From 93e202cd5f6e1372120e69ffc9a203ed0f28301a Mon Sep 17 00:00:00 2001 From: Mayo Date: Sun, 10 Oct 2021 18:25:27 +0800 Subject: [PATCH] [zh] update concept policy --- .../zh/docs/concepts/policy/pid-limiting.md | 21 ++-- .../concepts/policy/pod-security-policy.md | 117 +++++++++++++++--- .../docs/concepts/policy/resource-quotas.md | 38 +++--- 3 files changed, 137 insertions(+), 39 deletions(-) diff --git a/content/zh/docs/concepts/policy/pid-limiting.md b/content/zh/docs/concepts/policy/pid-limiting.md index 212146208a..9e69357b13 100644 --- a/content/zh/docs/concepts/policy/pid-limiting.md +++ b/content/zh/docs/concepts/policy/pid-limiting.md @@ -17,7 +17,8 @@ weight: 40 {{< feature-state for_k8s_version="v1.20" state="stable" >}} @@ -155,8 +156,8 @@ gate](/docs/reference/command-line-tools-reference/feature-gates/) Kubernetes allows you to limit the number of processes running in a Pod. You specify this limit at the node level, rather than configuring it as a resource limit for a particular Pod. Each Node can have a different PID limit. -To configure the limit, you can specify the command line parameter -`--pod-max-pids` to the kubelet, or set `PodPidsLimit` in the kubelet +To configure the limit, you can specify the command line parameter `--pod-max-pids` +to the kubelet, or set `PodPidsLimit` in the kubelet [configuration file](/docs/tasks/administer-cluster/kubelet-config-file/). --> ## Pod 级别 PID 限制 {#pod-pid-limits} @@ -183,9 +184,12 @@ the [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) ## PID based eviction You can configure kubelet to start terminating a Pod when it is misbehaving and consuming abnormal amount of resources. -This feature is called eviction. You can [Configure Out of Resource Handling](/docs/tasks/administer-cluster/out-of-resource) for various eviction signals. +This feature is called eviction. You can +[Configure Out of Resource Handling](/docs/concepts/scheduling-eviction/node-pressure-eviction/) +for various eviction signals. Use `pid.available` eviction signal to configure the threshold for number of PIDs used by Pod. -You can set soft and hard eviction policies. However, even with the hard eviction policy, if the number of PIDs growing very fast, +You can set soft and hard eviction policies. +However, even with the hard eviction policy, if the number of PIDs growing very fast, node can still get into unstable state by hitting the node PIDs limit. Eviction signal value is calculated periodically and does NOT enforce the limit. --> @@ -219,9 +223,10 @@ Pod 行为不正常而没有 PID 可用。 - 参阅 [PID 约束改进文档](https://github.com/kubernetes/enhancements/blob/097b4d8276bc9564e56adf72505d43ce9bc5e9e8/keps/sig-node/20190129-pid-limiting.md) 以了解更多信息。 @@ -229,5 +234,5 @@ Pod 行为不正常而没有 PID 可用。 [Kubernetes 1.14 中限制进程 ID 以提升稳定性](/blog/2019/04/15/process-id-limiting-for-stability-improvements-in-kubernetes-1.14/) 的博文。 - 请阅读[为容器管理资源](/zh/docs/concepts/configuration/manage-resources-containers/)。 -- 学习如何[配置资源不足情况的处理](/zh/docs/tasks/administer-cluster/out-of-resource)。 +- 学习如何[配置资源不足情况的处理](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/)。 