From c76cbc8ffeba31673a454e1c229df161bd76e6fe Mon Sep 17 00:00:00 2001 From: Zhuzhenghao Date: Sun, 23 Apr 2023 17:44:59 +0800 Subject: [PATCH] [zh] sync 1.2 kube-apiserver --- .../kube-apiserver.md | 184 +++++++++++------- 1 file changed, 111 insertions(+), 73 deletions(-) diff --git a/content/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver.md b/content/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver.md index e3ac50b7cc..355c93ce8a 100644 --- a/content/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver.md +++ b/content/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver.md @@ -782,9 +782,9 @@ CIDRs opened in GCE firewall for L7 LB traffic proxy & health checks -如果启用了性能分析，则启用锁争用性能分析。 +如果启用了性能分析，则启用阻塞分析。 @@ -793,17 +793,33 @@ Enable lock contention profiling, if profiling is enabled +

CORS 允许的来源清单，以逗号分隔。 允许的来源可以是支持子域匹配的正则表达式。 如果此列表为空，则不会启用 CORS。 +请确保每个表达式与整个主机名相匹配，方法是用'^'锚定开始或包括'//'前缀，同时用'$'锚定结束或包括':'端口分隔符后缀。 +有效表达式的例子是'//example.com(:|$)'和'^https://example.com(:|$)'。 +

+ +--debug-socket-path string + + +

+ +使用位于给定路径的、未受保护的（无身份认证或鉴权的）UNIX 域套接字执行性能分析。 +

+ + --default-not-ready-toleration-seconds int     默认值：300 @@ -853,13 +869,11 @@ Number of workers spawned for DeleteCollection call. These are used to speed up

-尽管位于默认启用的插件列表中，仍须被禁用的准入插件（NamespaceLifecycle、LimitRanger、ServiceAccount、TaintNodesByCondition、PodSecurity、Priority、DefaultTolerationSeconds、DefaultStorageClass、StorageObjectInUseProtection、PersistentVolumeClaimResize、RuntimeClass、CertificateApproval、CertificateSigning、CertificateSubjectRestriction、DefaultIngressClass、MutatingAdmissionWebhook、ValidatingAdmissionPolicy、ValidatingAdmissionWebhook、ResourceQuota）。 -取值为逗号分隔的准入插件列表：AlwaysAdmit、AlwaysDeny、AlwaysPullImages、CertificateApproval、CertificateSigning、CertificateSubjectRestriction、DefaultIngressClass、DefaultStorageClass、DefaultTolerationSeconds、DenyServiceExternalIPs、EventRateLimit、ExtendedResourceToleration、ImagePolicyWebhook、LimitPodHardAntiAffinityTopology、LimitRanger、MutatingAdmissionWebhook、NamespaceAutoProvision、NamespaceExists、NamespaceLifecycle、NodeRestriction、OwnerReferencesPermissionEnforcement、PersistentVolumeClaimResize、PersistentVolumeLabel、PodNodeSelector、PodSecurity、PodTolerationRestriction、Priority、ResourceQuota、RuntimeClass、SecurityContextDeny、ServiceAccount、StorageObjectInUseProtection、TaintNodesByCondition、ValidatingAdmissionPolicy、ValidatingAdmissionWebhook。 +尽管位于默认启用的插件列表中，仍须被禁用的准入插件（NamespaceLifecycle、LimitRanger、ServiceAccount、TaintNodesByCondition、PodSecurity、Priority、DefaultTolerationSeconds、DefaultStorageClass、StorageObjectInUseProtection、PersistentVolumeClaimResize、RuntimeClass、CertificateApproval、CertificateSigning、ClusterTrustBundleAttest、CertificateSubjectRestriction、DefaultIngressClass、MutatingAdmissionWebhook、ValidatingAdmissionPolicy、ValidatingAdmissionWebhook、ResourceQuota）。 +取值为逗号分隔的准入插件列表：AlwaysAdmit、AlwaysDeny、AlwaysPullImages、CertificateApproval、CertificateSigning、CertificateSubjectRestriction、ClusterTrustBundleAttest、DefaultIngressClass、DefaultStorageClass、DefaultTolerationSeconds、DenyServiceExternalIPs、EventRateLimit、ExtendedResourceToleration、ImagePolicyWebhook、LimitPodHardAntiAffinityTopology、LimitRanger、MutatingAdmissionWebhook、NamespaceAutoProvision、NamespaceExists、NamespaceLifecycle、NodeRestriction、OwnerReferencesPermissionEnforcement、PersistentVolumeClaimResize、PersistentVolumeLabel、PodNodeSelector、PodSecurity、PodTolerationRestriction、Priority、ResourceQuota、RuntimeClass、SecurityContextDeny、ServiceAccount、StorageObjectInUseProtection、TaintNodesByCondition、ValidatingAdmissionPolicy、ValidatingAdmissionWebhook。 该标志中插件的顺序无关紧要。

@@ -900,11 +914,11 @@ File with apiserver egress selector configuration.

