Question: <ins> --- #reviewers: #- soltysh #- sttts #- ericchiang content_type: concept title: 감사(auditing) --- <!-- overview --> 쿠버네티스 _감사(auditing)_ 는 클러스터의 작업 순서를 문서화하는 보안 관련 시간별 레코드 세트를 제공한다. 클러스터는 사용자, 쿠버네티스 API를 사용하는 애플리케이션 및 컨트롤 플레인 자체에서 생성된 활동을 감사한다. 감사를 통해 클러스터 관리자는 다음 질문에 답할 수 있다. - 무슨 일이 일어났는지? - 언제 일어난 일인지? - 누가 시작했는지? - 어떤 일이 있었는지? - 어디서 관찰되었는지? - 어디서부터 시작되었는지? - 그래서 어디까지 갔는지? <!-- body --> 감사 기록은 [kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/) 컴포넌트 내에서 수명주기를 시작한다. 실행의 각 단계에서 각 요청은 감사 이벤트를 생성하고, 감사 이벤트는 특정 정책에 따라 사전 처리되고 백엔드에 기록된다. 정책은 기록된 내용을 결정하고 백엔드는 기록을 유지한다. 현재 백엔드 구현에는 로그 파일 및 웹훅이 포함된다. 각 요청들은 연관된 _단계(stage)_ 와 함께 기록될 수 있다. 정의된 단계는 다음과 같다. - `RequestReceived` - 감사 핸들러가 요청을 수신한 직후, 그리고 핸들러 체인으로 위임되기 전에 생성되는 이벤트에 대한 단계이다. - `ResponseStarted` - 응답 헤더는 전송되었지만, 응답 본문(body)은 전송되기 전인 단계이다. 이 단계는 오래 실행되는 요청(예: watch)에 대해서만 생성된다. - `ResponseComplete` - 응답 내용이 완료되었으며, 더 이상 바이트가 전송되지 않을 때의 단계이다. - `Panic` - 패닉이 발생했을 때 생성되는 이벤트이다. {{< note >}} [Audit Event configuration](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Event) 의 구성은 [Event](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#event-v1-core) API 오브젝트와는 다르다. {{< /note >}} 감사 로깅 기능은 감사에 필요한 일부 컨텍스트가 요청마다 저장되기 때문에 API 서버의 메모리 사용량을 증가시킨다. 메모리 소비량은 감사 로깅 구성에 따라 다르다. ## 감사 정책 감사 정책은 기록해야 하는 이벤트와 포함해야 하는 데이터에 대한 규칙을 정의한다. 감사 정책 오브젝트 구조는 [`audit.k8s.io` API 그룹](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Policy)에 정의되어 있다. 이벤트가 처리되면 규칙 목록과 순서대로 비교된다. 첫번째 일치 규칙은 이벤트의 _감사 수준(audit level)_ 을 설정한다. 정의된 감사 수준은 다음과 같다. - `None` - 이 규칙에 해당되는 이벤트는 로깅하지 않는다. - `Metadata` - 요청 메타데이터(요청하는 사용자, 타임스탬프, 리소스, 동사(verb) 등)는 로깅하지만 요청/응답 본문은 로깅하지 않는다. - `Request` - 이벤트 메타데이터 및 요청 본문을 로깅하지만 응답 본문은 로깅하지 않는다. 리소스 외의 요청에는 적용되지 않는다. - `RequestResponse` - 이벤트 메타데이터 및 요청/응답 본문을 로깅한다. 리소스 외의 요청에는 적용되지 않는다. `--audit-policy-file` 플래그를 사용하여 정책이 포함된 파일을 `kube-apiserver`에 전달할 수 있다. 플래그를 생략하면 이벤트가 기록되지 않는다. 감사 정책 파일에 `rules` 필드 **반드시** 가 제공되어야 한다. 규칙이 없는(0개인) 정책은 적절하지 않은(illegal) 것으로 간주된다. 다음은 감사 정책 파일의 예이다. {{< codenew file="audit/audit-policy.yaml" >}} 최소 감사 정책 파일을 사용하여 `Metadata` 수준에서 모든 요청을 기록할 수 있다. ```yaml # Log all requests at the Metadata level. apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata ``` 자체 감사 프로필을 만드는 경우 Google Container-Optimized OS에 대한 감사 프로필을 시작점으로 사용할 수 있다. 감사 정책 파일을 생성하는 [configure-helper.sh](https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh) 스크립트를 확인하면 된다. 스크립트로 대부분의 감사 정책 파일을 볼 수 있다. 정의된 필드에 대한 자세한 내용은 [`Policy` configuration reference](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Policy)를 참조할 수도 있다. ## 감사 백엔드 감사 백엔드는 감사 이벤트를 외부 저장소에 유지한다. 기본적으로 kube-apiserver는 두 가지 백엔드를 제공한다. - 이벤트를 파일 시스템에 기록하는 로그 백엔드 - 이벤트를 외부 HTTP API로 보내는 Webhook 백엔드 모든 경우에 감사 이벤트는 쿠버네티스 API의 [`audit.k8s.io` API 그룹](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Event)에서 정의한 구조를 따른다. {{< note >}} 패치의 경우 요청 내용은 적절한 쿠버네티스 API 오브젝트를 포함하는 JSON 오브젝트가 아니라 패치 작업을 포함하는 JSON 배열이다. 예를 들어 다음 요청 내용은 `/apis/batch/v1/namespaces/some-namespace/jobs/some-job-name`에 대한 유효한 패치 요청이다. ```json [ { "op": "replace", "path": "/spec/parallelism", "value": 0 }, { "op": "remove", "path": "/spec/template/spec/containers/0/terminationMessagePolicy" } ] ``` {{< /note >}} ### 로그 백엔드 로그 백엔드는 감사이벤트를 [JSONlines](https://jsonlines.org/) 형식으로 파일에 기록한다. 다음의 `kube-apiserver` 플래그를 사용하여 로그 감사 백엔드를 구성할 수 있다. - `--audit-log-path` 는 로그 백엔드가 감사 이벤트를 쓰는 데 사용하는 로그 파일 경로를 지정한다. 이 플래그를 지정하지 않으면 로그 백엔드가 비활성화된다. `-` 는 표준 출력을 의미한다. - `--audit-log-maxage` 는 오래된 감사 로그 파일을 보관할 최대 일수를 정의한다. - `--audit-log-maxbackup` 은 보관할 감사 로그 파일의 최대 수를 정의한다. - `--audit-log-maxsize` 는 감사 로그 파일이 로테이트 되기 전의 최대 크기(MB)를 정의한다. 