependencies used in production.
2. When loaded as part of the :jekyll_plugins group, it allows
the Gem to set certain configuration defaults and overrides
(such as activating default plugins) to ensure, once again
that your local preview replicates the production version
as closely as possible.
Things looked odd due to the padding on code blocks; they sat 2px above the text surrounding them. This PR will fix that by aligning inline code blocks, and the text surrounding them, on their baseline.
There are too many horizontal lines in the documentation, which makes knowing which things are headings (h2) and which are sub-headings (h3) almost impossible.
I've tidied up the weights a little to make it more obvious and trimmed some excess whitespace. Ultimately I think a typographer's eye on the single choice of font-face (perhaps a serif for headings?) would be worthwhile.
`-d` is used for the Linux version of the command but in the Mac/BSD version they use `-D`.
Using `--decode` we are sure that the flag is compatible with both.
Although the Fedora install docs are under the "Bare Metal"
section in the docs, the instructions provided work fine
for Fedora installs in virtual machines
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
The Fedora multi-node doc need to tell users to install
flannel, since previous setup won't have brought it in.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
The install of kubernetes pulls in docker, which has a direct
dependancy on iptables. So there is no need to tell people to
yum install iptables manually.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
The /var/run/kubernetes directory is already created by
installation of the kubernetes RPM with correct user
and group ownership and permissions.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
The docs still refer to etcd using port 4001, but in all
currently released Fedora versions it will be using 2379
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
The KUBE_LOGTOSTDERR, KUBE_LOG_LEVEL and KUBE_ALLOW_PRIV
settings will already have correct values out of the box,
so no need to tell people to set them.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
There is no reason to tell people to enable updates-testing
repo for Fedora by default. The latest stable packages are
already in the main repos and updates-testing should only be
used by people wishing to test & report quality of pre-released
software, not general Kubnetes users.
Also remove the link to Koji builds - any Koji build which
is working well enough to user will be submitted as an update.
Telling users to install packages straight from Koji will
lead to them using potentially unstable / buggy builds.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
dnf has replaced yum as the standard package install tool
in all versions of Fedora that are currently supported.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
The content is in
docs/tutorials/stateful-applications/basic-stateful-set.md
The example application, named web, is in
docs/tutorials/stateful-applications/web.yaml
The tutorials TOC and index have been udpated to include a Stateful
Applications section of which this example is a subsection
Removes deprecation from comment wrt PetSets
Creates separate section in concepts/index.md for Controllers
Fixes grammer "an integer"
Removes claim about persistent storage being auto-deleted
Clarifies stability
Adds call out tick around attributes
The two affected lines:
a) Were both represented entirely in a code block due to indentation,
which does not appear to be the intent.
b) Look like a mess if you don't know they are formatted as a URL query
string.
This makes the image a lot smaller and it's using an official image
as the base to make sure we get security updates etc.
The image size went from:
```
REPOSITORY SIZE
gcr.io/google-samples/k8sdocs 837 MB
```
To:
```
REPOSITORY SIZE
gcr.io/google-samples/k8sdocs 227 MB
```
Signed-off-by: Jess Frazelle <acidburn@google.com>
This is the new disclosure process as discussed here: https://github.com/kubernetes/kubernetes/issues/35462
This relies on a doc to be merged into docs/devel/security-release-process.md but this doc can be reviewed in parallel.
You can find a draft of the content of that doc on #35462
Create an easy to remember and locate URL for security disclosure
process. This URL will need to be placed in lots of templates and tools
so make it easy.
The content is in
docs/tutorials/stateful-applications/basic-stateful-set.md
The example application, named web, is in
docs/tutorials/stateful-applications/web.yaml
The tutorials TOC and index have been udpated to include a Stateful
Applications section of which this example is a subsection
For kubenet, users should run kubelet with argument
--non-masquerade-cidr, or pods may have problem when access
"10.0.0.0/8" cidr. Also, if --pod-cidr is set outside the scope
of --non-masquerade-cidr, node will do ip masquerade for ingress
packets, which is not excepted.
moved text under command and changed wording based on some feedback. With regards to mentioning cloud providers. I think a lot of this documentation in general assumes a public cloud like Google so it may be worthwhile to mention a specific private cloud where this isn't implemented.
Removes deprecation from comment wrt PetSets
Creates separate section in concepts/index.md for Controllers
Fixes grammer "an integer"
Removes claim about persistent storage being auto-deleted
Clarifies stability
Adds call out tick around attributes
In a corporate environment you need to pass proxy information, and just setting the appropriate environment variables does not work.
The code snippet here works for me
@@ -17,7 +17,7 @@ The [Kubernetes SIG Docs Discussion Group](https://groups.google.com/forum/#!for
### Style Guides and Templates
Before submitting a pull request to create new content, please review the [Kubernetes.io style guide](http://kubernetes.io/docs/contribute/style-guide/) and follow the [instructions for using page templates](http://kubernetes.io/docs/contribute/page-templates/).
Before submitting a pull request to create new content, please review the [Kubernetes.io style guide](http://kubernetes.io/docs/home/contribute/style-guide/) and follow the [instructions for using page templates](http://kubernetes.io/docs/home/contribute/page-templates/).
## Contributing to Documentation
@@ -33,4 +33,4 @@ Note that code issues should be filed against the main kubernetes repository, wh
### Submitting Documentation Pull Requests
If you’re fixing an issue in the existing documentation, you should submit a PR against the master branch. Follow [these instructions to create a documentation pull request against the kubernetes.io repository](http://kubernetes.io/docs/contribute/create-pull-request/).
If you're fixing an issue in the existing documentation, you should submit a PR against the master branch. Follow [these instructions to create a documentation pull request against the kubernetes.io repository](http://kubernetes.io/docs/home/contribute/create-pull-request/).
## Instructions for Contributing to the Docs/Website
## Instructions for Contributing to the Kubernetes Documentation
Welcome! We are very pleased you want to contribute to the documentation and/or website for Kubernetes.
Welcome! We are very pleased you want to contribute to the Kubernetes documentation.
You can click the "Fork" button in the upper-right area of the screen to create a copy of our site on your GitHub account called a "fork." Make any changes you want in your fork, and when you are ready to send those changes to us, go to the index page for your fork and click "New Pull Request" to let us know about it.
You can click the **Fork** button in the upper-right area of the screen to create a copy of this repository in your GitHub account called a *fork*. Make any changes you want in your fork, and when you are ready to send those changes to us, go to your fork and create a new pull request to let us know about it.
For more information about contributing to the Kubernetes documentation, see:
* [Creating a Documentation Pull Request](http://kubernetes.io/docs/contribute/create-pull-request/)
* [Writing a New Topic](http://kubernetes.io/docs/contribute/write-new-topic/)
* [Staging Your Documentation Changes](http://kubernetes.io/docs/contribute/stage-documentation-changes/)
When you create a pull request (either against master or the upcoming release), your changes are staged in a custom subdomain on Netlify so that you can see your changes in rendered form before the PR is merged. You can use this to verify that everything is correct before the PR gets merged. To view your changes:
- Scroll down to the PR's list of Automated Checks
- Click "Show All Checks"
- Look for "deploy/netlify"; you'll see "Deploy Preview Ready!" if staging was successful
- Click "Details" to bring up the staged site and navigate to your changes
## Branch structure and staging
The current version of the website is served out of the `master` branch. To make changes to the live docs, such as bug fixes, broken links, typos, etc, **target your pull request to the master branch**
The `release-1.x` branch stores changes for **upcoming releases of Kubernetes**. For example, the `release-1.5` branch has changes for the 1.5 release. These changes target branches (and *not* master) to avoid publishing documentation updates prior to the release for which they're relevant. If you have a change for an upcoming release of Kubernetes, **target your pull request to the appropriate release branch**.
The staging site for the next upcoming Kubernetes release is here: [http://kubernetes-io-vnext-staging.netlify.com/](http://kubernetes-io-vnext-staging.netlify.com/). The staging site reflects the current state of what's been merged in the release branch, or in other words, what the docs will look like for the next upcoming release. It's automatically updated as new PRs get merged.
## Staging the site locally (using Docker)
Don't like installing stuff? Download and run a local staging server with a single `docker run` command.
docker run -ti --rm -v "$PWD":/k8sdocs -p 4000:4000 gcr.io/google-samples/k8sdocs:1.0
Then visit [http://localhost:4000](http://localhost:4000) to see our site. Any changes you make on your local machine will be automatically staged.
