Merge branch 'kubernetes:main' into patch-1

pull/43115/head
Ananya Nayak 2023-09-20 08:15:31 +05:30 committed by GitHub
commit ad68e2d2a7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
16 changed files with 234 additions and 143 deletions

View File

@ -274,16 +274,11 @@ After 15 seconds, view Pod events to verify that the liveness check has not fail
kubectl describe pod etcd-with-grpc
```
Before Kubernetes 1.23, gRPC health probes were often implemented using
[grpc-health-probe](https://github.com/grpc-ecosystem/grpc-health-probe/),
as described in the blog post
[Health checking gRPC servers on Kubernetes](/blog/2018/10/01/health-checking-grpc-servers-on-kubernetes/).
The built-in gRPC probe's behavior is similar to the one implemented by grpc-health-probe.
When migrating from grpc-health-probe to built-in probes, remember the following differences:
When using a gRPC probe, there are some technical details to be aware of:
- Built-in probes run against the pod IP address, unlike grpc-health-probe that often runs against
`127.0.0.1`. Be sure to configure your gRPC endpoint to listen on the Pod's IP address.
- Built-in probes do not support any authentication parameters (like `-tls`).
- The probes run against the pod IP address or its hostname.
Be sure to configure your gRPC endpoint to listen on the Pod's IP address.
- The probes do not support any authentication parameters (like `-tls`).
- There are no error codes for built-in probes. All errors are considered as probe failures.
- If `ExecProbeTimeout` feature gate is set to `false`, grpc-health-probe does **not**
respect the `timeoutSeconds` setting (which defaults to 1s), while built-in probe would fail on timeout.
@ -425,23 +420,6 @@ liveness and readiness checks:
See [probe-level `terminationGracePeriodSeconds`](#probe-level-terminationgraceperiodseconds)
for more detail.
{{< note >}}
Before Kubernetes 1.20, the field `timeoutSeconds` was not respected for exec probes:
probes continued running indefinitely, even past their configured deadline,
until a result was returned.
This defect was corrected in Kubernetes v1.20. You may have been relying on the previous behavior,
even without realizing it, as the default timeout is 1 second.
As a cluster administrator, you can disable the [feature gate](/docs/reference/command-line-tools-reference/feature-gates/)
`ExecProbeTimeout` (set it to `false`) on each kubelet to restore the behavior from older versions,
then remove that override once all the exec probes in the cluster have a `timeoutSeconds` value set.
If you have pods that are impacted from the default 1 second timeout, you should update their
probe timeout so that you're ready for the eventual removal of that feature gate.
With the fix of the defect, for exec probes, on Kubernetes `1.20+` with the `dockershim` container runtime,
the process inside the container may keep running even after probe returned failure because of the timeout.
{{< /note >}}
{{< caution >}}
Incorrect implementation of readiness probes may result in an ever growing number
of processes in the container, and resource starvation if this is left unchecked.
@ -518,34 +496,19 @@ to resolve it.
{{< feature-state for_k8s_version="v1.28" state="stable" >}}
Prior to release 1.21, the Pod-level `terminationGracePeriodSeconds` was used
for terminating a container that failed its liveness or startup probe. This
coupling was unintended and may have resulted in failed containers taking an
unusually long time to restart when a Pod-level `terminationGracePeriodSeconds`
was set.
In 1.25 and above, users can specify a probe-level `terminationGracePeriodSeconds`
as part of the probe specification. When both a pod- and probe-level
`terminationGracePeriodSeconds` are set, the kubelet will use the probe-level value.
{{< note >}}
Beginning in Kubernetes 1.25, the `ProbeTerminationGracePeriod` feature is enabled
by default. For users choosing to disable this feature, please note the following:
When setting the `terminationGracePeriodSeconds`, please note the following:
* The `ProbeTerminationGracePeriod` feature gate is only available on the API Server.
The kubelet always honors the probe-level `terminationGracePeriodSeconds` field if
* The kubelet always honors the probe-level `terminationGracePeriodSeconds` field if
it is present on a Pod.
* If you have existing Pods where the `terminationGracePeriodSeconds` field is set and
you no longer wish to use per-probe termination grace periods, you must delete
those existing Pods.
* When you or the control plane, or some other components create replacement
Pods, and the feature gate `ProbeTerminationGracePeriod` is disabled, then the
API server ignores the Probe-level `terminationGracePeriodSeconds` field, even if
a Pod or pod template specifies it.
{{< /note >}}
For example:
```yaml