-除了默认启用的插件（NamespaceLifecycle、LimitRanger、ServiceAccount、TaintNodesByCondition、PodSecurity、Priority、DefaultTolerationSeconds、DefaultStorageClass、StorageObjectInUseProtection、PersistentVolumeClaimResize、RuntimeClass、CertificateApproval、CertificateSigning、CertificateSubjectRestriction、DefaultIngressClass、MutatingAdmissionWebhook、ValidatingAdmissionPolicy、ValidatingAdmissionWebhook、ResourceQuota）之外要启用的准入插件。 -取值为逗号分隔的准入插件列表：AlwaysAdmit、AlwaysDeny、AlwaysPullImages、CertificateApproval、CertificateSigning、CertificateSubjectRestriction、DefaultIngressClass、DefaultStorageClass、DefaultTolerationSeconds、DenyServiceExternalIPs、EventRateLimit、ExtendedResourceToleration、ImagePolicyWebhook、LimitPodHardAntiAffinityTopology、LimitRanger、MutatingAdmissionWebhook、NamespaceAutoProvision、NamespaceExists、NamespaceLifecycle、NodeRestriction、OwnerReferencesPermissionEnforcement、PersistentVolumeClaimResize、PersistentVolumeLabel、PodNodeSelector、PodSecurity、PodTolerationRestriction、Priority、ResourceQuota、RuntimeClass、SecurityContextDeny、ServiceAccount、StorageObjectInUseProtection、TaintNodesByCondition、ValidatingAdmissionPolicy、ValidatingAdmissionWebhook。该标志中插件的顺序无关紧要。 +除了默认启用的插件（NamespaceLifecycle、LimitRanger、ServiceAccount、TaintNodesByCondition、PodSecurity、Priority、DefaultTolerationSeconds、DefaultStorageClass、StorageObjectInUseProtection、PersistentVolumeClaimResize、RuntimeClass、CertificateApproval、CertificateSigning、ClusterTrustBundleAttest、CertificateSubjectRestriction、DefaultIngressClass、MutatingAdmissionWebhook、ValidatingAdmissionPolicy、ValidatingAdmissionWebhook、ResourceQuota）之外要启用的准入插件。 +取值为逗号分隔的准入插件列表：AlwaysAdmit、AlwaysDeny、AlwaysPullImages、CertificateApproval、CertificateSigning、CertificateSubjectRestriction、ClusterTrustBundleAttest、DefaultIngressClass、DefaultStorageClass、DefaultTolerationSeconds、DenyServiceExternalIPs、EventRateLimit、ExtendedResourceToleration、ImagePolicyWebhook、LimitPodHardAntiAffinityTopology、LimitRanger、MutatingAdmissionWebhook、NamespaceAutoProvision、NamespaceExists、NamespaceLifecycle、NodeRestriction、OwnerReferencesPermissionEnforcement、PersistentVolumeClaimResize、PersistentVolumeLabel、PodNodeSelector、PodSecurity、PodTolerationRestriction、Priority、ResourceQuota、RuntimeClass、SecurityContextDeny、ServiceAccount、StorageObjectInUseProtection、TaintNodesByCondition、ValidatingAdmissionPolicy、ValidatingAdmissionWebhook。该标志中插件的顺序无关紧要。

