Question: [Azure CNI](https://docs.microsoft.com/en-us/azure/virtual-network/container-networking-overview) is an [open source](https://github.com/Azure/azure-container-networking/blob/master/docs/cni.md) plugin that integrates Kubernetes Pods with an Azure Virtual Network (also known as VNet) providing network performance at par with VMs. Pods can connect to peered VNet and to on-premises over Express Route or site-to-site VPN and are also directly reachable from these networks. Pods can access Azure services, such as storage and SQL, that are protected by Service Endpoints or Private Link. You can use VNet security policies and routing to filter Pod traffic. The plugin assigns VNet IPs to Pods by utilizing a pool of secondary IPs pre-configured on the Network Interface of a Kubernetes node. Azure CNI is available natively in the [Azure Kubernetes Service (AKS)] (https://docs.microsoft.com/en-us/azure/aks/configure-azure-cni). ### Big Cloud Fabric from Big Switch Networks

Per our discussion in today's SIG Docs: Sections of the site, like will always have some degree of 3rd party content, due to the fact that a k8s developer must implement an external networking CNI. The majority of post-3rd party content KEP PR's we get that actually involve third party content are to pages like this one. A part of the reasons is that a change like the KEP requires initial communication (which was well done) but also ongoing communication. This change proposes the following: Create a reusable Note or similar shortcode for pages that fall under . The note should: Be translatable (use a key) Warn people that they must use a 3rd party plugin/software for this step Indicate that per the projects are listed alphabetically Indicate that additions to this list/page must directly provide a solution for this step of an implementation (i.e. for the cluster networking page, projects listed must provide a networking solution – no 'nice to haves' that make networking easier or somehow nicer.) Link to the content guidelines for more info on acceptable additions to the page.
/assign /area web-development /priority important-longterm
/language en
Wording for review: This section contains links to third party projects which provide functionality required by Kubernetes. The Kubernetes project authors are not responsible for these projects. Projects are listed alphabetically, in accordance with [CNCF website guidelines]. To add a project to this list, read the <a href="/contribute/style/content-guide/#third-party-content"content guide</abefore submitting a change.
Related:
How about:
LGTM, I'll go ahead and implement. Thank you for the edit!
Hello , Some late feedback (sorry I missed the meeting): Since this is a "special" note, I think it warrants a different color on the left hand border. Is there another shortcode besides note or warning that could be used to set off the text? Could substitute the shortcode "Note" text with "Third party content"? The language in the third party content message is a bit obtuse. When this label is applied, can the reader assume that all content on the page falls under these guidelines? This sentence, "Kubernetes project authors are not responsible for these projects" seems repetitive. Third party implies an external source and outside of the project's domain.

Is there another shortcode besides note or warning that could be used to set off the text? Could substitute the shortcode "Note" text with "Third party content"? All good feedback. How would you phrase it differently?
Hi. I am not entirely sure. The text is okay, though, it may not be clear about what is "required for Kubernetes to function". What do you want readers to do: determine if their project belongs in the section (read the content guide) read the content as third party content (Sig Docs is hosting the links but not responsible for the content on the page)? [One idea:] This section links to third party projects and follows [CNCF website guidelines] by listing projects alphabetically. [Do you want to suggest adding content or not?] If you are considering adding content in this section, read the before submitting a change. [Do you need a statement about content responsibility?]
Is there another shortcode besides note or warning that could be used to set off the text? Could substitute the shortcode "Note" text with "Third party content"? I think this is a good suggestion. I'll update the PR. What do you want readers to do: This section links to third party projects and follows [CNCF website guidelines] by listing projects alphabetically. If you are considering adding content in this section, read the content guide before submitting a change. Is this blocking for the PR? If we can't come up with a concrete alternative, I'd prefer to merge the PR, re-open this issue, and continue to work on the wording. Would that be okay,
Sure . I think what you have is fine. As an aside, did you consider using the theme's shortcode (which has a parameter)? It may work as well as wrapping the "third party content" shortcode in a note/warning shortcode. I think you can set the attribute too.
I'm imagining a one-line shortcode that, when rendered, closely matches the styles of existing callouts. I'd rather not use callouts from the Docsy theme because that's different from our existing callouts (something to handle in a separate issue, I feel). Wording-wise I'm happy to see something merged and leave room to iterate. Would you be happy to implement that?
Hi.

I agree, let's get this change moving forward with a single line shortcode with similar styling to the existing callouts. The shortcode would use two template strings: one variable for the message title and another variable for the message body. In the future, I could imagine a flexible interface or more generic shortcode that accepts at least one argument: the name of the variable representing the message title.


Question: This annotation will be added to dynamic provisioning required PVC. <ins> ### volumes.kubernetes.io/controller-managed-attach-detach Used on: Node If a node has set the annotation `volumes.kubernetes.io/controller-managed-attach-detach` on itself, then its storage attach and detach operations are being managed by the _volume attach/detach_ {{< glossary_tooltip text="controller" term_id="controller" >}} running within the {{< glossary_tooltip term_id="kube-controller-manager" text="kube-controller-manager" >}}. The value of the annotation isn't important; if this annotation exists on a node, then storage attaches and detaches are controller managed. </ins> ### node.kubernetes.io/windows-build {#nodekubernetesiowindows-build} Example: `node.kubernetes.io/windows-build: "10.0.17763"`

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: I have a node in Minikube that's annotated with the key . This looks intended, but doesn't document that annotation. Proposed Solution: Document that annotation; as a side effect, this registers it. has some tips on what the annotation means. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /sig storage /language en /priority backlog PS. Maybe, as a separate detail, the project should deprecate this annotation. I'm not sure if modern Kubernetes still needs it.
/triage accepted
/assign
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale


Question: <ins> --- title: "TLS" weight: 100 description: Transport Layer Security(TLS)を使用して、クラスター内のトラフィックを保護する方法について理解します。 --- </ins>

This is a Feature Request What would you like to be Translate into Japanese. Why is this needed This page has not been translated. Comments /language ja /assign
/close
Closing this issue. <detailsIn response to : /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: ### コンテナリソース監視 <del> [コンテナリソース監視](/docs/tasks/debug-application-cluster/resource-usage-monitoring/)は、コンテナに関する一般的な時系列メトリックを中央データベースに記録します。また、そのデータを閲覧するためのUIを提供します。 </del> <ins> [コンテナリソース監視](/ja/docs/tasks/debug/debug-cluster/resource-usage-monitoring/)は、コンテナに関する一般的な時系列メトリックを中央データベースに記録します。また、そのデータを閲覧するためのUIを提供します。 </ins> <del> ### クラスターレベルログ </del> <ins> ### クラスターレベルのロギング </ins> <del> [クラスターレベルログ](/docs/concepts/cluster-administration/logging/)メカニズムは、コンテナのログを、検索／参照インターフェイスを備えた中央ログストアに保存します。 </del> <ins> [クラスターレベルのロギング](/ja/docs/concepts/cluster-administration/logging/)メカニズムは、コンテナのログを、検索／参照インターフェイスを備えた中央ログストアに保存します。 </ins> ## {{% heading "whatsnext" %}}

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Updated Japanese translation for the file. Why is this needed There are several updates in and therefore this page is outdated. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/language ja /assign
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: You can also email the private [security@kubernetes.io](mailto:security@kubernetes.io) list with the security details and the details expected for [all Kubernetes bug reports](https://git.k8s.io/kubernetes/.github/ISSUE_TEMPLATE/bug-report.md). <del> You may encrypt your email to this list using the GPG keys of the [Product Security Committee members](https://git.k8s.io/security/README.md#product-security-committee-psc). Encryption using GPG is NOT required to make a disclosure. </del> <ins> You may encrypt your email to this list using the GPG keys of the [Security Response Committee members](https://git.k8s.io/security/README.md#product-security-committee-psc). Encryption using GPG is NOT required to make a disclosure. </ins> ### When Should I Report a Vulnerability?

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be change We should find the term “product security committee” anywhere within the English-language docs, and replace that term with “security response committee”. We don't need to revise any blog articles. If we feel there are some blog articles where an exception is justified, I'd revise those in a separate PR per article as the review process is different. Why is this needed renamed the product security committee to “Security Response Committee” Comments /language en /sig docs /sig security /help /triage accepted Relevant to
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : This is a Feature Request <!-- See for guidance on writing an actionable issue description. --We should find the term “product security committee” anywhere within the English-language docs, and replace that term with “security response committee”. We don't need to revise any blog articles. If we feel there are some blog articles where an exception is justified, I'd revise those in a separate PR per article as the review process is different. renamed the product security committee to “Security Response Committee” /language en /sig docs /sig security /help /triage accepted Relevant to Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/priority backlog
thanks , PR's are incoming org wide for the change.
Hi, I would like to take this up /assign


Question: ## Community-maintained client libraries <ins> {{% thirdparty-content %}} </ins> The following Kubernetes API client libraries are provided and maintained by their authors, not the Kubernetes team.

Per our discussion in today's SIG Docs: Sections of the site, like will always have some degree of 3rd party content, due to the fact that a k8s developer must implement an external networking CNI. The majority of post-3rd party content KEP PR's we get that actually involve third party content are to pages like this one. A part of the reasons is that a change like the KEP requires initial communication (which was well done) but also ongoing communication. This change proposes the following: Create a reusable Note or similar shortcode for pages that fall under . The note should: Be translatable (use a key) Warn people that they must use a 3rd party plugin/software for this step Indicate that per the projects are listed alphabetically Indicate that additions to this list/page must directly provide a solution for this step of an implementation (i.e. for the cluster networking page, projects listed must provide a networking solution – no 'nice to haves' that make networking easier or somehow nicer.) Link to the content guidelines for more info on acceptable additions to the page.
/assign /area web-development /priority important-longterm
/language en
Wording for review: This section contains links to third party projects which provide functionality required by Kubernetes. The Kubernetes project authors are not responsible for these projects. Projects are listed alphabetically, in accordance with [CNCF website guidelines]. To add a project to this list, read the <a href="/contribute/style/content-guide/#third-party-content"content guide</abefore submitting a change.
Related:
How about:
LGTM, I'll go ahead and implement. Thank you for the edit!
Hello , Some late feedback (sorry I missed the meeting): Since this is a "special" note, I think it warrants a different color on the left hand border. Is there another shortcode besides note or warning that could be used to set off the text? Could substitute the shortcode "Note" text with "Third party content"? The language in the third party content message is a bit obtuse. When this label is applied, can the reader assume that all content on the page falls under these guidelines? This sentence, "Kubernetes project authors are not responsible for these projects" seems repetitive. Third party implies an external source and outside of the project's domain.

