Merge pull request #35091 from windsonsea/kubeconfig
[zh-cn] fixed /config-api/kubelet-config.v1beta1.mdpull/35104/head
commit
1a816008c8
|
@ -971,7 +971,7 @@ run those in addition to the pods specified by static pod files, and exit.
|
||||||
Default: false
|
Default: false
|
||||||
-->
|
-->
|
||||||
<p><code>runOnce</code>字段被设置时,kubelet 会咨询 API 服务器一次并获得 Pod 列表,
|
<p><code>runOnce</code>字段被设置时,kubelet 会咨询 API 服务器一次并获得 Pod 列表,
|
||||||
运行在静态 Pod 文件中指定的 Pod 及这里所获得的的 Pod,然后退出。</p>
|
运行在静态 Pod 文件中指定的 Pod 及这里所获得的 Pod,然后退出。</p>
|
||||||
<p>默认值:false</p>
|
<p>默认值:false</p>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
@ -1467,13 +1467,13 @@ Default: ""
|
||||||
<td>
|
<td>
|
||||||
<!--systemReservedCgroup helps the kubelet identify absolute name of top level CGroup used
|
<!--systemReservedCgroup helps the kubelet identify absolute name of top level CGroup used
|
||||||
to enforce <code>systemReserved</code> compute resource reservation for OS system daemons.
|
to enforce <code>systemReserved</code> compute resource reservation for OS system daemons.
|
||||||
Refer to <a href="https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md">Node Allocatable</a>
|
Refer to <a href="https://git.k8s.io/design-proposals-archive/node/node-allocatable.md">Node Allocatable</a>
|
||||||
doc for more information.
|
doc for more information.
|
||||||
Default: ""
|
Default: ""
|
||||||
-->
|
-->
|
||||||
<p><code>systemReservedCgroup</code>帮助 kubelet 识别用来为 OS 系统级守护进程实施
|
<p><code>systemReservedCgroup</code>帮助 kubelet 识别用来为 OS 系统级守护进程实施
|
||||||
<code>systemReserved</code>计算资源预留时使用的顶级控制组(CGroup)。
|
<code>systemReserved</code>计算资源预留时使用的顶级控制组(CGroup)。
|
||||||
参考 <a href="https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md">Node Allocatable</a>
|
参考 <a href="https://git.k8s.io/design-proposals-archive/node/node-allocatable.md">Node Allocatable</a>
|
||||||
以了解详细信息。</p>
|
以了解详细信息。</p>
|
||||||
<p>默认值:""</p>
|
<p>默认值:""</p>
|
||||||
</td>
|
</td>
|
||||||
|
@ -1486,13 +1486,13 @@ Default: ""
|
||||||
<td>
|
<td>
|
||||||
<!--kubeReservedCgroup helps the kubelet identify absolute name of top level CGroup used
|
<!--kubeReservedCgroup helps the kubelet identify absolute name of top level CGroup used
|
||||||
to enforce `KubeReserved` compute resource reservation for Kubernetes node system daemons.
|
to enforce `KubeReserved` compute resource reservation for Kubernetes node system daemons.
|
||||||
Refer to <a href="https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md">Node Allocatable</a>
|
Refer to <a href="https://git.k8s.io/design-proposals-archive/node/node-allocatable.md">Node Allocatable</a>
|
||||||
doc for more information.
|
doc for more information.
|
||||||
Default: ""
|
Default: ""
|
||||||
-->
|
-->
|
||||||
<p><code>kubeReservedCgroup</code> 帮助 kubelet 识别用来为 Kubernetes 节点系统级守护进程实施
|
<p><code>kubeReservedCgroup</code> 帮助 kubelet 识别用来为 Kubernetes 节点系统级守护进程实施
|
||||||
<code>kubeReserved</code>计算资源预留时使用的顶级控制组(CGroup)。
|
<code>kubeReserved</code>计算资源预留时使用的顶级控制组(CGroup)。
|
||||||
参阅 <a href="https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md">Node Allocatable</a>
|
参阅 <a href="https://git.k8s.io/design-proposals-archive/node/node-allocatable.md">Node Allocatable</a>
|
||||||
了解进一步的信息。</p>
|
了解进一步的信息。</p>
|
||||||
<p>默认值:""</p>
|
<p>默认值:""</p>
|
||||||
</td>
|
</td>
|
||||||
|
@ -1509,7 +1509,7 @@ If <code>none</code> is specified, no other options may be specified.
|
||||||
When <code>system-reserved</code> is in the list, systemReservedCgroup must be specified.
