| Field | Description |
|---|---|
| 字段 | 描述 |
apiVersionstring | kubelet.config.k8s.io/v1beta1 |
kindstring | KubeletConfiguration |
enableServer [Required]+ | |
enableServer [必需]bool
|
- enableServer enables Kubelet's secured server.
+
+
注意：kubelet 的不安全端口由 当 默认值： |
staticPodPathstring
|
- staticPodPath is the path to the directory containing local (static) pods to
+
+
当 默认值："" + |
syncFrequencymeta/v1.Duration
|
- syncFrequency is the max period between synchronizing running
+
+
当 默认值："1m" + |
fileCheckFrequencymeta/v1.Duration
|
- fileCheckFrequency is the duration between checking config files for
-new data
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："20s" + |
httpCheckFrequencymeta/v1.Duration
|
- httpCheckFrequency is the duration between checking http for new data
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："20s" + |
staticPodURLstring
|
- staticPodURL is the URL for accessing static pods to run
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："" + |
staticPodURLHeadermap[string][]string
|
- staticPodURLHeader is a map of slices with HTTP headers to use when accessing the podURL
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：nil + |
addressstring
|
+
+
当 默认值："0.0.0.0" + |
portint32
|
+
+
当 默认值：10250 + |
readOnlyPortint32
|
- readOnlyPort is the read-only port for the Kubelet to serve on with
+
+
当 默认值：0（禁用） + |
tlsCertFilestring
|
- tlsCertFile is the file containing x509 Certificate for HTTPS. (CA cert,
+
+
当 默认值："" + |
tlsPrivateKeyFilestring
|
- tlsPrivateKeyFile is the file containing x509 private key matching tlsCertFile
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："" + |
tlsCipherSuites[]string
|
- TLSCipherSuites is the list of allowed cipher suites for the server.
+
+
当 默认值：nil + |
tlsMinVersionstring
|
- TLSMinVersion is the minimum TLS version supported.
+
+
当 默认值："" + |
rotateCertificatesbool
|
- rotateCertificates enables client certificate rotation. The Kubelet will request a
+
+
当 默认值：false + |
serverTLSBootstrapbool
|
- serverTLSBootstrap enables server certificate bootstrap. Instead of self
+
+
当 默认值：false + |
authenticationKubeletAuthentication
|
- authentication specifies how requests to the Kubelet's server are authenticated
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值： + |
authorizationKubeletAuthorization
|
- authorization specifies how requests to the Kubelet's server are authorized
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值： + |
registryPullQPSint32
|
- registryPullQPS is the limit of registry pulls per second.
-Set to 0 for no limit.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：5 + |
registryBurstint32
|
- registryBurst is the maximum size of bursty pulls, temporarily allows
+
+
当 默认值：10 + |
eventRecordQPSint32
|
- eventRecordQPS is the maximum event creations per second. If 0, there
-is no limit enforced.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：5 + |
eventBurstint32
|
- eventBurst is the maximum size of a burst of event creations, temporarily
+
+
当 默认值：10 + |
enableDebuggingHandlersbool
|
- enableDebuggingHandlers enables server endpoints for log access
+
+
当 默认值：true + |
enableContentionProfilingbool
|
- enableContentionProfiling enables lock contention profiling, if enableDebuggingHandlers is true.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：false + |
healthzPortint32
|
- healthzPort is the port of the localhost healthz endpoint (set to 0 to disable)
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：10248 + |
healthzBindAddressstring
|
- healthzBindAddress is the IP address for the healthz server to serve on
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："127.0.0.1" + |
oomScoreAdjint32
|
- oomScoreAdj is The oom-score-adj value for kubelet process. Values
+
+
当 默认值：-999 + |
clusterDomainstring
|
- clusterDomain is the DNS domain for this cluster. If set, kubelet will
+
+
默认值："" + |
clusterDNS[]string
|
- clusterDNS is a list of IP addresses for the cluster DNS server. If set,
+
+
当 默认值：nil + |
streamingConnectionIdleTimeoutmeta/v1.Duration
|
- streamingConnectionIdleTimeout is the maximum time a streaming connection
+
+
当 默认值："4h" + |
nodeStatusUpdateFrequencymeta/v1.Duration
|
- nodeStatusUpdateFrequency is the frequency that kubelet computes node
+
+
注意：如果节点租约特性未被启用，更改此参数设置时要非常小心，
+所设置的参数值必须与节点控制器的 当 默认值："10s" + |
nodeStatusReportFrequencymeta/v1.Duration
|
- nodeStatusReportFrequency is the frequency that kubelet posts node
+
+
此字段仅当启用了节点租约特性时才被使用。 默认值："5m" + |
nodeLeaseDurationSecondsint32
|
- nodeLeaseDurationSeconds is the duration the Kubelet will set on its corresponding Lease,
-when the NodeLease feature is enabled. This feature provides an indicator of node
-health by having the Kubelet create and periodically renew a lease, named after the node,
-in the kube-node-lease namespace. If the lease expires, the node can be considered unhealthy.