클러스터의 컨트롤 플레인이 kube-apiserver를 파드로 실행하는 경우 감사 레코드가 지속되도록 정책 파일 및 로그 파일의 위치에 `hostPath` 를 마운트 해야한다. 예를 들면 ```shell --audit-policy-file=/etc/kubernetes/audit-policy.yaml  --audit-log-path=/var/log/kubernetes/audit/audit.log ``` 그런 다음 볼륨을 마운트 한다. ```yaml ... volumeMounts: - mountPath: /etc/kubernetes/audit-policy.yaml name: audit readOnly: true - mountPath: /var/log/kubernetes/audit/ name: audit-log readOnly: false ``` 그리고 마지막으로 `hostPath` 를 구성한다. ```yaml ... volumes: - name: audit hostPath: path: /etc/kubernetes/audit-policy.yaml type: File - name: audit-log hostPath: path: /var/log/kubernetes/audit/ type: DirectoryOrCreate ``` ### 웹훅 백엔드 웹훅 감사 백엔드는 원격 웹 API로 감사 이벤트를 전송하는데, 이는 인증 수단을 포함하여 쿠버네티스 API의 한 형태로 간주된다. 다음 kube-apiserver 플래그를 사용하여 웹훅 감사 백엔드를 구성할 수 있다. - `--audit-webhook-config-file` 은 웹훅 구성이 있는 파일의 경로를 지정한다. 웹훅 구성은 효과적으로 전문화된 [kubeconfig](/docs/tasks/access-application-cluster/configure-access-multiple-cluster)이다. - `--audit-webhook-initial-backoff` 는 첫 번째 실패한 요청 후 다시 시도하기 전에 대기할 시간을 지정한다. 이후 요청은 지수의 백오프로 재시도 된다. 웹훅 구성 파일은 kubeconfig 형식을 사용하여 서비스의 원격 주소와 서비스에 연결하는 데 사용되는 자격 증명을 지정한다. ## 이벤트 배치 {#배치} 로그 및 웹 훅 백엔드는 모두 배치를 지원한다. 웹훅 사용을 예로 들면, 다음은 사용 가능한 플래그 목록이다. 로그 백엔드에 대해 동일한 플래그를 가져오려면 플래그 이름에 있는 `webhook` 을 `log` 로 바꾼다. 기본적으로 배치 기능은 `webhook` 에서 활성화되고 `log` 에서 비활성화된다. 마찬가지로, 기본적으로 쓰로틀링은 `webhook` 에서는 활성화되고 `log` 에서는 비활성화된다. - `--audit-webhook-mode` 은 버퍼링 전략을 정의한다. 다음 중 하나이다. - `batch` - 이벤트를 버퍼링하고 비동기식으로 배치한다. 이것이 기본값이다. - `blocking` - 각 개별 이벤트를 처리할 때 API 서버 응답을 차단한다. - `blocking-strict` - `blocking`과 동일하지만, RequestReceived 단계에서 감사 로깅 중에 오류가 발생하면 kube-apiserver에 대한 전체 요청이 실패한다. 다음 플래그는 `batch` 모드에서만 사용된다. - `--audit-webhook-batch-buffer-size` 는 배치하기 전에 버퍼링할 이벤트 수를 정의한다. 들어오는 이벤트의 비율이 버퍼를 초과하면 이벤트가 삭제된다. - `--audit-webhook-batch-max-size` 는 한 배치의 최대 이벤트 수를 정의한다. - `--audit-webhook-batch-max-wait` 는 대기열에서 이벤트를 무조건 배치하기 전에 대기할 최대 시간을 정의한다. - `--audit-webhook-batch-throttle-qps` 는 초당 생성되는 최대 평균 배치 수를 정의한다. - `--audit-webhook-batch-throttle-burst` 는 허용된 QPS가 이전에 충분히 활용되지 않은 경우 동시에 생성되는 최대 배치 수를 정의한다. ## 파라미터 튜닝 파라미터는 API 서버의 로드를 수용할 수 있도록 설정해야 한다. 예를 들어 kube-apiserver가 초당 100건의 요청을 수신하고 각 요청이 `ResponseStarted` 와 `ResponseComplete` 단계에서만 감사되는 경우 초당 생성되는 ≅200건의 감사 이벤트를 고려해야 한다. 일괄적으로 최대 100개의 이벤트가 있다고 가정할 때 초당 최소 2개의 쿼리 조절 수준을 설정해야 한다. 백엔드가 이벤트를 쓰는 데 최대 5초가 걸릴 수 있다고 가정하면 버퍼크기를 최대 5초의 이벤트를 보유하도록 설정해야 한다. 즉, 10개의 배치 또는 100개의 이벤트이다. 그러나 대부분의 경우 기본 매개 변수만 있으면 충분하며 수동으로 설정할 필요가 없다. kube-apiserver에서 노출된 다음과 같은 프로메테우스 메트릭과 로그에서 감사 하위 시스템의 상태를 모니터링할 수 있다. - `apiserver_audit_event_total` 의 메트릭에는 내보낸 감사 이벤트의 총 수가 포함된다. - `apiserver_audit_error_total` 의 메트릭에는 내보내기 중 오류로 인해 삭제된 총 이벤트 수가 포함된다. ### 로그 항목 자르기 {#truncate} 로그 및 웹훅 백엔드는 모두 로깅되는 이벤트의 크기 제한을 지원한다. 예를 들어 로그 백엔드에 사용할 수 있는 플래그 목록은 다음과 같다. - `audit-log-truncate-enabled` 는 이벤트 및 자르기 배치가 활성화 되었는지 여부를 나타낸다. - `audit-log-truncate-max-batch-size` 는 기본 백엔드로 전송되는 배치의 바이트 단위의 최대 크기이다. - `audit-log-truncate-max-event-size` 는 기본 백엔드로 전송된 감사 이벤트의 바이트 단위의 최대 크기이다. 기본적으로 `webhook` 과 `log` 모두에서 자르기 기능이 비활성화되어 있으므로 이 기능을 활성화 하기 위해 클러스터 관리자는 `audit-log-truncate-enabled` 또는 `audit-webhook-truncate-enabled` 를 설정해야 한다. ## {{% heading "whatsnext" %}} * [Mutating webhook auditing annotations](/docs/reference/access-authn-authz/extensible-admission-controllers/#mutating-webhook-auditing-annotations) 에 대해 알아보기. * [`Event`](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Event) 에 대해 알아보고 감사 구성 참조를 읽고 [`Policy`](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Policy) 리소스 유형 확인하기. </ins>