Is there another shortcode besides note or warning that could be used to set off the text? Could substitute the shortcode "Note" text with "Third party content"? All good feedback. How would you phrase it differently?
Hi. I am not entirely sure. The text is okay, though, it may not be clear about what is "required for Kubernetes to function". What do you want readers to do: determine if their project belongs in the section (read the content guide) read the content as third party content (Sig Docs is hosting the links but not responsible for the content on the page)? [One idea:] This section links to third party projects and follows [CNCF website guidelines] by listing projects alphabetically. [Do you want to suggest adding content or not?] If you are considering adding content in this section, read the before submitting a change. [Do you need a statement about content responsibility?]
Is there another shortcode besides note or warning that could be used to set off the text? Could substitute the shortcode "Note" text with "Third party content"? I think this is a good suggestion. I'll update the PR. What do you want readers to do: This section links to third party projects and follows [CNCF website guidelines] by listing projects alphabetically. If you are considering adding content in this section, read the content guide before submitting a change. Is this blocking for the PR? If we can't come up with a concrete alternative, I'd prefer to merge the PR, re-open this issue, and continue to work on the wording. Would that be okay,
Sure . I think what you have is fine. As an aside, did you consider using the theme's shortcode (which has a parameter)? It may work as well as wrapping the "third party content" shortcode in a note/warning shortcode. I think you can set the attribute too.
I'm imagining a one-line shortcode that, when rendered, closely matches the styles of existing callouts. I'd rather not use callouts from the Docsy theme because that's different from our existing callouts (something to handle in a separate issue, I feel). Wording-wise I'm happy to see something merged and leave room to iterate. Would you be happy to implement that?
Hi.

I agree, let's get this change moving forward with a single line shortcode with similar styling to the existing callouts. The shortcode would use two template strings: one variable for the message title and another variable for the message body. In the future, I could imagine a flexible interface or more generic shortcode that accepts at least one argument: the name of the variable representing the message title.


Question: the *dataSource* field in the `PersistentVolumeClaim` object. For more details, see <del> [Volume Snapshot and Restore Volume from Snapshot](/docs/concepts/storage/persistent-volumes/#volume-snapshot-and-restore-volume-from-snapshot-support). </del> <ins> [Volume Snapshot and Restore Volume from Snapshot](/docs/concepts/storage/persistent-volumes/#volume-snapshot-and-restore-volume-from-snapshot-support). </ins>  No newline at end of file

Maybe its just me, but reading the page first time it is not clear what these volume-snapshots are really good for. Reading it again doesn't help, but it makes one thing clear: Taking a snapshot is just half of the story. Maybe a practical example (e.g. backup and restore of a mysql database, migration to another cluster) would be an improvement.
Thanks for the suggestion /language en /triage accepted /sig storage /priority backlog
/assign


Question: --- <!-- overview --> <del> Kubernetes contains several built-in tools to help you work with the Kubernetes system. </del> <ins> Kubernetes contains several built-in tools and external tools that are commonly used or relevant that may as well be seen as required for Kubernetes to function. </ins> <!-- body -->

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: lists Helm as being built-in to Kubernetes. (it isn't; it's a separate project that depends on Kubernetes in order to be useful) Proposed Solution: Reword the page to be a list of both built-in tools and external tools that are so commonly used or relevant that they may as well be seen as required for Kubernetes to function. (for context: see ) Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /language en
/assign
/triage accepted


Question: リソースクォータは集約されたクラスターリソースを分割しますが、ノードに対しては何の制限も行わないことに注意して下さい。例: 複数の名前空間のPodは同一のノード上で稼働する可能性があります。 <del> ## デフォルトで優先度クラスの消費を制限する </del> <ins> ## デフォルトで優先度クラスの消費を制限する {#limit-priority-class-consumption-by-default} </ins> 例えば"cluster-services"のように、条件に一致するクォータオブジェクトが存在する場合に限り、特定の優先度のPodを名前空間で許可することが望ましい場合があります。

This is a Feature Request What would you like to be Translate into Japanese Why is this needed This page has not been translated. Comments /language ja /assign
/triage accepted
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-contributor-experience at . /lifecycle stale
/remove-lifecycle stale


Question: <ins> --- reviewers: - ramrodo - krol3 - electrocucaracha title: Volúmenes proyectados content_type: concept weight: 21 # just after persistent volumes --- <!-- overview --> Este documento describe los _volúmenes proyectados_ en Kubernetes. Necesita estar familiarizado con [volúmenes](/es/docs/concepts/storage/volumes/). <!-- body --> ## Introducción Un volumen `proyectado` asigna varias fuentes de volúmenes existentes al mismo directorio. Actualmente se pueden proyectar los siguientes tipos de fuentes de volumen: - [`secret`](/es/docs/concepts/storage/volumes/#secret) - [`downwardAPI`](/es/docs/concepts/storage/volumes/#downwardapi) - [`configMap`](/es/docs/concepts/storage/volumes/#configmap) - [`serviceAccountToken`](#serviceaccounttoken) Se requiere que todas las fuentes estén en el mismo espacio de nombres que el Pod. Para más detalles, vea el documento de diseño [all-in-one volume](https://git.k8s.io/design-proposals-archive/node/all-in-one-volume.md). ### Configuración de ejemplo con un secreto, una downwardAPI y una configMap {#example-configuration-secret-downwardapi-configmap} {{% code_sample file="pods/storage/projected-secret-downwardapi-configmap.yaml" %}} ### Configuración de ejemplo: secretos con un modo de permiso no predeterminado establecido {#example-configuration-secrets-nondefault-permission-mode} {{% code_sample file="pods/storage/projected-secrets-nondefault-permission-mode.yaml" %}} Cada fuente de volumen proyectada aparece en la especificación bajo `sources`. Los parámetros son casi los mismos con dos excepciones: - Para los secretos, el campo `secretName` se ha cambiado a `name` para que sea coherente con el nombre de ConfigMap. - El `defaultMode` solo se puede especificar en el nivel proyectado y no para cada fuente de volumen. Sin embargo, como se ilustra arriba, puede configurar explícitamente el `mode` para cada proyección individual. ## Volúmenes proyectados de serviceAccountToken {#serviceaccounttoken} Puede inyectar el token para la [service account](/docs/reference/access-authn-authz/authentication/#service-account-tokens) actual en un Pod en una ruta especificada. Por ejemplo: {{% code_sample file="pods/storage/projected-service-account-token.yaml" %}} El Pod de ejemplo tiene un volumen proyectado que contiene el token de cuenta de servicio inyectado. Los contenedores en este Pod pueden usar ese token para acceder al servidor API de Kubernetes, autenticándose con la identidad de [the pod's ServiceAccount](/docs/tasks/configure-pod-container/configure-service-account/). El campo `audience` contiene la audiencia prevista del token. Un destinatario del token debe identificarse con un identificador especificado en la audiencia del token y, de lo contrario, debe rechazar el token. Este campo es opcional y de forma predeterminada es el identificador del servidor API. The `expirationSeconds` es la duración esperada de validez del token de la cuenta de servicio. El valor predeterminado es 1 hora y debe durar al menos 10 minutos (600 segundos). Un administrador también puede limitar su valor máximo especificando la opción `--service-account-max-token-expiration` para el servidor API. El campo `path` especifica una ruta relativa al punto de montaje del volumen proyectado. {{< note >}} Un contenedor que utiliza una fuente de volumen proyectada como montaje de volumen [`subPath`](/docs/concepts/storage/volumes/#using-subpath) no recibirá actualizaciones para esas fuentes de volumen. {{< /note >}} ## Interacciones SecurityContext La [propuesta](https://git.k8s.io/enhancements/keps/sig-storage/2451-service-account-token-volumes#proposal) para el manejo de permisos de archivos en la mejora del volumen de cuentas de servicio proyectadas introdujo los archivos proyectados que tienen los permisos de propietario correctos establecidos. ### Linux En los pods de Linux que tienen un volumen proyectado y `RunAsUser` configurado en el Pod [`SecurityContext`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context), los archivos proyectados tienen la conjunto de propiedad correcto, incluida la propiedad del usuario del contenedor. Cuando todos los contenedores en un pod tienen el mismo `runAsUser` configurado en su [`PodSecurityContext`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) o el contenedor [`SecurityContext`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1), entonces el kubelet garantiza que el contenido del volumen `serviceAccountToken` sea propiedad de ese usuario y que el archivo token tenga su modo de permiso establecido en `0600`. {{< note >}} {{< glossary_tooltip text="Ephemeral containers" term_id="ephemeral-container" >}} agregado a un pod después de su creación _no_ cambia los permisos de volumen que se establecieron cuando se creó el pod. Si los permisos de volumen `serviceAccountToken` de un Pod se establecieron en `0600` porque todos los demás contenedores en el Pod tienen el mismo `runAsUser`, los contenedores efímeros deben usar el mismo `runAsUser` para poder leer el token. {{< /note >}} ### Windows En los pods de Windows que tienen un volumen proyectado y `RunAsUsername` configurado en el pod `SecurityContext`, la propiedad no se aplica debido a la forma en que se administran las cuentas de usuario en Windows. Windows almacena y administra cuentas de grupos y usuarios locales en un archivo de base de datos llamado Administrador de cuentas de seguridad (SAM). Cada contenedor mantiene su propia instancia de la base de datos SAM, de la cual el host no tiene visibilidad mientras el contenedor se está ejecutando. Los contenedores de Windows están diseñados para ejecutar la parte del modo de usuario del sistema operativo de forma aislada del host, de ahí el mantenimiento de una base de datos SAM virtual. Como resultado, el kubelet que se ejecuta en el host no tiene la capacidad de configurar dinámicamente la propiedad de los archivos del host para cuentas de contenedores virtualizados. Se recomienda que, si los archivos de la máquina host se van a compartir con el contenedor, se coloquen en su propio montaje de volumen fuera de `C:`. De forma predeterminada, los archivos proyectados tendrán la siguiente propiedad, como se muestra en un archivo de volumen proyectado de ejemplo: ```powershell PS C:> Get-Acl C:varrunsecretskubernetes.ioserviceaccount..2021_08_31_22_22_18.318230061ca.crt | Format-List Path   : Microsoft.PowerShell.CoreFileSystem::C:varrunsecretskubernetes.ioserviceaccount..2021_08_31_22_22_18.318230061ca.crt Owner  : BUILTINAdministrators Group  : NT AUTHORITYSYSTEM Access : NT AUTHORITYSYSTEM Allow  FullControl BUILTINAdministrators Allow  FullControl BUILTINUsers Allow  ReadAndExecute, Synchronize Audit  : Sddl   : O:BAG:SYD:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU) ``` Esto implica que todos los usuarios administradores como `ContainerAdministrator` tendrán acceso de lectura, escritura y ejecución, mientras que los usuarios que no sean administradores tendrán acceso de lectura y ejecución. {{< note >}} En general, se desaconseja otorgar acceso al contenedor al host, ya que puede abrir la puerta a posibles vulnerabilidades de seguridad. Crear un Pod de Windows con `RunAsUser` en su `SecurityContext` dará como resultado que el Pod quede atascado en `ContainerCreating` para siempre. Por lo tanto, se recomienda no utilizar la opción `RunAsUser` exclusiva de Linux con Windows Pods. {{< /note >}} </ins>