View File

@ -280,7 +280,7 @@ Depending on how you installed `kubectl`, use one of the following methods.
1. Locate the `kubectl` binary on your system:
```bash
where kubectl
which kubectl
```
1. Remove the `kubectl` binary:

View File

@ -6,6 +6,7 @@ spec:
containers:
- name: busybox-cnt01
image: busybox:1.28
command: ["sleep", "3600"]
resources:
limits:
memory: "300Mi"

View File

@ -9,6 +9,7 @@ spec:
image: nginx
- name: shell
image: busybox:1.28
command: ["sleep", "3600"]
securityContext:
capabilities:
add:

View File

@ -6,6 +6,7 @@ spec:
containers:
- name: container-test
image: busybox:1.28
command: ["sleep", "3600"]
volumeMounts:
- name: all-in-one
mountPath: "/projected-volume"

View File

@ -6,6 +6,7 @@ spec:
containers:
- name: container-test
image: busybox:1.28
command: ["sleep", "3600"]
volumeMounts:
- name: all-in-one
mountPath: "/projected-volume"

View File

@ -6,6 +6,7 @@ spec:
containers:
- name: container-test
image: busybox:1.28
command: ["sleep", "3600"]
volumeMounts:
- name: token-vol
mountPath: "/service-account"

View File

@ -497,9 +497,9 @@ Resources is a list of resources this rule applies to.
<p>For example:
'pods' matches pods.
'pods/log' matches the log subresource of pods.
'<em>' matches all resources and their subresources.
'pods/</em>' matches all subresources of pods.
'*/scale' matches all scale subresources.</p>
'&ast;' matches all resources and their subresources.
'pods/&ast;' matches all subresources of pods.
'&ast;/scale' matches all scale subresources.</p>
-->
<p>例如:</p>
<ul>
@ -767,10 +767,10 @@ PolicyRule 包含一个映射,基于元数据将请求映射到某审计级别
<td>
<!--
NonResourceURLs is a set of URL paths that should be audited.
<em>s are allowed, but only as the full, final step in the path.
&ast;s are allowed, but only as the full, final step in the path.
Examples:
&quot;/metrics&quot; - Log requests for apiserver metrics
&quot;/healthz</em>&quot; - Log all health checks</p>
&quot;/healthz&ast;&quot; - Log all health checks</p>
-->
<p>

