Question:
 <svg aria-roledescription="flowchart-v2" role="graphics-document document" viewBox="-8 -8 283.8699951171875 664.2999877929688" xmlns="http://www.w3.org/2000/svg" height="700px" id="graph-div" xmlns:xlink="http://www.w3.org/1999/xlink"><g><marker orient="auto" markerHeight="12" markerWidth="12" markerUnits="userSpaceOnUse" refY="5" refX="10" viewBox="0 0 10 10" class="marker flowchart" id="flowchart-pointEnd"><path style="stroke-width: 1; stroke-dasharray: 1, 0;" class="arrowMarkerPath" d="M 0 0 L 10 5 L 0 10 z"></path></marker><marker orient="auto" markerHeight="12" markerWidth="12" markerUnits="userSpaceOnUse" refY="5" refX="0" viewBox="0 0 10 10" class="marker flowchart" id="flowchart-pointStart"><path style="stroke-width: 1; stroke-dasharray: 1, 0;" class="arrowMarkerPath" d="M 0 5 L 10 10 L 10 0 z"></path></marker><marker orient="auto" markerHeight="11" markerWidth="11" markerUnits="userSpaceOnUse" refY="5" refX="11" viewBox="0 0 10 10" class="marker flowchart" id="flowchart-circleEnd"><circle style="stroke-width: 1; stroke-dasharray: 1, 0;" class="arrowMarkerPath" r="5" cy="5" cx="5"></circle></marker><marker orient="auto" markerHeight="11" markerWidth="11" markerUnits="userSpaceOnUse" refY="5" refX="-1" viewBox="0 0 10 10" class="marker flowchart" id="flowchart-circleStart"><circle style="stroke-width: 1; stroke-dasharray: 1, 0;" class="arrowMarkerPath" r="5" cy="5" cx="5"></circle></marker><marker orient="auto" markerHeight="11" markerWidth="11" markerUnits="userSpaceOnUse" refY="5.2" refX="12" viewBox="0 0 11 11" class="marker cross flowchart" id="flowchart-crossEnd"><path style="stroke-width: 2; stroke-dasharray: 1, 0;" class="arrowMarkerPath" d="M 1,1 l 9,9 M 10,1 l -9,9"></path></marker><marker orient="auto" markerHeight="11" markerWidth="11" markerUnits="userSpaceOnUse" refY="5.2" refX="-1" viewBox="0 0 11 11" class="marker cross flowchart" id="flowchart-crossStart"><path style="stroke-width: 2; stroke-dasharray: 1, 0;" class="arrowMarkerPath" d="M 1,1 l 9,9 M 10,1 l -9,9"></path></marker><g class="root"><g class="clusters"></g><g class="edgePaths"><path marker-end="url(#flowchart-pointEnd)" style="fill:none;" class="edge-thickness-normal edge-pattern-solid flowchart-link LS-A LE-B" id="L-A-B-0" d="M127.32250022888184,63L127.32250022888184,71.16666666666667C127.32250022888184,79.33333333333333,127.32250022888184,95.66666666666667,127.32250022888184,112C127.32250022888184,128.33333333333334,127.32250022888184,144.66666666666666,127.32250022888184,152.83333333333334L127.32250022888184,161"></path><path marker-end="url(#flowchart-pointEnd)" style="fill:none;" class="edge-thickness-normal edge-pattern-solid flowchart-link LS-B LE-C" id="L-B-C-0" d="M127.32250022888184,200L127.32250022888184,204.16666666666666C127.32250022888184,208.33333333333334,127.32250022888184,216.66666666666666,127.40583356221516,225.0833339691162C127.48916689554851,233.50000127156576,127.65583356221516,242.0000025431315,127.73916689554851,246.2500031789144L127.82250022888182,250.50000381469727"></path><path marker-end="url(#flowchart-pointEnd)" style="fill:none;" class="edge-thickness-normal edge-pattern-solid flowchart-link LS-C LE-D" id="L-C-D-0" d="M94.03408152116836,389.01158052934716L86.33756785801302,400.7263176164156C78.64105419485769,412.44105470348404,63.24802686854701,435.8705288776209,55.551513205391664,453.75193263135606C47.85499954223633,471.6333363850911,47.85499954223633,483.9666697184245,47.85499954223633,490.1333363850911L47.85499954223633,496.3000030517578"></path><path marker-end="url(#flowchart-pointEnd)" style="fill:none;" class="edge-thickness-normal edge-pattern-solid flowchart-link LS-C LE-E" id="L-C-E-0" d="M161.61091594431227,389.01157589223556L169.14076343951479,400.72631375215593C176.6706109347173,412.4410516120763,191.73030592512234,435.8705273319171,199.26015342032483,453.7519318585041C206.79000091552734,471.6333363850911,206.79000091552734,483.9666697184245,206.79000091552734,490.1333363850911L206.79000091552734,496.3000030517578"></path><path marker-end="url(#flowchart-pointEnd)" style="fill:none;" class="edge-thickness-normal edge-pattern-solid flowchart-link LS-D LE-F" id="L-D-F-0" d="M47.85499954223633,535.3000030517578L47.85499954223633,541.4666697184244C47.85499954223633,547.6333363850912,47.85499954223633,559.9666697184244,47.85499954223633,572.3000030517578C47.85499954223633,584.6333363850912,47.85499954223633,596.9666697184244,47.85499954223633,603.1333363850912L47.85499954223633,609.3000030517578"></path></g><g class="edgeLabels"><g transform="translate(127.32250022888184, 112)" class="edgeLabel"><g transform="translate(-75.60499572753906, -24)" class="label"><foreignObject height="48" width="151.20999145507812">
annotate namespace
to validate signatures
</foreignObject></g></g><g class="edgeLabel"><g transform="translate(0, 0)" class="label"><foreignObject height="0" width="0">

</foreignObject></g></g><g transform="translate(47.85499954223633, 459.3000030517578)" class="edgeLabel"><g transform="translate(-16.899999618530273, -12)" class="label"><foreignObject height="24" width="33.79999923706055">
pass
</foreignObject></g></g><g transform="translate(206.79000091552734, 459.3000030517578)" class="edgeLabel"><g transform="translate(-10.229999542236328, -12)" class="label"><foreignObject height="24" width="20.459999084472656">
fail
</foreignObject></g></g><g transform="translate(47.85499954223633, 572.3000030517578)" class="edgeLabel"><g transform="translate(-42.68499755859375, -12)" class="label"><foreignObject height="24" width="85.3699951171875">
if necessary
</foreignObject></g></g></g><g class="nodes"><g transform="translate(127.32250022888184, 31.5)" id="flowchart-A-40" class="node default default flowchart-label"><rect height="63" width="110.1500015258789" y="-31.5" x="-55.07500076293945" ry="5" rx="5" style="" class="basic label-container"></rect><g transform="translate(-47.57500076293945, -24)" style="" class="label"><rect></rect><foreignObject height="48" width="95.1500015258789">
Create Policy
instance
</foreignObject></g></g><g transform="translate(127.32250022888184, 180.5)" id="flowchart-B-41" class="node default default flowchart-label"><rect height="39" width="95.93999481201172" y="-19.5" x="-47.96999740600586" ry="5" rx="5" style="" class="basic label-container"></rect><g transform="translate(-40.46999740600586, -12)" style="" class="label"><rect></rect><foreignObject height="24" width="80.93999481201172">
Create Pod
</foreignObject></g></g><g transform="translate(127.32250022888184, 336.1500015258789)" id="flowchart-C-43" class="node default default flowchart-label"><polygon style="" transform="translate(-86.14999771118164,86.14999771118164)" class="label-container" points="86.14999771118164,0 172.29999542236328,-86.14999771118164 86.14999771118164,-172.29999542236328 0,-86.14999771118164"></polygon><g transform="translate(-59.14999771118164, -12)" style="" class="label"><rect></rect><foreignObject height="24" width="118.29999542236328">
policy evaluation
</foreignObject></g></g><g transform="translate(47.85499954223633, 515.8000030517578)" id="flowchart-D-45" class="node default default flowchart-label"><rect height="39" width="95.70999908447266" y="-19.5" x="-47.85499954223633" ry="0" rx="0" style="" class="basic label-container"></rect><g transform="translate(-40.35499954223633, -12)" style="" class="label"><rect></rect><foreignObject height="24" width="80.70999908447266">
 Admitted
</foreignObject></g></g><g transform="translate(206.79000091552734, 515.8000030517578)" id="flowchart-E-47" class="node default default flowchart-label"><rect height="39" width="122.15999603271484" y="-19.5" x="-61.07999801635742" ry="0" rx="0" style="" class="basic label-container"></rect><g transform="translate(-53.57999801635742, -12)" style="" class="label"><rect></rect><foreignObject height="24" width="107.15999603271484">
 Not admitted
</foreignObject></g></g><g transform="translate(47.85499954223633, 628.8000030517578)" id="flowchart-F-49" class="node default default flowchart-label"><rect height="39" width="90.5999984741211" y="-19.5" x="-45.29999923706055" ry="0" rx="0" style="" class="basic label-container"></rect><g transform="translate(-37.79999923706055, -12)" style="" class="label"><rect></rect><foreignObject height="24" width="75.5999984741211">
Image Pull
</foreignObject></g></g></g></g></g></svg>

I will localize the blog: . To avoid any conflict, this issue is opened. /language zh /assign
/triage accepted


Question: ### Podセレクター <del> `.spec.selector`フィールドはPodセレクターとなります。これは[Job](/docs/concepts/workloads/controllers/job/)の`.spec.selector`と同じものです。 </del> <ins> `.spec.selector`フィールドはPodセレクターとなります。これは[Job](/ja/docs/concepts/workloads/controllers/job/)の`.spec.selector`と同じものです。 </ins> <del> Kubernetes1.8のように、ユーザーは`.spec.template`のラベルにマッチするPodセレクターを指定しなくてはいけません。Podセレクターは、値を空のままにしてもデフォルト設定にならなくなりました。セレクターのデフォルト化は`kubectl apply`と互換性はありません。また、一度DaemonSetが作成されると、その`.spec.selector`は変更不可能になります。Podセレクターの変更は、意図しないPodの孤立を引き起こし、ユーザーにとってやっかいなものとなります。 </del> <ins> ユーザーは`.spec.template`のラベルにマッチするPodセレクターを指定しなくてはいけません。 また、一度DaemonSetが作成されると、その`.spec.selector`は変更不可能になります。Podセレクターの変更は、意図しないPodの孤立を引き起こし、ユーザーにとってやっかいなものとなります。 </ins> `.spec.selector`は2つのフィールドからなるオブジェクトです。

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Updated Japanese translation for the file. Why is this needed There are several updates in and therefore this page is outdated. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/language ja
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign


Question: If the `preStop` hook is still running after the grace period expires, the kubelet requests a small, one-off grace period extension of 2 seconds. <del> {{< note >}} If the `preStop` hook needs longer to complete than the default grace period allows, you must modify `terminationGracePeriodSeconds` to suit this. {{< /note >}} </del> <ins> {{% note %}} If the `preStop` hook needs longer to complete than the default grace period allows, you must modify `terminationGracePeriodSeconds` to suit this. {{% /note %}} </ins> 1. The kubelet triggers the container runtime to send a TERM signal to process 1 inside each container. <del> {{< note >}} The containers in the Pod receive the TERM signal at different times and in an arbitrary order. If the order of shutdowns matters, consider using a `preStop` hook to synchronize. {{< /note >}} </del> <ins> There is [special ordering](#termination-with-sidecars) if the Pod has any {{< glossary_tooltip text="sidecar containers" term_id="sidecar-container" >}} defined. Otherwise, the containers in the Pod receive the TERM signal at different times and in an arbitrary order. If the order of shutdowns matters, consider using a `preStop` hook to synchronize (or switch to using sidecar containers). </ins> 1. At the same time as the kubelet is starting graceful shutdown of the Pod, the control plane evaluates whether to remove that shutting-down Pod from EndpointSlice (and Endpoints) objects,

work not well. Not sure how to fix it. This issue has spreaded to the currently. <img width="550" alt="image" src=""
/triage accepted
/language en
For a likely fix, see