This is a Feature Request What would you like to be Localize to Spanish Why is this needed Comments /triage accepted /kind feature /language es /sig docs
Hi Rodolfo, I will take it!
/assign
algún avance al respecto?
disculpa. Lo terminaré hoy, gracias por recordarmenlo Victor.


Question: defaultValue: false fromVersion: "1.24" --- <del> Allow fine-tuing of experimental, alpha-quality logging options. </del> <ins> Allow fine-tuning of experimental, alpha-quality logging options. </ins>

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --:information_source: If you have already worked on a docs issue for Kubernetes, you should strongly consider leaving this good first issue for someone who has not. <!--Required Information--Problem: The page has a typo in it, repeatedly: “fine-tuing” Proposed Solution: find files within that contain the typo correct the spelling Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /language en /good-first-issue
This request has been marked as suitable for new contributors. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : This is a Bug Report <!-- See for guidance on writing an actionable issue description. --Problem: The page has a typo in it, repeatedly: “fine-tuing” find files within that contain the typo correct the spelling Page to Update: <!--Kubernetes Version:--/language en /good-first-issue </details
/triage accepted
I'm new here but I want to contribute to this. I cant see option to assign the issue to me.
Update: Just seen how other issues are assigned. /assign
We have a policy of “no cookie licking”. Anyone is welcome to open a pull request that fixes this - and I hope you will do so. See for extra guidance. It's polite to mark when you start work, just like has; if another contributor wants to work on this as well, you can - but the polite thing to do is to liaise with the person who's already working on that. Maybe they are already well on their way to submitting a change.

Welcome to Kubernetes docs
Hey , I'm a first time contributor , can i take up this issue if it hasn't been already solved?
you should read which covers your question. TL;DR: yes, but it might be a bit unhelpful if you do.
Okay , are there other good first issues that i can work on ?
to find issues labelled as “good first issues”, start from (this includes all languages, so you might want to filter it further, and it also includes issues where people have said they have begun work)
Hey, How is it going on?
PR submitted for this issue.