-The lease is currently renewed every 10s, per KEP-0009. In the future, the lease renewal interval
-may be set based on the lease duration.
-Requires the NodeLease feature gate to be enabled.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
如果租约过期，则节点可被视作不健康。根据 KEP-0009 约定，目前的租约每 10 秒钟续约一次。 +在将来，租约的续约时间间隔可能会根据租约的时长来设置。 +此字段的取值必须大于零。 +当 默认值：40 + |
imageMinimumGCAgemeta/v1.Duration
|
- imageMinimumGCAge is the minimum age for an unused image before it is -garbage collected. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that -it may trigger or delay garbage collection, and may change the image overhead -on the node. -Default: "2m" | + +
imageGCHighThresholdPercentint32
|
- imageGCHighThresholdPercent is the percent of disk usage after which
-image garbage collection is always run. The percent is calculated as
-this field value out of 100.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：85 + |
imageGCLowThresholdPercentint32
|
- imageGCLowThresholdPercent is the percent of disk usage before which
+
+
当 默认值：80 + |
volumeStatsAggPeriodmeta/v1.Duration
|
- How frequently to calculate and cache volume disk usage for all pods
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："1m" + |
kubeletCgroupsstring
|
- kubeletCgroups is the absolute name of cgroups to isolate the kubelet in
-Dynamic Kubelet Config (beta): This field should not be updated without a full node
+
+
默认值："" + |
systemCgroupsstring
|
- systemCgroups is absolute name of cgroups in which to place
+
+
默认值："" + |
cgroupRootstring
|
- cgroupRoot is the root cgroup to use for pods. This is handled by the
+
+
默认值："" + |
cgroupsPerQOSbool
|
- Enable QoS based Cgroup hierarchy: top level cgroups for QoS Classes
-And all Burstable and BestEffort pods are brought up under their
-specific top level QoS cgroup.
-Dynamic Kubelet Config (beta): This field should not be updated without a full node
+
+
默认值：true + |
cgroupDriverstring
|
- driver that the kubelet uses to manipulate cgroups on the host (cgroupfs or systemd)
-Dynamic Kubelet Config (beta): This field should not be updated without a full node
+
+
默认值："cgroupfs" + |
cpuManagerPolicystring
|
- CPUManagerPolicy is the name of the policy to use.
+
+
默认值："None" + |
+
cpuManagerPolicyOptions+ map[string]string
+ |
+
+
+
默认值：nil + |
cpuManagerReconcilePeriodmeta/v1.Duration
|
- CPU Manager reconciliation period.
+
+
当 默认值："10s" + |
memoryManagerPolicy+ string
+ |
+
+
+
默认值："none" + |
+
topologyManagerPolicystring
|
- TopologyManagerPolicy is the name of the policy to use.
-Policies other than "none" require the TopologyManager feature gate to be enabled.