Question: <ins> <?xml version="1.0" encoding="UTF-8" standalone="no"?> <svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 612 612"> <defs> <style>.cls-1{fill:none;}.cls-2{fill:#fff;}</style> </defs> <polygon class="cls-1" points="70.747 264.908 62.371 264.908 44.981 340.539 53.357 340.539 70.747 264.908"/> <polygon class="cls-1" points="365.299 475.684 361.444 485.092 369.153 485.092 365.299 475.684"/> <polygon class="cls-1" points="96.361 153.521 306.504 53.14 516.647 153.387 516.784 153.982 525.13 153.982 525.13 153.982 523.628 147.452 306.504 43.737 89.381 147.452 87.879 153.982 96.255 153.982 96.361 153.521"/> <polygon class="cls-1" points="542.291 264.908 559.682 340.539 568.054 340.539 568.054 340.539 550.653 264.908 550.652 264.908 542.291 264.908"/> <path class="cls-1" d="M193.92755,551.69421v-.00006H419.215l84.6846-105.47149-396.58173-2.10944Zm216.50055-83.4707H432.312v5.67774h-15.5426v5.8858H430.447v5.67859H416.76941v6.09216h15.74976v5.67859H410.4281Zm-29.962,0h24.0398v5.885h-8.82941v23.12793H389.294v-23.128h-8.82788Zm-18.02746-.20721h5.8858l12.43433,29.22009h-6.67352l-2.65259-6.50745H359.16443l-2.65265,6.50745h-6.50739Zm-24.61871.20721h6.384v29.01288H337.82Zm-33.19507,14.50641a14.74527,14.74527,0,0,1,14.47921-15.00659q.32447-.00578.64893.00268c5.47131,0,8.74561,1.82379,11.43933,4.47644l-4.06195,4.6836c-2.23822-2.031-4.51758-3.275-7.41852-3.275-4.89087,0-8.415,4.062-8.415,9.03589v.083c0,4.97388,3.44037,9.11816,8.415,9.11816,3.31537,0,5.34638-1.32635,7.62574-3.39843l4.062,4.10308a14.83182,14.83182,0,0,1-11.8949,5.1811,14.645,14.645,0,0,1-14.88052-14.40561q-.00422-.25764.0007-.51526Zm-36.26374,0c0-8.24817,6.50745-15.00391,15.46027-15.00391,8.95123,0,15.3764,6.67273,15.3764,14.9209v.083c0,8.24817-6.50738,15.00391-15.46026,15.00391-8.95282,0-15.37641-6.67347-15.37641-14.92084ZM250.873,485.50671c-5.84461-1.49237-9.61554-3.10815-9.61554-8.86975v-.08307c0-5.26336,4.228-8.74481,10.155-8.74481a16.8002,16.8002,0,0,1,10.77661,3.68866l-3.317,4.8078c-2.56885-1.78265-5.09808-2.8598-7.54352-2.8598s-3.72979,1.11908-3.72979,2.52844v.08228c0,1.9068,1.24328,2.52844,6.25909,3.8136,5.88574,1.53357,9.20117,3.64758,9.20117,8.70373v.08307c0,5.7608-4.39416,8.994-10.65167,8.994a18.46526,18.46526,0,0,1-12.311-4.64173l3.77253-4.51837a13.31,13.31,0,0,0,8.6618,3.52344c2.61151,0,4.187-1.03607,4.187-2.73572v-.083c0-1.61661-.99493-2.44547-5.84466-3.68876Zm-27.14478,0c-5.84466-1.49237-9.6156-3.10815-9.6156-8.86975v-.08307c0-5.26336,4.22809-8.74481,10.155-8.74481a16.80022,16.80022,0,0,1,10.77661,3.68866l-3.317,4.8078c-2.56879-1.78265-5.09808-2.8598-7.54346-2.8598s-3.72986,1.11908-3.72986,2.52844v.08228c0,1.9068,1.24329,2.52844,6.2591,3.8136,5.8858,1.53357,9.20119,3.64758,9.20119,8.70373v.08307c0,5.7608-4.39417,8.994-10.65168,8.994a18.465,18.465,0,0,1-12.31091-4.64173l3.77252-4.51837a13.31,13.31,0,0,0,8.66181,3.52344c2.61151,0,4.18695-1.03607,4.18695-2.73572v-.083c0-1.61661-.99491-2.44547-5.84464-3.68876Zm-26.316-17.49041,12.43432,29.22009h-6.67346l-2.65265-6.50745h-12.2682l-2.65265,6.50745h-6.50739l12.43433-29.22009Z"/> <polygon class="cls-1" points="262.626 304.864 270.335 304.864 266.48 295.456 262.626 304.864"/> <polygon class="cls-1" points="194.386 475.684 190.532 485.092 198.241 485.092 194.386 475.684"/> <path class="cls-1" d="M283.82141,491.84808c5.13916,0,8.70288-4.062,8.70288-9.03509v-.08307a8.815,8.815,0,0,0-8.50583-9.11368q-.14039-.00485-.28091-.00522c-5.13916,0-8.70447,4.062-8.70447,9.03589v.083a8.81471,8.81471,0,0,0,8.506,9.113Q283.68017,491.84775,283.82141,491.84808Z"/> <polygon class="cls-1" points="70.747 264.908 62.371 264.908 44.981 340.539 53.357 340.539 70.747 264.908"/> <polygon class="cls-1" points="514.395 446.279 423.102 559.869 189.907 559.869 96.759 444.057 86.916 444.005 186.172 567.298 427.113 567.298 524.245 446.331 514.395 446.279"/> <path class="cls-1" d="M533.75092,264.90759h-454.65L61.73022,340.5387H551.15771ZM275.26715,317.00836l-2.65259-6.50738H260.34631l-2.65265,6.50738h-6.50738l12.43433-29.22009h5.88574l12.43432,29.22009Zm37.961,0H307.7995l-14.0509-18.44427v18.44427h-6.30017V287.99548h5.88574l13.59533,17.86377V287.99548h6.29865Zm34.731-14.50641c0,8.1651-6.30023,14.50641-15.41754,14.50641h-11.316V287.99548h11.316c9.11731,0,15.41754,6.2583,15.41754,14.4234Z"/> <polygon class="cls-1" points="306.37 62.253 114.425 153.982 498.581 153.982 306.37 62.253"/> <path class="cls-1" d="M332.54163,293.75629H327.608v17.49127h4.9336c5.22137,0,8.744-3.52344,8.744-8.6626v-.083a8.33214,8.33214,0,0,0-8.74395-8.74566Z"/> <polygon class="cls-2" points="372.217 394.802 382.758 394.802 377.488 381.937 372.217 394.802"/> <path class="cls-2" d="M187.04065,391.68463v-.11383c0-6.8-4.98737-12.46759-12.0152-12.46759-7.027,0-11.90124,5.55365-11.90124,12.35449v.1131c0,6.80078,4.98736,12.46832,12.01513,12.46832C182.16559,404.03912,187.04065,398.48468,187.04065,391.68463Z"/> <path class="cls-2" d="M265.09161,379.61334h-6.74469V403.529h6.74469c7.14014,0,11.95667-4.81732,11.95667-11.84436v-.11383C277.04828,384.54376,272.23175,379.61334,265.09161,379.61334Z"/> <path class="cls-2" d="M601.31055,367.76044l-.00006-.00006L550.49139,147.0365a39.45708,39.45708,0,0,0-21.32464-26.44806L323.53632,22.412a41.162,41.162,0,0,0-19.10913-3.8772A38.06041,38.06041,0,0,0,289.3338,22.412L83.70331,120.72687A39.76138,39.76138,0,0,0,62.37866,147.175L11.83649,367.89886a38.71579,38.71579,0,0,0,5.40039,29.90986,24.48956,24.48956,0,0,0,2.21557,3.04638L161.80133,577.822A39.98961,39.98961,0,0,0,192.54205,592.5H420.74347a39.98958,39.98958,0,0,0,30.74072-14.678l142.34888-176.9668A39.96484,39.96484,0,0,0,601.31055,367.76044ZM186.17236,567.2981,86.9162,444.0047,35.79211,380.49976l9.1886-39.96106,17.39051-75.63111H37.23737L62.44775,153.98175H87.879l1.50171-6.52985L306.50427,43.73657,523.62793,147.4519l1.50238,6.52985h21.35736l30.2525,110.92584H550.65253L568.054,340.5387l9.16253,39.82257-.00006.00006L524.2453,446.33087,427.1131,567.2981Z"/> <path class="cls-2" d="M189.90692,559.86938H423.10156L514.395,446.2785l9.85034.05237,52.97113-65.96954.00006-.00006L568.054,340.5387h-8.37159l-17.39111-75.63111h34.44891l-30.2525-110.92584H516.78424l-.13678-.59473L306.50427,53.14014,96.361,153.52106l-.106.46069H62.44775L37.23737,264.90759H70.74713L53.35663,340.5387H44.98071l-9.1886,39.96106L86.9162,444.0047l9.84289.05237ZM419.215,551.69415H193.92755v.00006l-86.60968-107.581,396.58173,2.10944ZM97.14691,404.03912c4.53333,0,7.31012-1.81353,10.427-4.64727l5.55445,5.61053c-4.081,4.36334-8.61438,7.084-16.26538,7.084A20.02372,20.02372,0,0,1,76.51721,392.39q-.00572-.35265.001-.70532v-.11383a20.162,20.162,0,0,1,19.79909-20.51849q.44288-.00787.88577.00366c7.481,0,11.95819,2.49365,15.64135,6.12067l-5.55365,6.4038c-3.05993-2.77679-6.17681-4.47723-10.14386-4.47723-6.68773,0-11.505,5.55365-11.505,12.35449v.1131C85.64185,398.37158,90.34607,404.03912,97.14691,404.03912Zm52.881-.56707v7.93414H121.522v-39.67h8.72742v31.7359Zm3.97259-11.78742v-.11383c0-11.27728,8.89746-20.51483,21.1388-20.51483,12.24139,0,21.025,9.12366,21.025,20.40173v.1131c0,11.278-8.89746,20.51556-21.13885,20.51556-12.24132,0-21.02489-9.12445-21.02489-20.40173Zm68.01307,12.29755c5.32745,0,8.55743-3.23,8.55743-9.52069V371.73615h8.72822V394.1214c0,12.01434-6.74469,17.908-17.39953,17.908-10.6532,0-17.17169-5.95062-17.17169-17.62488V371.73615h8.72821v22.4414c0,6.46076,3.23,9.80463,8.5574,9.80463Zm27.60668,7.424v-39.67h15.4713c12.46753,0,21.08191,8.55737,21.08191,19.72155v.1131c0,11.16492-8.61438,19.83539-21.08191,19.83539Zm64.16149,0v-39.67h8.04645l18.589,24.42492v-24.425h8.61431v39.67h-7.4248l-19.21222-25.219v25.219Zm84.454-31.6228v-8.04724H431.105v8.04724H419.03455v31.6228h-8.72669v-31.6228Zm.39068,31.6228h-9.12365l-3.627-8.89746H369.10114l-3.627,8.89746h-8.89746l17.00085-39.954h8.0481Zm40.98536,0v-39.67H448.34v39.67Zm16.66552-39.67h9.63459L476.282,399.675l10.37171-27.93884h9.4068L480.023,411.68933h-7.708Zm74.70084,15.8114v7.7641H512.27527v8.33044h21.53589v7.7641H503.60559v-39.67H533.528v7.7641H512.27527v8.0473Zm-41.82654-163.445c-1.20447-.51624-2.75311-1.37659-4.99-2.23694-1.54858-.68829-3.09729-1.37659-4.47381-2.06488a25.6401,25.6401,0,0,1-3.44141-2.58105,9.16853,9.16853,0,0,1-2.23694-3.44141,15.22822,15.22822,0,0,1-.68823-4.99,10.61963,10.61963,0,0,1,3.95758-8.77557c2.58105-2.23694,6.36658-3.26935,10.84045-3.26935a42.431,42.431,0,0,1,6.71076.51624,35.12,35.12,0,0,1,5.16211,1.37652l-1.89276,8.77564a21.53342,21.53342,0,0,0-3.95765-1.20445,22.23077,22.23077,0,0,0-4.99-.51624c-3.4414,0-5.16211.86035-5.16211,2.92517a2.55165,2.55165,0,0,0,.17206,1.20453,2.29413,2.29413,0,0,0,.86035,1.03241c.6883.34418,1.20453.68829,1.89283,1.03247a25.33929,25.33929,0,0,0,2.92523,1.20447,31.41442,31.41442,0,0,1,5.8504,2.75311,15.76369,15.76369,0,0,1,3.61347,2.92523,7.61552,7.61552,0,0,1,1.89282,3.44141,15.49353,15.49353,0,0,1,.51617,4.30176,10.323,10.323,0,0,1-4.1297,8.77563c-2.92523,2.06482-6.88281,2.92517-12.04492,2.92517l-.00006-.00006a38.65039,38.65039,0,0,1-8.43146-.68829,30.54266,30.54266,0,0,1-4.818-1.37653l1.89282-9.11975a22.04558,22.04558,0,0,0,5.67828,1.89276,31.68423,31.68423,0,0,0,5.67835.51624,12.00583,12.00583,0,0,0,4.1297-.51624,2.43866,2.43866,0,0,0,1.20447-2.409C490.87231,225.47913,490.18408,224.79083,489.15161,224.1026ZM306.37024,62.25348l192.21063,91.72827H114.425Zm159.72394,159.096-24.4339-.34411a6.75317,6.75317,0,0,0,3.09729,5.50622q2.58105,2.06488,7.227,2.06488a32.18191,32.18191,0,0,0,5.8504-.51623,20.62,20.62,0,0,0,4.81793-1.37659l1.37653,9.11977a18.68581,18.68581,0,0,1-2.40894.86035c-1.03247.17206-2.06482.51623-3.26934.68829s-2.58112.34412-3.78559.51624a30.46385,30.46385,0,0,1-3.95758.172,23.681,23.681,0,0,1-8.94775-1.7207,16.44138,16.44138,0,0,1-9.98011-10.6684,24.184,24.184,0,0,1-1.20452-8.08729,24.6075,24.6075,0,0,1,1.7207-9.11981,18.02613,18.02613,0,0,1,3.95764-6.53864,16.78539,16.78539,0,0,1,5.8504-3.95764,17.82826,17.82826,0,0,1,6.7107-1.20453c5.33423,0,9.636,1.7207,12.73327,5.16217,3.09723,3.44141,4.81794,8.60352,4.81794,15.14221v2.23694c0,.86041-.17