Question:
 --- layout: blog title: "Kubernetes 的十年" date: 2024-06-06 slug: 10-years-of-kubernetes author: > [Bob Killen](https://github.com/mrbobbytables) (CNCF), [Chris Short](https://github.com/chris-short) (AWS), [Frederico Muñoz](https://github.com/fsmunoz) (SAS), [Kaslin Fields](https://github.com/kaslin) (Google), [Tim Bannister](https://github.com/sftim) (The Scale Factory), 以及全球的每一位贡献者 translator: > [Mengjiao Liu](https://github.com/mengjiao-liu) (DaoCloud) ---   ![KCSEU 2024 团体照片](kcseu2024.jpg) 十年前的 2014 年 6 月 6 日，Kubernetes 的[第一次提交](https://github.com/kubernetes/kubernetes/commit/2c4b3a562ce34cddc3f8218a2c4d11c7310e6d56)被推送到 GitHub。 第一次提交包含了 250 个文件和 47,501 行的 Go、Bash 和 Markdown 代码， 开启了我们今天所拥有的项目。谁能预测到 10 年后，Kubernetes 会成长为迄今为止最大的开源项目之一， 拥有来自超过 8,000 家公司、来自 44 个国家的 [88,000 名贡献者](https://k8s.devstats.cncf.io/d/24/overall-project-statistics?orgId=1)。   这一里程碑不仅属于 Kubernetes，也属于由此蓬勃发展的云原生生态系统。 在 CNCF 本身就有近 [200 个项目](https://all.devstats.cncf.io/d/18/overall-project-statistics-table?orgId=1)，有来自 [240,000 多名个人贡献者](https://all.devstats.cncf.io/d/18/overall-project-statistics-table?orgId=1)， 还有数千名来自更大的生态系统的贡献者的贡献。 如果没有 [700 多万开发者](https://www.cncf.io/blog/2022/05/18/slashdata-cloud-native-continues-to-grow-with-more-than-7-million-developers-worldwide/)和更庞大的用户社区， Kubernetes 就不会达到今天的成就，他们一起帮助塑造了今天的生态系统。  ## Kubernetes 的起源 - 技术的融合 Kubernetes 背后的理念早在第一次提交之前， 甚至第一个原型（[在 2013 年问世](/blog/2018/07/20/the-history-of-kubernetes-the-community-behind-it/)之前就已经存在。 在 21 世纪初，摩尔定律仍然成立。计算硬件正以惊人的速度变得越来越强大。 相应地，应用程序变得越来越复杂。硬件商品化和应用程序复杂性的结合表明需要进一步将软件从硬件中抽象出来， 因此解决方案开始出现。  像当时的许多公司一样，Google 正在快速扩张，其工程师对在 Linux 内核中创建一种隔离形式的想法很感兴趣。 Google 工程师 Rohit Seth 在 [2006 年的一封电子邮件](https://lwn.net/Articles/199643/)中描述了这个概念：  > 我们使用术语 “容器” 来表示一种结构，通过该结构我们可以对负载的系统资源（如内存、任务等）利用情况进行跟踪和计费。   2013 年 3 月，[Solomon Hykes 在 PyCon 上进行了一场名为 “Linux容器的未来”](https://youtu.be/wW9CAH9nSLs?si=VtK_VFQHymOT7BIB)的 5 分钟闪电演讲，介绍了名为 “Docker” 的一款即将被推出的开源工具，用于创建和使用 Linux 容器。Docker 提升了 Linux 容器的可用性，使其比以往更容易被更多用户使用，从而使 Docker 和Linux 容器的流行度飙升。随着 Docker 使 Linux 容器的抽象概念可供所有人使用， 以更便于移植且可重复的方式运行应用突然成为可能，但大规模使用的问题仍然存在。  Google 用来管理大规模应用编排的 Borg 系统在 2000 年代中期采用当时所开发的 Linux 容器技术。 此后，该公司还开始研发该系统的一个新版本，名为 “Omega”。 熟悉 Borg 和 Omega 系统的 Google 工程师们看到了 Docker 所推动的容器化技术的流行。 他们意识到对一个开源的容器编排系统的需求，而且意识到这一系统的“必然性”，正如 Brendan Burns 在这篇[博文](/blog/2018/07/20/the-history-of-kubernetes-the-community-behind-it/)中所描述的。 这一认识在 2013 年秋天激发了一个小团队开始着手一个后来成为 **Kubernetes** 的项目。该团队包括 Joe Beda、Brendan Burns、Craig McLuckie、Ville Aikas、Tim Hockin、Dawn Chen、Brian Grant 和 Daniel Smith。  ## Kubernetes 十年回顾  Kubernetes 的历史始于 2014 年 6 月 6 日的那次历史性提交，随后， [Google 工程师 Eric Brewer 在 2014 年 6 月 10 日的 DockerCon 2014 上的主题演讲](https://youtu.be/YrxnVKZeqK8?si=Q_wYBFn7dsS9H3k3)([及其相应的 Google 博客](https://cloudplatform.googleblog.com/2014/06/an-update-on-container-support-on-google-cloud-platform.html))中由宣布了该项目。  在接下来的一年里，一个由[主要来自 Google 和 Red Hat 等公司的贡献者](https://k8s.devstats.cncf.io/d/9/companies-table?orgId=1&var-period_name=Before%20joining%20CNCF&var-metric=contributors)组成的小型社区为该项目付出了辛勤的努力，最终在 2015 年 7 月 21 日发布了 [1.0 版本](https://cloudplatform.googleblog.com/2015/07/Kubernetes-V1-Released.html)。 在发布 1.0 版本的同时，Google 宣布将 Kubernetes 捐赠给 Linux 基金会下的一个新成立的分支， 即[云原生计算基金会 (Cloud Native Computing Foundation，CNCF)](https://www.cncf.io/announcements/2015/06/21/new-cloud-native-computing-foundation-to-drive-alignment-among-container-technologies/)。  尽管到了 1.0 版本，但 Kubernetes 项目的使用和理解仍然很困难。Kubernetes 贡献者 Kelsey Hightower 特别注意到了该项目在易用性方面的不足，并于 2016 年 7 月 7 日推出了他著名的 “Kubernetes the Hard Way” 指南的[第一次提交](https://github.com/kelseyhightower/kubernetes-the-hard-way/commit/9d7ace8b186f6ebd2e93e08265f3530ec2fba81c)。  自从最初的 1.0 版本发布以来，项目经历了巨大的变化，取得了许多重大的成就，例如 [在 1.16 版本中正式发布的 Custom Resource Definitions (CRD) ](/blog/2019/09/18/kubernetes-1-16-release-announcement/)， 或者[在 1.23 版本中推出的全面双栈支持](/blog/2021/12/08/dual-stack-networking-ga/)，以及社区从 [1.22 版本中移除广泛使用的 Beta API](/blog/2021/07/14/upcoming-changes-in-kubernetes-1-22/) 和[弃用 Dockershim](/blog/2020/12/02/dockershim-faq/) 中吸取的“教训”。  自 1.0 版本以来的一些值得注意的更新、里程碑和事件包括： * 2016 年 12 月 - [Kubernetes 1.5](/blog/2016/12/kubernetes-1-5-supporting-production-workloads/) 引入了运行时可插拔性，初步支持 CRI 和 Alpha 版 Windows 节点支持。 OpenAPI 也首次出现，为客户端能够发现扩展 API 铺平了道路。 * 此版本还引入了 Beta 版的 StatefulSet 和 PodDisruptionBudget。  * 2017 年 4 月 — [引入基于角色的访问控制（RBAC）](/blog/2017/04/rbac-support-in-kubernetes/)。 * 2017 年 6 月 — 在 [Kubernetes 1.7](/blog/2017/06/kubernetes-1-7-security-hardening-stateful-application-extensibility-updates/) 中，ThirdPartyResources 或 "TPRs" 被 CustomResourceDefinitions（CRD）取代。 * 2017 年 12 月 — [Kubernetes 1.9](/blog/2017/12/kubernetes-19-workloads-expanded-ecosystem/) 中， 工作负载 API 成为 GA（正式可用）。发布博客中指出：“Deployment 和 ReplicaSet 是 Kubernetes 中最常用的两个对象， 在经过一年多的实际使用和反馈后，现在已经稳定下来。”  * 2018 年 12 月 — 在 1.13 版本中，容器存储接口（CSI）达到 GA，用于引导最小可用集群的 kubeadm 工具达到 GA，并且 CoreDNS 成为默认的 DNS 服务器。 * 2019 年 9 月 — [自定义资源定义（Custom Resource Definition）在 Kubernetes 1.16 中正式发布](/blog/2019/09/18/kubernetes-1-16-release-announcement/)。 * 2020 年 8 月 — [Kubernetes 1.19](/blog/2020/08/31/kubernetes-1-19-feature-one-year-support/) 将发布支持窗口增加到 1 年。 * 2020 年 12 月 — [Dockershim 在 1.20 版本中被弃用](/zh-cn/blog/2020/12/18/kubernetes-1.20-pod-impersonation-short-lived-volumes-in-csi/)。  * 2021 年 4 月 - [Kubernetes 发布节奏变更](/blog/2021/07/20/new-kubernetes-release-cadence/#:~:text=On%20April%2023%2C%202021%2C%20the,Kubernetes%20community's%20contributors%20and%20maintainers.)，从每年发布 4 个版本变为每年发布 3 个版本。 * 2021 年 7 月 - 在 Kubernetes 1.22 中[移除了广泛使用的 Beta API](/blog/2021/07/14/upcoming-changes-in-kubernetes-1-22/)。 * 2022 年 5 月 - 在 Kubernetes 1.24 中，[Beta API 默认被禁用](/zh-cn/blog/2022/05/03/kubernetes-1-24-release-announcement/)， 以减少升级冲突，并移除了 [Dockershim](/zh-cn/dockershim)，导致[用户普遍感到困惑](https://www.youtube.com/watch?v=a03Hh1kd6KE) （我们已经[改进了我们的沟通方式！](https://github.com/kubernetes/community/tree/master/communication/contributor-comms)） * 2022 年 12 月 - 在 1.26 版本中，进行了重大的[批处理和作业 API 改进](/blog/2022/12/29/scalable-job-tracking-ga/)， 为更好地支持 AI/ML/批处理工作负载铺平了道路。  **附言:** 想亲自体会一下这个项目的进展么？可以查看由社区成员 Carlos Santana、Amim Moises Salum Knabben 和 James Spurin 创建的 [Kubernetes 1.0 集群搭建教程](https://github.com/spurin/kubernetes-v1.0-lab)。 ---  Kubernetes 提供的扩展点多得数不胜数。最初设计用于与 Docker 一起工作，现在你可以插入任何符合 CRI 标准的容器运行时。还有其他类似的接口：用于存储的 CSI 和用于网络的 CNI。 而且这还远远不是全部。在过去的十年中，出现了全新的模式，例如使用[自定义资源定义](/docs/concepts/extend-kubernetes/api-extension/custom-resources/)（CRD） 来支持第三方控制器 - 这现在是 Kubernetes 生态系统的重要组成部分。  在过去十年间，参与构建该项目的社区也得到了巨大的扩展。通过使用 [DevStats](https://k8s.devstats.cncf.io/d/24/overall-project-statistics?orgId=1)，我们可以看到过去十年中令人难以置信的贡献量，这使得 Kubernetes 成为了[全球第二大开源项目](https://www.cncf.io/reports/kubernetes-project-journey-report/)： * **88,474** 位贡献者 * **15,121** 位代码提交者 * **4,228,347** 次贡献 * **158,530** 个问题 * **311,787** 个拉取请求  ## Kubernetes 现状  自项目初期以来，项目在技术能力、使用率和贡献方面取得了巨大的增长。 项目仍在积极努力改进并更好地为用户服务。  在即将发布的 1.31 版本中，该项目将庆祝一个重要的长期项目的完成：移除内部云提供商代码。在这个 [Kubernetes 历史上最大的迁移](/zh-cn/blog/2024/05/20/completing-cloud-provider-migration/)中，大约删除了 150 万行代码，将核心组件的二进制文件大小减小了约 40%。在项目早期，很明显可扩展性是成功的关键。 然而，如何实现这种可扩展性并不总是很清楚。此次迁移从核心 Kubernetes 代码库中删除了各种特定于供应商的功能。 现在，特定于供应商的功能可以通过其他可插拔的扩展功能或模式更好地提供，例如[自定义资源定义（CRD）](https://https://kubernetes.io/zh-cn/docs/concepts/extend-kubernetes/api-extension/custom-resources/) 或 [Gateway API](https://gateway-api.sigs.k8s.io/) 等 API 标准。 Kubernetes 在为其庞大的用户群体提供服务时也面临着新的挑战，社区正在相应地进行调整。其中一个例子是将镜像托管迁移到新的、由社区拥有的 registry.k8s.io。为用户提供预编译二进制镜像的出口带宽和成本已经变得非常巨大。这一新的仓库变更使社区能够以更具成本效益和性能高效的方式继续提供这些便利的镜像。 请务必查看[此博客文章](/blog/2022/11/28/registry-k8s-io-faster-cheaper-ga/)并更新你必须使用 registry.k8s.io 仓库的任何自动化设施！  ## Kubernetes 的未来  十年过去了，Kubernetes 的未来依然光明。社区正在优先考虑改进用户体验和增强项目可持续性的变革。 应用程序开发的世界不断演变，Kubernetes 正准备随之变化。  2024 年，人工智能的进展将一种曾经小众的工作负载类型变成了一种非常重要的工作负载类型。 分布式计算和工作负载调度一直与人工智能、机器学习和高性能计算工作负载的资源密集需求密切相关。 贡献者们密切关注新开发的工作负载的需求以及 Kubernetes 如何为它们提供最佳服务。新成立的 [Serving 工作组](https://github.com/kubernetes/community/tree/master/wg-serving) 就是社区组织来解决这些工作负载需求的一个例子。未来几年可能会看到 Kubernetes 在管理各种类型的硬件以及管理跨硬件运行的大型批处理工作负载的调度能力方面的改进。  Kubernetes 周围的生态系统将继续发展壮大。未来，为了保持项目的可持续性， 像内部供应商代码的迁移和仓库变更这样的举措将变得更加重要。  Kubernetes 的未来 10 年将由其用户和生态系统引领，但最重要的是，由为其做出贡献的人引领。 社区对新贡献者持开放态度。你可以在我们的新贡献者课程 [https://k8s.dev/docs/onboarding](https://k8s.dev/docs/onboarding) 中找到更多有关贡献的信息。 我们期待与你一起构建 Kubernetes 的未来！ {{
}}

I will translate the blog into Chinese: To avoid any conflict that may occur, this issue is opened. /assign /language zh
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/area blog
Just so you know we're likely to update the formatting of that article later this week.
Copy that. I will submit PR after the formatting of that article is updated.


Question: {{< tab name="Zsh" include="included/optional-kubectl-configs-zsh.md" />}} {{< /tabs >}} <ins> ### Install `kubectl convert` plugin {{< include "included/kubectl-convert-overview.md" >}} 1. Download the latest release with the command: {{< tabs name="download_convert_binary_macos" >}} {{< tab name="Intel" codelang="bash" >}} curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl-convert" {{< /tab >}} {{< tab name="Apple Silicon" codelang="bash" >}} curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/arm64/kubectl-convert" {{< /tab >}} {{< /tabs >}} 1. Validate the binary (optional) Download the kubectl checksum file: {{< tabs name="download_convert_checksum_macos" >}} {{< tab name="Intel" codelang="bash" >}} curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl-convert.sha256" {{< /tab >}} {{< tab name="Apple Silicon" codelang="bash" >}} curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/arm64/kubectl-convert.sha256" {{< /tab >}} {{< /tabs >}} Validate the kubectl-convert binary against the checksum file: ```bash echo "$(<kubectl-convert.sha256)  kubectl-convert" | shasum -a 256 --check ``` If valid, the output is: ```console kubectl-convert: OK ``` If the check fails, `shasum` exits with nonzero status and prints output similar to: ```bash kubectl-convert: FAILED shasum: WARNING: 1 computed checksum did NOT match ``` {{< note >}} Download the same version of the binary and checksum. {{< /note >}} 1. Make kubectl-convert binary executable ```bash chmod +x ./kubectl-convert ``` 1. Move the kubectl-convert binary to a file location on your system `PATH`. ```bash sudo mv ./kubectl /usr/local/bin/kubectl-convert sudo chown root: /usr/local/bin/kubectl-convert ``` {{< note >}} Make sure `/usr/local/bin` is in your PATH environment variable. {{< /note >}} 1. Verify plugin is successfully installed ```shell kubectl convert --help ``` If you do not see an error, it means the plugin is successfully installed. </ins> ## {{% heading "whatsnext" %}} {{< include "included/kubectl-whats-next.md" >}}

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Update (really, the 3 pages that it links to) to let readers know how to install Why is this needed is now delivered as a plugin, not part of the main binary. v1.22 includes lots of and release v1.22 is the first time lots of readers will really notice the deprecations. However, there has been no API removal release since was moved to be a plugin. Comments /sig cli /kind feature /priority important-soon (IMO)
ref:
<details<summary<emIt's there for the installing</em</summary<pre$ curl -L -I HTTP/2 302 server: nginx date: Wed, 30 Jun 2021 23:06:44 GMT content-type: text/html content-length: 154 location: via: 1.1 google alt-svc: clear </pre</detailsWhere current docs say to fetch (eg) , let's tell them to install as well.
Since kubectl-convert is a separate binary, should reference of the command from page also be removed?
/help I'm willing to revise this issue description if it's not clear how to make these changes.
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/triage accepted
what you're asking sounds like a separate issue.
I would like to work on this issue. From what I understand, a new command to download has to be under the first point titled for all the three operating systems something like this. Does verifying checksum step also have to for kubectl-convert?
Yes, we should let readers know how to check that the software they download is genuine.
We should also briefly explain what does (a hyperlink is OK)
/assign
the command line reference page still lists -
How do you install kubectl convert for windows? I don't seem to have it installed.