-Dynamic Kubelet Config (beta): This field should not be updated without a full node
+
+
如果策略不是 "none"，则要求启用
默认值："none" + |
topologyManagerScopestring
|
- TopologyManagerScope represents the scope of topology hint generation -that topology manager requests and hint providers generate. -"pod" scope requires the TopologyManager feature gate to be enabled. -Default: "container" | + +
qosReservedmap[string]string
|
- qosReserved is a set of resource name to percentage pairs that specify
+
+
默认值：nil + |
runtimeRequestTimeoutmeta/v1.Duration
|
- runtimeRequestTimeout is the timeout for all runtime requests except long running
+
+
当 默认值："2m" + |
hairpinModestring
|
- hairpinMode specifies how the Kubelet should configure the container
+
+
一般而言，用户必须设置 当 默认值："promiscuous-bridge" + |
maxPodsint32
|
- maxPods is the number of pods that can run on this Kubelet.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：110 + |
podCIDRstring
|
- The CIDR to use for pod IP addresses, only used in standalone mode.
-In cluster mode, this is obtained from the master.
-Dynamic Kubelet Config (beta): This field should always be set to the empty default.
+
+
默认值："" + |
podPidsLimitint64
|
- PodPidsLimit is the maximum number of pids in any pod.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：-1 + |
resolvConfstring
|
- ResolverConfig is the resolver configuration file used as the basis
+
+
当 默认值："/etc/resolv.conf" + |
runOncebool
|
- RunOnce causes the Kubelet to check the API server once for pods,
+
+
默认值：false + |
cpuCFSQuotabool
|
- cpuCFSQuota enables CPU CFS quota enforcement for containers that
+
+
当 默认值：true + |
cpuCFSQuotaPeriodmeta/v1.Duration
|
- CPUCFSQuotaPeriod is the CPU CFS quota period value, cpu.cfs_period_us.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："100ms" + |
nodeStatusMaxImagesint32
|
- nodeStatusMaxImages caps the number of images reported in Node.Status.Images.
+
+
注意：如果设置为 -1，则不会对镜像数量做限制；如果设置为 0，则不会返回任何镜像。 +当 默认值：50 + |
maxOpenFilesint64
|
- maxOpenFiles is Number of files that can be opened by Kubelet process.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：1000000 + |
contentTypestring
|
- contentType is contentType of requests sent to apiserver.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："application/vnd.kubernetes.protobuf" + |
kubeAPIQPSint32
|
- kubeAPIQPS is the QPS to use while talking with kubernetes apiserver
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：5 + |
kubeAPIBurstint32
|
- kubeAPIBurst is the burst to allow while talking with kubernetes apiserver
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：10 + |
serializeImagePullsbool
|
- serializeImagePulls when enabled, tells the Kubelet to pull images one
+
+
当 默认值：true + |
evictionHardmap[string]string
|
- Map of signal names to quantities that defines hard eviction thresholds. For example: {"memory.available": "300Mi"}.
+
+
当 默认值： + |
evictionSoftmap[string]string
|
- Map of signal names to quantities that defines soft eviction thresholds.
-For example: {"memory.available": "300Mi"}.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：nil + |
evictionSoftGracePeriodmap[string]string
|
- Map of signal names to quantities that defines grace periods for each soft eviction signal.
-For example: {"memory.available": "30s"}.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：nil + |
evictionPressureTransitionPeriodmeta/v1.Duration
|
- Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："5m" + |
evictionMaxPodGracePeriodint32
|
- Maximum allowed grace period (in seconds) to use when terminating pods in
-response to a soft eviction threshold being met. This value effectively caps
-the Pod's TerminationGracePeriodSeconds value during soft evictions.
+
+
注意：由于 Issue #64530 的原因，系统中存在一个缺陷，即此处所设置的值会在软性逐出时覆盖 +Pod 的宽限期设置，从而有可能增加 Pod 上原本设置的宽限期限时长。 +这个缺陷会在未来版本中修复。 +当 默认值：0 + |
evictionMinimumReclaimmap[string]string
|
- Map of signal names to quantities that defines minimum reclaims, which describe the minimum
-amount of a given resource the kubelet will reclaim when performing a pod eviction while
-that resource is under pressure. For example: {"imagefs.available": "2Gi"}
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：nil + |
podsPerCoreint32
|
- podsPerCore is the maximum number of pods per core. Cannot exceed MaxPods.