206,1.54866-.17206,2.0649Zm-41.12494-23.40161v9.29181H412.064v13.76562a12.66622,12.66622,0,0,0,1.20452,5.67835c.86036,1.37659,2.40894,2.0649,4.81794,2.0649a23.417,23.417,0,0,0,3.61352-.34418,22.91651,22.91651,0,0,0,3.26929-.86035l1.37659,8.77563a21.11842,21.11842,0,0,1-4.30182,1.37659,28.38925,28.38925,0,0,1-5.85034.51617,18.165,18.165,0,0,1-7.227-1.20447,12.95546,12.95546,0,0,1-4.47388-3.4414,13.74876,13.74876,0,0,1-2.409-5.33423,27.38016,27.38016,0,0,1-.68823-6.88281V188.312l10.6684-1.89283v11.52875Zm-53.1698,28.56372q2.58105,2.06488,7.227,2.06488a32.18126,32.18126,0,0,0,5.85034-.51623,20.62091,20.62091,0,0,0,4.818-1.37659l1.37653,9.11977a18.68663,18.68663,0,0,1-2.409.86035c-1.03241.17206-2.06482.51623-3.26928.68829-1.20453.17206-2.58112.34412-3.78559.51624a30.46154,30.46154,0,0,1-3.95764.172,23.68054,23.68054,0,0,1-8.94763-1.7207,16.44135,16.44135,0,0,1-9.9801-10.6684,24.18376,24.18376,0,0,1-1.20453-8.08729,24.6075,24.6075,0,0,1,1.7207-9.11981,17.16488,17.16488,0,0,1,9.808-10.49628,17.82817,17.82817,0,0,1,6.71076-1.20453c5.33417,0,9.636,1.7207,12.73321,5.16217,3.09723,3.44141,4.818,8.60352,4.818,15.14221v2.23694h.00006a13.28492,13.28492,0,0,1-.17206,1.7207h-24.434a6.75331,6.75331,0,0,0,3.09729,5.50631Zm-34.24219-17.55121c-1.03241-1.54864-2.58105-2.23694-5.16211-2.23694-.68829,0-1.37659.17212-2.409.17212a9.84682,9.84682,0,0,0-2.409.17206V237.352H316.90881V199.49652c1.72071-.51623,4.1297-.86035,7.05487-1.37659a52.93383,52.93383,0,0,1,9.11976-.68829,22.87782,22.87782,0,0,1,8.08734,1.20453,9.46627,9.46627,0,0,1,5.16211,3.61346,13.46913,13.46913,0,0,1,2.75317,5.67835,30.31446,30.31446,0,0,1,.68823,7.227l-.17206,22.19709H338.93384V216.53149c0-3.61349-.51624-6.19448-1.37659-7.5711Zm-26.15466-10.15216-1.89282,9.11975a22.43792,22.43792,0,0,0-3.61347-.68829,30.82838,30.82838,0,0,0-4.1297-.34412,13.08415,13.08415,0,0,0-2.409.17206,6.74211,6.74211,0,0,0-2.23693.34412v30.11242H286.45233V200.35686a32.62488,32.62488,0,0,1,6.88281-2.06488,44.59662,44.59662,0,0,1,8.77564-.86035c.86035,0,1.37652.17211,2.23688.17211.68829.17206,1.54864.17206,2.409.34412a13.49952,13.49952,0,0,1,2.409.34412,6.105,6.105,0,0,1,2.23694.51625ZM256.512,226.51166q2.58107,2.06478,7.22693,2.06482a32.17649,32.17649,0,0,0,5.8504-.51624,20.6229,20.6229,0,0,0,4.818-1.37652l1.37659,9.11975a18.71049,18.71049,0,0,1-2.409.86035c-1.03241.17206-2.06482.51617-3.26935.68823-1.20447.17212-2.58105.34418-3.78552.51624a30.46508,30.46508,0,0,1-3.95764.172,23.67962,23.67962,0,0,1-8.9477-1.7207,16.4419,16.4419,0,0,1-9.9801-10.66833,24.18491,24.18491,0,0,1-1.20447-8.08736,24.60659,24.60659,0,0,1,1.72071-9.11975,18.02632,18.02632,0,0,1,3.95764-6.5387,16.786,16.786,0,0,1,5.8504-3.95764,17.82779,17.82779,0,0,1,6.71069-1.20447c5.33423,0,9.636,1.72071,12.73328,5.16211,3.09723,3.44141,4.818,8.60352,4.818,15.14221v2.23694c0,.86035-.17212,1.54865-.17212,2.06482l-24.434-.34412A6.75336,6.75336,0,0,0,256.512,226.51166Zm-41.64123-28.9079a30.82852,30.82852,0,0,1,4.1297-.34412,17.77553,17.77553,0,0,1,7.05493,1.37659,12.79023,12.79023,0,0,1,5.33417,4.12964,18.31693,18.31693,0,0,1,3.09729,6.36664,32.338,32.338,0,0,1,1.03247,8.43145,27.38,27.38,0,0,1-1.20453,8.60352,16.39066,16.39066,0,0,1-3.78552,6.5387,17.03666,17.03666,0,0,1-6.19458,4.1297,25.465,25.465,0,0,1-8.43146,1.37658,31.79557,31.79557,0,0,1-3.95764-.17212l-4.1297-.51617c-1.20453-.17206-2.75312-.34412-4.1297-.51624-1.20453-.34411-2.409-.51617-3.26935-.86035v-54.7185l10.6684-1.89276v19.272a32.1095,32.1095,0,0,1,3.78555-1.20456ZM158.4317,227.372a32.79415,32.79415,0,0,1-.68829-7.399V198.12H168.4118v20.64849c0,3.61347.34412,6.02246,1.37653,7.74317,1.03247,1.7207,2.58105,2.409,5.16217,2.409.68823,0,1.54858-.1721,2.40894-.1721a9.84565,9.84565,0,0,0,2.409-.17206V198.292h10.6684V236.1476c-1.7207.51623-4.1297.86035-7.05493,1.37659a52.93274,52.93274,0,0,1-9.11975.68823,22.87765,22.87765,0,0,1-8.08736-1.20447,10.7026,10.7026,0,0,1-5.16209-3.78552h.00006A26.103,26.103,0,0,1,158.4317,227.372Zm-27.18725-19.09985c1.03247-1.20453,2.23692-2.58112,3.26933-3.78558.86041-1.20453,2.06488-2.58106,2.92525-3.61347a30.5142,30.5142,0,0,0,2.409-2.92523h12.73322c-2.409,3.09729-4.99,6.02246-7.39905,8.77564-2.58105,2.75311-5.16211,5.67834-8.08728,8.60351l-.00006.00006c1.37659,1.20447,2.75317,2.92517,4.47388,4.30176,1.54864,1.89276,3.09721,3.78552,4.47381,5.8504,1.37659,2.06482,2.75318,3.95764,3.95764,6.02246s2.23694,3.78553,3.09729,5.50623h-12.3891c-.68829-1.20445-1.7207-2.581-2.58105-4.30174s-2.06488-3.09729-3.09729-4.818a44.056,44.056,0,0,0-3.44141-4.47381,23.85024,23.85024,0,0,0-3.61345-3.61353V237.18H117.30676V181.085l10.6684-1.89276v32.69342c1.03241-1.03246,2.23685-2.40905,3.26929-3.61351ZM79.10089,264.90759h454.65l17.4068,75.63111H61.73022Z"/> <path class="cls-2" d="M263.62061,287.78827l-12.43433,29.22009h6.50738l2.65265-6.50738h12.26825l2.65259,6.50738h6.67352l-12.43432-29.22009Zm-.99494,17.07605,3.85474-9.40839,3.8548,9.40839Z"/> <polygon class="cls-2" points="306.93 305.859 293.334 287.995 287.448 287.995 287.448 317.008 293.749 317.008 293.749 298.564 307.799 317.008 313.228 317.008 313.228 287.995 306.93 287.995 306.93 305.859"/> <path class="cls-2" d="M332.54163,287.99548h-11.316v29.01288h11.316c9.11731,0,15.41754-6.34131,15.41754-14.50641v-.08307C347.95917,294.25378,341.65894,287.99548,332.54163,287.99548Zm8.744,14.58948c0,5.13916-3.52264,8.6626-8.744,8.6626H327.608V293.75629h4.9336a8.3319,8.3319,0,0,1,8.744,8.74566Z"/> <path class="cls-2" d="M266.148,208.61627a9.75312,9.75312,0,0,0-2.23694-1.7207,5.5192,5.5192,0,0,0-3.09729-.68829,8.3355,8.3355,0,0,0-3.09723.51623,5.93245,5.93245,0,0,0-2.23694,1.7207,10.51412,10.51412,0,0,0-1.20452,2.409,16.1134,16.1134,0,0,0-.68824,2.75311h-.17206v.17206h14.45392a15.493,15.493,0,0,0-.51623-2.75311C267.0083,209.99286,266.83624,209.13251,266.148,208.61627Z"/> <path class="cls-2" d="M381.26318,208.61621a9.75676,9.75676,0,0,0-2.23687-1.7207,5.51934,5.51934,0,0,0-3.09729-.68823,8.33579,8.33579,0,0,0-3.09723.51617,5.93268,5.93268,0,0,0-2.23694,1.7207,10.51315,10.51315,0,0,0-1.20453,2.409,16.1117,16.1117,0,0,0-.68823,2.75317l-.17212-.00006v.17212h14.45392a18.9891,18.9891,0,0,0-.51618-2.75317C382.12354,209.9928,381.95148,209.13245,381.26318,208.61621Z"/> <path class="cls-2" d="M454.22125,208.78833a9.75219,9.75219,0,0,0-2.23694-1.7207,5.51851,5.51851,0,0,0-3.09723-.6883,8.33441,8.33441,0,0,0-3.09722.51624,5.932,5.932,0,0,0-2.23694,1.7207,10.51274,10.51274,0,0,0-1.20453,2.409c-.34418.86035-.51624,1.7207-.86035,2.92517H455.942a18.99815,18.99815,0,0,0-.51624-2.75311C455.0816,210.16492,454.90948,209.30457,454.22125,208.78833Z"/> <path class="cls-2" d="M211.08527,228.57648c.68829,0,1.20451.17206,2.06488.17206a14.80321,14.80321,0,0,0,2.75311.172q4.64594,0,6.71075-3.09723a14.3269,14.3269,0,0,0,2.23694-8.43144c0-7.05493-2.409-10.6684-7.5711-10.6684a10.58936,10.58936,0,0,0-3.26935.34412,6.548,6.548,0,0,0-2.92523,1.37652Z"/> <path class="cls-2" d="M185.59961,497.23639l2.65265-6.50745h12.26825l2.65265,6.50745h6.67346L197.41229,468.0163h-5.88574l-12.43433,29.22009Zm8.78674-21.55249,3.8548,9.40839h-7.70953Z"/> <path class="cls-2" d="M225.386,492.01416a13.31,13.31,0,0,1-8.6618-3.52344l-3.77252,4.51837a18.465,18.465,0,0,0,12.31091,4.64173c6.25751,0,10.65169-3.23316,10.65169-8.994v-.08307c0-5.05615-3.31537-7.17017-9.20119-8.70373-5.01579-1.28516-6.2591-1.9068-6.2591-3.8136v-.08228c0-1.40936,1.28443-2.52844,3.72986-2.52844,2.44538,0,4.97467,1.07715,7.54346,2.8598l3.317-4.8078a16.80022,16.80022,0,0,0-10.77661-3.68866c-5.92688,0-10.155,3.48145-10.155,8.74481v.08307c0,5.7616,3.77094,7.37738,9.6156,8.86975,4.84973,1.24329,5.84467,2.07215,5.84467,3.68872v.083C229.57294,490.97809,227.9975,492.01416,225.386,492.01416Z"/> <path class="cls-2" d="M252.53076,492.01416a13.31,13.31,0,0,1-8.6618-3.52344l-3.77252,4.51837a18.46522,18.46522,0,0,0,12.311,4.64173c6.25751,0,10.65167-3.23316,10.65167-8.994v-.08307c0-5.05615-3.31543-7.17017-9.20117-8.70373-5.01581-1.28516-6.25909-1.9068-6.25909-3.8136v-.08228c0-1.40936,1.28436-2.52844,3.72979-2.52844s4.97467,1.07715,7.54352,2.8598l3.317-4.8078a16.8002,16.8002,0,0,0-10.77661-3.68866c-5.927,0-10.155,3.48145-10.155,8.74481v.08307c0,5.7616,3.77093,7.37738,9.61554,8.86975,4.84973,1.24329,5.84466,2.07215,5.84466,3.68872v.083C256.71771,490.97809,255.14227,492.01416,252.53076,492.01416Z"/> <path class="cls-2" d="M283.73755,497.73383c8.95288,0,15.46026-6.75574,15.46026-15.00391v-.083c0-8.24817-6.42517-14.9209-15.3764-14.9209-8.95282,0-15.46026,6.75574-15.46026,15.00391v.08307C268.36115,491.06036,274.78473,497.73383,283.73755,497.73383Zm-8.70447-15.08692c0-4.97394,3.56531-9.03589,8.70447-9.03589a8.815,8.815,0,0,1,8.792,8.838q-.00036.14048-.00522.28091v.08307c0,4.97308-3.56372,9.03509-8.70288,9.03509a8.81466,8.81466,0,0,1-8.79352-8.83578q.00033-.14122.00519-.28238Z"/> <path class="cls-2" d="M319.50464,497.73383a14.83182,14.83182,0,0,0,11.8949-5.1811l-4.062-4.10308c-2.27935,2.07208-4.31036,3.39843-7.62573,3.39843-4.97467,0-8.415-4.14428-8.415-9.11816v-.083c0-4.97394,3.52417-9.03589,8.415-9.03589,2.90094,0,5.1803,1.24408,7.41852,3.275l4.06195-4.6836c-2.69372-2.65265-5.968-4.47644-11.43933-4.47644a14.74524,14.74524,0,0,0-15.12543,14.355q-.00851.32437-.00268.6489v.08307a14.645,14.645,0,0,0,14.36456,14.92016Q319.247,497.738,319.50464,497.73383Z"/> <rect class="cls-2" x="337.81995" y="468.22351" width="6.38403" height="29.01288"/> <path class="cls-2" d="M359.16443,490.72894h12.26825l2.65259,6.50745h6.67352L368.32446,468.0163h-5.8858l-12.43427,29.22009h6.50739Zm6.13409-15.045,3.8548,9.40839h-7.70959Z"/> <polygon class="cls-2" points="389.294 497.236 395.677 497.236 395.677 474.108 404.506 474.108 404.506 468.224 380.466 468.224 380.466 474.108 389.294 474.108 389.294 497.236"/> <polygon class="cls-2" points="432.519 491.558 416.769 491.558 416.769 485.466 430.447 485.466 430.447 479.787 416.769 479.787 416.769 473.901 432.312 473.901 432.312 468.224 410.428 468.224 410.428 497.236 432.519 497.236 432.519 491.558"/> </svg> </ins>  No newline at end of file