I'm going to mark as off-topic; the original issue is resolved.
How is this issue resolved/closed? I didn't found anywhere on the docs how to install the plugin/binary, only found this info on a third-party site: This really should be better documented, and there is still a mention of this command on this page without any word about it being deprecated and transformed into a plugin/binary:
Try this link: For me, the top search result is to a page with a section “Install plugin”. I think this issue was OK to close.
Truly, didn't have found this section, thanks But i also didn't expected a deprecated command installation instructions would be directly on the page that teaches how to install the command itself, thought it would be in a or section. Can we at least add the link about on the page that teaches how to ? That what people trying to migrate from 1.22 to 1.23 would find it easier. Opened a PR for this here
I'm on a macbook pro Ventura 13, M1 chip. I followed the instructions using ARM64 version. Step 3 didn't work, so I used this instead: Which worked, but then, ran and got: "Error: exec format error" Am I doing something wrong or does this plugin not work on Mac with M1?
You should try asking in


Question: Hostname: web-55b8c6998d-8k564 ``` <del> You can also visit `hello-world.info` from your browser. </del> <ins> 1. Optionally, you can also visit `hello-world.info` from your browser. </ins> <del> * **Optionally** Look up the external IP address as reported by minikube: ```shell minikube ip ``` Add line similar to the following one to the bottom of the `/etc/hosts` file on </del> <ins> Add a line to the bottom of the `/etc/hosts` file on </ins> your computer (you will need administrator access): <del> ```none 172.17.0.15 hello-world.info ``` {{< note >}} Change the IP address to match the output from `minikube ip`. {{< /note >}} </del> <ins> {{< tabs name="hosts" >}} {{% tab name="Linux" %}} Look up the external IP address as reported by minikube ```none minikube ip ``` <br> ```none 172.17.0.15 hello-world.info ``` {{< note >}} Change the IP address to match the output from `minikube ip`. {{< /note >}} {{% /tab %}} {{% tab name="MacOS" %}} ```none 127.0.0.1 hello-world.info ``` {{% /tab %}} {{< /tabs >}} <br> </ins> After you make this change, your web browser sends requests for `hello-world.info` URLs to Minikube.

Problem: Going through the documentation provided by the link such issue has being met on the step of verification that Ingress controller is directing the traffic using the command below: curl --resolve "hello-$( minikube ip )" -i http://hello- After running this command the terminal returns: Failed to connect to hello- port 80 after ms: Couldn't connect to server Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Kubernetes version: v1.28.3 <!--Additional Information:--Environment that is used: Macbook M1 Pro Minikube version: v1.32.0 Minikube uses the docker driver. Step on which problem has been met:
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Page reported in issue: /language en
This is same as issue /triage duplicate I believe this should be fixed by updating the page by mentioning the instructions to create a for MacOS and Windows users. I'll try to work on a PR for this. Till the time the page is modified, the way around this is mentioned . The reason why it fails on MacOS and Windows is documented here , , You can also visit the page and view the tab in Step 4 Deploy applications.
/assign

you need start and then to solve same problem in mac
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/triage needs-information Hi. Is this about a particular web page?
sorry, this is about following tutorial Create an Ingress step 4
/retitle Ingress tutorial does not mention commands needed for Mac /remove-triage needs-information
/kind bug /language en
I can confirm that this is a valid issue on MacOS and the page needs to be updated. I think we should move this to /triage accepted. I cannot test this on Windows at the moment, but suggests that the behaviour on Windows will be the same as MacOS. The network is limited if using the Docker driver on Darwin, Windows, or WSL, and the Node IP is not reachable directly.
/assign


Question: ## 설치 방법 <del> kubeadm을 설치하려면, [설치 가이드](/docs/setup/production-environment/tools/kubeadm/install-kubeadm)를 참고한다. </del> <ins> kubeadm을 설치하려면, [설치 가이드](/ko/docs/setup/production-environment/tools/kubeadm/install-kubeadm/)를 참고한다. </ins> ## {{% heading "whatsnext" %}} <del> * [kubeadm init](/docs/reference/setup-tools/kubeadm/kubeadm-init): 쿠버네티스 컨트롤 플레인 노드를 부트스트랩한다. * [kubeadm join](/docs/reference/setup-tools/kubeadm/kubeadm-join): 쿠버네티스 워커(worker) 노드를 부트스트랩하고 클러스터에 조인시킨다. * [kubeadm upgrade](/docs/reference/setup-tools/kubeadm/kubeadm-upgrade): 쿠버네티스 클러스터를 새로운 버전으로 업그레이드한다. * [kubeadm config](/docs/reference/setup-tools/kubeadm/kubeadm-config): kubeadm v1.7.x 이하의 버전을 사용하여 클러스터를 초기화한 경우, `kubeadm upgrade` 를 위해 사용자의 클러스터를 구성한다. * [kubeadm token](/docs/reference/setup-tools/kubeadm/kubeadm-token): `kubeadm join` 을 위한 토큰을 관리한다. * [kubeadm reset](/docs/reference/setup-tools/kubeadm/kubeadm-reset): `kubeadm init` 또는 `kubeadm join` 에 의한 호스트의 모든 변경 사항을 되돌린다. * [kubeadm version](/docs/reference/setup-tools/kubeadm/kubeadm-version): kubeadm 버전을 출력한다. * [kubeadm alpha](/docs/reference/setup-tools/kubeadm/kubeadm-alpha): 커뮤니티에서 피드백을 수집하기 위해서 기능 미리 보기를 제공한다. </del> <ins> * [kubeadm init](/docs/reference/setup-tools/kubeadm/kubeadm-init/): 쿠버네티스 컨트롤 플레인 노드를 부트스트랩한다. * [kubeadm join](/docs/reference/setup-tools/kubeadm/kubeadm-join/): 쿠버네티스 워커(worker) 노드를 부트스트랩하고 클러스터에 조인시킨다. * [kubeadm upgrade](/docs/reference/setup-tools/kubeadm/kubeadm-upgrade/): 쿠버네티스 클러스터를 새로운 버전으로 업그레이드한다. * [kubeadm config](/docs/reference/setup-tools/kubeadm/kubeadm-config/): kubeadm v1.7.x 이하의 버전을 사용하여 클러스터를 초기화한 경우, `kubeadm upgrade` 를 위해 사용자의 클러스터를 구성한다. * [kubeadm token](/docs/reference/setup-tools/kubeadm/kubeadm-token/): `kubeadm join` 을 위한 토큰을 관리한다. * [kubeadm reset](/docs/reference/setup-tools/kubeadm/kubeadm-reset/): `kubeadm init` 또는 `kubeadm join` 에 의한 호스트의 모든 변경 사항을 되돌린다. * [kubeadm version](/docs/reference/setup-tools/kubeadm/kubeadm-version/): kubeadm 버전을 출력한다. * [kubeadm alpha](/docs/reference/setup-tools/kubeadm/kubeadm-alpha/): 커뮤니티에서 피드백을 수집하기 위해서 기능 미리 보기를 제공한다. </ins>

<!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: In , the link href is (English). The of is recently in . Proposed Solution: In , Before: After: Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/assign
/language ko
/triage accepted
Resolved by


Question: ## {{% heading "whatsnext" %}} <ins> * Read the {{< glossary_tooltip text="CNCF" term_id="cncf" >}} [Operator White Paper](https://github.com/cncf/tag-app-delivery/blob/eece8f7307f2970f46f100f51932db106db46968/operator-wg/whitepaper/Operator-WhitePaper_v1-0.md). </ins> * Learn more about [Custom Resources](/docs/concepts/extend-kubernetes/api-extension/custom-resources/) * Find ready-made operators on [OperatorHub.io](https://operatorhub.io/) to suit your use case * [Publish](https://operatorhub.io/) your operator for other people to use

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Update to have an extra link in it's What's Next section, pointing at Why is this needed The is very relevant to people reading about the operator pattern. Comments /language en /kind feature
/good-first-issue /triage accepted
This request has been marked as suitable for new contributors. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /good-first-issue /triage accepted Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign I can work on this.
Fixed it here


Question: 要确认 hypervisor 和 Minikube 均已成功安装，可以运行以下命令来启动本地 Kubernetes 集群： <del> {{< note >}} </del> <!-- For setting the `--vm-driver` with `minikube start`, enter the name of the hypervisor you installed in lowercase letters where `<driver_name>` is mentioned below. A full list of `--vm-driver` values is available in [specifying the VM driver documentation](https://kubernetes.io/docs/setup/learning-environment/minikube/#specifying-the-vm-driver). --> <del> 通过 `minikube start` 设置 `--vm-driver`。在下面提到 `<driver_name>` 的地方，用小写字母，输入你安装的 hypervisor 的名称。 [指定 VM 驱动程序](https://kubernetes.io/docs/setup/learning-environment/minikube/#specifying-the-vm-driver) 列举了 `--vm-driver` 值的完整列表 </del> <ins> {{< note >}} 若要为 `minikube start` 设置 `--vm-driver`，在下面提到 `<driver_name>` 的地方，用小写字母输入你安装的 hypervisor 的名称。 [指定 VM 驱动程序](/docs/setup/learning-environment/minikube/#specifying-the-vm-driver) 列举了 `--vm-driver` 值的完整列表。 </ins> {{< /note >}} ```shell