|
When <code>system-reserved</code> is in the list, systemReservedCgroup must be specified.
|
||||||
When <code>kube-reserved</code> is in the list, kubeReservedCgroup must be specified.
|
When <code>kube-reserved</code> is in the list, kubeReservedCgroup must be specified.
|
||||||
This field is supported only when <code>cgroupsPerQOS</code> is set to true.
|
This field is supported only when <code>cgroupsPerQOS</code> is set to true.
|
||||||
Refer to <a href="https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md">Node Allocatable</a>
|
Refer to <a href="https://git.k8s.io/design-proposals-archive/node/node-allocatable.md">Node Allocatable</a>
|
||||||
for more information.
|
for more information.
|
||||||
Default: ["pods"]
|
Default: ["pods"]
|
||||||
-->
|
-->
|
||||||
|
@ -1520,7 +1520,7 @@ Default: ["pods"]
|
||||||
<p>如果列表中包含<code>system-reserved</code>,则必须设置<code>systemReservedCgroup</code>。</p>
|
<p>如果列表中包含<code>system-reserved</code>,则必须设置<code>systemReservedCgroup</code>。</p>
|
||||||
<p>如果列表中包含<code>kube-reserved</code>,则必须设置<code>kubeReservedCgroup</code>。</p>
|
<p>如果列表中包含<code>kube-reserved</code>,则必须设置<code>kubeReservedCgroup</code>。</p>
|
||||||
<p>这个字段只有在<code>cgroupsPerQOS</code>被设置为<code>true</code>才被支持。</p>
|
<p>这个字段只有在<code>cgroupsPerQOS</code>被设置为<code>true</code>才被支持。</p>
|
||||||
<p>参阅<a href="https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md">Node Allocatable</a>
|
<p>参阅<a href="https://git.k8s.io/design-proposals-archive/node/node-allocatable.md">Node Allocatable</a>
|
||||||
了解进一步的信息。</p>
|
了解进一步的信息。</p>
|
||||||
<p>默认值:["pods"]</p>
|
<p>默认值:["pods"]</p>
|
||||||
</td>
|
</td>
|
||||||
|
|
|
@ -152,12 +152,12 @@ Here's a summary of each level:
|
||||||
## API 组
|
## API 组
|
||||||
|
|
||||||
<!--
|
<!--
|
||||||
[API groups](https://git.k8s.io/community/contributors/design-proposals/api-machinery/api-group.md)
|
[API groups](https://git.k8s.io/design-proposals-archive/api-machinery/api-group.md)
|
||||||
make it easier to extend the Kubernetes API.
|
make it easier to extend the Kubernetes API.
|
||||||
The API group is specified in a REST path and in the `apiVersion` field of a
|
The API group is specified in a REST path and in the `apiVersion` field of a
|
||||||
serialized object.
|
serialized object.
|
||||||
-->
|
-->
|
||||||
[API 组](https://git.k8s.io/community/contributors/design-proposals/api-machinery/api-group.md)
|
[API 组](https://git.k8s.io/design-proposals-archive/api-machinery/api-group.md)
|
||||||
能够简化对 Kubernetes API 的扩展。
|
能够简化对 Kubernetes API 的扩展。
|
||||||
API 组信息出现在REST 路径中,也出现在序列化对象的 `apiVersion` 字段中。
|
API 组信息出现在REST 路径中,也出现在序列化对象的 `apiVersion` 字段中。
|
||||||
|
|
||||||
|
|
|
@ -462,10 +462,10 @@ PersistentVolume are not present on the Pod resource itself.
|
||||||
|
|
||||||
<!--
|
<!--
|
||||||
* Learn more about [PersistentVolumes](/docs/concepts/storage/persistent-volumes/).
|
* Learn more about [PersistentVolumes](/docs/concepts/storage/persistent-volumes/).
|
||||||
* Read the [Persistent Storage design document](https://git.k8s.io/community/contributors/design-proposals/storage/persistent-storage.md).
|
* Read the [Persistent Storage design document](https://git.k8s.io/design-proposals-archive/storage/persistent-storage.md).