This is a Feature Request Korean Localization for branch. What would you like to be Any localization contributions for Korean. Comments This issue is to notify the schedule of Korean localization to contributors. is the current work branch for Korean localization. Important dates A Korean localization work branch is merged to main branch after we complete around 3~4 weeks job. PR Freeze: 10/03 (PR opened after freeze will be requested to rebase to next work branch) Branch Merge: 10/06 (merge to main branch) 3~4 , main . PR : 10/03 ( PR , PR ) : 10/06 (main , k8s.io ) /language ko /help
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : ## In English This is a Feature Request is the current work branch for Korean localization.PR Freeze: 10/03 (PR opened after freeze will be requested to rebase to next work branch) Branch Merge: 10/06 (merge to main branch) PR : 10/03 ( PR , PR ) : 10/06 (main , k8s.io ) /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Thanks :) /triage accepted
/milestone dev-1.25-ko.1


Question: "name-virtual-host-ingress":               {&networking.Ingress{}}, "name-virtual-host-ingress-no-third-host": {&networking.Ingress{}}, "namespaced-params":                       {&networking.IngressClass{}}, <ins> "networkpolicy":                           {&networking.NetworkPolicy{}}, </ins> "network-policy-allow-all-egress":         {&networking.NetworkPolicy{}}, "network-policy-allow-all-ingress":        {&networking.NetworkPolicy{}}, "network-policy-default-deny-egress":      {&networking.NetworkPolicy{}},

While working through the Killer Shell scenario for NetworkPolicies to prep for my CKA, I used the example but it failed validation. When I looked at their solution it had one tiny difference, they had a - in front of "ports:" and you guys didn't. Based on the reference docs it appears ports does expect an array which would mean that you are missing the hyphen. docs: solution from
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
The indentation of list items may be the source of confusion. Once you indent all list items under a given key, the parent element of the 'ports' attribute becomes more evident. The example on the website is correct. I'm not sure about the solution from If you put as the first key of a list item object, if will carry the bar for that list item, if is not the the first key, you will indent it rather than adding another before it. Anyway, I'm fixing the example in hope things become clearer for readers.


Question: title: "What's next?" description: "What's next after installing kubectl." headless: true <ins> _build: list: never render: never publishResources: false </ins> --- * [Install Minikube](https://minikube.sigs.k8s.io/docs/start/)

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The source Markdown needs to exist for pages such as but we don't need to make those turn into actual web pages. Proposed Solution: Edit every file within : Page to Update: and its contents /area web-development /help /priority backlog /good-first-issue
This request has been marked as suitable for new contributors. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : This is a Bug Report <!-- See for guidance on writing an actionable issue description. --Problem: The source Markdown needs to exist for pages such as but we don't need to make those turn into actual web pages. Edit every file within : Page to Update: and its contents /help /priority backlog /good-first-issue </details
/retitle Include files for install are rendered and served /triage accepted
/assign
/unassign
Thanks !


Question: - **CPU requirement (cores)** and **Memory requirement (MiB)**: You can specify the minimum [resource limits](/docs/tasks/configure-pod-container/limit-range/) for the container. By default, Pods run with unbounded CPU and memory limits. <del> - **Run command** and **Run command arguments**: By default, your containers run the specified Docker image's default [entrypoint command](/docs/user-guide/containers/#containers-and-commands). You can use the command options and arguments to override the default. </del> <ins> - **Run command** and **Run command arguments**: By default, your containers run the specified Docker image's default [entrypoint command](/docs/tasks/inject-data-application/define-command-argument-container/). You can use the command options and arguments to override the default. </ins> - **Run as privileged**: This setting determines whether processes in [privileged containers](/docs/user-guide/pods/#privileged-mode-for-pod-containers) are equivalent to processes running as root on the host. Privileged containers can make use of capabilities like manipulating the network stack and accessing devices.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The link navigates to . However, there is no ID . Proposed Solution: It would probably be fine to replace the link with . Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
/assign PR created:
/close
Closing this issue. <detailsIn response to : /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: only when a Pod is created (either by the client, or mutated during admission). After creation, each schedulingGate can be removed in arbitrary order, but addition of a new scheduling gate is disallowed. <del> {{<mermaid>}} stateDiagram-v2 s1: pod created s2: pod scheduling gated s3: pod scheduling ready s4: pod running if: empty scheduling gates? [*] --> s1 s1 --> if s2 --> if: scheduling gate removed if --> s2: no if --> s3: yes s3 --> s4 s4 --> [*] {{< /mermaid >}} </del> <ins> {{< figure src="/docs/images/podSchedulingGates.svg" alt="pod-scheduling-gates-diagram" caption="Figure. Pod SchedulingGates" class="diagram-large" link="https://mermaid.live/edit#pako:eNplkktTwyAUhf8KgzuHWpukaYszutGlK3caFxQuCVMCGSDVTKf_XfKyPlhxz4HDB9wT5lYAptgHFuBRsdKxenFMClMYFIdfUdRYgbiD6ItJTEbR8wpEq5UpUfnDTf-5cbPoJjcbXdcaE61RVJIiqJvQ_Y30D-OCt-t3tFjcR5wZayiVnIGmkv4NiEfX9jijKTmmRH5jf0sRugOP0HyHUc1m6KGMFP27cM28fwSJDluPpNKaXqVJzmFNfHD2APRKSjnNFx9KhIpmzSfhVls3eHdTRrwG8QnxKfEZUUNeYTDBNbiaKRF_5dSfX-BQQQ0FpnEqQLJWhwIX5hyXsjbYl85wTINrgeC2EZd_xFQy7b_VJ6GCdd-itkxALE84dE3fAqXyIUZya6Qqe711OspVCI2ny2Vv35QqVO3-htt66ZWomAvVcZcv8yTfsiSFfJOydZoKvl_ttjLJVlJsblcJw-czwQ0zr9ZeqGDgeR77b2jD8xdtjtDn" >}} </ins> ## Usage example To mark a Pod not-ready for scheduling, you can create it with one or more scheduling gates like this:

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: has a diagram, but it doesn't use Kubernetes colors. Proposed Solution: Copy the colors from an example in and then apply those colors to the items in the diagram. Page to Update: /priority backlog
/triage accepted
/assign