If you're interested you can view [the Dockerfile for this image](https://github.com/kubernetes/kubernetes.github.io/blob/master/staging-container/Dockerfile).
## Staging the site locally (from scratch setup)
The below commands to setup your environment for running GitHub pages locally. Then, any edits you make will be viewable
on a lightweight webserver that runs on your local machine.
This will typically be the fastest way (by far) to iterate on docs changes and see them staged, once you get this set up, but it does involve several install steps that take awhile to complete, and makes system-wide modifications.
Install Ruby 2.2 or higher. If you're on Linux, run these commands:
apt-get install software-properties-common
apt-add-repository ppa:brightbox/ruby-ng
apt-get install ruby2.2
apt-get install ruby2.2-dev
* If you're on a Mac, follow [these instructions](https://gorails.com/setup/osx/).
* If you're on a Windows machine you can use the [Ruby Installer](http://rubyinstaller.org/downloads/). During the installation make sure to check the option for *Add Ruby executables to your PATH*.
The remainder of the steps should work the same across operating systems.
To confirm you've installed Ruby correctly, at the command prompt run `gem --version` and you should get a response with your version number. Likewise you can confirm you have Git installed properly by running `git --version`, which will respond with your version of Git.
Install the GitHub Pages package, which includes Jekyll:
Make any changes you want. Then, to see your changes locally:
cd kubernetes.github.io
jekyll serve
Your copy of the site will then be viewable at: [http://localhost:4000](http://localhost:4000)
(or wherever Jekyll tells you).
## GitHub help
If you're a bit rusty with git/GitHub, you might want to read
[this](http://readwrite.com/2013/10/02/github-for-beginners-part-2) for a refresher.
## Common Tasks
### Edit Page Titles or Change the Left Navigation
Edit the yaml files in `/_data/` for the Guides, Reference, Samples, or Support areas.
You may have to exit and `jekyll clean` before restarting the `jekyll serve` to
get changes to files in `/_data/` to show up.
### Add Images
Put the new image in `/images/docs/` if it's for the documentation, and just `/images/` if it's for the website.
**For diagrams, we greatly prefer SVG files!**
### Include code from another file
To include a file that is hosted on this GitHub repo, insert this code:
<pre>{% include code.html language="<LEXERVALUE>" file="<RELATIVEPATH>" ghlink="<PATHFROMROOT>" %}</pre>
*`LEXERVALUE`: The language in which the file was written; must be [a value supported by Rouge](https://github.com/jneen/rouge/wiki/list-of-supported-languages-and-lexers).
*`RELATIVEPATH`: The path to the file you're including, relative to the current file.
*`PATHFROMROOT`: The path to the file relative to root, e.g. `/docs/admin/foo.yaml`
To include a file that is hosted in the external, main Kubernetes repo, make sure it's added to [/update-imported-docs.sh](https://github.com/kubernetes/kubernetes.github.io/blob/master/update-imported-docs.sh), and run it so that the file gets downloaded, then enter:
<pre>{% include code.html language="<LEXERVALUE>" file="<RELATIVEPATH>" k8slink="<PATHFROMK8SROOT>" %}</pre>
*`PATHFROMK8SROOT`: The path to the file relative to the root of [the Kubernetes repo](https://github.com/kubernetes/kubernetes/tree/release-1.2), e.g. `/examples/rbd/foo.yaml`
## Using tabs for multi-language examples
By specifying some inline CSV in a varable called `tabspec`, you can include a file
called `tabs.html` that generates tabs showing code examples in multiple langauges.
In English, this would read: "Create a set of tabs with the alias `servicesample`,
and have tabs visually labeled "JSON" and "YAML" that use `json` and `yaml` Rouge syntax highlighting, which display the contents of
`service-sample.{extension}` on the page, and link to the file in GitHub at (full path)."
Example file: [Pods: Multi-Container](http://kubernetes.io/docs/user-guide/pods/multi-container/).
## Use a global variable
The `/_config.yml` file defines some useful variables you can use when editing docs.
*`page.githubbranch`: The name of the GitHub branch on the Kubernetes repo that is associated with this branch of the docs. e.g. `release-1.2`
*`page.version` The version of Kubernetes associated with this branch of the docs. e.g. `v1.2`
*`page.docsbranch` The name of the GitHub branch on the Docs/Website repo that you are currently using. e.g. `release-1.1` or `master`
This keeps the docs you're editing aligned with the Kubernetes version you're talking about. For example, if you define a link like so, you'll never have to worry about it going stale in future doc branches:
<pre>View the README [here](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/README.md).</pre>
section on "Docker images" from the Kubernetes repository.
## Partners
Kubernetes partners refers to the companies who contribute to the Kubernetes core codebase, extend their platform to support Kubernetes or provide managed services to users centered around the Kubernetes platform. Partners can get their services and offerings added to the [partner page](https://k8s.io/partners) by completing and submitting the [partner request form](https://goo.gl/qcSnZF). Once the information and assets are verified, the partner product/services will be listed in the partner page. This would typically take 7-10 days.
* [Contributing to the Kubernetes Documentation](http://kubernetes.io/editdocs/)
* [Creating a Documentation Pull Request](http://kubernetes.io/docs/home/contribute/create-pull-request/)
* [Writing a New Topic](http://kubernetes.io/docs/home/contribute/write-new-topic/)
* [Staging Your Documentation Changes](http://kubernetes.io/docs/home/contribute/stage-documentation-changes/)
This feature is currently in a *beta* state, meaning:
* The version names contain beta (e.g. v2beta3).
* Code is well tested. Enabling the feature is considered safe. Enabled by default.
* Support for the overall feature will not be dropped, though details may change.
* The schema and/or semantics of objects may change in incompatible ways in a subsequent beta or stable release. When this happens, we will provide instructions for migrating to the next version. This may require deleting, editing, and re-creating API objects. The editing process may require some thought. This may require downtime for applications that rely on the feature.
* Recommended for only non-business-critical uses because of potential for incompatible changes in subsequent releases. If you have multiple clusters that can be upgraded independently, you may be able to relax this restriction.
* **Please do try our beta features and give feedback on them! After they exit beta, it may not be practical for us to make more changes.**
<!-- Commenting out AnswerDash for now; we need to work on our list of questions/answers/design first
<!-- Start of AnswerDash script <script>var AnswerDash;!function(e,t,n,s,a){if(!t.getElementById(s)){var i,r=t.createElement(n),c=t.getElementsByTagName(n)[0];e[a]||(i=e[a]=function(){i.__oninit.push(arguments)},i.__oninit=[]),r.type="text/javascript",r.async=!0,r.src="https://p1.answerdash.com/answerdash.min.js?siteid=756",r.setAttribute("id",s),c.parentNode.insertBefore(r,c)}}(window,document,"script","answerdash-script","AnswerDash");</script> <!-- End of AnswerDash script -->
<p>Ready to get your hands dirty? Build a simple Kubernetes cluster that runs "Hello World" for Node.js.</p>
</div>
<divclass="nav-box">
<h3><ahref="/docs/">Documentation</a></h3>
<p>Learn how to use Kubernetes with the use of walkthroughs, samples, and reference documentation. You can even <ahref="/editdocs/"data-auto-burger-exclude>help contribute to the docs</a>!</p>
</div>
<divclass="nav-box">
<h3><ahref="/community/">Community</a></h3>
<p>If you need help, you can connect with other Kubernetes users and the Kubernetes authors, attend community events, and watch video presentations from around the web.</p>
<p>Ready to get your hands dirty? Build a simple Kubernetes cluster that runs "Hello World" for Node.js.</p>
</div>
<divclass="nav-box">
<h3><ahref="/docs/home/">Documentation</a></h3>
<p>Learn how to use Kubernetes with the use of walkthroughs, samples, and reference documentation. You can even <ahref="/editdocs/"data-auto-burger-exclude>help contribute to the docs</a>!</p>
</div>
<divclass="nav-box">
<h3><ahref="/community/">Community</a></h3>
<p>If you need help, you can connect with other Kubernetes users and the Kubernetes authors, attend community events, and watch video presentations from around the web.</p>
blurb:'ETA helps companies architect, implement, and manage scalable applications using Kubernetes on on public or private cloud.'
},
{
type:0,
name:'CloudPlex.io',
logo:'cloudplex',
link:'http://www.cloudplex.io',
blurb:'CloudPlex enables operations teams to visually deploy, orchestrate, manage, and monitor infrastructure, applications, and services in public or private cloud.'