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Update to mention the qualification. Why is this needed There's now a KCNA qualification that you can train for. Comments /kind feature /language en /priority important-longterm
/help /triage accepted
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /help /triage accepted Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign (I just modified the in the training folder, please LMK if that was not the right way)
That's how we do it. As a separate issue: it'd be nice to convert that to a kind of HTML that's closer to what Docsy renders our site to.


Question: resources: limits: nvidia.com/gpu: 1 <del> nodeSelector: accelerator: nvidia-tesla-p100 # or nvidia-tesla-k80 etc. </del> <ins> affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: – matchExpressions: – key: beta.amd.com/gpu.family.AI # Arctic Islands GPU family operator: Exist </ins> ``` <del> This will ensure that the Pod will be scheduled to a node that has the GPU type </del> <ins> This ensures that the Pod will be scheduled to a node that has the GPU type </ins> you specified.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: doesn't have our disclaimer for 3rd party content. Proposed Solution: Add a third party content disclaimer. See for an example. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /language en /help /triage accepted
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : This is a Bug Report <!-- See for guidance on writing an actionable issue description. --Problem: doesn't have our disclaimer for 3rd party content. Add a third party content disclaimer. See for an example. <!--Kubernetes Version:--/language en /help /triage accepted Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Separately, it would be good if didn't include advice about installing the plugins. Instead, we can hyperlink to the vendors' own docs (where those exist).


Question: <ins> --- title: Criando um Balanceador de Carga Externo content_type: task weight: 80 --- <!-- overview --> Esta página mostra como criar um balanceador de carga externo para um service em execução em um cluster Kubernetes. Criando um {{< glossary_tooltip text="Service" term_id="service" >}}, você tem a opção de criar automaticamente um balanceador de carga em nuvem. Isso fornece um endereço IP acessível externamente que envia tráfego para a porta correta nos nós do seu cluster, _desde que seu cluster seja executado em um ambiente suportado e esteja configurado com o pacote do provedor de balanceador de carga em nuvem correto_. Você também pode usar um {{< glossary_tooltip term_id="ingress" >}} no lugar de Service. Para obter mais informações, verifique a documentação do [Ingress](/docs/concepts/services-networking/ingress/). ## {{% heading "prerequisites" %}} {{< include "task-tutorial-prereqs.md" >}} Seu cluster deve estar em execução em uma nuvem ou em outro ambiente que já tenha suporte para configurar balanceadores de carga externos. <!-- steps --> ## Criando um service ### Criando um service com base em um manifesto Para criar um balanceador de carga externo, adicione a seguinte linha ao manifesto do service: ```yaml type: LoadBalancer ``` Seu manifesto pode se parecer com: ```yaml apiVersion: v1 kind: Service metadata: name: example-service spec: selector: app: example ports: - port: 8765 targetPort: 9376 type: LoadBalancer ``` ### Criando um Service usando o kubectl Como alternativa, você pode criar o service com o comando `kubectl expose` e a flag `--type=LoadBalancer`: ```bash kubectl expose deployment example --port=8765 --target-port=9376  --name=example-service --type=LoadBalancer ``` Esse comando cria um novo service usando os mesmos seletores do recurso referenciado (no caso do exemplo acima, um {{< glossary_tooltip text="Deployment" term_id="deployment" >}} chamado `example`). Para obter mais informações, incluindo flags opcionais, consulte a referência do comando [`kubectl expose` reference](/docs/reference/generated/kubectl/kubectl-commands/#expose). ## Encontrando seu endereço IP Você pode encontrar o endereço IP criado para o seu service obtendo as informações do service por meio do `kubectl`: ```bash kubectl describe services example-service ``` que devem produzir resultados semelhantes a: ``` Name:                     example-service Namespace:                default Labels:                   app=example Annotations:              <none> Selector:                 app=example Type:                     LoadBalancer IP Families:              <none> IP:                       10.3.22.96 IPs:                      10.3.22.96 LoadBalancer Ingress:     192.0.2.89 Port:                     <unset>  8765/TCP TargetPort:               9376/TCP NodePort:                 <unset>  30593/TCP Endpoints:                172.17.0.3:9376 Session Affinity:         None External Traffic Policy:  Cluster Events:                   <none> ``` O endereço IP do balanceador de carga é listado ao lado de `LoadBalancer Ingress`. {{< note >}} Se você estiver executando seu service no Minikube, poderá encontrar o endereço IP e a porta designados com: ```bash minikube service example-service --url ``` {{< /note >}} ## Preservando o IP de origem do cliente Por padrão, o IP de origem visto no contêiner de destino _não é o IP de origem original_ do cliente.  Para permitir a preservação do IP do cliente, os seguintes campos podem ser configurados no `.spec` do Service: * `.spec.externalTrafficPolicy` - indica se este Service deseja rotear o tráfego externo para endpoints locais do nó ou em todo o cluster. Existem duas opções disponíveis: `Cluster` (padrão) e `Local`. `Cluster` oculta o IP de origem do cliente e pode causar um segundo salto para outro nó, mas deve ter uma boa distribuição geral de carga. `Local` preserva o IP de origem do cliente e evita um segundo salto para Service do tipo LoadBalancer e NodePort, mas corre o risco de uma distribuição de tráfego potencialmente desequilibrada. * `.spec.healthCheckNodePort` - especifica a porta de verificação de integridade (número de porta numérico) para o service. Se você não especificar `healthCheckNodePort`, o controlador de service alocará uma porta do intervalo NodePort do seu cluster. Você pode configurar esse intervalo definindo uma opção de linha de comando do servidor de API, `--service-node-port-range`. O Service usará o valor `healthCheckNodePort` especificado pelo usuário, se você o especificar, desde que o tipo do Service esteja definido como LoadBalancer e `externalTrafficPolicy` esteja definido como `Local`. A definição `externalTrafficPolicy: Local` no manifesto do Service ativa esse recurso. Por exemplo: ```yaml apiVersion: v1 kind: Service metadata: name: example-service spec: selector: app: example ports: - port: 8765 targetPort: 9376 externalTrafficPolicy: Local type: LoadBalancer ``` ### Ressalvas e limitações ao preservar IPs de origem Os service de balanceamento de carga de alguns provedores de nuvem não permitem configurar pesos diferentes para cada destino. Como cada destino recebe o mesmo peso no balanceamento de tráfego para os Nós, o tráfego externo não é distribuído igualmente entre os Pods. Isso ocorre porque o balanceador de carga externo não considera o número de Pods por Nó. Quando `NumServicePods << NumNodes` ou `NumServicePods >> NumNodes`, uma distribuição relativamente próxima da igualdade será observada, mesmo sem pesos. O tráfego interno Pod-a-Pod deve apresentar um comportamento similar aos services ClusterIP, com a mesma probabilidade entre todos os Pods. ## Limpeza de balanceadores de carga {{< feature-state for_k8s_version="v1.17" state="stable" >}} Em um caso normal, ao excluir um Service do tipo LoadBalancer, os recursos de balanceamento de carga no provedor de nuvem são automaticamente removidos. Porém, existem casos onde esses recursos permanecem ativos, mesmo após a exclusão do Service. Para resolver esse problema, foi introduzida a Proteção por Finalizadores para LoadBalancers de Service. Essa proteção utiliza finalizadores, que são mecanismos que impedem a exclusão de um Serviço até que os recursos de balanceamento de carga associados também sejam removidos. Para Service do tipo LoadBalancer, o controlador de service utiliza um finalizador chamado `service.kubernetes.io/load-balancer-cleanup`. Esse finalizador funciona como um mecanismo de segurança, impedindo a exclusão do Service até que o recurso de balanceamento de carga associado seja removido. Essa medida evita a existência de recursos de balanceamento de carga órfãos, mesmo em situações inesperadas, como a falha do controlador de service. ## Provedores de balanceamento de carga externo É importante ressaltar que o roteamento e distribuição do tráfego para essa funcionalidade são realizados por um balanceador de carga que não faz parte do cluster Kubernetes. Quando um Serviço é configurado como LoadBalancer, o Kubernetes garante o acesso interno aos pods do Serviço (como no tipo ClusterIP) e também integra o Serviço com um balanceador de carga externo. A camada de gerenciamento do Kubernetes é responsável por criar o balanceador de carga externo no provedor de nuvem, configurar as verificações de integridade (quando necessárias) e as regras de filtragem de pacotes (quando necessárias). Assim que o provedor de nuvem aloca um endereço IP ao balanceador de carga, a camada de gerenciamento o adiciona ao objeto de Serviço, tornando-o acessível externamente. ## {{% heading "whatsnext" %}} * Siga o tutorial [Conectando Aplicações com Services](/docs/tutorials/services/connect-applications-service/) * Saiba mais sobre [Service](/docs/concepts/services-networking/service/) * Saiba mais sobre [Ingress](/pt-br/docs/concepts/services-networking/ingress/) </ins>