@@ -1185,16 +1199,16 @@ comma-separated 'key=True|False' pairs - +

-

一组 key=value 对，用来描述测试性/试验性功能的特性门控。可选项有：
APIListChunking=true|false (BETA - 默认值=true)
APIPriorityAndFairness=true|false (BETA - 默认值=true)
APIResponseCompression=true|false (BETA - 默认值=true)
-APISelfSubjectReview=true|false (ALPHA - 默认值=false)
+APISelfSubjectReview=true|false (BETA - 默认值=true)
APIServerIdentity=true|false (BETA - 默认值=true)
-APIServerTracing=true|false (ALPHA - 默认值=false)
-AggregatedDiscoveryEndpoint=true|false (ALPHA - 默认值=false)
+APIServerTracing=true|false (BETA - 默认值=true)
+AdmissionWebhookMatchConditions=true|false (ALPHA - 默认值=false)
+AggregatedDiscoveryEndpoint=true|false (BETA - 默认值=true)
AllAlpha=true|false (ALPHA - 默认值=false)
AllBeta=true|false (BETA - 默认值=false)
AnyVolumeDataSource=true|false (BETA - 默认值=true)
@@ -1314,29 +1334,31 @@ CPUManagerPolicyBetaOptions=true|false (BETA - 默认值=true)
CPUManagerPolicyOptions=true|false (BETA - 默认值=true)
CSIMigrationPortworx=true|false (BETA - 默认值=false)
CSIMigrationRBD=true|false (ALPHA - 默认值=false)
-CSINodeExpandSecret=true|false (ALPHA - 默认值=false)
+CSINodeExpandSecret=true|false (BETA - 默认值=true)
CSIVolumeHealth=true|false (ALPHA - 默认值=false)
-ComponentSLIs=true|false (ALPHA - 默认值=false)
+CloudControllerManagerWebhook=true|false (ALPHA - 默认值=false)
+CloudDualStackNodeIPs=true|false (ALPHA - 默认值=false)
+ClusterTrustBundle=true|false (ALPHA - 默认值=false)
+ComponentSLIs=true|false (BETA - 默认值=true)
ContainerCheckpoint=true|false (ALPHA - 默认值=false)
ContextualLogging=true|false (ALPHA - 默认值=false)
-CronJobTimeZone=true|false (BETA - 默认值=true)
CrossNamespaceVolumeDataSource=true|false (ALPHA - 默认值=false)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - 默认值=false)
CustomResourceValidationExpressions=true|false (BETA - 默认值=true)
DisableCloudProviders=true|false (ALPHA - 默认值=false)
DisableKubeletCloudCredentialProviders=true|false (ALPHA - 默认值=false)
-DownwardAPIHugePages=true|false (BETA - 默认值=true)
DynamicResourceAllocation=true|false (ALPHA - 默认值=false)
-EventedPLEG=true|false (ALPHA - 默认值=false)
+ElasticIndexedJob=true|false (BETA - 默认值=true)
+EventedPLEG=true|false (BETA - 默认值=false)
ExpandedDNSConfig=true|false (BETA - 默认值=true)
ExperimentalHostUserNamespaceDefaulting=true|false (BETA - 默认值=false)
-GRPCContainerProbe=true|false (BETA - 默认值=true)
-GracefulNodeShutdown=true|false (BETA - 默认值=true) +GracefulNodeShutdown=true|false (BETA - 默认值=true)
GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - 默认值=true)
-HPAContainerMetrics=true|false (ALPHA - 默认值=false)
+HPAContainerMetrics=true|false (BETA - 默认值=true)
HPAScaleToZero=true|false (ALPHA - 默认值=false)
HonorPVReclaimPolicy=true|false (ALPHA - 默认值=false)
-IPTablesOwnershipCleanup=true|false (ALPHA - 默认值=false)
+IPTablesOwnershipCleanup=true|false (BETA - 默认值=true)
+InPlacePodVerticalScaling=true|false (ALPHA - 默认值=false)
InTreePluginAWSUnregister=true|false (ALPHA - 默认值=false)
InTreePluginAzureDiskUnregister=true|false (ALPHA - 默认值=false)
InTreePluginAzureFileUnregister=true|false (ALPHA - 默认值=false)
@@ -1345,63 +1367,67 @@ InTreePluginOpenStackUnregister=true|false (ALPHA - 默认值=false)
InTreePluginPortworxUnregister=true|false (ALPHA - 默认值=false)
InTreePluginRBDUnregister=true|false (ALPHA - 默认值=false)
InTreePluginvSphereUnregister=true|false (ALPHA - 默认值=false)
-JobMutableNodeSchedulingDirectives=true|false (BETA - 默认值=true)
JobPodFailurePolicy=true|false (BETA - 默认值=true)
JobReadyPods=true|false (BETA - 默认值=true)
-KMSv2=true|false (ALPHA - 默认值=false)
+KMSv2=true|false (BETA - 默认值=true)
KubeletInUserNamespace=true|false (ALPHA - 默认值=false)
KubeletPodResources=true|false (BETA - 默认值=true)
+KubeletPodResourcesDynamicResources=true|false (ALPHA - 默认值=false)
+KubeletPodResourcesGet=true|false (ALPHA - 默认值=false)
KubeletPodResourcesGetAllocatable=true|false (BETA - 默认值=true)
-KubeletTracing=true|false (ALPHA - 默认值=false)
-LegacyServiceAccountTokenTracking=true|false (ALPHA - 默认值=false)