|
||||||
-->
|
-->
|
||||||
* 进一步了解 [PersistentVolumes](/zh-cn/docs/concepts/storage/persistent-volumes/)
|
* 进一步了解 [PersistentVolumes](/zh-cn/docs/concepts/storage/persistent-volumes/)
|
||||||
* 阅读[持久存储设计文档](https://git.k8s.io/community/contributors/design-proposals/storage/persistent-storage.md)
|
* 阅读[持久存储设计文档](https://git.k8s.io/design-proposals-archive/storage/persistent-storage.md)
|
||||||
|
|
||||||
<!--
|
<!--
|
||||||
### Reference
|
### Reference
|
||||||
|
|
|
@ -721,7 +721,7 @@ Pod 的安全上下文适用于 Pod 中的容器,也适用于 Pod 所挂载的
|
||||||
<!--
|
<!--
|
||||||
* `fsGroup`: Volumes that support ownership management are modified to be owned
|
* `fsGroup`: Volumes that support ownership management are modified to be owned
|
||||||
and writable by the GID specified in `fsGroup`. See the
|
and writable by the GID specified in `fsGroup`. See the
|
||||||
[Ownership Management design document](https://git.k8s.io/community/contributors/design-proposals/storage/volume-ownership-management.md)
|
[Ownership Management design document](https://git.k8s.io/design-proposals-archive/storage/volume-ownership-management.md)
|
||||||
for more details.
|
for more details.
|
||||||
|
|
||||||
* `seLinuxOptions`: Volumes that support SELinux labeling are relabeled to be accessible
|
* `seLinuxOptions`: Volumes that support SELinux labeling are relabeled to be accessible
|
||||||
|
@ -732,7 +732,7 @@ Pod 的安全上下文适用于 Pod 中的容器,也适用于 Pod 所挂载的
|
||||||
-->
|
-->
|
||||||
* `fsGroup`:支持属主管理的卷会被修改,将其属主变更为 `fsGroup` 所指定的 GID,
|
* `fsGroup`:支持属主管理的卷会被修改,将其属主变更为 `fsGroup` 所指定的 GID,
|
||||||
并且对该 GID 可写。进一步的细节可参阅
|
并且对该 GID 可写。进一步的细节可参阅
|
||||||
[属主变更设计文档](https://git.k8s.io/community/contributors/design-proposals/storage/volume-ownership-management.md)。
|
[属主变更设计文档](https://git.k8s.io/design-proposals-archive/storage/volume-ownership-management.md)。
|
||||||
|
|
||||||
* `seLinuxOptions`:支持 SELinux 标签的卷会被重新打标签,以便可被 `seLinuxOptions`
|
* `seLinuxOptions`:支持 SELinux 标签的卷会被重新打标签,以便可被 `seLinuxOptions`
|
||||||
下所设置的标签访问。通常你只需要设置 `level` 部分。
|
下所设置的标签访问。通常你只需要设置 `level` 部分。
|
||||||
|
@ -771,11 +771,11 @@ kubectl delete pod security-context-demo-4
|
||||||
* [PodSecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritycontext-v1-core)
|
* [PodSecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritycontext-v1-core)
|
||||||
* [SecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#securitycontext-v1-core)
|
* [SecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#securitycontext-v1-core)
|
||||||
* [Tuning Docker with the newest security enhancements](https://github.com/containerd/containerd/blob/main/docs/cri/config.md)
|
* [Tuning Docker with the newest security enhancements](https://github.com/containerd/containerd/blob/main/docs/cri/config.md)
|
||||||
* [Security Contexts design document](https://git.k8s.io/community/contributors/design-proposals/auth/security_context.md)
|
* [Security Contexts design document](https://git.k8s.io/design-proposals-archive/auth/security_context.md)
|
||||||
* [Ownership Management design document](https://git.k8s.io/community/contributors/design-proposals/storage/volume-ownership-management.md)
|
* [Ownership Management design document](https://git.k8s.io/design-proposals-archive/storage/volume-ownership-management.md)
|
||||||
* [Pod Security Policies](/docs/concepts/security/pod-security-policy/)
|
* [Pod Security Policies](/docs/concepts/security/pod-security-policy/)
|
||||||
* [AllowPrivilegeEscalation design
|
* [AllowPrivilegeEscalation design
|
||||||
document](https://git.k8s.io/community/contributors/design-proposals/auth/no-new-privs.md)
|
document](https://git.k8s.io/design-proposals-archive/auth/no-new-privs.md)
|
||||||
* For more information about security mechanisms in Linux, see
|
* For more information about security mechanisms in Linux, see
|
||||||
[Overview of Linux Kernel Security Features](https://www.linux.com/learn/overview-linux-kernel-security-features)
|
[Overview of Linux Kernel Security Features](https://www.linux.com/learn/overview-linux-kernel-security-features)
|
||||||
-->
|
-->
|
||||||
|
|
Loading…
Reference in New Issue