},
{
type:1,
name:'Kumina',
logo:'kumina',
link:'https://www.kumina.nl/managed_kubernetes',
blurb:'Kumina creates Kubernetes solutions on your choice of infrastructure with around-the-clock management and unlimited support.'
<p>As of March 14, 2017, the Kubernetes SIG-Docs-Maintainers group have begun migration of the User Guide content as announced previously to the <a href="https://git.k8s.io/community/sig-docs">SIG Docs community</a> through the <a href="https://groups.google.com/forum/#!forum/kubernetes-sig-docs">kubernetes-sig-docs</a> group and <a href="https://kubernetes.slack.com/messages/sig-docs/">kubernetes.slack.com #sig-docs</a> channel.</p>
<p>The user guides within this section are being refactored into topics within Tutorials, Tasks, and Concepts. Anything that has been moved will have a notice placed in its previous location as well as a link to its new location. The reorganization implements a new table of contents and should improve the documentation's findability and readability for a wider range of audiences.</p>
<p>For any questions, please contact: <a href="mailto:kubernetes-sig-docs@googlegroups.com">kubernetes-sig-docs@googlegroups.com</a></p>
<p>FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p>
<p>FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p></td>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p></td>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">Host is the fully qualified domain name of a network host, as defined by RFC 3986. Note the following deviations from the "host" part of the URI as defined in the RFC: 1. IPs are not allowed. Currently an IngressRuleValue can only apply to the<br>
IP in the Spec of the parent Ingress.<br>
IP in the Spec of the parent Ingress.<br>
2. The <code>:</code> delimiter is not respected because ports are not allowed.<br>
Currently the port of an Ingress is implicitly :80 for http and<br>
:443 for https.<br>
Currently the port of an Ingress is implicitly :80 for http and<br>
:443 for https.<br>
Both these may change in the future. Incoming requests are matched against the host before the IngressRuleValue. If the host is unspecified, the Ingress routes all traffic based on the specified IngressRuleValue.</p></td>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">Path is a extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">Path is an extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
<p>FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p>
<p>FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p></td>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p></td>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p></td>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p></td>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">Host is the fully qualified domain name of a network host, as defined by RFC 3986. Note the following deviations from the "host" part of the URI as defined in the RFC: 1. IPs are not allowed. Currently an IngressRuleValue can only apply to the<br>
IP in the Spec of the parent Ingress.<br>
IP in the Spec of the parent Ingress.<br>
2. The <code>:</code> delimiter is not respected because ports are not allowed.<br>
Currently the port of an Ingress is implicitly :80 for http and<br>
:443 for https.<br>
Currently the port of an Ingress is implicitly :80 for http and<br>
:443 for https.<br>
Both these may change in the future. Incoming requests are matched against the host before the IngressRuleValue. If the host is unspecified, the Ingress routes all traffic based on the specified IngressRuleValue.</p></td>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">Path is an extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
<tdclass="tableblock halign-left valign-top"><pclass="tableblock">Path is an extended POSIX regex as defined by IEEE Std 1003.1, (i.e. this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
{% for thistoc in site.data.globals.tocs %}{% if foundTOC %}{% break %}{% else %}{% assign tree = site.data[thistoc].toc %}{% include tocsearch.html %}{% endif %}{% endfor %}
{% for override in site.data.overrides.overrides %}{% if page.path contains override.path %}{% assign notitle = "true" %}{% endif %}{% endfor %}
<!-- Commenting out AnswerDash for now; we need to work on our list of questions/answers/design first
<!-- Start of AnswerDash script <script>var AnswerDash;!function(e,t,n,s,a){if(!t.getElementById(s)){var i,r=t.createElement(n),c=t.getElementsByTagName(n)[0];e[a]||(i=e[a]=function(){i.__oninit.push(arguments)},i.__oninit=[]),r.type="text/javascript",r.async=!0,r.src="https://p1.answerdash.com/answerdash.min.js?siteid=756",r.setAttribute("id",s),c.parentNode.insertBefore(r,c)}}(window,document,"script","answerdash-script","AnswerDash");</script> <!-- End of AnswerDash script -->
<pclass="quote">“With Kubernetes, we’re simplifying our environment and making it easier for developers to build the tools that make wikis run better.”</p>
<pclass="quote">"With Kubernetes, we're simplifying our environment and making it easier for developers to build the tools that make wikis run better."</p>
<atarget="_blank"href="https://docs.google.com/a/google.com/forms/d/e/1FAIpQLScuI7Ye3VQHQTwBASrgkjQDSS5TP0g3AXfFhwSM9YpHgxRKFA/viewform"class="tell-your-story"><imgsrc="/images/case_studies/story.png"alt="Tell your story"></a>
</div>
</main>
<main>
<h3>Kubernetes Users</h3>
<divid="usersGrid">
<atarget="_blank"href="https://www.youtube.com/watch?v=P5qfyv_zGcU"><imgsrc="/images/case_studies/nyt.png"alt="New York Times"></a>
<atarget="_blank"href="https://docs.google.com/a/google.com/forms/d/e/1FAIpQLScuI7Ye3VQHQTwBASrgkjQDSS5TP0g3AXfFhwSM9YpHgxRKFA/viewform"class="tell-your-story"><imgsrc="/images/case_studies/story.png"alt="Tell your story"></a>
<h3id="caseStudyTitle">Using Kubernetes to reinvent the world’s largest educational company</h3>
<p>
Pearson, the world’s education company, serving 75 million learners worldwide, set a goal to more than double that number to 200 million by 2025. A key part of this growth is in digital learning experiences, and that requires an infrastructure platform that is able to scale quickly and deliver products to market faster. So Pearson’s Cloud Technology team chose Kubernetes to help build a platform to meet the business requirements.</p>
“To transform our infrastructure, we had to think beyond simply enabling automated provisioning, we realized we had to build a platform that would allow Pearson developers to build manage and deploy applications in a completely different way. We chose Kubernetes because of its flexibility, ease of management and the way it would improve our engineers’ productivity.” </p>
<pclass="attrib">— Chris Jackson, Director for Cloud Product Engineering, Pearson</p>
</div>
</div>
</main>
<main>
<divclass="content">
<h3id="caseStudyTitle">Using Kubernetes to reinvent the world's largest educational company</h3>
<p>
Pearson, the world's education company, serving 75 million learners worldwide, set a goal to more than double that number to 200 million by 2025. A key part of this growth is in digital learning experiences, and that requires an infrastructure platform that is able to scale quickly and deliver products to market faster. So Pearson's Cloud Technology team chose Kubernetes to help build a platform to meet the business requirements.</p>
"To transform our infrastructure, we had to think beyond simply enabling automated provisioning, we realized we had to build a platform that would allow Pearson developers to build manage and deploy applications in a completely different way. We chose Kubernetes because of its flexibility, ease of management and the way it would improve our engineers' productivity." </p>
<pclass="attrib">— Chris Jackson, Director for Cloud Product Engineering, Pearson</p>
</div>
</div>
</main>
</section>
<sectionclass="bullets">
<main>
<divclass="content">
<divclass="bullet">
<h4>Challenges:</h4>
<ul>
<li>Pearson had difficulty in scaling and adapting to the growing online audience. They wanted to build and deliver content primarily over the web.</li>
</ul>
</div>
<divclass="bullet">
<h4>Why Kubernetes:</h4>
<ul>
<li>Kubernetes will allow Pearson’s teams to develop their apps in a consistent manner, saving time and minimizing complexity.</li>
</ul>
</div>
<divclass="bullet">
<h4>Approach:</h4>
<ul>
<li>Build a centralized platform for use across the entire enterprise</li>
<li>Use container technology as the core of the platform</li>
<li>Deploy Kubernetes to manage the platform</li>
</ul>
</div>
<divclass="bullet">
<h4>Results:</h4>
<ul>
<li>Pearson is building an enterprise-wide platform for delivering innovative, web-based educational content. They expect engineers’ productivity to increase by up to 20 percent.</li>
</ul>
</div>
</div>
</main>
<main>
<divclass="content">
<divclass="bullet">
<h4>Challenges:</h4>
<ul>
<li>Pearson had difficulty in scaling and adapting to the growing online audience. They wanted to build and deliver content primarily over the web.</li>
</ul>
</div>
<divclass="bullet">
<h4>Why Kubernetes:</h4>
<ul>
<li>Kubernetes will allow Pearson's teams to develop their apps in a consistent manner, saving time and minimizing complexity.</li>
</ul>
</div>
<divclass="bullet">
<h4>Approach:</h4>
<ul>
<li>Build a centralized platform for use across the entire enterprise</li>
<li>Use container technology as the core of the platform</li>
<li>Deploy Kubernetes to manage the platform</li>
</ul>
</div>
<divclass="bullet">
<h4>Results:</h4>
<ul>