+KubeletTracing=true|false (BETA - 默认值=true)
+LegacyServiceAccountTokenTracking=true|false (BETA - 默认值=true)
LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - 默认值=false)
LogarithmicScaleDown=true|false (BETA - 默认值=true)
LoggingAlphaOptions=true|false (ALPHA - 默认值=false)
LoggingBetaOptions=true|false (BETA - 默认值=true)
-MatchLabelKeysInPodTopologySpread=true|false (ALPHA - 默认值=false)
+MatchLabelKeysInPodTopologySpread=true|false (BETA - 默认值=true)
MaxUnavailableStatefulSet=true|false (ALPHA - 默认值=false)
MemoryManager=true|false (BETA - 默认值=true)
MemoryQoS=true|false (ALPHA - 默认值=false)
-MinDomainsInPodTopologySpread=true|false (BETA - 默认值=false)
-MinimizeIPTablesRestore=true|false (ALPHA - 默认值=false)
+MinDomainsInPodTopologySpread=true|false (BETA - 默认值=true)
+MinimizeIPTablesRestore=true|false (BETA - 默认值=true)
MultiCIDRRangeAllocator=true|false (ALPHA - 默认值=false)
+MultiCIDRServiceAllocator=true|false (ALPHA - 默认值=false)
NetworkPolicyStatus=true|false (ALPHA - 默认值=false)
+NewVolumeManagerReconstruction=true|false (BETA - 默认值=true)
NodeInclusionPolicyInPodTopologySpread=true|false (BETA - 默认值=true)
+NodeLogQuery=true|false (ALPHA - 默认值=false)
NodeOutOfServiceVolumeDetach=true|false (BETA - 默认值=true)
NodeSwap=true|false (ALPHA - 默认值=false)
OpenAPIEnums=true|false (BETA - 默认值=true)
-OpenAPIV3=true|false (BETA - 默认值=true)
-PDBUnhealthyPodEvictionPolicy=true|false (ALPHA - 默认值=false)
+PDBUnhealthyPodEvictionPolicy=true|false (BETA - 默认值=true)
PodAndContainerStatsFromCRI=true|false (ALPHA - 默认值=false)
PodDeletionCost=true|false (BETA - 默认值=true)
PodDisruptionConditions=true|false (BETA - 默认值=true)
PodHasNetworkCondition=true|false (ALPHA - 默认值=false)
-PodSchedulingReadiness=true|false (ALPHA - 默认值=false)
+PodSchedulingReadiness=true|false (BETA - 默认值=true)
ProbeTerminationGracePeriod=true|false (BETA - 默认值=true)
ProcMountType=true|false (ALPHA - 默认值=false)
ProxyTerminatingEndpoints=true|false (BETA - 默认值=true)
QOSReserved=true|false (ALPHA - 默认值=false)
-ReadWriteOncePod=true|false (ALPHA - 默认值=false)
+ReadWriteOncePod=true|false (BETA - 默认值=true)
RecoverVolumeExpansionFailure=true|false (ALPHA - 默认值=false)
RemainingItemCount=true|false (BETA - 默认值=true)
RetroactiveDefaultStorageClass=true|false (BETA - 默认值=true)
RotateKubeletServerCertificate=true|false (BETA - 默认值=true)
-SELinuxMountReadWriteOncePod=true|false (ALPHA - 默认值=false)
-SeccompDefault=true|false (BETA - 默认值=true)
-ServerSideFieldValidation=true|false (BETA - 默认值=true)
+SELinuxMountReadWriteOncePod=true|false (BETA - 默认值=true)
+SecurityContextDeny=true|false (ALPHA - 默认值=false)
+ServiceNodePortStaticSubrange=true|false (ALPHA - 默认值=false)
SizeMemoryBackedVolumes=true|false (BETA - 默认值=true)
-StatefulSetAutoDeletePVC=true|false (ALPHA - 默认值=false)
-StatefulSetStartOrdinal=true|false (ALPHA - 默认值=false)
+StableLoadBalancerNodeSet=true|false (BETA - 默认值=true)
+StatefulSetAutoDeletePVC=true|false (BETA - 默认值=true)
+StatefulSetStartOrdinal=true|false (BETA - 默认值=true)
StorageVersionAPI=true|false (ALPHA - 默认值=false)
StorageVersionHash=true|false (BETA - 默认值=true)
TopologyAwareHints=true|false (BETA - 默认值=true)
-TopologyManager=true|false (BETA - 默认值=true)
TopologyManagerPolicyAlphaOptions=true|false (ALPHA - 默认值=false)
TopologyManagerPolicyBetaOptions=true|false (BETA - 默认值=false)
TopologyManagerPolicyOptions=true|false (ALPHA - 默认值=false)
UserNamespacesStatelessPodsSupport=true|false (ALPHA - 默认值=false)
ValidatingAdmissionPolicy=true|false (ALPHA - 默认值=false)
VolumeCapacityPriority=true|false (ALPHA - 默认值=false)
+WatchList=true|false (ALPHA - 默认值=false)
WinDSR=true|false (ALPHA - 默认值=false)
WinOverlay=true|false (BETA - 默认值=true)
WindowsHostNetwork=true|false (ALPHA - 默认值=true) @@ -2214,6 +2240,18 @@ in addition 'Connection: close' response header is set in order to tear down the + +--shutdown-watch-termination-grace-period duration + + +

+ +此选项如果被设置了，则表示 API 服务器体面关闭服务器窗口内，等待活跃的监听请求耗尽的最长宽限期。 +

+ + --storage-backend string