Note shortcode with html comment wont be parsed correctly Problem: After has been updated since , the HTML comment inside will result in markdownify not working correctly. English version docs: ! Chinese version docs: ! Proposed Solution: Move the HTML comment outside the shortcode, it does work correctly. Just like this.
This partially duplicates issue


Question: | [release-managers-private@kubernetes.io](mailto:release-managers-private@kubernetes.io) | N/A | Private | Private discussion for privileged Release Managers | Release Managers, SIG Release leadership | | [security-release-team@kubernetes.io](mailto:security-release-team@kubernetes.io) | [#security-release-team](https://kubernetes.slack.com/archives/G0162T1RYHG) (channel) / @security-rel-team (user group) | Private | Security release coordination with the Product Security Committee | [security-discuss-private@kubernetes.io](mailto:security-discuss-private@kubernetes.io), [release-managers-private@kubernetes.io](mailto:release-managers-private@kubernetes.io) | <ins> ### Security Embargo Policy Some information about releases is subject to embargo and we have defined policy about how those embargos are set. Please refer [Security Embargo Policy](https://github.com/kubernetes/security/blob/master/private-distributors-list.md#embargo-policy) here for more information. </ins> ## Handbooks **NOTE: The Patch Release Team and Branch Manager handbooks will be de-duplicated at a later date.**

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Mention the within , or link to it. Why is this needed Readers might have an interest in knowing how security fixes are planned and communicated. Comments /sig release /sig security /language en /kind feature
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign I can work on this.
Hi Please suggest which option from the following I will go with In this, we will have to make a page for embargo policy(security-embargo-) as we do not mention the link directly. 1) Copy the whole content from the to security-embargo- which seems redudant as it already mention in kubernete/security. 2) Mention the below text and then the link to for more details like:
I can clarify: this issue is about explaining that some information about upcoming releases is subject to embago, and that there is a defined policy about how those embargos are set. I don't see a need to mention how to join the mailing list for distributors within If someone is maintaining a Kubernetes distribution, I hope they're able to follow hyperlinks well enough to work that out. We have readers who might not think to look there. That's why we should refer to it (a hyperlink could be OK).
Thanks for suggestion. will create a pr for it soon.
fixed it here:


Question: NAME                            READY     STATUS    RESTARTS   AGE frontend-3823415956-k22zn       1/1       Running   0          1h frontend-3823415956-w9gbt       1/1       Running   0          1h <del> mongo-1068406935-3lswp   1/1       Running   0          1h </del> <ins> mongo-1068406935-3lswp          1/1       Running   0          1h </ins> ```

4 ordered lists have wrong indexes. For example, the number below should be 3. ! Page to update: /language en /kind cleanup
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign


Question: # Array of authenticated usernames to exempt. usernames: [] # Array of runtime class names to exempt. <del> runtimeClassNames: [] </del> <ins> runtimeClasses: [] </ins> # Array of namespaces to exempt. namespaces: [] ```

In the v1beta1 admission config example, I had to use rather than See
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Page:
/sig auth /language en /assign


Question: 1. You use the `kubectl` tool to manually delete a specific Pod, with the default grace period (30 seconds). 1. The Pod in the API server is updated with the time beyond which the Pod is considered "dead" <del> along with the grace period. </del> <ins> along with the grace period. </ins> If you use `kubectl describe` to check on the Pod you're deleting, that Pod shows up as <del> "Terminating". </del> <ins> "Terminating". </ins> On the node where the Pod is running: as soon as the kubelet sees that a Pod has been marked as terminating (a graceful shutdown duration has been set), the kubelet begins the local Pod shutdown process.

Second sentence of the second paragraph is obviously incomplete. It reads like this . ! It would be good to restore missing bit.
Page is PR introduced the regression; I suggest the second “handles” should instead read “determines what action to take to make the Pod healthy again”. /kind bug /language en /triage accepted /priority backlog Thanks
/help
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: ## 金丝雀部署 {#canary-deployment} 如果要使用 Deployment 向用户子集或服务器子集上线版本， <del> 则可以遵循[资源管理](/zh-cn/docs/concepts/cluster-administration/manage-deployment/#canary-deployments) 所描述的金丝雀模式，创建多个 Deployment，每个版本一个。 </del> <ins> 则可以遵循[资源管理](/zh-cn/docs/concepts/cluster-administration/manage-deployment/#canary-deployments)所描述的金丝雀模式， 创建多个 Deployment，每个版本一个。 </ins> <!-- ## Writing a Deployment Spec

There are some bugs: ,nginx%3Dnginx%3A1.9.1,-%2D%2Drecord%3Dtrue%0A3 "nginx=nginx:1.9.1" should be changed to "nginx=nginx:1.16.1" ,nginx%3Dnginx%3A1.91,-%2D%2Drecord%3Dtrue "nginx=nginx:1.91" should be changed to "nginx=nginx:1.161" "image updated to 1.9.1" should be changed to "image updated to 1.16.1" The content of this article has many "", it could be changed to "deployment". For example: ,,-%E8%BE%93%E5%87%BA%E7%B1%BB%E4%BC%BC%E4%BA%8E "kubectl rollout history " could be changed to "kubectl rollout history deployment/nginx-deployment"
/language zh
/triage accepted
The label cannot be applied. Only GitHub organization members can add the label. <detailsIn response to : /triage accepted Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
looks like docs is already updated to nginx:1.16.1. Do you mind closing this issue?
There should still be a few places left unfinished.
Could you please edit the issue which needs to be still updated?
Bug1: ,nginx%3Dnginx%3A1.9.1,-%2D%2Drecord%3Dtrue%0A3 "nginx=nginx:1.9.1" should be changed to "nginx=nginx:1.16.1" Bug2: ,nginx%3Dnginx%3A1.91,-%2D%2Drecord%3Dtrue "nginx=nginx:1.91" should be changed to "nginx=nginx:1.161" Bug3: "image updated to 1.9.1" should be changed to "image updated to 1.16.1" Bug4: The content of this article has many "", it could be changed to "deployment".

For example: ,,-%E8%BE%93%E5%87%BA%E7%B1%BB%E4%BC%BC%E4%BA%8E "kubectl rollout history " could be changed to "kubectl rollout history deployment/nginx-deployment"
Thanks for clarifying. /assign
/retitle [zh] Localization bugs / work required for Deployment concept
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale
/triage accepted


Question: 1. There is not yet an easy way to generate a `kubeconfig` file which can be used to authenticate to the cluster remotely with `kubectl` on, for example, your workstation. Workaround: copy the kubelet's `kubeconfig` from the master: use `scp root@<master>:/etc/kubernetes/admin.conf .` and then e.g. `kubectl --kubeconfig ./admin.conf get nodes` from your workstation. <ins> 1. If you are using VirtualBox (directly or via Vagrant), you will need to ensure that `hostname -i` returns a routable IP address (i.e. one on the second network interface, not the first one). By default, it doesn't do this and kubelet ends-up using first non-loopback network interface, which is usually NATed. Workaround: Modify `/etc/hosts`, take a look at this [`Vagrantfile`][ubuntu-vagrantfile] for how you this can be achieved. [ubuntu-vagrantfile]: https://github.com/errordeveloper/k8s-playground/blob/22dd39dfc06111235620e6c4404a96ae146f26fd/Vagrantfile#L11), </ins>

<!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!--Required Information--This is a... <!-- choose one by changing [ ] to [x] --- [x] Feature Request [ ] Bug Report Problem: The other day I was informed that when interracting with the Kubernetes Developer Community on slack I should change my Slack display name to be the same as my github handle. The person telling me then wondered if we had this documented in the new developer guide. I checked and this does not appear to be mentioned in the new developer guide. Proposed Solution: Add a section to the new developer guide () to mention that when interracting with the Kubernetes Developer Community on slack all contributors should make sure their Slack display name is the same as their github handle. Page to Update:
Great! I'll add this one to my todo list. Thanks!
It'd also be good to keep the icon the same between GH and slack. I think that's more recognizable. But that's okay, it depends on guys' wish.


Question: Different kinds of object can also have different `.status`; again, the API reference pages detail the structure of that `.status` field, and its content for each different type of object. <ins> ## Server side field validation Starting with Kubernetes v1.25, the API server offers server side [field validation](/docs/reference/using-api/api-concepts/#field-validation) that detects unrecognized or duplicate fields in an object. It provides all the functionality of `kubectl --validate` on the server side. The `kubectl` tool uses the `--validate` flag to set the level of field validation. It accepts the values `ignore`, `warn`, and `strict` while also accepting the values `true` (equivalent to `strict`) and `false` (equivalent to `ignore`). The default validation setting for `kubectl` is `--validate=true`. `Strict` : Strict field validation, errors on validation failure `Warn` : Field validation is performed, but errors are exposed as warnings rather than failing the request `Ignore` : No server side field validation is performed When `kubectl` cannot connect to an API server that supports field validation it will fall back to using client-side validation. Kubernetes 1.27 and later versions always offer field validation; older Kubernetes releases might not. If your cluster is older than v1.27, check the documentation for your version of Kubernetes. </ins> ## {{% heading "whatsnext" %}} If you're new to Kubernetes, read more about the following:

The docs on currently make no mention of field validation. Now that of unknown and duplicate fields is graduating to GA, we should mention it briefly here.
/cc
/triage accepted
/wg api-expression /language en /priority important-longterm /sig api-machinery
/assign


Question: ### Linux ```shell <del> export KUBECONFIG=$KUBECONFIG_SAVED </del> <ins> export KUBECONFIG="$KUBECONFIG_SAVED" </ins> ``` ### Windows PowerShell

Setting KUBECONFIG variable doesn't work very well on macOS (Monterey 12.2.1). In the line: The first colon (:) will make the following character (c) dissappear: What I get is the mangled text: What works for me better is explicitly using full paths:
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
Thanks for reporting, I can open a PR to fix this! /remove-lifecycle stale /assign


Question: ## Taint Nodes by Condition <del> The node lifecycle controller automatically creates taints corresponding to Node conditions with `NoSchedule` effect. Similarly the scheduler does not check Node conditions; instead the scheduler checks taints. This assures that Node conditions don't affect what's scheduled onto the Node. The user can choose to ignore some of the Node's problems (represented as Node conditions) by adding appropriate Pod tolerations. </del> <ins> The control plane, using the node {{<glossary_tooltip text="controller" term_id="controller">}}, automatically creates taints with a `NoSchedule` effect for [node conditions](/docs/concepts/scheduling-eviction/pod-eviction#node-conditions). The scheduler checks taints, not node conditions, when it makes scheduling decisions. This ensures that node conditions don't directly affect scheduling. For example, if the `DiskPressure` node condition is active, the control plane adds the `node.kubernetes.io/disk-pressure` taint and does not schedule new pods onto the affected node. If the `MemoryPressure` node condition is active, the control plane adds the `node.kubernetes.io/memory-pressure` taint. You can ignore node conditions for newly created pods by adding the corresponding Pod tolerations. The control plane also adds the `node.kubernetes.io/memory-pressure` toleration on pods that have a {{< glossary_tooltip text="QoS class" term_id="qos-class" >}} other than `BestEffort`. This is because Kubernetes treats pods in the `Guaranteed` or `Burstable` QoS classes (even pods with no memory request set) as if they are able to cope with memory pressure, while new `BestEffort` pods are not scheduled onto the affected node. </ins> The DaemonSet controller automatically adds the following `NoSchedule` tolerations to all daemons, to prevent DaemonSets from breaking.