Localize docs/tasks/access-application-cluster/create-external-load-balancer/ to pt-br
/triage accepted /language pt /area localization
I will start resolving this issue.
The contribution PR can be found at:
/assign


Question: different than {{< param "version" >}}, replace {{< param "version" >}} with the desired minor version in the command below. <del> ```bash # This overwrites any existing configuration in /etc/yum.repos.d/kubernetes.repo cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://pkgs.k8s.io/core:/stable:/{{< param "version" >}}/rpm/ enabled=1 gpgcheck=1 gpgkey=https://pkgs.k8s.io/core:/stable:/{{< param "version" >}}/rpm/repodata/repomd.xml.key EOF ``` </del> <ins> ```bash # This overwrites any existing configuration in /etc/yum.repos.d/kubernetes.repo cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://pkgs.k8s.io/core:/stable:/{{< param "version" >}}/rpm/ enabled=1 gpgcheck=1 gpgkey=https://pkgs.k8s.io/core:/stable:/{{< param "version" >}}/rpm/repodata/repomd.xml.key EOF ``` </ins> {{< note >}} To upgrade kubectl to another minor release, you'll need to bump the version in `/etc/yum.repos.d/kubernetes.repo` before running `yum update`. This procedure is described in more detail in [Changing The Kubernetes Package Repository](/docs/tasks/administer-cluster/kubeadm/change-package-repository/). {{< /note >}} <del> 1. Install kubectl using `yum`: </del> <ins> 2. Install kubectl using `yum`: </ins> <del> ```bash sudo yum install -y kubectl ``` </del> <ins> ```bash sudo yum install -y kubectl ``` </ins> {{% /tab %}} {{< /tabs >}}

The following tab has missing or duplicate content: Install using native package management
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Page related to issue: /language en
/kind bug
The tabs don't seem to be working right in that page. Fixes are welcome. I am wary to triage this as Accepted though as I'm worried that the bug description is unclear.
In addition to the tab content, there seems to be an issue with the overall layout, which appears to be disrupted. This might have been unintentionally caused by the changes introduced in It's possible that this occurred because the release documentation deadline was approaching, leading us to merge it based on an older Netlify build preview instead of verifying it with the latest Netlify preview build.
I've opened to address and rectify this layout. /assign
There's a shortcoming around merges and Netlify. The preview from Netlify shows how the branch renders; it doesn't show (merge train style) how the site would look after the merge.
/assign


Question: --- title: Tutorial Interativo - Explorando seu aplicativo weight: 20 <ins> headless: true toc_hide: true _build: list: never publishResources: false </ins> --- <!DOCTYPE html>

The terminal to use the interactive tutorials is using Katacoda, however, it was purchased by O'Reilly and is outside the domain that the terminal is using to run.
Hi You can ask support queries in channels.
Page related to issue: /language pt
/retitle [pt-br] Remove the obsolete online interactive tutorial from the page
For anyone willing to assist on this, please refer to PR for information regarding the implementation of similar changes carried out on the main website (i.e. English pages).
/good-first-isssue
/triage accepted /assign
/retitle [pt-br] Obsolete online interactive tutorial in the Using Minikube to Create a Cluster page /kind bug


Question: Scalable tracking of network endpoints in a Kubernetes cluster. content_template: templates/concept <del> weight: 10 </del> <ins> weight: 15 </ins> ---

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: lists the EndpointSlice concept before Service. Although the , the current page about Service should come before the page about EndpointSlice, which is still beta and only partly activated by default. Proposed Solution: Revise the EndpointSlice page to have a that is higher than the Service page. See for the line that needs tweaking. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--Kubernetes Version: v1.18 Additional Information: /language en
This request has been marked as suitable for new contributors. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : This is a Bug Report <!-- See for guidance on writing an actionable issue description. --Problem: lists the EndpointSlice concept before Service. Revise the EndpointSlice page to have a that is higher than the Service page. See for the line that needs tweaking. Kubernetes Version: v1.17 /language en /good-first-issue </details
This is a good first issue; if you've already had a pull request or two merged, I recommend leaving this one so that it's saved for a new contributor.
Thanks for triaging with an eye for new contributors!
I'd like to work on this issue, as a new contributor.
it'll be great to have your input Have you already seen
Yes, I've read the docs and signed CLA already.
Retract my application as it seem I haven't meet some of requirements described in
If it is okay, I would like to take this up. Thanks.
/assign
This also looks like maybe it affects the rendering of the main Kubernetes web page at also, actually -- under Features, EndpointSlices is listed before Service Topology (in fact EndpointSlices is the very first feature listed).
Thanks for pointing that out I will put that list in the same sequence as documentation. I am planning to work on it this weekend.
are you working on this issue? if not I would like to take this.

Please let me know
I planned to work on it during my break but couldn't find much time to tend to it. Please feel free to take this up. I will circle back to this issue on March 1 when I have some capacity to spare. Thanks.
/assign
Hi, I am back from my holidays. Are you still working on this issue or would you like me to take it forward? Thanks.
You please take it, Sent from my iPhone
/priority important-longterm
I noticed you were just working in this area - would you like to pick this issue up as well?
Sure. :) Tim Bannister <:
/assign Prasad Katti <: working in this area - would you like to pick this issue up as well? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub , or unsubscribe


Question: a Hello world application by entering this command: ```shell <del> kubectl run node-hello --image=gcr.io/google-samples/node-hello:1.0 --port=8080 </del> <ins> kubectl create deployment node-hello --image=gcr.io/google-samples/node-hello:1.0 --port=8080 </ins> ``` <!-- steps -->

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Proposed Solution: Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
could you provide some more information about what isn't right with
Tim, I am getting this !
I think you're concerned about the deprecation warning Have I got that right? /triage needs-information
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle rotten
Rotten issues close after 30d of inactivity. Reopen the issue with . Mark the issue as fresh with . Send feedback to sig-testing, kubernetes/test-infra and/or . /close
Closing this issue. <detailsIn response to : Rotten issues close after 30d of inactivity. Reopen the issue with . Mark the issue as fresh with . /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/reopen
/assign
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question:
[thirdparty_message_single_item] other = """🛇 This item links to a third party project or product that is not part of Kubernetes itself. More information""" [thirdparty_message_disclaimer] other = """
Items on this page refer to third party products or projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. See the CNCF website guidelines for more details.

You should read the content guide before proposing a change that adds an extra third-party link.
"""  [thirdparty_message_vendor] other = """Items on this page refer to vendors external to Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. To add a vendor, product or project to this list, read the content guide before submitting a change. More information."""  [ui_search_placeholder] other = "Search this site"

This is a Refactor request <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The overview page at is a bit out of date: no reference to I'm not convinced that the “Four Cs of cloud native security” model is useful for readers to learn Does not align with other CNCF documents, such as Proposed Solution: Either: remove outright migrate content from into several destinations (keep this brief but on-point) …and then redirect to Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /sig docs /sig security /language en
If we keep the link to then we should update it to be as this is the English docs.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale /triage accepted
Also see
/assign
I'd appreciate a (fresh) review on .