<li>Pearson is building an enterprise-wide platform for delivering innovative, web-based educational content. They expect engineers' productivity to increase by up to 20 percent.</li>
</ul>
</div>
</div>
</main>
</section>
<sectionclass="details">
<main>
<divclass="content">
<h4>Kubernetes powers a comprehensive developer experience</h4>
<p>Pearson wanted to use as much open source technology as possible for the platform given that it provides both technical and commercial benefits over the duration of the project. Jackson says, “Building an infrastructure platform based on open source technology in Pearson was a no-brainer, the sharing of technical challenges and advanced use cases in a community of people with talent far beyond what we could hire independently allows us to innovate at a level we could not reach on our own. Our engineers enjoy returning code to the community and participating in talks, blogs and meetings, it’s a great way for us to allow our team to express themselves and share the pride they have in their work.”</p>
<p>It also wanted to use a container-focused platform. Pearson has 400 development groups and diverse brands with varying business and technical needs. With containers, each brand could experiment with building new types of content using their preferred technologies, and then deliver it using containers. Pearson chose Kubernetes because it believes that is the best technology for managing containers, has the widest community support and offers the most flexible and powerful tools.“</p>
<p>Kubernetes is at the core of the platform we’ve built for developers. After we get our big spike in back-to-school in traffic, much of Pearson’s traffic will interact with Kubernetes. It is proving to be as effective as we had hoped,” Jackson says.</p>
</div>
</main>
<main>
<divclass="content">
<h4>Kubernetes powers a comprehensive developer experience</h4>
<p>Pearson wanted to use as much open source technology as possible for the platform given that it provides both technical and commercial benefits over the duration of the project. Jackson says, "Building an infrastructure platform based on open source technology in Pearson was a no-brainer, the sharing of technical challenges and advanced use cases in a community of people with talent far beyond what we could hire independently allows us to innovate at a level we could not reach on our own. Our engineers enjoy returning code to the community and participating in talks, blogs and meetings, it's a great way for us to allow our team to express themselves and share the pride they have in their work."</p>
<p>It also wanted to use a container-focused platform. Pearson has 400 development groups and diverse brands with varying business and technical needs. With containers, each brand could experiment with building new types of content using their preferred technologies, and then deliver it using containers. Pearson chose Kubernetes because it believes that is the best technology for managing containers, has the widest community support and offers the most flexible and powerful tools."</p>
<p>Kubernetes is at the core of the platform we've built for developers. After we get our big spike in back-to-school in traffic, much of Pearson's traffic will interact with Kubernetes. It is proving to be as effective as we had hoped," Jackson says.</p>
<p>With the new platform, Pearson will increase stability and performance, and to bring products to market more quickly. The company says its engineers will also get a productivity boost because they won’t spend time managing infrastructure. Jackson estimates 15 to 20 percent in productivity savings.</p>
<p>Beyond that, Pearson says the platform will encourage innovation because of the ease with which new applications can be developed, and because applications will be deployed far more quickly than in the past. It expects that will help the company meet its goal of reaching 200 million learners within the next 10 years.</p>
<p>“We’re already seeing tremendous benefits with Kubernetes — improved engineering productivity, faster delivery of applications and a simplified infrastructure. But this is just the beginning. Kubernetes will help transform the way that educational content is delivered online,” says Jackson.</p>
<p>With the new platform, Pearson will increase stability and performance, and to bring products to market more quickly. The company says its engineers will also get a productivity boost because they won't spend time managing infrastructure. Jackson estimates 15 to 20 percent in productivity savings.</p>
<p>Beyond that, Pearson says the platform will encourage innovation because of the ease with which new applications can be developed, and because applications will be deployed far more quickly than in the past. It expects that will help the company meet its goal of reaching 200 million learners within the next 10 years.</p>
<p>"We're already seeing tremendous benefits with Kubernetes — improved engineering productivity, faster delivery of applications and a simplified infrastructure. But this is just the beginning. Kubernetes will help transform the way that educational content is delivered online," says Jackson.</p>
<h3id="caseStudyTitle">Using Kubernetes to Build Tools to Improve the World's Wikis</h3>
<p>
The non-profit Wikimedia Foundation operates some of the largest collaboratively edited reference projects in the world, including Wikipedia. To help users maintain and use wikis, it runs Wikimedia Tool Labs, a hosting environment for community developers working on tools and bots to help editors and other volunteers do their work, including reducing vandalism. The community around Wikimedia Tool Labs began forming nearly 10 years ago.
“Wikimedia Tool Labs is vital for making sure wikis all around the world work as well as they possibly can. Because it’s grown organically for almost 10 years, it has become an extremely challenging environment and difficult to maintain. It’s like a big ball of mud — you really can’t see through it. With Kubernetes, we’re simplifying the environment and making it easier for developers to build the tools that make wikis run better.”
</p>
<pclass="attrib">— Yuvi Panda, operations engineer at Wikimedia Foundation and Wikimedia Tool Labs</p>
</div>
</div>
</main>
<main>
<divclass="content">
<h3id="caseStudyTitle">Using Kubernetes to Build Tools to Improve the World's Wikis</h3>
<p>
The non-profit Wikimedia Foundation operates some of the largest collaboratively edited reference projects in the world, including Wikipedia. To help users maintain and use wikis, it runs Wikimedia Tool Labs, a hosting environment for community developers working on tools and bots to help editors and other volunteers do their work, including reducing vandalism. The community around Wikimedia Tool Labs began forming nearly 10 years ago.
"Wikimedia Tool Labs is vital for making sure wikis all around the world work as well as they possibly can. Because it's grown organically for almost 10 years, it has become an extremely challenging environment and difficult to maintain. It's like a big ball of mud — you really can't see through it. With Kubernetes, we're simplifying the environment and making it easier for developers to build the tools that make wikis run better."
</p>
<pclass="attrib">— Yuvi Panda, operations engineer at Wikimedia Foundation and Wikimedia Tool Labs</p>
</div>
</div>
</main>
</section>
<sectionclass="bullets">
<main>
<divclass="content">
<divclass="bullet">
<h4>Challenges:</h4>
<ul>
<li>Simplify a complex, difficult-to-manage infrastructure</li>
<li>Allow developers to continue writing tools and bots using existing techniques</li>
</ul>
</div>
<divclass="bullet">
<h4>Why Kubernetes:</h4>
<ul>
<li>Wikimedia Tool Labs chose Kubernetes because it can mimic existing workflows, while reducing complexity</li>
</ul>
</div>
<divclass="bullet">
<h4>Approach:</h4>
<ul>
<li>Migrate old systems and a complex infrastructure to Kubernetes</li>
</ul>
</div>
<divclass="bullet">
<h4>Results:</h4>
<ul>
<li>20 percent of web tools that account for more than 40 percent of web traffic now run on Kubernetes</li>
<li>A 25-node cluster that keeps up with each new Kubernetes release</li>
<li>Thousands of lines of old code have been deleted, thanks to Kubernetes</li>
</ul>
</div>
</div>
</main>
<main>
<divclass="content">
<divclass="bullet">
<h4>Challenges:</h4>
<ul>
<li>Simplify a complex, difficult-to-manage infrastructure</li>
<li>Allow developers to continue writing tools and bots using existing techniques</li>
</ul>
</div>
<divclass="bullet">
<h4>Why Kubernetes:</h4>
<ul>
<li>Wikimedia Tool Labs chose Kubernetes because it can mimic existing workflows, while reducing complexity</li>
</ul>
</div>
<divclass="bullet">
<h4>Approach:</h4>
<ul>
<li>Migrate old systems and a complex infrastructure to Kubernetes</li>
</ul>
</div>
<divclass="bullet">
<h4>Results:</h4>
<ul>
<li>20 percent of web tools that account for more than 40 percent of web traffic now run on Kubernetes</li>
<li>A 25-node cluster that keeps up with each new Kubernetes release</li>
<li>Thousands of lines of old code have been deleted, thanks to Kubernetes</li>
</ul>
</div>
</div>
</main>
</section>
<sectionclass="details">
<main>
<divclass="content">
<h4>Using Kubernetes to provide tools for maintaining wikis</h4>
<p>
Wikimedia Tool Labs is run by a staff of four-and-a-half paid employees and two volunteers. The infrastructure didn't make it easy or intuitive for developers to build bots and other tools to make wikis work more easily. Yuvi says, “It’s incredibly chaotic. We have lots of Perl and Bash duct tape on top of it. Everything is super fragile.”