View File

@ -145,7 +145,7 @@ kubeadm 所提供的默认值在必要时也会保证其在多个组件之间是
<!--
<p>Users are always allowed to override default values, with the only exception of a small subset of setting with
relevance for security (e.g. enforce authorization-mode Node and RBAC on api server)</p>
relevance for security (e.g. enforce authorization-mode Node and RBAC on api server).</p>
<p>If the user provides a configuration types that is not expected for the action you are performing, kubeadm will
ignore those types and print a warning.</p>
-->
@ -1409,7 +1409,7 @@ HostPathMount contains elements describing volumes that are mounted from the hos
</td>
</tr>
<tr><td><code>pathType</code><br/>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#hostpathtype-v1-core"><code>core/v1.HostPathType</code></a>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#hostpathtype-v1-core"><code>core/v1.HostPathType</code></a>
</td>
<td>
<!--
@ -1700,14 +1700,14 @@ Defaults to the hostname of the node if not provided.
<td>
<!--
<code>criSocket</code> is used to retrieve container runtime info.
This information will be annotated to the Node API object, for later re-use
This information will be annotated to the Node API object, for later re-use.
-->
<p><code>criSocket</code> 用来读取容器运行时的信息。
此信息会被以注解的方式添加到 Node API 对象至上,用于后续用途。</p>
</td>
</tr>
<tr><td><code>taints</code> <B><!--[Required]-->[必需]</B><br/>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#taint-v1-core"><code>[]core/v1.Taint</code></a>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#taint-v1-core"><code>[]core/v1.Taint</code></a>
</td>
<td>
<!--
@ -1750,14 +1750,19 @@ command line except without leading dash(es).
<td>
<!--
<code>ignorePreflightErrors</code> provides a list of pre-flight errors to be ignored when
the current node is registered.
the current node is registered, e.g.
<code>IsPrevilegedUser,Swap</code>.
Value <code>all</code> ignores errors from all checks.
-->
<p><code>ignorePreflightErrors</code> 提供一组在当前节点被注册时可以
忽略掉的预检错误。</p>
<p>
<code>ignorePreflightErrors</code> 提供一组在当前节点被注册时可以忽略掉的预检错误。
例如:<code>IsPrevilegedUser,Swap</code>
取值 <code>all</code> 忽略所有检查的错误。
</p>
</td>
</tr>
<tr><td><code>imagePullPolicy</code><br/>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#pullpolicy-v1-core"><code>core/v1.PullPolicy</code></a>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#pullpolicy-v1-core"><code>core/v1.PullPolicy</code></a>
</td>
<td>
<!--
@ -1881,7 +1886,7 @@ for, so other administrators can know its purpose.
</td>
</tr>
<tr><td><code>expires</code><br/>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#time-v1-meta"><code>meta/v1.Time</code></a>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#time-v1-meta"><code>meta/v1.Time</code></a>
</td>
<td>
<!--

View File

@ -132,9 +132,9 @@ auth 是一个映射,包含传递给 kubelet 的身份验证信息。
<!--
Each key in the map is a pattern which can optionally contain a port and a path.
Globs can be used in the domain, but not in the port or the path. Globs are supported
as subdomains like <code>&ast;.k8s.io</code> or <code>k8s.&ast;.io</code>, and top-level-domains such as <code>k8s.&ast;</code>.
Matching partial subdomains like <code>app&ast;.k8s.io</code> is also supported. Each glob can only match
a single subdomain segment, so <code>&ast;.io</code> does not match <code>&ast;.k8s.io</code>.</p>
as subdomains like '&ast;.k8s.io' or 'k8s.&ast;.io', and top-level-domains such as 'k8s.&ast;'.
Matching partial subdomains like 'app&ast;.k8s.io' is also supported. Each glob can only match
a single subdomain segment, so &ast;.io does not match &ast;.k8s.io.</p>
-->
<p>
映射中的每个主键都可以包含端口和路径。

View File

@ -0,0 +1,8 @@
---
title: 外部 API
weight: 135
---
<!--
title: External APIs
weight: 135
-->