Question: <ins> --- reviewers: title: クラウドネイティブセキュリティの概要 content_type: concept weight: 10 --- <!-- overview --> この概要では、クラウドネイティブセキュリティにおけるKubernetesのセキュリティを考えるためのモデルを定義します。 {{< warning >}} コンテナセキュリティモデルは、実証済の情報セキュリティポリシーではなく提案を提供します。 {{< /warning >}} <!-- body --> ## クラウドネイティブセキュリティの４C セキュリティは階層で考えることができます。クラウドネイティブの4Cは、クラウド、クラスター、コンテナ、そしてコードです。 {{< note >}} 階層化されたアプローチは、セキュリティに対する[多層防御](https://en.wikipedia.org/wiki/Defense_in_depth_(computing))のアプローチを強化します。これはソフトウェアシステムを保護するベストプラクティスとして幅広く認知されています。 {{< /note >}} {{< figure src="/images/docs/4c.png" title="クラウドネイティブセキュリティの４C" >}} クラウドネイティブセキュリティモデルの各レイヤーは次の最も外側のレイヤー上に構築します。コードレイヤーは、強固な基盤(クラウド、クラスター、コンテナ)セキュリティレイヤーから恩恵を受けます。コードレベルのセキュリティに対応しても基盤レイヤーが低い水準のセキュリティでは守ることができません。 ## クラウド いろいろな意味でも、クラウド(または同じ場所に設置されたサーバー、企業のデータセンター)はKubernetesクラスターの[トラステッド・コンピューティング・ベース](https://en.wikipedia.org/wiki/Trusted_computing_base)です。クラウドレイヤーが脆弱な(または脆弱な方法で構成されている)場合、この基盤の上に構築されたコンポーネントが安全であるという保証はありません。各クラウドプロバイダーは、それぞれの環境でワークロードを安全に実行させるためのセキュリティの推奨事項を作成しています。 ### クラウドプロバイダーのセキュリティ Kubernetesクラスターを所有しているハードウェアや様々なクラウドプロバイダー上で実行している場合、セキュリティのベストプラクティスに関するドキュメントを参考にしてください。ここでは人気のあるクラウドプロバイダーのセキュリティドキュメントの一部のリンクを紹介します。 {{< table caption="Cloud provider security" >}} IaaSプロバイダー        | リンク | -------------------- | ------------ | Alibaba Cloud | https://www.alibabacloud.com/trust-center | Amazon Web Services | https://aws.amazon.com/security/ | Google Cloud Platform | https://cloud.google.com/security/ | IBM Cloud | https://www.ibm.com/cloud/security | Microsoft Azure | https://docs.microsoft.com/en-us/azure/security/azure-security | VMWare VSphere | https://www.vmware.com/security/hardening-guides.html | {{< /table >}} ### インフラのセキュリティ {#infrastructure-security} Kubernetesクラスターのインフラを保護するための提案です。 {{< table caption="Infrastructure security" >}} Kubernetesインフラに関する懸念事項 | 推奨事項 | --------------------------------------------- | -------------- | API Server(コントロールプレーン)へのネットワークアクセス| Kubernetesコントロールプレーンへのすべてのアクセスは、インターネット上での一般公開は許されず、クラスター管理に必要なIPアドレスに制限するネットワークアクセス制御リストによって制御されます。| Nodeへのネットワークアクセス | Nodeはコントロールプレーンの特定ポート _のみ_ 接続(ネットワークアクセス制御リストを介して)を受け入れるよう設定し、NodePortとLoadBalancerタイプのKubernetesのServiceに関する接続を受け入れるよう設定する必要があります。可能であれば、それらのNodeはパブリックなインターネットに完全公開しないでください。| KubernetesからのクラウドプロバイダーAPIへのアクセス | 各クラウドプロバイダーはKubernetesコントロールプレーンとNodeに異なる権限を与える必要があります。[最小権限の原則](https://en.wikipedia.org/wiki/Principle_of_least_privilege)に従い、管理に必要なリソースに対してクラウドプロバイダーへのアクセスをクラスターに提供するのが最善です。[Kopsドキュメント](https://github.com/kubernetes/kops/blob/master/docs/iam_roles.md#iam-roles)にはIAMのポリシーとロールについての情報が記載されています。| etcdへのアクセス | etcd(Kubernetesのデータストア)へのアクセスはコントロールプレーンのみに制限すべきです。設定によっては、TLS経由でetcdを利用する必要があります。詳細な情報は[etcdドキュメント](https://github.com/etcd-io/etcd/tree/master/Documentation)を参照してください。| etcdの暗号化 | 可能な限り、保存時に全ドライブを暗号化することは良いプラクティスですが、etcdはクラスター全体(Secretを含む)の状態を保持しているため、そのディスクは特に暗号化する必要があります。| {{< /table >}} ## クラスター Kubernetesを保護する為には２つの懸念事項があります。 * 設定可能なクラスターコンポーネントの保護 * クラスターで実行されるアプリケーションの保護 ### クラスターのコンポーネント {#cluster-components} 想定外または悪意のあるアクセスからクラスターを保護して適切なプラクティスを採用したい場合、[クラスターの保護](/docs/tasks/administer-cluster/securing-a-cluster/)に関するアドバイスを読み従ってください。 ### クラスター内のコンポーネント(アプリケーション) {#cluster-applications} アプリケーションを対象にした攻撃に応じて、セキュリティの特定側面に焦点をあてたい場合があります。例:他のリソースとの連携で重要なサービス(サービスA)と、リソース枯渇攻撃に対して脆弱な別のワークロード(サービスB)が実行されている場合、サービスBのリソースを制限していないとサービスAが危険にさらされるリスクが高くなります。次の表はセキュリティの懸念事項とKubernetesで実行されるワークロードを保護するための推奨事項を示しています。 ワークロードセキュリティに関する懸念事項 | 推奨事項 | ------------------------------ | --------------------- | RBAC認可(Kubernetes APIへのアクセス) | https://kubernetes.io/docs/reference/access-authn-authz/rbac/ 認証 | https://kubernetes.io/docs/reference/access-authn-authz/controlling-access/ | アプリケーションのSecret管理(およびetcdへの保存時に暗号化) | https://kubernetes.io/ja/docs/concepts/configuration/secret/ <br> https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/ | PodSecurityPolicy | https://kubernetes.io/docs/concepts/policy/pod-security-policy/ | Quality of Service (およびクラスターリソース管理) | https://kubernetes.io/ja/docs/tasks/configure-pod-container/quality-service-pod/ | NetworkPolicy | https://kubernetes.io/docs/concepts/services-networking/network-policies/ | Kubernetes IngressのTLS | https://kubernetes.io/ja/docs/concepts/services-networking/ingress/#tls | ## コンテナ コンテナセキュリティは本ガイドの範囲外になります。このトピックを検索するために一般的な推奨事項とリンクを以下に示します。 コンテナに関する懸念事項 | 推奨事項 | ------------------------------ | -------------- | コンテナの脆弱性スキャンとOS依存のセキュリティ | イメージをビルドする手順の一部として、既知の脆弱性がないかコンテナをスキャンする必要があります。 | イメージの署名と実施 | コンテナイメージを署名し、コンテナの中身に関する信頼性を維持します。 | 特権ユーザーを許可しない | コンテナの構成時に、コンテナの目的を実行するために必要最低限なOS特権を持ったユーザーをコンテナ内部に作成する方法のドキュメントを参考にしてください。 | ## コード アプリケーションコードは、あなたが最も制御できる主要な攻撃対象のひとつです。アプリケーションコードを保護することはKubernetesのセキュリティトピックの範囲外ですが、アプリケーションコードを保護するための推奨事項を以下に示します。 ### コードセキュリティ {{< table caption="Code security" >}} コードに関する懸念事項 | 推奨事項 | -------------------------| -------------- | TLS経由のアクセスのみ | コードがTCP通信を必要とする場合は、事前にクライアントとのTLSハンドシェイクを実行してください。 いくつかの例外を除いて、全ての通信を暗号化してください。さらに一歩すすめて、サービス間のネットワークトラフィックを暗号化することはよい考えです。これは、サービスを特定した2つの証明書で通信の両端を検証する相互認証、または[mTLS](https://en.wikipedia.org/wiki/Mutual_authentication)して知られているプロセスを通じて実行できます。| 通信ポートの範囲制限 | この推奨事項は一目瞭然かもしれませんが、可能なかぎり、通信とメトリクス収集に必要不可欠なサービスのポートのみを公開します。 | サードパティに依存するセキュリティ | 既知の脆弱性についてアプリケーションのサードパーティ製ライブラリーを定期的にスキャンすることを推奨します。それぞれの言語は自動でこのチェックを実行するツールを持っています。 | 静的コード解析 | ほとんどの言語ではコードのスニペットを解析して、安全でない可能性のあるコーディングを分析する方法が提供しています。可能な限り、コードベースでスキャンして、よく起こるセキュリティエラーを検出できる自動ツールを使用してチェックを実行すべきです。一部のツールはここで紹介されています。 https://owasp.org/www-community/Source_Code_Analysis_Tools | 動的プロービング攻撃 | よく知られているいくつかのサービス攻撃をサービスに対して試すことができる自動ツールがいくつかあります。これにはSQLインジェクション、CSRF、そしてXSSが含まれます。よく知られている動的解析ツールは[OWASP Zed Attack proxy](https://owasp.org/www-project-zap/)toolです。 | {{< /table >}} ## {{% heading "whatsnext" %}} 関連するKubernetesセキュリティについて学びます。 * [Podのセキュリティ基準](/docs/concepts/security/pod-security-standards/) * [PodのNetworkPolicy](/docs/concepts/services-networking/network-policies/) * [クラスターの保護](/docs/tasks/administer-cluster/securing-a-cluster/) * [APIアクセスコントロール](/docs/reference/access-authn-authz/controlling-access/) * コントロールプレーンとの[通信時のデータ暗号化](/docs/tasks/tls/managing-tls-in-a-cluster/) * [保存時のデータ暗号化](/docs/tasks/administer-cluster/encrypt-data/) * [Kubernetes Secret](/ja/docs/concepts/configuration/secret/) </ins>

This is a Feature Request What would you like to be Translate docs/concepts/security/overview into Japanese. Why is this needed This page has not been translated. Comments /language ja /assign
/close
Closing this issue. <detailsIn response to : /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: ## CLIリファレンス * [kubectl](/docs/reference/kubectl/overview/) - コマンドの実行やKubernetesクラスターの管理に使う主要なCLIツールです。 <del> * [JSONPath](/docs/reference/kubectl/jsonpath/) - kubectlで[JSONPath記法](https://goessner.net/articles/JsonPath/)を使うための構文ガイドです。 </del> <ins> * [JSONPath](/ja/docs/reference/kubectl/jsonpath/) - kubectlで[JSONPath記法](https://goessner.net/articles/JsonPath/)を使うための構文ガイドです。 </ins> * [kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm/) - セキュアなKubernetesクラスターを簡単にプロビジョニングするためのCLIツールです。 ## コンポーネントリファレンス

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Translate reference/kubectl/jsonpath/ into Japanese. Why is this needed This page has not been translated. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/language ja /assign
/triage accepted


Question: <ins> --- title: ストレージ容量 content_type: concept weight: 45 --- <!-- overview --> ストレージ容量は、Podが実行されるノードごとに制限があったり、大きさが異なる可能性があります。たとえば、NASがすべてのノードからはアクセスできなかったり、初めからストレージがノードローカルでしか利用できない可能性があります。 {{< feature-state for_k8s_version="v1.19" state="alpha" >}} このページでは、Kubernetesがストレージ容量を追跡し続ける方法と、スケジューラーがその情報を利用して、残りの未作成のボリュームのために十分なストレージ容量へアクセスできるノード上にどのようにPodをスケジューリングするかについて説明します。もしストレージ容量の追跡がなければ、スケジューラーは、ボリュームをプロビジョニングするために十分な容量のないノードを選択してしまい、スケジューリングの再試行が複数回行われてしまう恐れがあります。 ストレージ容量の追跡は、{{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}}(CSI)向けにサポートされており、CSIドライバーのインストール時に[有効にする必要があります](#enabling-storage-capacity-tracking)。 <!-- body --> ## API この機能には、以下の2つのAPI拡張があります。 - [CSIStorageCapacity](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#csistoragecapacity-v1alpha1-storage-k8s-io)オブジェクト: このオブジェクトは、CSIドライバーがインストールされた名前空間に生成されます。各オブジェクトには1つのストレージクラスに対する容量の情報が含まれ、そのストレージに対してどのノードがアクセス権を持つかが定められています。 - [`CSIDriverSpec.StorageCapacity`フィールド](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#csidriverspec-v1-storage-k8s-io): `true`に設定すると、Kubernetesのスケジューラーが、CSIドライバーを使用するボリュームに対してストレージ容量を考慮するようになります。 ## スケジューリング ストレージ容量の情報がKubernetesのスケジューラーで利用されるのは、以下のすべての条件を満たす場合です。 - `CSIStorageCapacity`フィーチャーゲートがtrueである - Podがまだ作成されていないボリュームを使用する時 - そのボリュームが、CSIドライバーを参照し、[volume binding mode](/docs/concepts/storage/storage-classes/#volume-binding-mode)に`WaitForFirstConsumer`を使う{{< glossary_tooltip text="StorageClass" term_id="storage-class" >}}を使用している - ドライバーに対する`CSIDriver`オブジェクトの`StorageCapacity`がtrueに設定されている その場合、スケジューラーはPodに対して、十分なストレージ容量が利用できるノードだけを考慮するようになります。このチェックは非常に単純で、ボリュームのサイズと、`CSIStorageCapacity`オブジェクトに一覧された容量を、ノードを含むトポロジーで比較するだけです。 volume binding modeが`Immediate`のボリュームの場合、ストレージドライバーはボリュームを使用するPodとは関係なく、ボリュームを作成する場所を決定します。次に、スケジューラーはボリュームが作成された後、Podをボリュームが利用できるノードにスケジューリングします。 [CSI ephemeral volumes](/docs/concepts/storage/volumes/#csi)の場合、スケジューリングは常にストレージ容量を考慮せずに行われます。このような動作になっているのは、このボリュームタイプはノードローカルな特別なCSIドライバーでのみ使用され、そこでは特に大きなリソースが必要になることはない、という想定に基づいています。 ## 再スケジューリング `WaitForFirstConsumer`ボリュームがあるPodに対してノードが選択された場合は、その決定はまだ一時的なものです。次のステップで、CSIストレージドライバーに対して、選択されたノード上でボリュームが利用可能になることが予定されているというヒントを使用してボリュームの作成を要求します。 Kubernetesは古い容量の情報をもとにノードを選択する場合があるため、実際にはボリュームが作成できないという可能性が存在します。その場合、ノードの選択がリセットされ、KubernetesスケジューラーはPodに割り当てるノードを再び探します。 ## 制限 ストレージ容量を追跡することで、1回目の試行でスケジューリングが成功する可能性が高くなります。しかし、スケジューラーは潜在的に古い情報に基づいて決定を行う可能性があるため、成功を保証することはできません。通常、ストレージ容量の情報が存在しないスケジューリングと同様のリトライの仕組みによって、スケジューリングの失敗に対処します。 スケジューリングが永続的に失敗する状況の1つは、Podが複数のボリュームを使用する場合で、あるトポロジーのセグメントで1つのボリュームがすでに作成された後、もう1つのボリュームのために十分な容量が残っていないような場合です。この状況から回復するには、たとえば、容量を増加させたり、すでに作成されたボリュームを削除するなどの手動での対応が必要です。この問題に自動的に対処するためには、まだ[追加の作業](https://github.com/kubernetes/enhancements/pull/1703)が必要となっています。 ## ストレージ容量の追跡を有効にする {#enabling-storage-capacity-tracking} ストレージ容量の追跡は*アルファ機能*であり、`CSIStorageCapacity`[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)と`storage.k8s.io/v1alpha1` {{< glossary_tooltip text="API group" term_id="api-group" >}}を有効にした場合にのみ、有効化されます。詳細については、`--feature-gates`および`--runtime-config` [kube-apiserverパラメータ](/docs/reference/command-line-tools-reference/kube-apiserver/)を参照してください。 Kubernetesクラスターがこの機能をサポートしているか簡単に確認するには、以下のコマンドを実行して、CSIStorageCapacityオブジェクトを一覧表示します。 ```shell kubectl get csistoragecapacities --all-namespaces ``` クラスターがCSIStorageCapacityをサポートしていれば、CSIStorageCapacityのリストが表示されるか、次のメッセージが表示されます。 ``` No resources found ``` もしサポートされていなければ、代わりに次のエラーが表示されます。 ``` error: the server doesn't have a resource type "csistoragecapacities" ``` クラスター内で機能を有効化することに加えて、CSIドライバーもこの機能をサポートしている必要があります。詳細については、各ドライバーのドキュメントを参照してください。 ## {{% heading "whatsnext" %}} - 設計に関するさらなる情報について知るために、[Storage Capacity Constraints for Pod Scheduling KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-storage/1472-storage-capacity-tracking/README.md)を読む。 - この機能の今後の開発に関する情報について知るために、[enhancement tracking issue #1472](https://github.com/kubernetes/enhancements/issues/1472)を参照する。 - [Kubernetesのスケジューラー](/ja/docs/concepts/scheduling-eviction/kube-scheduler/)についてもっと学ぶ。 </ins>