diff --git a/content/zh/docs/concepts/policy/pod-security-policy.md b/content/zh/docs/concepts/policy/pod-security-policy.md index 46db85215e..813bfce688 100644 --- a/content/zh/docs/concepts/policy/pod-security-policy.md +++ b/content/zh/docs/concepts/policy/pod-security-policy.md @@ -15,9 +15,11 @@ weight: 30 {{< feature-state for_k8s_version="v1.21" state="deprecated" >}} PodSecurityPolicy 在 Kubernetes v1.21 版本中被弃用，将在 v1.25 中删除。 +关于弃用的更多信息，请查阅 [PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/)。 ## 启用 Pod 安全策略 -Pod 安全策略实现为一种可选（但是建议启用）的 +Pod 安全策略实现为一种可选的 [准入控制器](/zh/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy)。 [启用了准入控制器](/zh/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-on-an-admission-control-plug-in) 即可强制实施 Pod 安全策略，不过如果没有授权认可策略之前即启用 @@ -206,7 +207,11 @@ roleRef: name: apiGroup: rbac.authorization.k8s.io subjects: -# Authorize specific service accounts: +# Authorize all service accounts in a namespace (recommended): +- kind: Group + apiGroup: rbac.authorization.k8s.io + name: system:serviceaccounts: +# Authorize specific service accounts (not recommended): - kind: ServiceAccount name: namespace: @@ -222,20 +227,24 @@ subjects: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: <绑定名称> + name: roleRef: kind: ClusterRole - name: <角色名称> + name: apiGroup: rbac.authorization.k8s.io subjects: -# 授权特定的服务账号 +# 授权命名空间下的所有服务账号（推荐）： +- kind: Group + apiGroup: rbac.authorization.k8s.io + name: system:serviceaccounts: +# 授权特定的服务账号（不建议这样操作）： - kind: ServiceAccount - name: <要授权的服务账号名称> + name: namespace: -# 授权特定的用户（不建议这样操作） +# 授权特定的用户（不建议这样操作）： - kind: User apiGroup: rbac.authorization.k8s.io - name: <要授权的用户名> + name: ``` +## 推荐实践 {#recommended-practice} + +PodSecurityPolicy 正在被一个新的、简化的 `PodSecurity` {{< glossary_tooltip +text="准入控制器" term_id="admission-controller" >}}替代。 +有关此变更的更多详细信息，请参阅 [PodSecurityPolicy Deprecation: Past, Present, and +Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/)。 +参照下述指导，简化从 PodSecurityPolicy 迁移到新的准入控制器步骤： + + +1. 将 PodSecurityPolicies 限制为 [Pod 安全性标准](/zh/docs/concepts/security/pod-security-standards)所定义的策略： + - {{< example file="policy/privileged-psp.yaml" >}}Privileged{{< /example >}} + - {{< example file="policy/baseline-psp.yaml" >}}Baseline{{< /example >}} + - {{< example file="policy/restricted-psp.yaml" >}}Restricted{{< /example >}} +2. 通过配置 `system:serviceaccounts:` 组（`` 是目标命名空间），仅将 PSP 绑定到整个命名空间。示例： + + ```yaml + apiVersion: rbac.authorization.k8s.io/v1 + # This cluster role binding allows all pods in the "development" namespace to use the baseline PSP. + kind: ClusterRoleBinding + metadata: + name: psp-baseline-namespaces + roleRef: + kind: ClusterRole + name: psp-baseline + apiGroup: rbac.authorization.k8s.io + subjects: + - kind: Group + name: system:serviceaccounts:development + apiGroup: rbac.authorization.k8s.io + - kind: Group + name: system:serviceaccounts:canary + apiGroup: rbac.authorization.k8s.io + ``` + +- 参阅 [PodSecurityPolicy Deprecation: Past, Present, and + Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/)，了解 Pod 安全策略的未来。 + - 参阅[Pod 安全标准](/zh/docs/concepts/security/pod-security-standards/) 了解策略建议。 - 阅读 [Pod 安全策略参考](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy)了解 API 细节。 