</p>
<p>
To solve the problem, Wikimedia Tool Labs migrated parts of its infrastructure to Kubernetes, in preparation for eventually moving its entire system. Yuvi said Kubernetes greatly simplifies maintenance. The goal is to allow developers creating bots and other tools to use whatever development methods they want, but make it easier for the Wikimedia Tool Labs to maintain the required infrastructure for hosting and sharing them.
</p>
<p>
“With Kubernetes, I’ve been able to remove a lot of our custom-made code, which makes everything easier to maintain. Our users’ code also runs in a more stable way than previously,” says Yuvi.
</p>
</div>
</main>
<main>
<divclass="content">
<h4>Using Kubernetes to provide tools for maintaining wikis</h4>
<p>
Wikimedia Tool Labs is run by a staff of four-and-a-half paid employees and two volunteers. The infrastructure didn't make it easy or intuitive for developers to build bots and other tools to make wikis work more easily. Yuvi says, "It's incredibly chaotic. We have lots of Perl and Bash duct tape on top of it. Everything is super fragile."
</p>
<p>
To solve the problem, Wikimedia Tool Labs migrated parts of its infrastructure to Kubernetes, in preparation for eventually moving its entire system. Yuvi said Kubernetes greatly simplifies maintenance. The goal is to allow developers creating bots and other tools to use whatever development methods they want, but make it easier for the Wikimedia Tool Labs to maintain the required infrastructure for hosting and sharing them.
</p>
<p>
"With Kubernetes, I've been able to remove a lot of our custom-made code, which makes everything easier to maintain. Our users' code also runs in a more stable way than previously," says Yuvi.
</p>
</div>
</main>
</section>
<sectionclass="details">
<main>
<divclass="content">
<h4>Simplifying infrastructure and keeping wikis running better</h4>
<p>
Wikimedia Tool Labs has seen great success with the initial Kubernetes deployment. Old code is being simplified and eliminated, contributing developers don’t have to change the way they write their tools and bots, and those tools and bots run in a more stable fashion than they have in the past. The paid staff and volunteers are able to better keep up with fixing issues.
</p>
<p>
In the future, with a more complete migration to Kubernetes, Wikimedia Tool Labs expects to make it even easier to host and maintain the bots and tools that help run wikis across the world. The tool labs already host approximately 1,300 tools and bots from 800 volunteers, with many more being submitted every day. Twenty percent of the tool labs’ web tools that account for more than 60 percent of web traffic now run on Kubernetes. The tool labs has a 25-node cluster that keeps up with each new Kubernetes release. Many existing web tools are migrating to Kubernetes.
</p>
<p>
“Our goal is to make sure that people all over the world can share knowledge as easily as possible. Kubernetes helps with that, by making it easier for wikis everywhere to have the tools they need to thrive,” says Yuvi.
</p>
</div>
</main>
<main>
<divclass="content">
<h4>Simplifying infrastructure and keeping wikis running better</h4>
<p>
Wikimedia Tool Labs has seen great success with the initial Kubernetes deployment. Old code is being simplified and eliminated, contributing developers don't have to change the way they write their tools and bots, and those tools and bots run in a more stable fashion than they have in the past. The paid staff and volunteers are able to better keep up with fixing issues.
</p>
<p>
In the future, with a more complete migration to Kubernetes, Wikimedia Tool Labs expects to make it even easier to host and maintain the bots and tools that help run wikis across the world. The tool labs already host approximately 1,300 tools and bots from 800 volunteers, with many more being submitted every day. Twenty percent of the tool labs' web tools that account for more than 60 percent of web traffic now run on Kubernetes. The tool labs has a 25-node cluster that keeps up with each new Kubernetes release. Many existing web tools are migrating to Kubernetes.
</p>
<p>
"Our goal is to make sure that people all over the world can share knowledge as easily as possible. Kubernetes helps with that, by making it easier for wikis everywhere to have the tools they need to thrive," says Yuvi.
此处，Kubernetes 不仅仅是一个 "编排系统"；它消除了编排的需要。 "编排"技术定义的是工作流的执行: 从 A 到 B，然后到 C。相反，Kubernetes 是包括一套独立、可组合的控制过程，通过声明式语法使其连续地朝着期望状态驱动当前状态。 不需要告诉它具体从 A 到 C 的过程，只要告诉到 C 的状态即可。 也不需要集中控制；该方法更类似于"编舞"。这使得系统更容易使用并且更强大、更可靠、更具弹性和可扩展性。
<p>虽然每个 Pod 在所在的集群中拥有自己独立的 IP 地址，但这些 IP 地址不会暴露在 Kubernetes 集群外部。考虑到 Pod 可能随时会被终止、删除或被其他 Pod 替换，我们需要一种方法让其他 Pod 和应用程序自动发现彼此。Kubernetes 通过 Service 对 Pods 进行分组来解决此问题。一个 Kubernetes <b>Service</b> 是一个抽象层，它定义了一组逻辑的 Pods，并让这些 Pods 对外部流量可见，可以被负载均衡和服务发现。 </p>
<p>此抽象允许我们将 Pods 暴露给集群外部的流量访问。Services 具有自己的唯一集群专用 IP 地址，并显示一个端口以接收流量。如果选择在集群外公开 Service，则有如下选项:</p>
This document describes how access to the Kubernetes API is controlled.
## Overview
Users [access the API](/docs/user-guide/accessing-the-cluster) using `kubectl`,
client libraries, or by making REST requests. Both human users and
[Kubernetes service accounts](/docs/user-guide/service-accounts/) can be
[Kubernetes service accounts](/docs/tasks/configure-pod-container/configure-service-account/) can be
authorized for API access.
When a request reaches the API, it goes through several stages, illustrated in the
following diagram:
@@ -24,7 +20,7 @@ following diagram:
In a typical Kubernetes cluster, the API served on port 443. A TLS connection is
established. The API server presents a certificate. This certificate is
often self-signed, so `$USER/.kube/config` on the user's machine typically
contains the root certficate for the API server's certificate, which when specified
contains the root certificate for the API server's certificate, which when specified
is used in place of the system default root certificates. This certificate is typically
automatically written into your `$USER/.kube/config` when you create a cluster yourself
using `kube-up.sh`. If the cluster has multiple users, then the creator needs to share
@@ -42,7 +38,7 @@ The input to the authentication step is the entire HTTP request, however, it typ
just examines the headers and/or client certificate.
Authentication modules include Client Certificates, Password, and Plain Tokens,
and JWT Tokens (used for service accounts).
Bootstrap Tokens, and JWT Tokens (used for service accounts).
Multiple authentication modules can be specified, in which case each one is tried in sequence,
until one of them succeeds.
@@ -61,43 +57,48 @@ users in its object store.
## Authorization
Once the request is authenticated as coming from a specific user,
it moves to a generic authorization step. This is shown as step **2** in the
diagram.
After the request is authenticated as coming from a specific user, the request must be authorized. This is shown as step**2**in the diagram.
The input to the Authorization step are attributes of the REST request, including:
- the username determined by the Authentication step.
- a `verb` associated with the API request. Most object support these common operations: `list, watch, create, update, patch, delete`. Some objects have "special verbs"; for example pods and services can be `proxy`-ed.
- any subresource associated with the API request (e.g. `status`).
- the Group, Version, and Kind of the API resource (e.g. `v1 pod`, or `batch/v1 job`) being
operated on.
- the name and namespace of the object.
A request must include the username of the requester, the requested action, and the object affected by the action. The request is authorized if an existing policy declares that the user has permissions to complete the requested action.
There are multiple supported Authorization Modules. The cluster creator configures the API
server with which Authorization Modules should be used. When multiple Authorization Modules
are configured, each is checked in sequence, and if any Module authorizes the request,
then the request can proceed. If all deny the request, then the request is denied (HTTP status
code 403).
For example, if Bob has the policy below, then he can read pods only in the namespace `projectCaribou`:
The [Authorization Modules](/docs/admin/authorization) page describes what authorization modules
If Bob makes the following request, the request is authorized because he is allowed to read objects in the `projectCaribou` namespace:
For version 1.2, clusters created by `kube-up.sh` are configured so that no authorization is
required for any request.