This is a Feature Request What would you like to be Translate into Japanese. Why is this needed This page has not been translated. Comments /language ja /assign
/close
Closing this issue. <detailsIn response to : /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question:
--feature-gates <comma-separated 'key=True|False' pairs>

A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
APIListChunking=true|false (BETA - default=true)
APIPriorityAndFairness=true|false (BETA - default=true)
APIResponseCompression=true|false (BETA - default=true)
APIServerIdentity=true|false (ALPHA - default=false)
APIServerTracing=true|false (ALPHA - default=false)
AllAlpha=true|false (ALPHA - default=false)
AllBeta=true|false (BETA - default=false)
AnyVolumeDataSource=true|false (BETA - default=true)
AppArmor=true|false (BETA - default=true)
CPUManager=true|false (BETA - default=true)
CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
CPUManagerPolicyOptions=true|false (BETA - default=true)
CSIInlineVolume=true|false (BETA - default=true)
CSIMigration=true|false (BETA - default=true)
CSIMigrationAWS=true|false (BETA - default=true)
CSIMigrationAzureFile=true|false (BETA - default=true)
CSIMigrationGCE=true|false (BETA - default=true)
CSIMigrationPortworx=true|false (ALPHA - default=false)
CSIMigrationRBD=true|false (ALPHA - default=false)
CSIMigrationvSphere=true|false (BETA - default=false)
CSIVolumeHealth=true|false (ALPHA - default=false)
ContextualLogging=true|false (ALPHA - default=false)
CronJobTimeZone=true|false (ALPHA - default=false)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
CustomResourceValidationExpressions=true|false (ALPHA - default=false)
DaemonSetUpdateSurge=true|false (BETA - default=true)
DelegateFSGroupToCSIDriver=true|false (BETA - default=true)
DevicePlugins=true|false (BETA - default=true)
DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
DisableCloudProviders=true|false (ALPHA - default=false)
DisableKubeletCloudCredentialProviders=true|false (ALPHA - default=false)
DownwardAPIHugePages=true|false (BETA - default=true)
EndpointSliceTerminatingCondition=true|false (BETA - default=true)
EphemeralContainers=true|false (BETA - default=true)
ExpandedDNSConfig=true|false (ALPHA - default=false)
ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
GRPCContainerProbe=true|false (BETA - default=true)
GracefulNodeShutdown=true|false (BETA - default=true)
GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
HPAContainerMetrics=true|false (ALPHA - default=false)
HPAScaleToZero=true|false (ALPHA - default=false)
HonorPVReclaimPolicy=true|false (ALPHA - default=false)
IdentifyPodOS=true|false (BETA - default=true)
InTreePluginAWSUnregister=true|false (ALPHA - default=false)
InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
InTreePluginGCEUnregister=true|false (ALPHA - default=false)
InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
InTreePluginRBDUnregister=true|false (ALPHA - default=false)
InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
JobMutableNodeSchedulingDirectives=true|false (BETA - default=true)
JobReadyPods=true|false (BETA - default=true)
JobTrackingWithFinalizers=true|false (BETA - default=false)
KubeletCredentialProviders=true|false (BETA - default=true)
KubeletInUserNamespace=true|false (ALPHA - default=false)
KubeletPodResources=true|false (BETA - default=true)
KubeletPodResourcesGetAllocatable=true|false (BETA - default=true)
LegacyServiceAccountTokenNoAutoGeneration=true|false (BETA - default=true)
LocalStorageCapacityIsolation=true|false (BETA - default=true)
LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
LogarithmicScaleDown=true|false (BETA - default=true)
MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
MemoryManager=true|false (BETA - default=true)
MemoryQoS=true|false (ALPHA - default=false)
MinDomainsInPodTopologySpread=true|false (ALPHA - default=false)
MixedProtocolLBService=true|false (BETA - default=true)
NetworkPolicyEndPort=true|false (BETA - default=true)
NetworkPolicyStatus=true|false (ALPHA - default=false)
NodeOutOfServiceVolumeDetach=true|false (ALPHA - default=false)
NodeSwap=true|false (ALPHA - default=false)
OpenAPIEnums=true|false (BETA - default=true)
OpenAPIV3=true|false (BETA - default=true)
PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
PodDeletionCost=true|false (BETA - default=true)
PodSecurity=true|false (BETA - default=true)
ProbeTerminationGracePeriod=true|false (BETA - default=false)
ProcMountType=true|false (ALPHA - default=false)
ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
QOSReserved=true|false (ALPHA - default=false)
ReadWriteOncePod=true|false (ALPHA - default=false)
RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
RemainingItemCount=true|false (BETA - default=true)
RotateKubeletServerCertificate=true|false (BETA - default=true)
SeccompDefault=true|false (ALPHA - default=false)
ServerSideFieldValidation=true|false (ALPHA - default=false)
ServiceIPStaticSubrange=true|false (ALPHA - default=false)
ServiceInternalTrafficPolicy=true|false (BETA - default=true)
SizeMemoryBackedVolumes=true|false (BETA - default=true)
StatefulSetAutoDeletePVC=true|false (ALPHA - default=false)
StatefulSetMinReadySeconds=true|false (BETA - default=true)
StorageVersionAPI=true|false (ALPHA - default=false)
StorageVersionHash=true|false (BETA - default=true)
TopologyAwareHints=true|false (BETA - default=true)
TopologyManager=true|false (BETA - default=true)
VolumeCapacityPriority=true|false (ALPHA - default=false)
WinDSR=true|false (ALPHA - default=false)
WinOverlay=true|false (BETA - default=true)
WindowsHostProcessContainers=true|false (BETA - default=true)This parameter is ignored if a config file is specified by --config.

A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
APIListChunking=true|false (BETA - default=true)
APIPriorityAndFairness=true|false (BETA - default=true)
APIResponseCompression=true|false (BETA - default=true)
APIServerIdentity=true|false (ALPHA - default=false)
APIServerTracing=true|false (ALPHA - default=false)
AllAlpha=true|false (ALPHA - default=false)
AllBeta=true|false (BETA - default=false)
AnyVolumeDataSource=true|false (BETA - default=true)
AppArmor=true|false (BETA - default=true)
CPUManager=true|false (BETA - default=true)
CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
CPUManagerPolicyOptions=true|false (BETA - default=true)
CSIInlineVolume=true|false (BETA - default=true)
CSIMigration=true|false (BETA - default=true)
CSIMigrationAWS=true|false (BETA - default=true)
CSIMigrationAzureFile=true|false (BETA - default=true)
CSIMigrationGCE=true|false (BETA - default=true)
CSIMigrationPortworx=true|false (ALPHA - default=false)
CSIMigrationRBD=true|false (ALPHA - default=false)
CSIMigrationvSphere=true|false (BETA - default=false)
CSIVolumeHealth=true|false (ALPHA - default=false)
CronJobTimeZone=true|false (ALPHA - default=false)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
CustomResourceValidationExpressions=true|false (ALPHA - default=false)
DaemonSetUpdateSurge=true|false (BETA - default=true)
DelegateFSGroupToCSIDriver=true|false (BETA - default=true)
DevicePlugins=true|false (BETA - default=true)
DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
DisableCloudProviders=true|false (ALPHA - default=false)
DisableKubeletCloudCredentialProviders=true|false (ALPHA - default=false)
DownwardAPIHugePages=true|false (BETA - default=true)
EndpointSliceTerminatingCondition=true|false (BETA - default=true)
EphemeralContainers=true|false (BETA - default=true)
ExpandedDNSConfig=true|false (ALPHA - default=false)
ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
GRPCContainerProbe=true|false (BETA - default=true)
GracefulNodeShutdown=true|false (BETA - default=true)
GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
HPAContainerMetrics=true|false (ALPHA - default=false)
HPAScaleToZero=true|false (ALPHA - default=false)
HonorPVReclaimPolicy=true|false (ALPHA - default=false)
IdentifyPodOS=true|false (BETA - default=true)
InTreePluginAWSUnregister=true|false (ALPHA - default=false)
InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
InTreePluginGCEUnregister=true|false (ALPHA - default=false)
InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
InTreePluginRBDUnregister=true|false (ALPHA - default=false)
InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
JobMutableNodeSchedulingDirectives=true|false (BETA - default=true)
JobReadyPods=true|false (BETA - default=true)
JobTrackingWithFinalizers=true|false (BETA - default=false)
KubeletCredentialProviders=true|false (BETA - default=true)
KubeletInUserNamespace=true|false (ALPHA - default=false)
KubeletPodResources=true|false (BETA - default=true)
KubeletPodResourcesGetAllocatable=true|false (BETA - default=true)
LegacyServiceAccountTokenNoAutoGeneration=true|false (BETA - default=true)
LocalStorageCapacityIsolation=true|false (BETA - default=true)
LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
LogarithmicScaleDown=true|false (BETA - default=true)
MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
MemoryManager=true|false (BETA - default=true)
MemoryQoS=true|false (ALPHA - default=false)
MinDomainsInPodTopologySpread=true|false (ALPHA - default=false)
MixedProtocolLBService=true|false (BETA - default=true)
NetworkPolicyEndPort=true|false (BETA - default=true)
NetworkPolicyStatus=true|false (ALPHA - default=false)
NodeOutOfServiceVolumeDetach=true|false (ALPHA - default=false)
NodeSwap=true|false (ALPHA - default=false)
OpenAPIEnums=true|false (BETA - default=true)
OpenAPIV3=true|false (BETA - default=true)
PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
PodDeletionCost=true|false (BETA - default=true)
PodSecurity=true|false (BETA - default=true)
ProbeTerminationGracePeriod=true|false (BETA - default=false)
ProcMountType=true|false (ALPHA - default=false)
ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
QOSReserved=true|false (ALPHA - default=false)
ReadWriteOncePod=true|false (ALPHA - default=false)
RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
RemainingItemCount=true|false (BETA - default=true)
RotateKubeletServerCertificate=true|false (BETA - default=true)
SeccompDefault=true|false (ALPHA - default=false)
ServerSideFieldValidation=true|false (ALPHA - default=false)
ServiceIPStaticSubrange=true|false (ALPHA - default=false)
ServiceInternalTrafficPolicy=true|false (BETA - default=true)
SizeMemoryBackedVolumes=true|false (BETA - default=true)
StatefulSetAutoDeletePVC=true|false (ALPHA - default=false)
StatefulSetMinReadySeconds=true|false (BETA - default=true)
StorageVersionAPI=true|false (ALPHA - default=false)
StorageVersionHash=true|false (BETA - default=true)
TopologyAwareHints=true|false (BETA - default=true)
TopologyManager=true|false (BETA - default=true)
VolumeCapacityPriority=true|false (ALPHA - default=false)
WinDSR=true|false (ALPHA - default=false)
WinOverlay=true|false (BETA - default=true)
WindowsHostProcessContainers=true|false (BETA - default=true)This parameter is ignored if a config file is specified by --config.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: ! xref: Has references to some CLI arguments that are not valid for . Seem to be side effect of changes went into Proposed Solution: Remove the invalid flags from the documentation in Page to Update:
/language en /triage accepted
/assign
/assign
Thanks for taking care of this :)


Question: You can project keys to specific paths and specific permissions on a per-file basis. The [Secrets](/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod) user guide explains the syntax. <del> ### Optional References A ConfigMap reference may be marked "optional".  If the ConfigMap is non-existent, the mounted volume will be empty. If the ConfigMap exists, but the referenced key is non-existent the path will be absent beneath the mount point. ### Mounted ConfigMaps are updated automatically When a mounted ConfigMap is updated, the projected content is eventually updated too.  This applies in the case where an optionally referenced ConfigMap comes into existence after a pod has started. Kubelet checks whether the mounted ConfigMap is fresh on every periodic sync. However, it uses its local TTL-based cache for getting the current value of the ConfigMap. As a result, the total delay from the moment when the ConfigMap is updated to the moment when new keys are projected to the pod can be as long as kubelet sync period (1 minute by default) + TTL of ConfigMaps cache (1 minute by default) in kubelet. {{< note >}} A container using a ConfigMap as a [subPath](/docs/concepts/storage/volumes/#using-subpath) volume will not receive ConfigMap updates. {{< /note >}} </del> <!-- discussion -->