diff --git a/content/zh/docs/concepts/policy/resource-quotas.md b/content/zh/docs/concepts/policy/resource-quotas.md index 23cc9a2308..8d7cba6884 100644 --- a/content/zh/docs/concepts/policy/resource-quotas.md +++ b/content/zh/docs/concepts/policy/resource-quotas.md @@ -102,8 +102,9 @@ Neither contention nor changes to quota will affect already created resources. ## 启用资源配额 @@ -122,7 +123,9 @@ ResourceQuota in that namespace. ## 计算资源配额 @@ -249,7 +252,9 @@ In release 1.8, quota support for local ephemeral storage is added as an alpha f {{< note >}} 如果所使用的是 CRI 容器运行时，容器日志会被计入临时存储配额。 这可能会导致存储配额耗尽的 Pods 被意外地驱逐出节点。 @@ -382,7 +387,7 @@ Resources specified on the quota outside of the allowed set results in a validat | `NotTerminating` | Match pods where `.spec.activeDeadlineSeconds is nil` | | `BestEffort` | Match pods that have best effort quality of service. | | `NotBestEffort` | Match pods that do not have best effort quality of service. | -| `PriorityClass` | Match pods that references the specified [priority class](/docs/concepts/configuration/pod-priority-preemption). | +| `PriorityClass` | Match pods that references the specified [priority class](/docs/concepts/scheduling-eviction/pod-priority-preemption). | | `CrossNamespacePodAffinity` | Match pods that have cross-namespace pod [(anti)affinity terms](/docs/concepts/scheduling-eviction/assign-pod-node). | --> | 作用域 | 描述 | @@ -391,7 +396,7 @@ Resources specified on the quota outside of the allowed set results in a validat | `NotTerminating` | 匹配所有 `spec.activeDeadlineSeconds` 是 nil 的 Pod。 | | `BestEffort` | 匹配所有 Qos 是 BestEffort 的 Pod。 | | `NotBestEffort` | 匹配所有 Qos 不是 BestEffort 的 Pod。 | -| `PriorityClass` | 匹配所有引用了所指定的[优先级类](/zh/docs/concepts/configuration/pod-priority-preemption)的 Pods。 | +| `PriorityClass` | 匹配所有引用了所指定的[优先级类](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption)的 Pods。 | | `CrossNamespacePodAffinity` | 匹配那些设置了跨名字空间 [（反）亲和性条件](/zh/docs/concepts/scheduling-eviction/assign-pod-node)的 Pod。 | -Pod 可以创建为特定的[优先级](/zh/docs/concepts/configuration/pod-priority-preemption/#pod-priority)。 +Pod 可以创建为特定的[优先级](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority)。 通过使用配额规约中的 `scopeSelector` 字段，用户可以根据 Pod 的优先级控制其系统资源消耗。 如果配额对象通过 `scopeSelector` 字段设置其作用域为优先级类，则配额对象只能 跟踪以下资源： @@ -702,7 +708,7 @@ pods 0 10 --> ### 跨名字空间的 Pod 亲和性配额 {#cross-namespace-pod-affinity-quota} -{{< feature-state for_k8s_version="v1.21" state="alpha" >}} +{{< feature-state for_k8s_version="v1.22" state="beta" >}} -此功能特性处于 Alpha 阶段，默认被禁用。你可以通过为 kube-apiserver 和 +此功能特性处于 Beta 阶段，默认被禁用。你可以通过为 kube-apiserver 和 kube-scheduler 设置 [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/) `PodAffinityNamespaceSelector` 来启用此特性。 @@ -868,7 +874,7 @@ kubectl create -f ./object-counts.yaml --namespace=myspace kubectl get quota --namespace=myspace ``` -``` +```none NAME AGE compute-resources 30s object-counts 32s @@ -878,7 +884,7 @@ object-counts 32s kubectl describe quota compute-resources --namespace=myspace ``` -``` +```none Name: compute-resources Namespace: myspace Resource Used Hard @@ -894,7 +900,7 @@ requests.nvidia.com/gpu 0 4 kubectl describe quota object-counts --namespace=myspace ``` -``` +```none Name: object-counts Namespace: myspace Resource Used Hard @@ -1034,7 +1040,7 @@ Then, create a resource quota object in the `kube-system` namespace: kubectl apply -f https://k8s.io/examples/policy/priority-class-resourcequota.yaml -n kube-system ``` -``` +```none resourcequota/pods-cluster-services created ```