Question: <ins> --- title: static Podを作成する weight: 170 content_type: task --- <!-- overview --> *Static Pod*とは、{{< glossary_tooltip text="APIサーバー" term_id="kube-apiserver" >}}が監視せず、特定のノード上のkubeletデーモンによって直接管理されるPodです。コントロールプレーンに管理されるPod(たとえば{{< glossary_tooltip text="Deployment" term_id="deployment" >}}など)とは異なり、kubeletがそれぞれのstatic Podを監視(および障害時には再起動)します。 Static Podは、常に特定のノード上の1つの{{< glossary_tooltip term_id="kubelet" >}}に紐付けられます。 kubeletは、各static Podに対して、自動的にKubernetes APIサーバー上に{{< glossary_tooltip text="ミラーPod" term_id="mirror-pod" >}}の作成を試みます。つまり、ノード上で実行中のPodはAPIサーバーから検出されますが、APIサーバー自身から制御されることはないということです。 {{< note >}} 複数ノードからなるKubernetesクラスターを実行していて、Podをすべてのノード上で実行するためにstatic Podを使用している場合、おそらくstatic Podの代わりに{{< glossary_tooltip text="DaemonSet" term_id="daemonset" >}}を使用するべきでしょう。 {{< /note >}} ## {{% heading "prerequisites" %}} {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} このページの説明では、Podを実行するために{{< glossary_tooltip term_id="docker" >}}を使用しており、ノード上のOSがFedoraであることを前提としています。他のディストリビューションやKubernetesのインストール方法によっては、操作が異なる場合があります。 <!-- steps --> ## static Podを作成する {#static-pod-creation} static Podは、[ファイルシステム上でホストされた設定ファイル](#configuration-files)または[ウェブ上でホストされた設定ファイル](/#pods-created-via-http)を使用して設定できます。 ### ファイルシステム上でホストされたstatic Podマニフェスト {#configuration-files} マニフェストは、JSONまたはYAML形式の標準のPod定義で、特定のディレクトリに置きます。[kubeletの設定ファイル](/docs/tasks/administer-cluster/kubelet-config-file)の中で、`staticPodPath: <ディレクトリの場所>`というフィールドを使用すると、kubeletがこのディレクトリを定期的にスキャンして、YAML/JSONファイルが作成/削除されるたびに、static Podの作成/削除が行われるようになります。指定したディレクトリをスキャンする際、kubeletはドットから始まる名前のファイルを無視することに注意してください。 例として、単純なウェブサーバーをstatic Podとして実行する方法を示します。 1. static Podを実行したいノードを選択します。この例では、`my-node1`です。 ```shell ssh my-node1 ``` 2. ディレクトリを選び(ここでは`/etc/kubelet.d`とします)、ここにウェブサーバーのPodの定義を置きます。たとえば、`/etc/kubelet.d/static-web.yaml`に置きます。 ```shell # このコマンドは、kubeletが実行中のノード上で実行してください mkdir /etc/kubelet.d/ cat <<EOF >/etc/kubelet.d/static-web.yaml apiVersion: v1 kind: Pod metadata: name: static-web labels: role: myrole spec: containers: - name: web image: nginx ports: - name: web containerPort: 80 protocol: TCP EOF ``` 3. ノード上のkubeletがこのディレクトリを使用するようにするために、`--pod-manifest-path=/etc/kubelet.d/`引数を付けてkubeletを実行するように設定します。Fedoraの場合、次の行が含まれるように`/etc/kubernetes/kubelet`を編集します。 ``` KUBELET_ARGS="--cluster-dns=10.254.0.10 --cluster-domain=kube.local --pod-manifest-path=/etc/kubelet.d/" ``` あるいは、[kubeletの設定ファイル](/docs/tasks/administer-cluster/kubelet-config-file)に、`staticPodPath: <ディレクトリの場所>`フィールドを追加することでも設定できます。 4. kubeletを再起動します。Fedoraの場合、次のコマンドを実行します。 ```shell # このコマンドは、kubeletが実行中のノード上で実行してください systemctl restart kubelet ``` ### ウェブ上でホストされたstatic Podマニフェスト {#pods-created-via-http} kubeletは、`--manifest-url=<URL>`引数で指定されたファイルを定期的にダウンロードし、Podの定義が含まれたJSON/YAMLファイルとして解釈します。kubeletは、[ファイルシステム上でホストされたマニフェスト](#configuration-files)での動作方法と同じように、定期的にマニフェストを再取得します。static Podのリスト中に変更が見つかると、kubeletがその変更を適用します。 このアプローチを採用する場合、次のように設定します。 1. YAMLファイルを作成し、kubeletにファイルのURLを渡せるようにするために、ウェブサーバー上に保存する。 ```yaml apiVersion: v1 kind: Pod metadata: name: static-web labels: role: myrole spec: containers: - name: web image: nginx ports: - name: web containerPort: 80 protocol: TCP ``` 2. 選択したノード上のkubeletを`--manifest-url=<manifest-url>`を使用して実行することで、このウェブ上のマニフェストを使用するように設定する。Fedoraの場合、`/etc/kubernetes/kubelet`に次の行が含まれるように編集します。 ``` KUBELET_ARGS="--cluster-dns=10.254.0.10 --cluster-domain=kube.local --manifest-url=<マニフェストのURL" ``` 3. kubeletを再起動する。Fedoraの場合、次のコマンドを実行します。 ```shell # このコマンドは、kubeletが実行中のノード上で実行してください systemctl restart kubelet ``` ## static Podの動作を観察する {#behavior-of-static-pods} kubeletが起動すると、定義されたすべてのstatic Podを起動します。ここまででstatic Podを設定してkubeletを再起動したため、すでに新しいstatic Podが実行中になっているはずです。 次のコマンドを(ノード上で)実行することで、(static Podを含む)実行中のコンテナを確認できます。 ```shell # このコマンドは、kubeletが実行中のノード上で実行してください docker ps ``` 出力は次のようになります。 ``` CONTAINER ID IMAGE         COMMAND  CREATED        STATUS         PORTS     NAMES f6d05272b57e nginx:latest  "nginx"  8 minutes ago  Up 8 minutes             k8s_web.6f802af4_static-web-fk-node1_default_67e24ed9466ba55986d120c867395f3c_378e5f3c ``` APIサーバー上では、ミラーPodを確認できます。 ```shell kubectl get pods ``` ``` NAME                       READY     STATUS    RESTARTS   AGE static-web-my-node1        1/1       Running   0          2m ``` {{< note >}} kubeletにAPIサーバー上のミラーPodを作成する権限があることを確認してください。もし権限がない場合、APIサーバーによって作成のリクエストが拒否されてしまいます。詳しくは、[PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/)を参照してください。 {{< /note >}} static Podに付けた{{< glossary_tooltip term_id="label" text="ラベル" >}}はミラーPodに伝搬します。ミラーPodに付けたラベルは、通常のPodと同じように{{< glossary_tooltip term_id="selector" text="セレクター" >}}などから利用できます。 もし`kubectl`を使用してAPIサーバーからミラーPodを削除しようとしても、kubeletはstatic Podを削除*しません*。 ```shell kubectl delete pod static-web-my-node1 ``` ``` pod "static-web-my-node1" deleted ``` Podはまだ実行中であることがわかります。 ```shell kubectl get pods ``` ``` NAME                       READY     STATUS    RESTARTS   AGE static-web-my-node1        1/1       Running   0          12s ``` kubeletが実行中のノードに戻り、Dockerコンテナを手動で停止してみることができます。しばらくすると、kubeletが変化に気づき、Podを自動的に再起動することがわかります。 ```shell # このコマンドは、kubeletが実行中のノード上で実行してください docker stop f6d05272b57e # 実際のコンテナIDと置き換えてください sleep 20 docker ps ``` ``` CONTAINER ID        IMAGE         COMMAND                CREATED       ... 5b920cbaf8b1        nginx:latest  "nginx -g 'daemon of   2 seconds ago ... ``` ## static Podの動的な追加と削除 実行中のkubeletは設定ディレクトリ(この例では`/etc/kubelet.d`)の変更を定期的にスキャンし、このディレクトリ内にファイルが追加/削除されると、Podの追加/削除を行います。 ```shell # This assumes you are using filesystem-hosted static Pod configuration # このコマンドは、kubeletが実行中のノード上で実行してください # mv /etc/kubelet.d/static-web.yaml /tmp sleep 20 docker ps # You see that no nginx container is running mv /tmp/static-web.yaml  /etc/kubelet.d/ sleep 20 docker ps ``` ``` CONTAINER ID        IMAGE         COMMAND                CREATED           ... e7a62e3427f1        nginx:latest  "nginx -g 'daemon of   27 seconds ago ``` </ins>