```json
{
"apiVersion":"authorization.k8s.io/v1beta1",
"kind":"SubjectAccessReview",
"spec":{
"resourceAttributes":{
"namespace":"projectCaribou",
"verb":"get",
"group":"unicorn.example.org",
"resource":"pods"
}
}
}
```
If Bob makes a request to write (`create` or `update`) to the objects in the `projectCaribou` namespace, his authorization is denied. If Bob makes a request to read (`get`) objects in a different namespace such as `projectFish`, then his authorization is denied.
As of version 1.3, clusters created by `kube-up.sh` are configured so that the ABAC authorization
modules is enabled. However, its input file is initially set to allow all users to do all
operations. The cluster administrator needs to edit that file, or configure a different authorizer
to restrict what users can do.
Kubernetes authorization requires that you use common REST attributes to interact with existing organization-wide or cloud-provider-wide access control systems. It is important to use REST formatting because these control systems might interact with other APIs besides the Kubernetes API.
Kubernetes supports multiple authorization modules, such as ABAC mode, RBAC Mode, and Webhook mode. When an administrator creates a cluster, they configured the authorization modules that should be used in the API server. If more than one authorization modules are configured, Kubernetes checks each module, and if any module authorizes the request, then the request can proceed. If all of the modules deny the request, then the request is denied (HTTP status code 403).
The Authorization step is designed to operate on attributes that are likely to be common to most
REST requests, such as object name, kind, etc. This is intended to facilitate interation with
existing organization-wide or cloud-provider-wide access control systems (which may handle
other APIs besides the Kubernetes API.
To learn more about Kubernetes authorization, including details about creating policies using the supported authorization modules, see [Authorization Overview](/docs/admin/authorization).
Access controls and policies that depend on specific fields of specific Kinds of objects
are handled by Admission Controllers.
## Admission Control
@@ -108,7 +109,7 @@ They act on objects being created, deleted, updated or connected (proxy), but no
Multiple admission controllers can be configured. Each is called in order.
This is shown as step **3** in the diagram.
This is shown as step **3** in the diagram.
Unlike Authentication and Authorization Modules, if any admission controller module
rejects, then the request is immediately rejected.
@@ -122,17 +123,17 @@ Once a request passes all admission controllers, it is validated using the valid
for the corresponding API object, and then written to the object store (shown as step **4**).
## API Server Ports and IPs
## API Server Ports and IPs
The previous discussion applies to requests sent to the secure port of the API server
(the typical case). The API server can actually serve on 2 ports:
By default the Kubernetes APIserver serves HTTP on 2 ports:
By default the Kubernetes APIserver serves HTTP on 2 ports:
1.`Localhost Port`:
- is intended for testing and bootstrap, and for other components of the master node
(scheduler, controller-manager) to talk to the API
(scheduler, controller-manager) to talk to the API
- no TLS
- default is port 8080, change with `--insecure-port` flag.
- defaults IP is localhost, change with `--insecure-bind-address` flag.
@@ -141,14 +142,14 @@ By default the Kubernetes APIserver serves HTTP on 2 ports:
- protected by need to have host access
2.`Secure Port`:
- use whenever possible
- use whenever possible
- uses TLS. Set cert with `--tls-cert-file` and key with `--tls-private-key-file` flag.
- default is port 6443, change with `--secure-port` flag.
- default IP is first non-localhost network interface, change with `--bind-address` flag.
- request handled by authentication and authorization modules.
- request handled by admission control module(s).
- authentication and authoriation modules run.
- authentication and authorisation modules run.
When the cluster is created by `kube-up.sh`, on Google Compute Engine (GCE),
and on several other cloud providers, the API server serves on port 443. On
This page lists some of the available add-ons and links to their respective installation instructions.
Add-ons in each section are sorted alphabetically - the ordering does not imply any preferential status.
## Networking and Network Policy
* [Calico](http://docs.projectcalico.org/v1.6/getting-started/kubernetes/installation/hosted/) is a secure L3 networking and network policy provider.
* [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy.
* [Flannel](https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml) is a overlay network provider that can be used with Kubernetes.
* [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API](/docs/user-guide/networkpolicies/). Kubeadm add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize).
* [Weave Net](https://www.weave.works/docs/net/latest/kube-addon/) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database.
## Visualization & Control
* [Dashboard](https://github.com/kubernetes/dashboard#kubernetes-dashboard) is a dashboard web interface for Kubernetes.
* [Weave Scope](https://www.weave.works/documentation/scope-latest-installing/#k8s) is a tool for graphically visualizing your containers, pods, services etc. Use it in conjunction with a [Weave Cloud account](https://cloud.weave.works/) or host the UI yourself.
## Legacy Add-ons
There are several other add-ons documented in the deprecated [cluster/addons](https://github.com/kubernetes/kubernetes/tree/master/cluster/addons) directory.
Well-maintained ones should be linked to here. PRs welcome!
@@ -87,7 +87,7 @@ The ImagePolicyWebhook plug-in allows a backend webhook to make admission decisi
```
#### Configuration File Format
ImagePolicyWebhook uses the admission controller config file (`--admission-controller-config-file`) to set configuration options for the behavior of the backend. This file may be json or yaml and has the following format:
ImagePolicyWebhook uses the admission config file `--admission-control-config-file` to set configuration options for the behavior of the backend. This file may be json or yaml and has the following format:
The config file must reference a [kubeconfig](/docs/user-guide/kubeconfig-file/) formatted file which sets up the connection to the backend. It is required that the backend communicate over TLS.
The config file must reference a [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) formatted file which sets up the connection to the backend. It is required that the backend communicate over TLS.
The kubeconfig file's cluster field must point to the remote service, and the user field must contain the returned authorizer.
@@ -120,13 +120,13 @@ users:
client-certificate:/path/to/cert.pem# cert for the webhook plugin to use
client-key:/path/to/key.pem # key matching the cert
```
For additional HTTP configuration, refer to the [kubeconfig](/docs/user-guide/kubeconfig-file/) documentation.
For additional HTTP configuration, refer to the [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) documentation.
#### Request Payloads
When faced with an admission decision, the API Server POSTs a JSON serialized api.imagepolicy.v1alpha1.ImageReview object describing the action. This object contains fields describing the containers being admitted, as well as any pod annotations that match `*.image-policy.k8s.io/*`.
Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for alpha objects and check the “apiVersion” field of the request to ensure correct deserialization. Additionally, the API Server must enable the imagepolicy.k8s.io/v1alpha1 API extensions group (`--runtime-config=imagepolicy.k8s.io/v1alpha1=true`).
Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for alpha objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the imagepolicy.k8s.io/v1alpha1 API extensions group (`--runtime-config=imagepolicy.k8s.io/v1alpha1=true`).
An example request body:
@@ -151,7 +151,7 @@ An example request body:
}
```
The remote service is expected to fill the ImageReviewStatus field of the request and respond to either allow or disallow access. The response body’s “spec” field is ignored and may be omitted. A permissive response would return:
The remote service is expected to fill the ImageReviewStatus field of the request and respond to either allow or disallow access. The response body's "spec" field is ignored and may be omitted. A permissive response would return:
```
{
@@ -197,7 +197,7 @@ We strongly recommend using this plug-in if you intend to make use of Kubernetes
### SecurityContextDeny
This plug-in will deny any pod with a [SecurityContext](/docs/user-guide/security-context) that defines options that were not available on the `Container`.
This plug-in will deny any pod that attempts to set certain escalating [SecurityContext](/docs/user-guide/security-context) fields. This should be enabled if a cluster doesn't utilize [pod security policies](/docs/user-guide/pod-security-policy) to restrict the set of values a security context can take.
### ResourceQuota
@@ -205,7 +205,7 @@ This plug-in will observe the incoming request and ensure that it does not viola
enumerated in the `ResourceQuota` object in a `Namespace`. If you are using `ResourceQuota`
objects in your Kubernetes deployment, you MUST use this plug-in to enforce quota constraints.
See the [resourceQuota design doc](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/design/admission_control_resource_quota.md) and the [example of Resource Quota](/docs/admin/resourcequota/) for more details.
See the [resourceQuota design doc](https://git.k8s.io/community/contributors/design-proposals/admission_control_resource_quota.md) and the [example of Resource Quota](/docs/concepts/policy/resource-quotas/) for more details.
It is strongly encouraged that this plug-in is configured last in the sequence of admission control plug-ins. This is
so that quota is not prematurely incremented only for the request to be rejected later in admission control.