View File

@ -0,0 +1,164 @@
---
title: Kubernetes External Metrics (v1beta1)
content_type: tool-reference
package: external.metrics.k8s.io/v1beta1
---
<!--
title: Kubernetes External Metrics (v1beta1)
content_type: tool-reference
package: external.metrics.k8s.io/v1beta1
auto_generated: true
-->
<p>
<!--
Package v1beta1 is the v1beta1 version of the external metrics API.
-->
v1beta1 包是 v1beta1 版本的外部指标 API。
</p>
<!--
## Resource Types
-->
## 资源类型 {#resource-types}
- [ExternalMetricValue](#external-metrics-k8s-io-v1beta1-ExternalMetricValue)
- [ExternalMetricValueList](#external-metrics-k8s-io-v1beta1-ExternalMetricValueList)
## `ExternalMetricValue` {#external-metrics-k8s-io-v1beta1-ExternalMetricValue}
<!--
**Appears in:**
-->
**出现在:**
- [ExternalMetricValueList](#external-metrics-k8s-io-v1beta1-ExternalMetricValueList)
<p>
<!--
ExternalMetricValue is a metric value for external metric
A single metric value is identified by metric name and a set of string labels.
For one metric there can be multiple values with different sets of labels.
-->
ExternalMetricValue 是外部指标的一个度量值。
单个度量值由指标名称和一组字符串标签标识。
对于一个指标,可以有多个具有不同标签集的值。
</p>
<table class="table">
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
<tbody>
<tr><td><code>apiVersion</code><br/>string</td><td><code>external.metrics.k8s.io/v1beta1</code></td></tr>
<tr><td><code>kind</code><br/>string</td><td><code>ExternalMetricValue</code></td></tr>
<tr><td><code>metricName</code> <B><!--[Required]-->[必需]</B><br/>
<code>string</code>
</td>
<td>
<p>
<!--
the name of the metric
-->
指标的名称。
</p>
</td>
</tr>
<tr><td><code>metricLabels</code> <B><!--[Required]-->[必需]</B><br/>
<code>map[string]string</code>
</td>
<td>
<p>
<!--
a set of labels that identify a single time series for the metric
-->
用于标识指标的单个时间序列的标签集。
</p>
</td>
</tr>
<tr><td><code>timestamp</code> <B><!--[Required]-->[必需]</B><br/>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#time-v1-meta"><code>meta/v1.Time</code></a>
</td>
<td>
<p>
<!--
indicates the time at which the metrics were produced
-->
标明这些度量值生成的时间。
</p>
</td>
</tr>
<tr><td><code>window</code> <B><!--[Required]-->[必需]</B><br/>
<code>int64</code>
</td>
<td>
<p>
<!--
indicates the window ([Timestamp-Window, Timestamp]) from
which these metrics were calculated, when returning rate
metrics calculated from cumulative metrics (or zero for
non-calculated instantaneous metrics).
-->
当返回根据累积度量计算的速率度量值时,此字段标明计算这些度量值的时间窗口
[Timestamp-Window, Timestamp])(或对于非计算的瞬时度量值为零)。
</p>
</td>
</tr>
<tr><td><code>value</code> <B><!--[Required]-->[必需]</B><br/>
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/api/resource#Quantity"><code>k8s.io/apimachinery/pkg/api/resource.Quantity</code></a>
</td>
<td>
<p>
<!--
the value of the metric
-->
度量值。
</p>
</td>
</tr>
</tbody>
</table>
## `ExternalMetricValueList` {#external-metrics-k8s-io-v1beta1-ExternalMetricValueList}
<p>
<!--
ExternalMetricValueList is a list of values for a given metric for some set labels
-->
ExternalMetricValueList 是某个给定指标的某些标签集的数值列表。
</p>
<table class="table">
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
<tbody>
<tr><td><code>apiVersion</code><br/>string</td><td><code>external.metrics.k8s.io/v1beta1</code></td></tr>
<tr><td><code>kind</code><br/>string</td><td><code>ExternalMetricValueList</code></td></tr>
<tr><td><code>metadata</code> <B><!--[Required]-->[必需]</B><br/>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#listmeta-v1-meta"><code>meta/v1.ListMeta</code></a>
</td>
<td>
<span class="text-muted">
<!--
No description provided.
-->
无描述。
</span></td>
</tr>
<tr><td><code>items</code> <B><!--[Required]-->[必需]</B><br/>
<a href="#external-metrics-k8s-io-v1beta1-ExternalMetricValue"><code>[]ExternalMetricValue</code></a>
</td>
<td>
<p>
<!--
value of the metric matching a given set of labels
-->
与给定标签集匹配的度量值。
</p>
</td>
</tr>
</tbody>
</table>