This is a Feature Request What would you like to be Translate into Japanese. Why is this needed This page has not been translated. Comments /language ja /assign


Question: _Pods_ are the smallest deployable units of computing that you can create and manage in Kubernetes. A _Pod_ (as in a pod of whales or pea pod) is a group of one or more <del> {{< glossary_tooltip text="containers" term_id="container" >}}, with shared storage/network resources, and a specification </del> <ins> [containers](/docs/concepts/containers/), with shared storage/network resources, and a specification </ins> for how to run the containers. A Pod's contents are always co-located and co-scheduled, and run in a shared context. A Pod models an application-specific "logical host": it contains one or more application

Clicking the "Containers" hyperlink leads to the "What is Kubernetes?" page. I'm not sure if this was intended. There is some explanation of containerized deployments (after a scroll) but I wonder if it makes more sense to direct them to the "Containers" term page. As a user learning in the docs, it was a bit confusing. Pods hyperlink re-direction shown below, from this <img width="901" alt="Screen Shot 2020-10-09 at 1 58 28 PM" src="https://user-"Leads to the below <img width="843" alt="Screen Shot 2020-10-09 at 1 58 54 PM" src="https://user-"Perhaps redirecting to the page defining containers in the concepts may be better, though I believe more definition could be there.
/triage accepted
/kind bug /language en /priority backlog /help
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /kind bug /language en /priority backlog /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Hi I'd like to work on this
Awesome! I think you can assign it yourself by running the "assign" command. Context here: and example here:
/assign


Question: deployment methods. - Configure user management by determining your [Authentication](/docs/reference/access-authn-authz/authentication/) and <del> [Authorization](docs/reference/access-authn-authz/authorization/) methods. </del> <ins> [Authorization](/docs/reference/access-authn-authz/authorization/) methods. </ins> - Prepare for application workloads by setting up <del> [resource limits](docs/tasks/administer-cluster/manage-resources/), </del> <ins> [resource limits](/docs/tasks/administer-cluster/manage-resources/), </ins> [DNS autoscaling](/docs/tasks/administer-cluster/dns-horizontal-autoscaling/) and [service accounts](/docs/reference/access-authn-authz/service-accounts-admin/).

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The href of contains unwanted . A slash () is missing in the href of . Proposed Solution: Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/language en /assign
/triage accepted


Question: <!-- Kubernetes runs your workload by placing containers into Pods to run on _Nodes_. A node may be a virtual or physical machine, depending on the cluster. Each node <del> is managed by the {{< glossary_tooltip text="control plane" term_id="control-plane" >}} and contains the services necessary to run {{< glossary_tooltip text="Pods" term_id="pod" >}} </del> <ins> contains the services necessary to run {{< glossary_tooltip text="Pods" term_id="pod" >}}, managed by the {{< glossary_tooltip text="control plane" term_id="control-plane" >}}. </ins> Typically you have several nodes in a cluster; in a learning or resource-limited environment, you might have just one.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: ! URL #self-registration-of-nodes #manual-node-administration # # Proposed Solution: {#self-registration-of-nodes} {#manual-node-administration} Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/language zh /assign


Question: rollback | 롤백 | rolling update | 롤링 업데이트 | rollout | 롤아웃 | <ins> Romana | 로마나(Romana) | </ins> Running | Running | 파드의 상태에 한함 runtime | 런타임 | Scale | 스케일 |

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --There are several CNI plugins that need to be translated into Korean to be to . English --- --- Calico Cilium Flannel Kube-router Romana Weave-net Weaveworks 'Weave Net' . Why is this needed This is for standardization of terminology when document is localized. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --Page to update: - /language ko
/assign


Question: --> * 了解 Kubernetes 中的[属主与依赖](/zh/docs/concepts/overview/working-with-objects/owners-dependents/) * 了解 Kubernetes [finalizers](/zh/docs/concepts/overview/working-with-objects/finalizers/) <del> * 了解[垃圾收集](/zh/docs/concepts/workloads/controllers/garbage-collection/). </del> <ins> * 了解[垃圾收集](/zh/docs/concepts/architecture/garbage-collection/). </ins>

There is a bug: ,%E4%BA%86%E8%A7%A3%E5%9E%83%E5%9C%BE%E6%94%B6%E9%9B%86.,-%E5%8F%8D%E9%A6%88 This hyperlink is 404, it should be ""
/assign
/triage accepted
The issue was solved by PR . If there is any problem, please give feedback again. /close
Closing this issue. <detailsIn response to : The issue was solved by PR . If there is any problem, please give feedback again. /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: This label has been deprecated. Please use `kubernetes.io/os` instead. <ins> ### kube-aggregator.kubernetes.io/automanaged {#kube-aggregator-kubernetesio-automanaged} Example: `kube-aggregator.kubernetes.io/automanaged: "onstart"` Used on: APIService The `kube-apiserver` sets this label on any APIService object that the API server has created automatically. The label marks how the control plane should manage that APIService. You should not add, modify, or remove this label by yourself. {{< note >}} Automanaged APIService objects are deleted by kube-apiserver when it has no built-in or custom resource API corresponding to the API group/version of the APIService. {{< /note >}} There are two possible values: - `onstart`: The APIService should be reconciled when an API server starts up, but not otherwise. - `true`: The API server should reconcile this APIService continuously. </ins> ### kubernetes.io/hostname {#kubernetesiohostname} Example: `kubernetes.io/hostname: "ip-172-20-114-199.ec2.internal"`

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Code from the Kubernetes project sets (or previously did set) a label, This looks intended, but doesn't document that label. Proposed Solution: Document that label; as a side effect, this registers it. If it's deprecated, we should mark it as deprecated but still document it. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /language en /priority backlog
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
The label cannot be applied. Only GitHub organization members can add the label. <detailsIn response to : /triage accepted Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Created a , Havent seen any document for it's deprecation . Please let me know if any change is needed.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues. This bot triages un-triaged issues according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue as fresh with Close this issue with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
Since this issue's PR is already merged. i'd like to close it
/close
Closing this issue. <detailsIn response to : /close </details


Question: See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. <ins> ### rbac.authorization.kubernetes.io/autoupdate Example: `rbac.authorization.kubernetes.io/autoupdate: "false"` Used on: ClusterRole, ClusterRoleBinding, Role, RoleBinding When this annotation is set to `"true"` on default RBAC objects created by the kube-apiserver, they are automatically updated at server start to add missing permissions and subjects (extra permissions and subjects are left in place). To prevent autoupdating a particular role or rolebinding, set this annotation to `"false"`. If you create your own RBAC objects and set this annotation to `"false"`, `kubectl auth reconcile` (which allows reconciling arbitrary RBAC objects in a {{< glossary_tooltip text="manifest" term_id="manifest" >}}) respects this annotation and does not automatically add missing permissions and subjects. </ins> ### kubernetes.io/psp (deprecated) {#kubernetes-io-psp} Example: `kubernetes.io/psp: restricted`

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Kubernetes can use an annotation, , but this is not registered or documented. Proposed Solution: Document the annotation in . Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /sig auth
mentions this annotation, so it has been used in the past (and, I suspect, it is still used).
/assign
/triage accepted
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle rotten [1]:
/lifecycle frozen /priority backlog
Thanks SIG Auth folks!