Page to update: Blocked by Based on in PR , we should add the following information about node conditions to the Taint Nodes by Condition section of this page. The API server also respects when making scheduling decisions. For example, If the node condition is active, the system doesn't allow any new Pods to schedule on the node. If the node condition is active on a node, the system doesn't allow new pods on the node. What is "the system"? The API server? /cc /assign /sig docs /language en
"The system" is a mix of components: the kube-controller-manager sets the taints via the node controller. apiserver sets the toleration for DiskPressure for non-BestEffort pods. scheduler checks if pods have tolerations for the taint But that's too much implementation detail. "The system" or "the control plane" should be enough. WDYT ?
Ah, if it's the control plane then we can say that haha I thought it was something else :P
/triage accepted


Question: <ins> {{/* If a 404 occurs and the referrer is a different version of the Kubernetes documentation, don't show the regular 404 error page, but instead redirect to the site root */}} <script type="text/javascript"> var sameBaseUrlRegExp = new RegExp("^" + location.protocol + "//" + location.host.replace(".", ".") + "/.*", "i"); var kubernetesDocumentationUrlRegExp = new RegExp("^https?://(.+.)?kubernetes.io/.*", "i"); if (!sameBaseUrlRegExp.test(document.referrer) && kubernetesDocumentationUrlRegExp.test(document.referrer)) { location.replace("/"); } </script> </ins>

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Current page is lost when switching between documentation versions. Steps to reproduce to some page in the docs, for example the version selector at the top of the page to change to 1.17. that it it sends me to the instead of showing me the . Proposed Solution: Keep the relative path when switching versions Page to Update: All <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: Am I wrong that it used to preserve the page you are on when switching versions? I feel like it used to do that, but I'm not 100% sure.
Yes, at some point the site kept the same page when switching between versions.
/kind bug /priority backlog (I think this is a low-priority-backlog sort of issue; it's a frustration, but we have other places where it makes sense to focus effort first).
/area web-development


Question: image: redis:3.2-alpine ``` <del> ウェブサーバーのDeploymentを記載した以下のyamlファイルには、`podAntiAffinity` と`podAffinity`が設定されています。 全てのレプリカが`app=store`のラベルが付与されたPodと同じゾーンで稼働するよう、スケジューラーに設定されます。 また、それぞれのウェブサーバーは1つのノードで稼働されないことも保証されます。 </del> <ins> 次のウェブサーバーのDeployment例では、`app=web-store`ラベルが付与されたレプリカを作成します。Podアフィニティルールは、各レプリカを、`app=store`ラベルが付与されたPodを持つNodeに配置するようスケジューラーに指示します。Podアンチアフィニティルールは、1つのNodeに複数の`app=web-store`サーバーを配置しないようにスケジューラーに指示します。 </ins> ```yaml apiVersion: apps/v1

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Updated Japanese translation for the file. Why is this needed There are several updates in and therefore this page is outdated. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/language ja /assign
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: 上記の設定ファイルは、`dev-ramp-up`というコンテキストを表します。 <del> ## KUBECONFIG環境変数を設定する </del> <ins> ## KUBECONFIG環境変数を設定する {#set-the-kubeconfig-environment-variable} </ins> `KUBECONFIG`という環境変数が存在するかを確認してください。もし存在する場合は、後で復元できるようにバックアップしてください。例えば:

This is a Feature Request What would you like to be Translate into Japanese. Why is this needed This page has not been translated. Comments /language ja /assign
/triage accepted


Question: ``` 1. Verify the stored Secret is prefixed with `k8s:enc:aescbc:v1:` which indicates <del> the `aescbc` provider has encrypted the resulting data. </del> <ins> the `aescbc` provider has encrypted the resulting data. Confirm that the key name shown in `etcd` matches the key name specified in the `EncryptionConfiguration` mentioned above. In this example, you can see that the encryption key named `key1` is used in `etcd` and in `EncryptionConfiguration`. </ins> 1. Verify the Secret is correctly decrypted when retrieved via the API:

I propose adding one more best practice to “Encrypting Secret Data at Rest”: manually verify that the key used to encrypt secrets in etcd match the key that is saved to disk. Race conditions, bugs in the code, or user mistakes can overwrite with the wrong key. While the chances of this happening are small, it does happen and the consequences can be devastating. A best practice would be to verify that the keys match. Here are several such bugs: (Subscription required) As I said, these bugs are rare but will be devastating. We ran into this on a production cluster and very nearly lost the cluster. In our case, showed one key but we saw that was using a different, older key to encrypt secrets. The key in memory and the key on disk were different, and determining that required some very advanced troubleshooting. If all API servers are rebooted, the key will be lost and the secrets along with the key.
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/label language/en
The label(s) cannot be applied. These labels are supported: . Is this label configured under or in ? <detailsIn response to : /label language/en Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig security


Question: - `KubeletCredentialProviders`: Enable kubelet exec credential providers for image pull credentials. - `KubeletPluginsWatcher`: Enable probe-based plugin watcher utility to enable kubelet to discover plugins such as [CSI volume drivers](/docs/concepts/storage/volumes/#csi). <del> - `KubeletPodResources`: Enable the kubelet's pod resources GRPC endpoint. See [Support Device Monitoring](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/compute-device-assignment.md) </del> <ins> - `KubeletPodResources`: Enable the kubelet's pod resources gRPC endpoint. See [Support Device Monitoring](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/606-compute-device-assignment/README.md) </ins> for more details. - `LegacyNodeRoleBehavior`: When disabled, legacy behavior in service load balancers and node disruption will ignore the `node-role.kubernetes.io/master` label in favor of the

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Proposed Solution: in this page is linked to a dead url. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
/kind bug /sig node /language en /triage accepted Rather than linking to a KEP, we should really add a new page to the documentation (maybe in Concepts, maybe in Reference) and then link to that.
The fail link in Support Device Monitoring due to . This root cause in the kind/bug is the repo of kubernetes/enhancements url that move to . I had a look at it and sent in a pull request for fix this.(PR ) /assign
/close
Closing this issue. <detailsIn response to : /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: Use the following commands to delete the StatefulSet. ```console <del> $ grace=$(kubectl get po cassandra-0 --template '{{.spec.terminationGracePeriodSeconds}}')  </del> <ins> $ grace=$(kubectl get po cassandra-0 -o=jsonpath='{.spec.terminationGracePeriodSeconds}')  </ins> && kubectl delete statefulset -l app=cassandra  && echo "Sleeping $grace"  && sleep $grace

<!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!--Required Information--This is a... <!-- choose one by changing [ ] to [x] --- [ ] Feature Request [X] Bug Report Problem: There is a warning during the Netlify preview build process: Looks like liquid is trying to parse in the line: Proposed Solution: Find out how to escape in a code block for Liquid. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Kubernetes 1.6 <!--Additional Information:--


Question: You can also use TokenRequest to obtain short-lived tokens for your external application. {{< /note >}} <ins> ### Restricting access to Secrets {#enforce-mountable-secrets} Kubernetes provides an annotation called `kubernetes.io/enforce-mountable-secrets` that you can add to your ServiceAccounts. When this annotation is applied, the ServiceAccount's secrets can only be mounted on specified types of resources, enhancing the security posture of your cluster. You can add the annotation to a ServiceAccount using a manifest: ```yaml apiVersion: v1 kind: ServiceAccount metadata: annotations: kubernetes.io/enforce-mountable-secrets: "true" name: my-serviceaccount namespace: my-namespace ``` When this annotation is set to "true", the Kubernetes control plane ensures that the Secrets from this ServiceAccount are subject to certain mounting restrictions. 1. The name of each Secret that is mounted as a volume in a Pod must appear in the `secrets` field of the Pod's ServiceAccount. 1. The name of each Secret referenced using `envFrom` in a Pod must also appear in the `secrets` field of the Pod's ServiceAccount. 1. The name of each Secret referenced using `imagePullSecrets` in a Pod must also appear in the `secrets` field of the Pod's ServiceAccount. By understanding and enforcing these restrictions, cluster administrators can maintain a tighter security profile and ensure that secrets are accessed only by the appropriate resources. </ins> ## Authenticating service account credentials {#authenticating-credentials} ServiceAccounts use signed

The documentation for the annotation on consists of : This leaves unclear the details of the actual effect of the annotation. By checking I was able to determine that setting this annotation to causes the following enforcements: (1) s mounted as must appear in the 's (2) s referenced in in or must appear in the 's (3) s referenced in of s must appear in the 's (1) is implied by the name of the annotation, but the lack of any mention of (2) or (3) in the documentation forced me to check the code to ensure that it wasn't only enforcing mounting of s as the name implies. The documentation also mentions only the field of the , yet the enforcement also takes into account the 's field (which the 's are checked against). The documentation would be improved by describing the actual enforcement behaviour that this feature implements. This feature may also benefit from being mentioned in the document.
/triage accepted /help /kind feature
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /triage accepted /help /kind feature </details
I see , can come up with something like: I'll take this up?
/assign