View File

@ -1,35 +1,21 @@
<!--
The file is auto-generated from the Go source code of the component using a generic
[generator](https://github.com/kubernetes-sigs/reference-docs/). To learn how
to generate the reference documentation, please read
[Contributing to the reference documentation](/docs/contribute/generate-ref-docs/).
To update the reference content, please follow the
[Contributing upstream](/docs/contribute/generate-ref-docs/contribute-upstream/)
guide. You can file document formatting bugs against the
[reference-docs](https://github.com/kubernetes-sigs/reference-docs/) project.
-->
<!--
Use this command to invoke single phase of the init workflow
-->
使用此命令可以调用 init 工作流程的单个阶段
使用此命令可以调用 init 工作流程的单个阶段。
<!--
### Synopsis
-->
### 概要
<!--
Use this command to invoke single phase of the init workflow
-->
使用此命令可以调用 init 工作流程的单个阶段
使用此命令可以调用 init 工作流程的单个阶段。
<!--
### Options
-->
### 选项
<table style="width: 100%; table-layout: fixed;">
@ -47,7 +33,7 @@ Use this command to invoke single phase of the init workflow
<!--
<p>help for phase</p>
-->
<p>phase 操作的帮助命令</p>
<p>phase 操作的帮助命令</p>
</td>
</tr>
@ -57,7 +43,6 @@ Use this command to invoke single phase of the init workflow
<!--
### Options inherited from parent commands
-->
### 继承于父命令的选择项
<table style="width: 100%; table-layout: fixed;">
@ -81,4 +66,3 @@ Use this command to invoke single phase of the init workflow
</tbody>
</table>

View File

@ -1,14 +1,4 @@
<!--
The file is auto-generated from the Go source code of the component using a generic
[generator](https://github.com/kubernetes-sigs/reference-docs/). To learn how
to generate the reference documentation, please read
[Contributing to the reference documentation](/docs/contribute/generate-ref-docs/).
To update the reference conent, please follow the
[Contributing upstream](/docs/contribute/generate-ref-docs/contribute-upstream/)
guide. You can file document formatting bugs against the
[reference-docs](https://github.com/kubernetes-sigs/reference-docs/) project.
-->
<!--
Kubeconfig file utilities
### Synopsis
@ -17,8 +7,7 @@ Kubeconfig file utilities.
### Options
-->
Kubeconfig 文件工具。
kubeconfig 文件工具。
### 概要
@ -38,8 +27,10 @@ kubeconfig 文件工具。
</tr>
<tr>
<td></td><td style="line-height: 130%; word-wrap: break-word;">
<!-- help for kubeconfig -->
kubeconfig 操作的帮助命令
<!--
help for kubeconfig
-->
kubeconfig 操作的帮助命令。
</td>
</tr>
@ -73,4 +64,3 @@ kubeconfig 操作的帮助命令
</tbody>
</table>