Question: <ins> --- title: 投影ボリューム content_type: concept weight: 21 # just after persistent volumes --- <!-- overview --> このドキュメントでは、Kubernetesの*投影ボリューム*について説明します。[ボリューム](/docs/concepts/storage/volumes/)に精通していることをお勧めします。 <!-- body --> ## 概要 ボリュームは、いくつかの既存の`投影`ボリュームソースを同じディレクトリにマップします。 現在、次のタイプのボリュームソースを投影できます。 * [`secret`](/docs/concepts/storage/volumes/#secret) * [`downwardAPI`](/docs/concepts/storage/volumes/#downwardapi) * [`configMap`](/docs/concepts/storage/volumes/#configmap) * `serviceAccountToken` すべてのソースは、Podと同じnamespaceにある必要があります。詳細は[all-in-one volume](https://github.com/kubernetes/design-proposals-archive/blob/main/node/all-in-one-volume.md)デザインドキュメントを参照してください。 ### secret、downwardAPI、およびconfigMapを使用した構成例 {#example-configuration-secret-downwardapi-configmap} {{< codenew file="pods/storage/projected-secret-downwardapi-configmap.yaml" >}} ### 構成例:デフォルト以外のアクセス許可モードが設定されたsecret {#example-configuration-secrets-nondefault-permission-mode} {{< codenew file="pods/storage/projected-secrets-nondefault-permission-mode.yaml" >}} 各投影ボリュームソースは、specの`sources`にリストされています。パラメータは、2つの例外を除いてほぼ同じです。 * secretについて、ConfigMapの命名と一致するように`secretName`フィールドが`name`に変更されました。 * `defaultMode`はprojectedレベルでのみ指定でき、各ボリュームソースには指定できません。ただし上に示したように、個々の投影ごとに`mode`を明示的に設定できます。 `TokenRequestProjection`機能が有効になっている場合、現在の[サービスアカウントトークン](/ja/docs/reference/access-authn-authz/authentication/#サービスアカウントトークン)を指定されたパスのPodに挿入できます。例えば: {{< codenew file="pods/storage/projected-service-account-token.yaml" >}} 例のPodには、挿入されたサービスアカウントトークンを含む投影ボリュームがあります。このトークンはPodのコンテナがKubernetes APIサーバーにアクセスするために使用できます。この`audience`フィールドにはトークンのオーディエンスが含まれています。トークンの受信者は、トークンのオーディエンスで指定された識別子で自分自身を識別する必要があります。そうでない場合はトークンを拒否する必要があります。このフィールドはオプションで、デフォルトではAPIサーバーの識別子が指定されます。 `expirationSeconds`はサービスアカウントトークンが有効であると予想される期間です。 デフォルトは1時間で、最低でも10分(600秒)でなければなりません。 管理者は、APIサーバーに`--service-account-max-token-expiration`オプションを指定することで、その最大値を制限することも可能です。 `path`フィールドは、投影ボリュームのマウントポイントへの相対パスを指定します。 {{< note >}} 投影ボリュームソースを[`subPath`](/docs/concepts/storage/volumes/#using-subpath)ボリュームマウントとして使用しているコンテナは、それらのボリュームソースの更新を受信しません。 {{< /note >}} ## SecurityContextの相互作用 サービスアカウントの投影ボリューム拡張でのファイル権限処理の[提案](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/2451-service-account-token-volumes#proposal)により、正しい所有者権限が設定された投影ファイルが導入されました。 ### Linux 投影ボリュームがあり、Podの[`SecurityContext`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context)に`RunAsUser`が設定されているLinux Podでは、投影されたファイルには、コンテナユーザーの所有権を含む正しい所有権が設定されます。 ### Windows 投影ボリュームを持ち、Podの`SecurityContext`で`RunAsUsername`を設定したWindows Podでは、Windowsのユーザーアカウント管理方法により所有権が強制されません。 Windowsは、ローカルユーザーとグループアカウントをセキュリティアカウントマネージャー(SAM)と呼ばれるデータベースファイルに保存し、管理します。 各コンテナはSAMデータベースの独自のインスタンスを維持し、コンテナの実行中はホストはそのインスタンスを見ることができません。 Windowsコンテナは、OSのユーザーモード部分をホストから分離して実行するように設計されており、そのため仮想SAMデータベースを維持することになります。 そのため、ホスト上で動作するkubeletには、仮想化されたコンテナアカウントのホストファイル所有権を動的に設定する機能がありません。 ホストマシン上のファイルをコンテナと共有する場合は、`C:`以外の独自のボリュームマウントに配置することをお勧めします。 デフォルトでは、投影ボリュームファイルの例に示されているように、投影されたファイルには次の所有権があります。 ```powershell PS C:> Get-Acl C:varrunsecretskubernetes.ioserviceaccount..2021_08_31_22_22_18.318230061ca.crt | Format-List Path   : Microsoft.PowerShell.CoreFileSystem::C:varrunsecretskubernetes.ioserviceaccount..2021_08_31_22_22_18.318230061ca.crt Owner  : BUILTINAdministrators Group  : NT AUTHORITYSYSTEM Access : NT AUTHORITYSYSTEM Allow  FullControl BUILTINAdministrators Allow  FullControl BUILTINUsers Allow  ReadAndExecute, Synchronize Audit  : Sddl   : O:BAG:SYD:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU) ``` これは、`ContainerAdministrator`のようなすべての管理者ユーザーが読み取り、書き込み、および実行アクセス権を持ち、非管理者ユーザーが読み取りおよび実行アクセス権を持つことを意味します。 {{< note >}} 一般に、コンテナにホストへのアクセスを許可することは、潜在的なセキュリティの悪用への扉を開く可能性があるため、お勧めできません。 Windows Podの`SecurityContext`に`RunAsUser`を指定して作成すると、Podは`ContainerCreating`で永久に固まります。したがって、Windows PodでLinux専用の`RunAsUser`オプションを使用しないことをお勧めします。 {{< /note >}} </ins>

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Translate into Japanese. Why is this needed This page has not been translated. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/language ja /assign
/triage accepted