-If 0, this field is ignored.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：0 + |
enableControllerAttachDetachbool
|
- enableControllerAttachDetach enables the Attach/Detach controller to
+
+
当 默认值：true + |
protectKernelDefaultsbool
|
- protectKernelDefaults, if true, causes the Kubelet to error if kernel
+
+
当 默认值：false + |
makeIPTablesUtilChainsbool
|
- If true, Kubelet ensures a set of iptables rules are present on host.
-These rules will serve as utility rules for various components, e.g. KubeProxy.
-The rules will be created based on IPTablesMasqueradeBit and IPTablesDropBit.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：true + |
iptablesMasqueradeBitint32
|
- iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT
+
+
警告：请确保此值设置与 kube-proxy 中对应的参数设置取值相同。 +当 默认值：14 + |
iptablesDropBitint32
|
- iptablesDropBit is the bit of the iptables fwmark space to mark for dropping packets.
+
+
当 默认值：15 + |
featureGatesmap[string]bool
|
- featureGates is a map of feature names to bools that enable or disable alpha/experimental
+
+
当 默认值：nil + |
failSwapOnbool
|
- failSwapOn tells the Kubelet to fail to start if swap is enabled on the node.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：true + |
memorySwap+ MemorySwapConfiguration
+ |
+
+
+
|
+
containerLogMaxSizestring
|
- A quantity defines the maximum size of the container log file before it is rotated.
-For example: "5Mi" or "256Ki".
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："10Mi" + |
containerLogMaxFilesint32
|
- Maximum number of container log files that can be present for a container.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："5" + |
configMapAndSecretChangeDetectionStrategyResourceChangeDetectionStrategy
|
- ConfigMapAndSecretChangeDetectionStrategy is a mode in which -config map and secret managers are running. -Default: "Watch" | + +
systemReservedmap[string]string
|
- systemReserved is a set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G)
+
+
目前仅支持 CPU 和内存。更多细节可参见 http://kubernetes.io/zh/docs/user-guide/compute-resources。 +当 默认值：Nil + |
kubeReservedmap[string]string
|
- A set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs
+
+
当 默认值：Nil + |
reservedSystemCPUs [Required]+ + | |
reservedSystemCPUs [必需]string
|
- This ReservedSystemCPUs option specifies the cpu list reserved for the host level system threads and kubernetes related threads. -This provide a "static" CPU list rather than the "dynamic" list by system-reserved and kube-reserved. -This option overwrites CPUs provided by system-reserved and kube-reserved. | + +
showHiddenMetricsForVersionstring
|
- The previous version for which you want to show hidden metrics.
+
+
默认值："" + |
systemReservedCgroupstring
|
- This flag helps kubelet identify absolute name of top level cgroup used to enforce `SystemReserved` compute resource reservation for OS system daemons.
-Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information.
-Dynamic Kubelet Config (beta): This field should not be updated without a full node
+
+
默认值："" + |
kubeReservedCgroupstring
|
- This flag helps kubelet identify absolute name of top level cgroup used to enforce `KubeReserved` compute resource reservation for Kubernetes node system daemons.
-Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information.
-Dynamic Kubelet Config (beta): This field should not be updated without a full node
+
+
默认值："" + |
enforceNodeAllocatable[]string
|
- This flag specifies the various Node Allocatable enforcements that Kubelet needs to perform.
-This flag accepts a list of options. Acceptable options are `none`, `pods`, `system-reserved` & `kube-reserved`.
-If `none` is specified, no other options may be specified.
-Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+ 此标志设置 kubelet 需要执行的各类节点可分配资源策略。此字段接受一组选项列表。
+可接受的选项有 如果设置了 如果列表中包含 如果列表中包含 这个字段只有在 参阅Node Allocatable +了解进一步的信息。 +当 默认值：["pods"] + |
allowedUnsafeSysctls[]string
|
- A comma separated whitelist of unsafe sysctls or sysctl patterns (ending in ∗). -Unsafe sysctl groups are kernel.shm∗, kernel.msg∗, kernel.sem, fs.mqueue.∗, and net.∗. -These sysctls are namespaced but not allowed by default. For example: "kernel.msg∗,net.ipv4.route.min_pmtu" -Default: [] | + +
volumePluginDirstring
|
- volumePluginDir is the full path of the directory in which to search
+
+
当 默认值："/usr/libexec/kubernetes/kubelet-plugins/volume/exec/" + |
providerIDstring
|
- providerID, if set, sets the unique id of the instance that an external provider (i.e. cloudprovider)
-can use to identify a specific node.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值："" + |
kernelMemcgNotificationbool
|
- kernelMemcgNotification, if set, the kubelet will integrate with the kernel memcg notification
-to determine if memory eviction thresholds are crossed rather than polling.
-Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
+
+
当 默认值：false + |
logging [Required]+ + | |
logging [必需]LoggingConfiguration
|
- Logging specifies the options of logging. -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. -Defaults: - Format: text | + +
enableSystemLogHandlerbool
|
- enableSystemLogHandler enables system logs via web interface host:port/logs/ -Default: true | + +
shutdownGracePeriodmeta/v1.Duration
|
- ShutdownGracePeriod specifies the total duration that the node should delay the shutdown and total grace period for pod termination during a node shutdown. -Default: "30s" | + +
shutdownGracePeriodCriticalPodsmeta/v1.Duration
|
- ShutdownGracePeriodCriticalPods specifies the duration used to terminate critical pods during a node shutdown. This should be less than ShutdownGracePeriod. -For example, if ShutdownGracePeriod=30s, and ShutdownGracePeriodCriticalPods=10s, during a node shutdown the first 20 seconds would be reserved for gracefully terminating normal pods, and the last 10 seconds would be reserved for terminating critical pods. -Default: "10s" | + +
shutdownGracePeriodByPodPriority+ []ShutdownGracePeriodByPodPriority
+ |
+
+
+
数组中的每个表项代表的是节点关闭时 Pod 的体面终止时间；这里的 Pod +的优先级类介于列表中当前优先级类值和下一个表项的优先级类值之间。 +例如，要赋予关键 Pod 10 秒钟时间来关闭，赋予优先级>=10000 Pod 20 秒钟时间来关闭， +赋予其余的 Pod 30 秒钟来关闭。 +shutdownGracePeriodByPodPriority: +
在退出之前，kubelet 要等待的时间上限为节点上所有优先级类的
+ 当 默认值：nil + |
+
reservedMemory+ []MemoryReservation
+ |
+
+
+
此参数仅在内存管理器功能特性语境下有意义。内存管理器不会为容器负载分配预留内存。
+例如，如果你的 NUMA0 节点内存为 10Gi， 你可以设置不同数量的 NUMA 节点和内存类型。你也可以完全忽略这个字段，不过你要清楚， +所有 NUMA 节点上预留内存的总量要等于通过 +node allocatable +设置的内存量。 +如果至少有一个节点可分配参数设置值非零，则你需要设置至少一个 NUMA 节点。 +此外，避免如下设置： +
默认值：nil + |
+
enableProfilingHandler+ bool
+ |
+
+
+
默认值：true + |
+
enableDebugFlagsHandler+ bool
+ |
+
+
+
默认值：true + |
+
seccompDefault+ bool
+ |
+
+
+
默认值：false + |
+
memoryThrottlingFactor+ float64
+ |
+
+
+ 当设置 cgroupv2 减小此系数会为容器控制组设置较低的 high 限制值，从而增大回收压力；反之， +增大此系数会降低回收压力。更多细节参见 http://kep.k8s.io/2570。 +默认值：0.8 + |
+
registerWithTaints+ []core/v1.Taint
+ |
+
+
+
默认值：nil + |
+
registerNode+ bool
+ |
+
+
+
默认值：true + |
| Field | Description |
|---|---|
| 字段 | 描述 |
apiVersionstring | kubelet.config.k8s.io/v1beta1 |
kindstring | SerializedNodeConfigSource |
source- core/v1.NodeConfigSource