View File

@ -1,14 +1,3 @@
<!--
The file is auto-generated from the Go source code of the component using a generic
[generator](https://github.com/kubernetes-sigs/reference-docs/). To learn how
to generate the reference documentation, please read
[Contributing to the reference documentation](/docs/contribute/generate-ref-docs/).
To update the reference content, please follow the
[Contributing upstream](/docs/contribute/generate-ref-docs/contribute-upstream/)
guide. You can file document formatting bugs against the
[reference-docs](https://github.com/kubernetes-sigs/reference-docs/) project.
-->
<!--
Output a kubeconfig file for an additional user
@ -29,28 +18,22 @@ kubeadm alpha kubeconfig user [flags]
<!--
### Examples
<!--
# Output a kubeconfig file for an additional user named foo
-->
```
# 为一个名为 foo 的其他用户输出 kubeconfig 文件
# Output a kubeconfig file for an additional user named foo
kubeadm kubeconfig user --client-name=foo
# Output a kubeconfig file for an additional user named foo using a kubeadm config file bar
kubeadm kubeconfig user --client-name=foo --config=bar
```
<!--
# Output a kubeconfig file for an additional user named foo using a kubeadm config file bar
-->
```
# 使用 kubeadm 配置文件 bar 为另一个名为 foo 的用户输出 kubeconfig 文件
kubeadm alpha kubeconfig user --client-name=foo --config=bar
```
-->
### 示例
```
# 使用名为 bar 的 kubeadm 配置文件为名为 foo 的另一用户输出 kubeconfig 文件
kubeadm kubeconfig user --client-name=foo --config=bar
```shell
# 为一个名为 foo 的其他用户输出 kubeconfig 文件
kubeadm kubeconfig user --client-name=foo
# 使用 kubeadm 配置文件 bar 为另一个名为 foo 的用户输出 kubeconfig 文件
kubeadm alpha kubeconfig user --client-name=foo --config=bar
```
<!--
@ -85,7 +68,7 @@ The name of user. It will be used as the CN if client certificates are created
<!--
Path to a kubeadm configuration file.
-->
指向 kubeadm 配置文件的路径
指向 kubeadm 配置文件的路径
</td>
</tr>
@ -97,7 +80,7 @@ Path to a kubeadm configuration file.
<!--
help for user
-->
user 操作的帮助命令
user 操作的帮助命令
</td>
</tr>
@ -122,7 +105,7 @@ The organizations of the client certificate. It will be used as the O if client
<!--
The token that should be used as the authentication mechanism for this kubeconfig, instead of client certificates
-->
应该用此令牌做为 kubeconfig 的身份验证机制,而不是客户端证书
应该用此令牌做为 kubeconfig 的身份验证机制,而不是客户端证书
</td>
</tr>
@ -130,13 +113,15 @@ The token that should be used as the authentication mechanism for this kubeconfi
<td colspan="2">--validity-period duration&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Default: 8760h0m0s</td>
</tr>
<tr>
<td></td><td style="line-height: 130%; word-wrap: break-word;"><!--The validity period of the client certificate. It is an offset from the current time.-->
<td></td><td style="line-height: 130%; word-wrap: break-word;">
<!--
The validity period of the client certificate. It is an offset from the current time.
-->
<p>
客户证书的合法期限。所设置值为相对当前时间的偏移。
</p></td>
</tr>
</tbody>
</table>
@ -166,4 +151,3 @@ The token that should be used as the authentication mechanism for this kubeconfi
</tbody>
</table>

View File

@ -1,14 +1,3 @@
<!--
The file is auto-generated from the Go source code of the component using a generic
[generator](https://github.com/kubernetes-sigs/reference-docs/). To learn how
to generate the reference documentation, please read
[Contributing to the reference documentation](/docs/contribute/generate-ref-docs/).
To update the reference content, please follow the
[Contributing upstream](/docs/contribute/generate-ref-docs/contribute-upstream/)
guide. You can file document formatting bugs against the
[reference-docs](https://github.com/kubernetes-sigs/reference-docs/) project.
-->
<!--
Run cleanup node.
-->
@ -17,7 +6,6 @@ Run cleanup node.
<!--
### Synopsis
-->
### 概要
<!--
@ -71,7 +59,7 @@ The path to the directory where the certificates are stored. If specified, clean
Cleanup the &quot;/etc/kubernetes/tmp&quot; directory
-->
<p>
清理 &quot;/etc/kubernetes/tmp&quot; 目录
清理 &quot;/etc/kubernetes/tmp&quot; 目录
</p>
</td>
</tr>
@ -85,7 +73,7 @@ Cleanup the &quot;/etc/kubernetes/tmp&quot; directory
Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.
-->
<p>
要连接的 CRI 套接字的路径。如果为空,则 kubeadm 将尝试自动检测此值;仅当安装了多个 CRI 或具有非标准 CRI 插槽时,才使用此选项。
要连接的 CRI 套接字的路径。如果为空,则 kubeadm 将尝试自动检测此值;仅当安装了多个 CRI 或具有非标准 CRI 套接字时,才使用此选项。
</p>
</td>
</tr>
@ -115,7 +103,7 @@ Don't apply any changes; just output what would be done.
help for cleanup-node
-->
<p>
cleanup-node 操作的帮助命令
cleanup-node 操作的帮助命令
</p>
</td>
</tr>