@@ -218,7 +218,7 @@ your Kubernetes deployment, you MUST use this plug-in to enforce those constrain
be used to apply default resource requests to Pods that don't specify any; currently, the default LimitRanger
applies a 0.1 CPU requirement to all Pods in the `default` namespace.
See the [limitRange design doc](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/design/admission_control_limit_range.md) and the [example of Limit Range](/docs/admin/limitrange/) for more details.
See the [limitRange design doc](https://git.k8s.io/community/contributors/design-proposals/admission_control_limit_range.md) and the [example of Limit Range](/docs/tasks/configure-pod-container/limit-range/) for more details.
### InitialResources (experimental)
@@ -227,7 +227,7 @@ then the plug-in auto-populates a compute resource request based on historical u
If there is not enough data to make a decision the Request is left unchanged.
When the plug-in sets a compute resource request, it annotates the pod with information on what compute resources it auto-populated.
See the [InitialResouces proposal](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/proposals/initial-resources.md) for more details.
See the [InitialResouces proposal](https://git.k8s.io/community/contributors/design-proposals/initial-resources.md) for more details.
### NamespaceLifecycle
@@ -252,9 +252,60 @@ This plugin ignores any `PersistentVolumeClaim` updates, it acts only on creatio
See [persistent volume](/docs/user-guide/persistent-volumes) documentation about persistent volume claims and
storage classes and how to mark a storage class as default.
### DefaultTolerationSeconds
This plug-in sets the default forgiveness toleration for pods, which have no forgiveness tolerations, to tolerate
the taints `notready:NoExecute` and `unreachable:NoExecute` for 5 minutes.
### PodNodeSelector
This plug-in defaults and limits what node selectors may be used within a namespace by reading a namespace annotation and a global configuration.
#### Configuration File Format
PodNodeSelector uses the admission config file `--admission-control-config-file` to set configuration options for the behavior of the backend.
Note that the configuration file format will move to a versioned file in a future release.
This file may be json or yaml and has the following format:
Where `<container_name>` is the name of the container to apply the profile to, and `<profile_ref>`
specifies the profile to apply. The `profile_ref` can be one of:
-`runtime/default` to apply the runtime's default profile.
-`localhost/<profile_name>` to apply the profile loaded on the host with the name `<profile_name>`
See the [API Reference](#api-reference) for the full details on the annotation and profile name formats.
The Kubernetes AppArmor enforcement works by first checking that all the prerequisites have been
met, and then forwarding the profile selection to the container runtime for enforcement. If the
prerequisites have not been met, the Pod will be rejected, and will not run.
To verify that the profile was applied, you can expect to see the AppArmor security option listed in the container created event:
$ kubectl get events | grep Created
22s 22s 1 hello-apparmor Pod spec.containers{hello} Normal Created {kubelet e2e-test-stclair-minion-group-31nt} Created container with docker id 269a53b202d3; Security:[seccomp=unconfined apparmor=k8s-apparmor-example-deny-write]
You can also verify directly that the container's root process is running with the correct profile by checking its proc attr:
If we look at the pod events, we can see that the Pod container was created with the AppArmor
profile "k8s-apparmor-example-deny-write":
$ kubectl get events | grep hello-apparmor
14s 14s 1 hello-apparmor Pod Normal Scheduled {default-scheduler } Successfully assigned hello-apparmor to gke-test-default-pool-239f5d02-gyn2
14s 14s 1 hello-apparmor Pod spec.containers{hello} Normal Pulling {kubelet gke-test-default-pool-239f5d02-gyn2} pulling image "busybox"
13s 13s 1 hello-apparmor Pod spec.containers{hello} Normal Pulled {kubelet gke-test-default-pool-239f5d02-gyn2} Successfully pulled image "busybox"
13s 13s 1 hello-apparmor Pod spec.containers{hello} Normal Created {kubelet gke-test-default-pool-239f5d02-gyn2} Created container with docker id 06b6cd1c0989; Security:[seccomp=unconfined apparmor=k8s-apparmor-example-deny-write]
13s 13s 1 hello-apparmor Pod spec.containers{hello} Normal Started {kubelet gke-test-default-pool-239f5d02-gyn2} Started container with docker id 06b6cd1c0989
We can verify that the container is actually running with that profile by checking its proc attr:
@@ -27,9 +29,9 @@ stored as `Secrets`, which are mounted into pods allowing in cluster processes
to talk to the Kubernetes API.
API requests are tied to either a normal user or a service account, or are treated
as anonymous requests. This means every process inside or outside the cluster, from
a human user typing `kubectl` on a workstation, to `kubelets` on nodes, to members
of the control plane, must authenticate when making requests to the the API server,
as anonymous requests. This means every process inside or outside the cluster, from
a human user typing `kubectl` on a workstation, to `kubelets` on nodes, to members
of the control plane, must authenticate when making requests to the API server,
or be treated as an anonymous user.
## Authentication strategies
@@ -52,11 +54,11 @@ You can enable multiple authentication methods at once. You should usually use a
- service account tokens for service accounts
- at least one other method for user authentication.
When multiple are enabled, the first authenticator module
When multiple authenticator modules are enabled, the first module
to successfully authenticate the request short-circuits evaluation.
The API server does not guarantee the order authenticators run in.
The `system:authenticated` group is included in the list of groups for all authenticated users.
The `system:authenticated` group is included in the list of groups for all authenticated users.
### X509 Client Certs
@@ -83,9 +85,9 @@ See [APPENDIX](#appendix) for how to generate a client cert.
The API server reads bearer tokens from a file when given the `--token-auth-file=SOMEFILE` option on the command line. Currently, tokens last indefinitely, and the token list cannot be
changed without restarting API server.
The token file format is implemented in `plugin/pkg/auth/authenticator/token/tokenfile/...`
and is a csv file with a minimum of 3 columns: token, user name, user uid, followed by
optional group names. Note, if you have more than one group the column must be double quoted e.g.
The token file is a csv file with a minimum of 3 columns: token, user name, user uid,
followed by optional group names. Note, if you have more than one group the column must be
* `--oidc-issuer-url` URL of the provider which allows the API server to discover
public signing keys. Only URLs which use the `https://` scheme are accepted. This is typically
the provider's URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com".
1. Login to your identity provider
2. Your identity provider will provide you with an `access_token`, `id_token` and a `refresh_token`
3. When using `kubectl`, use your `id_token` with the `--token` flag or add it directly to your `kubeconfig`
4. `kubectl` sends your `id_token` in a header called Authorization to the API server
5. The API server will make sure the JWT signature is valid by checking against the certificate named in the configuration
6. Check to make sure the `id_token` hasn't expired
7. Make sure the user is authorized
8. Once authorized the API server returns a response to `kubectl`
9. `kubectl` provides feedback to the user
* `--oidc-client-id` A client id that all tokens must be issued for.
Since all of the data needed to validate who you are is in the `id_token`, Kubernetes doesn't need to
"phone home" to the identity provider. In a model where every request is stateless this provides a very scalable
solution for authentication. It does offer a few challenges:
1. Kubernetes has no "web interface" to trigger the authentication process. There is no browser or interface to collect credentials which is why you need to authenticate to your identity provider first.
2. The `id_token` can't be revoked, its like a certificate so it should be short-lived (only a few minutes) so it can be very annoying to have to get a new token every few minutes
3. There's no easy way to authenticate to the Kubernetes dashboard without using the `kubectl -proxy` command or a reverse proxy that injects the `id_token`
#### Configuring the API Server
To enable the plugin, configure the following flags on the API server:
| Parameter | Description | Example | Required |
| --------- | ----------- | ------- | ------- |
| `--oidc-issuer-url` | URL of the provider which allows the API server to discover public signing keys. Only URLs which use the `https://` scheme are accepted. This is typically the provider's discovery URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com". This URL should point to the level below .well-known/openid-configuration | If the discovery URL is https://accounts.google.com/.well-known/openid-configuration the value should be https://accounts.google.com | Yes |
| `--oidc-client-id` | A client id that all tokens must be issued for. | kubernetes | Yes |
| `--oidc-username-claim` | JWT claim to use as the user name. By default `sub`, which is expected to be a unique identifier of the end user. Admins can choose other claims, such as `email` or `name`, depending on their provider. However, claims other than `email` will be prefixed with the issuer URL to prevent naming clashes with other plugins. | sub | No |
| `--oidc-groups-claim` | JWT claim to use as the user's group. If the claim is present it must be an array of strings. | groups | No |
| `--oidc-ca-file` | The path to the certificate for the CA that signed your identity provider's web certificate. Defaults to the host's root CAs. | `/etc/kubernetes/ssl/kc-ca.pem` | No |
If a claim other than `email` is chosen for `--oidc-username-claim`, the value
will be prefixed with the `--oidc-issuer-url` to prevent clashes with existing
Kubernetes names (such as the `system:` users). For example, if the provider
URL is `https://accounts.google.com` and the username claim maps to `jane`, the
plugin will authenticate the user as:
```
https://accounts.google.com#jane
```
Importantly, the API server is not an OAuth2 client, rather it can only be
configured to trust a single client. This allows the use of public providers,
configured to trust a single issuer. This allows the use of public providers,
such as Google, without trusting credentials issued to third parties. Admins who
wish utilize multiple OAuth clients should explore providers which support the
wish to utilize multiple OAuth clients should explore providers which support the
`azp` (authorized party) claim, a mechanism for allowing one client to issue
tokens on behalf of another.