Question: {{< note >}} Para descargar una versión específica, reemplace el `$(curl -L -s https://dl.k8s.io/release/stable.txt)` parte del comando con la versión específica. <del> Por ejemplo, para descargar la versión {{< param "fullversion" >}} en Intel macOS, escriba: </del> <ins> Por ejemplo, para descargar la versión {{< skew currentPatchVersion >}} en Intel macOS, escriba: </ins> ```bash <del> curl -LO "https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/darwin/amd64/kubectl" </del> <ins> curl -LO "https://dl.k8s.io/release/v{{< skew currentPatchVersion >}}/bin/darwin/amd64/kubectl" </ins> ``` Y para macOS en Apple Silicon, escriba: ```bash <del> curl -LO "https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/darwin/arm64/kubectl" </del> <ins> curl -LO "https://dl.k8s.io/release/v{{< skew currentPatchVersion >}}/bin/darwin/arm64/kubectl" </ins> ``` {{< /note >}}

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The param is deprecated. Proposed Solution: Replace the shortcode (Spanish pages), for example with or something close. <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--Part of /language es
/triage accepted /area localization /priority backlog


Question: <ins> --- title: क्यूबएडीएम (Kubeadm) id: kubeadm date: 2018-04-12 full_link: /docs/admin/kubeadm/ short_description: > कुबेरनेट्स को जल्दी से इंस्टॉल करने और एक सुरक्षित क्लस्टर स्थापित करने के लिए एक उपकरण। aka: tags: - tool - operation --- कुबेरनेट्स को जल्दी से इंस्टॉल करने और एक सुरक्षित क्लस्टर स्थापित करने के लिए एक उपकरण। <!--more--> आप कंट्रोल प्लेन और {{< glossary_tooltip text="वर्कर नोड्स" term_id="node" >}} दोनों घटकों को स्थापित करने के लिए क्यूबएडीएम का उपयोग कर सकते हैं। </ins>

If this is your first contribution, visit for information on how to get started. Review a few to see which content you have to change and which you leave unchanged. Make sure your base, target branch is and create a working branch called . Create a file called Copy the content of to the file you created Localize the content. Push your change and create a pull request. Completing this feature issue fixes part of /language hi /triage accepted
/assign Thank you


Question: All of this is best illustrated by examples.  Imagine a Kubernetes release, version X, which introduces a new API group.  A new Kubernetes release is made <del> every approximately 3 months (4 per year).  The following table describes which </del> <ins> every approximately 4 months (3 per year).  The following table describes which </ins> API versions are supported in a series of subsequent releases. <table>

In k8s document page: Second paragraph below Rule b says: All of this is best illustrated by examples. Imagine a Kubernetes release, version X, which introduces a new API group. A new Kubernetes release is made every approximately 3 months (4 per year). It should say: All of this is best illustrated by examples. Imagine a Kubernetes release, version X, which introduces a new API group. A new Kubernetes release is made every approximately 4 months (3 per year).
/kind bug /retitle Kubernetes Deprecation Policy page lists wrong release cadence /language en /help /priority backlog /triage accepted Thanks for the report.
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /kind bug /retitle Kubernetes Deprecation Policy page lists wrong release cadence /language en /help /priority backlog /triage accepted Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
I would like to pick this up /assign


Question: To enable swap on a node, the `NodeSwap` feature gate must be enabled on the kubelet, and the `--fail-swap-on` command line flag or `failSwapOn` <del> [configuration setting](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) </del> <ins> [configuration setting](/docs/reference/config-api/kubelet-config.v1beta1/) </ins> must be set to false. {{< warning >}}

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Url selector #kubelet-config-k8s-io-v1beta1-KubeletConfiguration doesn't make a difference between: and Proposed Solution: Removing the selector from the URLs Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/language en
/assign
/retitle Problems with (generated) reference for kubelet configuration


Question: Deployments and Services. See [Use a Service to Access an Application in a Cluster](/docs/tasks/access-application-cluster/service-access-application-cluster/) for an example.

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be describes a bug in Kubernetes where YAML 1.2 documents are not parsed (Kubernetes does not have good support for YAML 1.1), but then also Kubernetes does incorrectly parse completely valid YAML 1.1 the way that the specification defines. Why is this needed The bug makes it hard for some people, using conformant libraries, to make YAML documents that Kubernetes accepts. We should document the bug so that readers are aware of the shortcomings here. Comments /wg api-expression /language en /priority backlog
/triage accepted
i can help you because I'm new to it so if i can tag along i will be able to learn a lot
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale
would you add this as a warning note in ?
/assign


Question: [javascript_required] other = "JavaScript must be [enabled](https://www.enable-javascript.com/) to view this content" <del> [katacoda_removal_warning] other = """This online tutorial on this page uses functionality that will [not be available](https://www.oreilly.com/online-learning/leveraging-katacoda-technology.html) past <time datetime="2022-06-15">June 15th, 2022</time>.""" </del> [latest_release] other = "Latest Release:"

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: We a banner: Given the latest updates from O'Reilly, that banner may not be accurate and the service (albeit possibly degraded?) is expected to survive beyond June 15th 2022. Example page: Relevant to issue
we could remove the banner and wait till June 15. If a new update came then we can update it?
I'm OK with removing the banner.
/assign
/triage accepted


Question: | `persistentvolumes` | `pv` | | false | PersistentVolume | | `pods` | `po` | | true | Pod | | `podtemplates` | | | true | PodTemplate | <del> | `replicationcontrollers` | `rc` | | true| ReplicationController | </del> <ins> | `replicationcontrollers` | `rc` | | true | ReplicationController | </ins> | `resourcequotas` | `quota` | | true | ResourceQuota | | `secrets` | | | true | Secret | | `serviceaccounts` | `sa` | | true | ServiceAccount | | `services` | `svc` | | true | Service | | `mutatingwebhookconfigurations` | | admissionregistration.k8s.io | false | MutatingWebhookConfiguration | | `validatingwebhookconfigurations` | | admissionregistration.k8s.io | false | ValidatingWebhookConfiguration | <del> | `customresourcedefinitions` | `crd`, `crds` | apiextensions.k8s.io | false |  CustomResourceDefinition | </del> <ins> | `customresourcedefinitions` | `crd,crds` | apiextensions.k8s.io | false | CustomResourceDefinition | </ins> | `apiservices` | | apiregistration.k8s.io | false | APIService | | `controllerrevisions` | | apps | true | ControllerRevision | | `daemonsets` | `ds` | apps | true | DaemonSet |

This is a Bug Report Problem: The resource type list on is about v1.13.3 which is too old. We are not obliged to keep the list updated on every release, but having the list updated to a supported version is still desireable. Proposed Solution: Update the list to reflect what we have today. Page to Update:
ref:
/assign
fixed. /close
Closing this issue. <detailsIn response to : fixed. /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: <!--more--> <!-- <del> Kubernetes supports several container runtimes: [Docker](http://www.docker.com), [containerd](https://containerd.io), [cri-o](https://cri-o.io/), [rktlet](https://github.com/kubernetes-incubator/rktlet) and any implementation of the [Kubernetes CRI (Container Runtime Interface)](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/container-runtime-interface.md). </del> <ins> Kubernetes supports several container runtimes: {{< glossary_tooltip term_id="docker">}}, {{< glossary_tooltip term_id="containerd" >}}, {{< glossary_tooltip term_id="cri-o" >}}, and any implementation of the [Kubernetes CRI (Container Runtime Interface)](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/container-runtime-interface.md). </ins> --> <del> Kubernetes 支持多个容器运行环境: [Docker](http://www.docker.com)、 [containerd](https://containerd.io)、[cri-o](https://cri-o.io/)、 [rktlet](https://github.com/kubernetes-incubator/rktlet) 以及任何实现 [Kubernetes CRI (容器运行环境接口)](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/container-runtime-interface.md)。 </del> <ins> Kubernetes 支持多个容器运行环境: {{< glossary_tooltip term_id="docker">}}、 {{< glossary_tooltip term_id="containerd" >}}、{{< glossary_tooltip term_id="cri-o" >}} 以及任何实现 [Kubernetes CRI (容器运行环境接口)](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/container-runtime-interface.md)。 </ins>

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Clicking the "" hyperlink leads to the 404 page. <img width="876" alt="WeChatc2b6a16c89afc8d1086c8c92a0a7f437" src="https://user-"Proposed Solution: correct link as below: full_link: /docs/setup/production-environment/container-runtimes <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
/language zh


Question:
Allowed Values

Undefined/nil

Known list

Known list (not supported by the built-in Pod Security Admission controller)

0

This is a Feature Request "Host Ports" rule have the following description "HostPorts should be disallowed, or at minimum restricted to a known list." It is not clear for the reader that this statement is composed from two mutually exclusive terms "HostPorts should be disallowed” OR “HostPorts should be restricted to a known list." Additionally, it is not clear that Pod Security Admission Controller implements the first option and the second one is for 3rd party controllers like Gatekeeper/Kyverno. What would you like to be "Host Ports" rule can be rephrased so it is clear that it consist of two mutually exclusive options. Or it be divided into two separate rules (two rows in the table). doc or/and doc should clearly state which "Host Ports" option is implemented by the "Pod Security Admission" Why is this needed Pod Security Standards doc can mislead user. Comments
/language en /sig security
/sig auth
/remove-kind feature /kind bug
If we're updating the PSA doc, we should perhaps work with sig-auth ( maybe) to identify if there are other Pod Security Standards where PSA only enforces a specific condition or behaviour by default.
Yes, I agree. I'd be OK with just change this to "HostPorts should be disallowed". The standards used to include more optional restrictions, but we've been making them more opinionated (and aligned with the PSA implementation) over time.
/triage accepted
/assign
I don't see any updates; so unassigning you. Please feel free to assign, if you come back here again and are willing to work on /unassign
For the adventurous contributor looking for a good issue, here's what you need to do: In the Host Ports row in , replace the first sentence with "HostPorts should be disallowed." For instructions to edit a page and create a PR, use in our contributor guide /help-wanted