This is a... [x] Bug Report Problem: The documentation mentions "optional" in the restrictions for configmap, but doesn't explain how to use it anywhere else in the documentation. You must create a ConfigMap before referencing it in a Pod specification (unless you mark the ConfigMap as “optional”). If you reference a ConfigMap that doesn’t exist, the Pod won’t start. Likewise, references to keys that don’t exist in the ConfigMap will prevent the pod from starting. Please see for the feature. It appears it got lost in the 1.5-1.6 upgrade. Proposed Solution: Restore the copy from that wrote. Page to Update:
For clarity, the copy from got removed here:
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/language en /remove-lifecycle stale /assign
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
/priority backlog
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle rotten
/remove-lifecycle stale
/remove-lifecycle rotten
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
Relevant to /remove-lifecycle stale
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
This awesome feature is still missing in the documentation, Can someone please add it ?
were you thinking of opening a pull request? We'd be happy to help you with that.
/remove-lifecycle stale
/lifecycle frozen
/triage accepted
I don't see any updates; so unassigning you. Please feel free to assign, if you come back here again and are willing to work on it. Thank you! /unassign
/assign


Question: <ins> --- title: ノードとコントロールプレーン間の通信 content_type: concept weight: 20 aliases: - master-node-communication --- <!-- overview --> 本ドキュメントは、APIサーバーとKubernetesクラスター間の通信経路をまとめたものです。 その目的は、信頼できないネットワーク上(またはクラウドプロバイダー上の完全なパブリックIP)でクラスターが実行できるよう、ユーザーがインストールをカスタマイズしてネットワーク構成を強固にできるようにすることです。 <!-- body --> ## ノードからコントロールプレーンへの通信 {#node-to-control-plane} Kubernetesには「ハブアンドスポーク」というAPIパターンがあります。ノード(またはノードが実行するPod)からのすべてのAPIの使用は、APIサーバーで終了します。他のコントロールプレーンコンポーネントは、どれもリモートサービスを公開するようには設計されていません。APIサーバーは、1つ以上の形式のクライアント[認証](/ja/docs/reference/access-authn-authz/authentication/)が有効になっている状態で、セキュアなHTTPSポート(通常は443)でリモート接続をリッスンするように設定されています。 特に[匿名リクエスト](/ja/docs/reference/access-authn-authz/authentication/#anonymous-requests)や[サービスアカウントトークン](/ja/docs/reference/access-authn-authz/authentication/#service-account-token)が許可されている場合は、1つ以上の[認可](/docs/reference/access-authn-authz/authorization/)形式を有効にする必要があります。 ノードは、有効なクライアント認証情報とともに、APIサーバーに安全に接続できるように、クラスターのパブリックルート証明書でプロビジョニングされる必要があります。適切なやり方は、kubeletに提供されるクライアント認証情報が、クライアント証明書の形式であることです。kubeletクライアント証明書の自動プロビジョニングについては、[kubelet TLSブートストラップ](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/)を参照してください。 APIサーバーに接続したいPodは、サービスアカウントを利用することで、安全に接続することができます。これにより、Podのインスタンス化時に、Kubernetesはパブリックルート証明書と有効なBearerトークンを自動的にPodに挿入します。 `kubernetes`サービス(`デフォルト`の名前空間)は、APIサーバー上のHTTPSエンドポイントに(`kube-proxy`経由で)リダイレクトされる仮想IPアドレスで構成されます。 また、コントロールプレーンのコンポーネントは、セキュアなポートを介してAPIサーバーとも通信します。 その結果、ノードやノード上で動作するPodからコントロールプレーンへの接続は、デフォルトでセキュアであり、信頼されていないネットワークやパブリックネットワークを介して実行することができます。 ## コントロールプレーンからノードへの通信 {#control-plane-to-node} コントロールプレーン(APIサーバー)からノードへの主要な通信経路は2つあります。 1つ目は、APIサーバーからクラスター内の各ノードで実行されるkubeletプロセスへの通信経路です。 2つ目は、APIサーバーの _プロキシー_ 機能を介した、APIサーバーから任意のノード、Pod、またはサービスへの通信経路です。 ### APIサーバーからkubeletへの通信 {#api-server-to-kubelet} APIサーバーからkubeletへの接続は、以下の目的で使用されます: * Podのログの取得。 * 実行中のPodへのアタッチ(通常は`kubectl`を使用)。 * kubeletのポート転送機能の提供。 これらの接続は、kubeletのHTTPSエンドポイントで終了します。デフォルトでは、APIサーバーはkubeletのサービング証明書を検証しないため、接続は中間者攻撃の対象となり、信頼されていないネットワークやパブリックネットワークを介して実行するのは**安全ではありません**。 この接続を検証するには、`--kubelet-certificate-authority`フラグを使用して、kubeletのサービング証明書を検証するために使用するルート証明書バンドルを、APIサーバーに提供します。 それができない場合は、信頼できないネットワークやパブリックネットワークを介した接続を回避するため、必要に応じてAPIサーバーとkubeletの間で[SSHトンネル](#ssh-tunnels)を使用します。 最後に、kubelet APIを保護するために、[Kubelet認証/認可](/docs/reference/access-authn-authz/kubelet-authn-authz/)を有効にする必要があります。 ### APIサーバーからノード、Pod、サービスへの通信 {#api-server-to-nodes-pods-and-services} APIサーバーからノード、Pod、またはサービスへの接続は、デフォルトで平文のHTTP接続になるため、認証も暗号化もされません。API URL内のノード、Pod、サービス名に`https:`を付けることで、セキュアなHTTPS接続を介して実行できますが、HTTPSエンドポイントから提供された証明書を検証したり、クライアント認証情報を提供したりすることはありません。そのため、接続の暗号化はされますが、完全性の保証はありません。これらの接続を、信頼されていないネットワークやパブリックネットワークを介して実行するのは、**現在のところ安全ではありません**。 ### SSHトンネル {#ssh-tunnels} Kubernetesは、コントロールプレーンからノードへの通信経路を保護するために、SSHトンネルをサポートしています。この構成では、APIサーバーがクラスター内の各ノードへのSSHトンネルを開始(ポート22でリッスンしているSSHサーバーに接続)し、kubelet、ノード、Pod、またはサービス宛てのすべてのトラフィックをトンネル経由で渡します。 このトンネルにより、ノードが稼働するネットワークの外部にトラフィックが公開されないようになります。 {{< note >}} SSHトンネルは現在非推奨であるため、自分が何をしているのか理解していないのであれば、使用すべきではありません。この通信経路の代替となるものとして、[Konnectivityサービス](#konnectivity-service)があります。 {{< /note >}} ### Konnectivityサービス {#konnectivity-service} {{< feature-state for_k8s_version="v1.18" state="beta" >}} SSHトンネルの代替として、Konnectivityサービスは、コントロールプレーンからクラスターへの通信に、TCPレベルのプロキシーを提供します。Konnectivityサービスは、コントロールプレーンネットワークのKonnectivityサーバーと、ノードネットワークのKonnectivityエージェントの、2つの部分で構成されています。 Konnectivityエージェントは、Konnectivityサーバーへの接続を開始し、ネットワーク接続を維持します。 Konnectivityサービスを有効にすると、コントロールプレーンからノードへのトラフィックは、すべてこの接続を経由するようになります。 [Konnectivityサービスのセットアップ](/docs/tasks/extend-kubernetes/setup-konnectivity/)に従って、クラスターにKonnectivityサービスをセットアップしてください。 </ins>

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Translate into Japanese. Why is this needed This page has not been translated into Japanese. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/language ja
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
This file for the original page was renamed from to , and some updates. ref: The file for the Japanese page is not renamed yet. So, "" remains and "Communication between Nodes and the Control Plane" for ja does not exist. Japanese page also needs to be updated in the same way. /assign


Question: kubectl get pod private-reg ``` ## {{% heading "whatsnext" %}} * Learn more about [Secrets](/docs/concepts/configuration/secret/). * Learn more about [using a private registry](/docs/concepts/containers/images/#using-a-private-registry). * Learn more about [adding image pull secrets to a service account](/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account).

This link "" appears to be broken in the line: " <your-registry-serveris your Private Docker Registry FQDN. ( for DockerHub) "
According to , the V1 API has been deprecated.
/triage accepted /assign


Question: title: Container Runtime id: container-runtime date: 2019-06-05 <del> full_link: /docs/reference/generated/container-runtime </del> <ins> full_link: /docs/setup/production-environment/container-runtimes </ins> short_description: > The container runtime is the software that is responsible for running containers.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Clicking the "" hyperlink leads to the 404 page. <img width="876" alt="WeChatc2b6a16c89afc8d1086c8c92a0a7f437" src="https://user-"Proposed Solution: correct link as below: full_link: /docs/setup/production-environment/container-runtimes <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
/language zh


Question: This annotation requires the [PodTolerationRestriction](/docs/reference/access-authn-authz/admission-controllers/#podtolerationrestriction) admission controller to be enabled. This annotation key allows assigning tolerations to a namespace and any new pods created in this namespace would get these tolerations added. <ins> ### scheduler.alpha.kubernetes.io/tolerationsWhitelist {#schedulerkubernetestolerations-whitelist} Example: `scheduler.alpha.kubernetes.io/tolerationsWhitelist: '[{"operator": "Exists", "effect": "NoSchedule", "key": "dedicated-node"}]'` Used on: Namespace This annotation is only useful when the (alpha) [PodTolerationRestriction](/docs/reference/access-authn-authz/admission-controllers/#podtolerationrestriction) admission controller is enabled. The annotation value is a JSON document that defines a list of allowed tolerations for the namespace it annotates. When you create a Pod or modify its tolerations, the API server checks the tolerations to see if they are mentioned in the allow list. The pod is admitted only if the check succeeds. </ins> ### scheduler.alpha.kubernetes.io/preferAvoidPods (deprecated) {#scheduleralphakubernetesio-preferavoidpods} Used on: Nodes

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Kubernetes has alpha support for an annotation ; however, this is not registered or documented. Proposed Solution: register the annotation document it We can achieve both of these by updating with information about the annotation. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: We should document this name even though WG Naming have recommended avoiding the term “whitelist”. After documenting it, the next step could be to deprecate the annotation, or to make a new, non-alpha annotation that has a different name. /language en /kind bug /sig scheduling /lifecycle frozen
Also see
/triage accepted
Relevant to
/assign
Are you working on this issue? Do you need any help?
yes I am working on it.
Need any help from my side?
No as of now
I don't see any updates; so unassigning you. Please feel free to assign, if you come back here again and are willing to work on /unassign
I found this issue while going through and trying to learn more about these annotations. I have raised a PR regarding same here: PTAL! Also, how to proceed with this?


Question: If you have already created the cluster you must adapt it by doing the following: - Find and edit the `kubelet-config-{{< skew currentVersion >}}` ConfigMap in the `kube-system` namespace. In that ConfigMap, the `kubelet` key has a <del> [KubeletConfiguration](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) </del> <ins> [KubeletConfiguration](/docs/reference/config-api/kubelet-config.v1beta1/) </ins> document as its value. Edit the KubeletConfiguration document to set `serverTLSBootstrap: true`. - On each node, add the `serverTLSBootstrap: true` field in `/var/lib/kubelet/config.yaml` and restart the kubelet with `systemctl restart kubelet`

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Url selector #kubelet-config-k8s-io-v1beta1-KubeletConfiguration doesn't make a difference between: and Proposed Solution: Removing the selector from the URLs Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/language en
/assign
/retitle Problems with (generated) reference for kubelet configuration


Question: * Lean about [RuntimeClass](/docs/concepts/containers/runtime-class/) and how you can use it to configure different Pods with different container runtime configurations. * Read about [Pod topology spread constraints](/docs/concepts/workloads/pods/pod-topology-spread-constraints/). <del> * Read about [PodDisruptionBudget](https://kubernetes.io/docs/concepts/workloads/pods/disruptions/) and how you can use it to manage application availability during disruptions. </del> <ins> * Read about [PodDisruptionBudget](/docs/concepts/workloads/pods/disruptions/) and how you can use it to manage application availability during disruptions. </ins> * Pod is a top-level resource in the Kubernetes REST API. The [Pod](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#pod-v1-core) object definition describes the object in detail.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Line 260, should be removed from the link to PodDisruptionBudget: Read about [PodDisruptionBudget]() and how you can use it to manage application availability during disruptions. Proposed Solution: Read about [PodDisruptionBudget](/docs/concepts/workloads/pods/disruptions/) and how you can use it to manage application availability during disruptions. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/language en
/assign