+core/v1.NodeConfigSource
|
- Source is the source that we are serializing | + +
| Field | Description |
|---|---|
| 字段 | 描述 |
enabledbool
|
- enabled allows anonymous requests to the kubelet server. -Requests that are not rejected by another authentication method are treated as anonymous requests. -Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated. | + +
| Field | Description |
|---|---|
| 字段 | 描述 |
x509KubeletX509Authentication
|
- x509 contains settings related to x509 client certificate authentication | + +
webhookKubeletWebhookAuthentication
|
- webhook contains settings related to webhook bearer token authentication | + +
anonymousKubeletAnonymousAuthentication
|
- anonymous contains settings related to anonymous authentication | + +
| Field | Description |
|---|---|
| 字段 | 描述 |
modeKubeletAuthorizationMode
|
- mode is the authorization mode to apply to requests to the kubelet server. -Valid values are AlwaysAllow and Webhook. -Webhook mode uses the SubjectAccessReview API to determine authorization. | + +
webhookKubeletWebhookAuthorization
|
- webhook contains settings related to Webhook authorization. | + +
| Field | Description |
|---|---|
| 字段 | 描述 |
enabledbool
|
- enabled allows bearer token authentication backed by the tokenreviews.authentication.k8s.io API | + +
cacheTTLmeta/v1.Duration
|
- cacheTTL enables caching of authentication results | + +
| Field | Description |
|---|---|
| 字段 | 描述 |
cacheAuthorizedTTLmeta/v1.Duration
|
- cacheAuthorizedTTL is the duration to cache 'authorized' responses from the webhook authorizer. | + +
cacheUnauthorizedTTLmeta/v1.Duration
|
- cacheUnauthorizedTTL is the duration to cache 'unauthorized' responses from the webhook authorizer. | + +
| Field | Description |
|---|---|
| 字段 | 描述 |
clientCAFilestring
|
- clientCAFile is the path to a PEM-encoded certificate bundle. If set, any request presenting a client certificate -signed by one of the authorities in the bundle is authenticated with a username corresponding to the CommonName, -and groups corresponding to the Organization in the client certificate. | + +
| Field | Description |
|---|---|
| 字段 | 描述 |
format [Required]+ | |
numaNode [必需]+ int32
+ |
+
+
+ NUMA 节点 + |
+
limits [必需]+ core/v1.ResourceList
+ |
+
+
+ 资源列表 + |
+
| 字段 | 描述 |
|---|---|
swapBehaviorstring
|
- Format Flag specifies the structure of log messages. -default value of format is `text` | + +
sanitization [Required]+ |
| 字段 | 描述 |
|---|---|
priority [必需]+ int32
+ |
+
+
+
|
+
shutdownGracePeriodSeconds [必需]+ int64
+ |
+
+
+
|
+
+ +FormatOptions 包含为不同日志格式提供的选项。 +
+ +| 字段 | 描述 |
|---|---|
json [必需]+ JSONOptions
+ |
+
+
+ [试验功能] |
+
+ +JSONOptions 包含为 "json" 日志格式提供的选项。 +
+ +| 字段 | 描述 |
|---|---|
splitStream [必需]bool
|
- [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). -Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`) | +
infoBufferSize [必需]+ k8s.io/apimachinery/pkg/api/resource.QuantityValue
+ |
+
+
+
+ [试验功能] |
| 字段 | 描述 |
|---|---|
format [必需]+ string
+ |
+
+
+
+ |
+
flushFrequency [必需]+ time.Duration
+ |
+
+ + + 对日志进行清洗的最大间隔秒数。如果所选的日志后端在写入日志消息时不提供缓存， +则此配置会被忽略。 + + |
+
verbosity [必需]+ uint32
+ |
+
+
+
+ |
+
vmodule [必需]+ VModuleConfiguration
+ |
+
+
+
+ |
+
sanitization [必需]+ bool
+ |
+
+ + + [试验功能] 当启用此选项时，被标记为敏感的字段（密码、秘钥、令牌）不会被日志记录。 +运行时日志过滤功能可能会引入非常大的计算开销，因此在生产环境中不应启用。 + + |
+
options [必需]+ FormatOptions
+ |
+
+
+
+ [试验功能] |
+