Question:
 --- title: kube-scheduler 配置 (v1) content_type: tool-reference package: kubescheduler.config.k8s.io/v1 ---   ## 资源类型 {#resource-types} - [DefaultPreemptionArgs](#kubescheduler-config-k8s-io-v1-DefaultPreemptionArgs) - [InterPodAffinityArgs](#kubescheduler-config-k8s-io-v1-InterPodAffinityArgs) - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1-KubeSchedulerConfiguration) - [NodeAffinityArgs](#kubescheduler-config-k8s-io-v1-NodeAffinityArgs) - [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1-NodeResourcesBalancedAllocationArgs) - [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1-NodeResourcesFitArgs) - [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1-PodTopologySpreadArgs) - [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1-VolumeBindingArgs) ## `DefaultPreemptionArgs`     {#kubescheduler-config-k8s-io-v1-DefaultPreemptionArgs}
DefaultPreemptionArgs 包含用来配置 DefaultPreemption 插件的参数。

字段	描述

apiVersion
string	kubescheduler.config.k8s.io/v1

kind
string	DefaultPreemptionArgs

minCandidateNodesPercentage [必需]
 int32
minCandidateNodesPercentage 字段为试运行抢占时 shortlist 中候选节点数的下限， 数值为节点数的百分比。字段值必须介于 [0, 100] 之间。未指定时默认值为整个集群规模的 10%。

minCandidateNodesAbsolute [必需]
 int32
minCandidateNodesAbsolute 字段设置 shortlist 中候选节点的绝对下限。 用于试运行抢占而列举的候选节点个数近似于通过下面的公式计算的：
 候选节点数 = max(节点数 * minCandidateNodesPercentage, minCandidateNodesAbsolute)
 之所以说是"近似于"是因为存在一些类似于 PDB 违例这种因素， 会影响到进入 shortlist 中候选节点的个数。 取值至少为 0 节点。若未设置默认为 100 节点。

 ## `InterPodAffinityArgs`     {#kubescheduler-config-k8s-io-v1-InterPodAffinityArgs}
InterPodAffinityArgs 包含用来配置 InterPodAffinity 插件的参数。

字段	描述

apiVersion
string	kubescheduler.config.k8s.io/v1

kind
string	InterPodAffinityArgs

hardPodAffinityWeight [必需]
 int32
hardPodAffinityWeight 字段是一个计分权重值。针对新增的 Pod，要对现存的、 带有与新 Pod 匹配的硬性亲和性设置的 Pods 计算亲和性得分。

 ## `KubeSchedulerConfiguration`     {#kubescheduler-config-k8s-io-v1-KubeSchedulerConfiguration}
KubeSchedulerConfiguration 用来配置调度器。

字段	描述

apiVersion
string	kubescheduler.config.k8s.io/v1

kind
string	KubeSchedulerConfiguration

parallelism [必需]
 int32
 parallelism 字段设置为调度 Pod 而执行算法时的并发度。此值必须大于 0。默认值为 16。

leaderElection [必需]
 LeaderElectionConfiguration
LeaderElection 字段用来定义领导者选举客户端的配置。

clientConnection [必需]
 ClientConnectionConfiguration
clientConnection 字段为与 API 服务器通信时使用的代理服务器设置 kubeconfig 文件和客户端连接配置。

DebuggingConfiguration [必需]
 DebuggingConfiguration 	  （DebuggingConfiguration 的成员被内嵌到此类型中）
DebuggingConfiguration 字段设置与调试相关功能特性的配置。 TODO：我们可能想把它做成一个子结构，像调试 component-base/config/v1alpha1.DebuggingConfiguration 一样。

percentageOfNodesToScore [必需]
 int32
 percentageOfNodesToScore 字段为所有节点的百分比，一旦调度器找到所设置比例的、能够运行 Pod 的节点， 则停止在集群中继续寻找更合适的节点。这一配置有助于提高调度器的性能。 调度器总会尝试寻找至少 "minFeasibleNodesToFind" 个可行节点，无论此字段的取值如何。 例如：当集群规模为 500 个节点，而此字段的取值为 30， 则调度器在找到 150 个合适的节点后会停止继续寻找合适的节点。当此值为 0 时， 调度器会使用默认节点数百分比（基于集群规模确定的值，在 5% 到 50% 之间）来执行打分操作。

podInitialBackoffSeconds [必需]
 int64
podInitialBackoffSeconds 字段设置不可调度 Pod 的初始回退秒数。 如果设置了此字段，其取值必须大于零。若此值为 null，则使用默认值（1s）。

podMaxBackoffSeconds [必需]
 int64
podMaxBackoffSeconds 字段设置不可调度的 Pod 的最大回退秒数。 如果设置了此字段，则其值必须大于 podInitialBackoffSeconds 字段值。 如果此值设置为 null，则使用默认值（10s）。

profiles [必需]
 []KubeSchedulerProfile
 profiles 字段为 kube-scheduler 所支持的方案（profiles）。 Pod 可以通过设置其对应的调度器名称来选择使用特定的方案。 未指定调度器名称的 Pod 会使用 "default-scheduler" 方案来调度，如果存在的话。

extenders [必需]
 []Extender
extenders 字段为调度器扩展模块（Extender）的列表，每个元素包含如何与某扩展模块通信的配置信息。 所有调度器模仿会共享此扩展模块列表。

 ## `NodeAffinityArgs`     {#kubescheduler-config-k8s-io-v1-NodeAffinityArgs}
NodeAffinityArgs 中包含配置 NodeAffinity 插件的参数。

字段	描述

apiVersion
string	kubescheduler.config.k8s.io/v1

kind
string	NodeAffinityArgs

addedAffinity
 core/v1.NodeAffinity
 addedAffinity 会作为附加的亲和性属性添加到所有 Pod 的规约中指定的 NodeAffinity 中。 换言之，节点需要同时满足 addedAffinity 和 .spec.nodeAffinity。 默认情况下，addedAffinity 为空（与所有节点匹配）。使用了 addedAffinity 时， 某些带有已经能够与某特定节点匹配的亲和性需求的 Pod （例如 DaemonSet Pod）可能会继续呈现不可调度状态。

 ## `NodeResourcesBalancedAllocationArgs`     {#kubescheduler-config-k8s-io-v1-NodeResourcesBalancedAllocationArgs}
NodeResourcesBalancedAllocationArgs 包含用来配置 NodeResourcesBalancedAllocation 插件的参数。

字段	描述

apiVersion
string	kubescheduler.config.k8s.io/v1

kind
string	NodeResourcesBalancedAllocationArgs

resources [必需]
 []ResourceSpec
要管理的资源；如果未设置，则默认值为 "cpu" 和 "memory"。

 ## `NodeResourcesFitArgs`     {#kubescheduler-config-k8s-io-v1-NodeResourcesFitArgs}
NodeResourcesFitArgs 包含用来配置 NodeResourcesFit 插件的参数。