The plugin also accepts the following optional flags:
* `--oidc-ca-file` Used by the API server to establish and verify the secure
connection to the issuer. Defaults to the host's root CAs.
And experimental flags:
* `--oidc-username-claim` JWT claim to use as the user name. By default `sub`,
which is expected to be a unique identifier of the end user. Admins can choose
other claims, such as `email`, depending on their provider.
* `--oidc-groups-claim` JWT claim to use as the user's group. If the claim is present
it must be an array of strings.
Kubernetes does not provide an OpenID Connect Identity Provider.
You can use an existing public OpenID Connect Identity Provider (such as Google, or [others](http://connect2id.com/products/nimbus-oauth-openid-connect-sdk/openid-connect-providers)).
Or, you can run your own Identity Provider, such as CoreOS [dex](https://github.com/coreos/dex), [Keycloak](https://github.com/keycloak/keycloak) or CloudFoundry [UAA](https://github.com/cloudfoundry/uaa).
Or, you can run your own Identity Provider, such as CoreOS [dex](https://github.com/coreos/dex), [Keycloak](https://github.com/keycloak/keycloak), CloudFoundry [UAA](https://github.com/cloudfoundry/uaa), or Tremolo Security's [OpenUnison](https://github.com/tremolosecurity/openunison).
The provider needs to support [OpenID connect discovery](https://openid.net/specs/openid-connect-discovery-1_0.html); not all do.
For an identity provider to work with Kubernetes it must:
1. Support [OpenID connect discovery](https://openid.net/specs/openid-connect-discovery-1_0.html); not all do.
2. Run in TLS with non-obsolete ciphers
3. Have a CA signed certificate (even if the CA is not a commercial CA or is self signed)
A note about requirement #3 above, requiring a CA signed certificate. If you deploy your own identity provider (as opposed to one of the cloud providers like Google or Microsoft) you MUST have your identity provider's web server certificate signed by a certificate with the `CA` flag set to `TRUE`, even if it is self signed. This is due to GoLang's TLS client implementation being very strict to the standards around certificate validation. If you don't have a CA handy, you can use this script from the CoreOS team to create a simple CA and a signed certificate and key pair - https://github.com/coreos/dex/blob/1ee5920c54f5926d6468d2607c728b71cfe98092/examples/k8s/gencert.sh or this script based on it that will generate SHA256 certs with a longer life and larger key size https://raw.githubusercontent.com/TremoloSecurity/openunison-qs-kubernetes/master/makecerts.sh.
The first option is to use the `oidc` authenticator. This authenticator takes your `id_token`, `refresh_token` and your OIDC `client_secret` and will refresh your token automatically. Once you have authenticated to your identity provider:
Once your `id_token` expires, `kubectl` will attempt to refresh your `id_token` using your `refresh_token` and `client_secret` storing the new values for the `refresh_token` and `id_token` in your `kube/.config`.
##### Option 2 - Use the `--token` Option
The `kubectl` command lets you pass in a token using the `--token` option. Simply copy and paste the `id_token` into this option:
```
kubectl --token=eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL21sYi50cmVtb2xvLmxhbjo4MDQzL2F1dGgvaWRwL29pZGMiLCJhdWQiOiJrdWJlcm5ldGVzIiwiZXhwIjoxNDc0NTk2NjY5LCJqdGkiOiI2RDUzNXoxUEpFNjJOR3QxaWVyYm9RIiwiaWF0IjoxNDc0NTk2MzY5LCJuYmYiOjE0NzQ1OTYyNDksInN1YiI6Im13aW5kdSIsInVzZXJfcm9sZSI6WyJ1c2VycyIsIm5ldy1uYW1lc3BhY2Utdmlld2VyIl0sImVtYWlsIjoibXdpbmR1QG5vbW9yZWplZGkuY29tIn0.f2As579n9VNoaKzoF-dOQGmXkFKf1FMyNV0-va_B63jn-_n9LGSCca_6IVMP8pO-Zb4KvRqGyTP0r3HkHxYy5c81AnIh8ijarruczl-TK_yF5akjSTHFZD-0gRzlevBDiH8Q79NAr-ky0P4iIXS8lY9Vnjch5MF74Zx0c3alKJHJUnnpjIACByfF2SCaYzbWFMUNat-K1PaUk5-ujMBG7yYnr95xD-63n8CO8teGUAAEMx6zRjzfhnhbzX-ajwZLGwGUBT4WqjMs70-6a7_8gZmLZb2az1cZynkFRj2BaCkVT3A2RrjeEwZEtGXlMqKJ1_I2ulrOVsYx01_yD35-rw get nodes
```
### Webhook Token Authentication
@@ -266,7 +395,7 @@ Webhook authentication is a hook for verifying bearer tokens.
* `--authentication-token-webhook-config-file` a kubeconfig file describing how to access the remote webhook service.
* `--authentication-token-webhook-cache-ttl` how long to cache authentication decisions. Defaults to two minutes.
The configuration file uses the [kubeconfig](/docs/user-guide/kubeconfig-file/)
The configuration file uses the [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/)
file format. Within the file "users" refers to the API server webhook and
"clusters" refers to the remote service. An example would be:
@@ -366,13 +495,47 @@ HTTP status codes can be used to supply additional error context.
The API server can be configured to identify users from request header values, such as `X-Remote-User`.
It is designed for use in combination with an authenticating proxy, which sets the request header value.
* `--requestheader-username-headers` Required, case-insensitive. Header names to check, in order, for the user identity. The first header containing a value is used as the username.
* `--requestheader-group-headers` 1.6+. Optional, case-insensitive. "X-Remote-Group" is suggested. Header names to check, in order, for the user's groups. All values in all specified headers are used as group names.
* `--requestheader-extra-headers-prefix` 1.6+. Optional, case-insensitive. "X-Remote-Extra-" is suggested. Header prefixes to look for to determine extra information about the user (typically used by the configured authorization plugin). Any headers beginning with any of the specified prefixes have the prefix removed, the remainder of the header name becomes the extra key, and the header value is the extra value.
In order to prevent header spoofing, the authenticating proxy is required to present a valid client
certificate to the API server for validation against the specified CA before the request headers are
certificate to the API server for validation against the specified CA before the request headers are
checked.
* `--requestheader-username-headers` Required, case-insensitive. Header names to check, in order, for the user identity. The first header containing a value is used as the identity.
* `--requestheader-client-ca-file` Required. PEM-encoded certificate bundle. A valid client certificate must be presented and validated against the certificate authorities in the specified file before the request headers are checked for user names.
* `--requestheader-allowed-names` Optional. List of common names (cn). If set, a valid client certificate with a Common Name (cn) in the specified list must be presented before the request headers are checked for user names. If empty, any Common Name is allowed.
* `--requestheader-allowed-names` Optional. List of common names (cn). If set, a valid client certificate with a Common Name (cn) in the specified list must be presented before the request headers are checked for user names. If empty, any Common Name is allowed.
### Keystone Password
@@ -382,6 +545,13 @@ option to the API server during startup. The plugin is implemented in
`plugin/pkg/auth/authenticator/password/keystone/keystone.go` and currently uses
basic auth to verify used by username and password.
If you have configured self-signed certificates for the Keystone server,
you may need to set the `--experimental-keystone-ca-file=SOMEFILE` option when
starting the Kubernetes API server. If you set the option, the Keystone
server's certificate is verified by one of the authorities in the
`experimental-keystone-ca-file`. Otherwise, the certificate is verified by
the host's root Certificate Authority.
For details on how to use keystone to manage projects and users, refer to the
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Andrew Chen