字段	描述

apiVersion
string	kubescheduler.config.k8s.io/v1

kind
string	NodeResourcesFitArgs

ignoredResources [必需]
 []string
ignoredResources 字段为 NodeResources 匹配过滤器要忽略的资源列表。此列表不影响节点打分。

ignoredResourceGroups [必需]
 []string
ignoredResourceGroups 字段定义 NodeResources 匹配过滤器要忽略的资源组列表。 例如，如果配置值为 ["example.com"]， 则以 "example.com" 开头的资源名 （如"example.com/aaa" 和 "example.com/bbb"）都会被忽略。 资源组名称中不可以包含 '/'。此设置不影响节点的打分。

scoringStrategy [必需]
 ScoringStrategy
scoringStrategy 用来选择节点资源打分策略。默认的策略为 LeastAllocated， 且 "cpu" 和 "memory" 的权重相同。

 ## `PodTopologySpreadArgs`     {#kubescheduler-config-k8s-io-v1-PodTopologySpreadArgs}
PodTopologySpreadArgs 包含用来配置 PodTopologySpread 插件的参数。

字段	描述

apiVersion
string	kubescheduler.config.k8s.io/v1

kind
string	PodTopologySpreadArgs

defaultConstraints
 []core/v1.TopologySpreadConstraint
defaultConstraints 字段针对未定义 .spec.topologySpreadConstraints 的 Pod， 为其提供拓扑分布约束。.defaultConstraints[∗].labelSelectors必须为空， 因为这一信息要从 Pod 所属的 Service、ReplicationController、ReplicaSet 或 StatefulSet 来推导。 此字段不为空时，.defaultingType 必须为 "List"。

defaultingType
 PodTopologySpreadConstraintsDefaulting
defaultingType 决定如何推导 .defaultConstraints。 可选值为 "System" 或 "List"。

"System"：使用 Kubernetes 定义的约束，将 Pod 分布到不同节点和可用区；

"List"：使用 .defaultConstraints 中定义的约束。

默认值为 "System"。

 ## `VolumeBindingArgs`     {#kubescheduler-config-k8s-io-v1-VolumeBindingArgs}
VolumeBindingArgs 包含用来配置 VolumeBinding 插件的参数。

字段	描述

apiVersion
string	kubescheduler.config.k8s.io/v1

kind
string	VolumeBindingArgs

bindTimeoutSeconds [必需]
 int64
bindTimeoutSeconds 字段设置卷绑定操作的超时秒数。字段值必须是非负数。 取值为 0 意味着不等待。如果此值为 null，则使用默认值（600）。

shape
 []UtilizationShapePoint
shape 用来设置打分函数曲线所使用的计分点， 这些计分点用来基于静态制备的 PV 卷的利用率为节点打分。 卷的利用率是计算得来的， 将 Pod 所请求的总的存储空间大小除以每个节点上可用的总的卷容量。 每个计分点包含利用率（范围从 0 到 100）和其对应的得分（范围从 0 到 10）。 你可以通过为不同的使用率值设置不同的得分来反转优先级：

默认的曲线计分点为：

利用率为 0 时得分为 0；

利用率为 100 时得分为 10。

所有计分点必须按利用率值的升序来排序。

 ## `Extender`     {#kubescheduler-config-k8s-io-v1-Extender}  **出现在：** - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1-KubeSchedulerConfiguration)
Extender 包含与扩展模块（Extender）通信所用的参数。 如果未指定 verb 或者 verb 为空，则假定对应的扩展模块选择不提供该扩展功能。

字段	描述

urlPrefix [必需]
 string
用来访问扩展模块的 URL 前缀。

filterVerb [必需]
 string
filter 调用所使用的动词，如果不支持过滤操作则为空。 此动词会在向扩展模块发送 filter 调用时追加到 urlPrefix 后面。

preemptVerb [必需]
 string
preempt 调用所使用的动词，如果不支持 preempt 操作则为空。 此动词会在向扩展模块发送 preempt 调用时追加到 urlPrefix 后面。

prioritizeVerb [必需]
 string
prioritize 调用所使用的动词，如果不支持 prioritize 操作则为空。 此动词会在向扩展模块发送 prioritize 调用时追加到 urlPrefix 后面。

weight [必需]
 int64
针对 prioritize 调用所生成的节点分数要使用的数值系数。 weight 值必须是正整数。

bindVerb [必需]
 string
bind 调用所使用的动词，如果不支持 bind 操作则为空。 此动词会在向扩展模块发送 bind 调用时追加到 urlPrefix 后面。 如果扩展模块实现了此方法，扩展模块要负责将 Pod 绑定到 API 服务器。 只有一个扩展模块可以实现此函数。

enableHTTPS [必需]
 bool
enableHTTPS 字段设置是否需要使用 HTTPS 来与扩展模块通信。

tlsConfig [Required]
 ExtenderTLSConfig
tlsConfig 字段设置传输层安全性（TLS）配置。

httpTimeout [必需]
 meta/v1.Duration
httpTimeout 给出扩展模块功能调用的超时值。filter 操作超时会导致 Pod 无法被调度。 prioritize 操作超时会被忽略， Kubernetes 或者其他扩展模块所给出的优先级值会被用来选择节点。

nodeCacheCapable [必需]
 bool
nodeCacheCapable 指示扩展模块可以缓存节点信息，从而调度器应该发送关于可选节点的最少信息， 假定扩展模块已经缓存了集群中所有节点的全部详细信息。

managedResources
 []ExtenderManagedResource
managedResources 是一个由此扩展模块所管理的扩展资源的列表。

如果某 Pod 请求了此列表中的至少一个扩展资源，则 Pod 会在 filter、 prioritize 和 bind （如果扩展模块可以执行绑定操作）阶段被发送到该扩展模块。

如果某资源上设置了 ignoredByScheduler 为 true，则 kube-scheduler 会在断言阶段略过对该资源的检查。

ignorable [必需]
 bool
ignorable 用来设置扩展模块是否是可忽略的。 换言之，当扩展模块返回错误或者完全不可达时，调度操作不应失败。

 ## `ExtenderManagedResource`     {#kubescheduler-config-k8s-io-v1-ExtenderManagedResource}  **出现在：** - [Extender](#kubescheduler-config-k8s-io-v1-Extender)
ExtenderManagedResource 描述某扩展模块所管理的扩展资源的参数。

字段	描述

name [必需]
 string
扩展资源的名称。

ignoredByScheduler [必需]
 bool
ignoredByScheduler 标明 kube-scheduler 是否应在应用断言时忽略此资源。

 ## `ExtenderTLSConfig`     {#kubescheduler-config-k8s-io-v1-ExtenderTLSConfig}  **出现在：** - [Extender](#kubescheduler-config-k8s-io-v1-Extender)
ExtenderTLSConfig 包含启用与扩展模块间 TLS 传输所需的配置参数。

字段	描述

insecure [必需]
 bool
访问服务器时不需要检查 TLS 证书。此配置仅针对测试用途。

serverName [必需]
 string
serverName 会被发送到服务器端，作为 SNI 标志； 客户端会使用此设置来检查服务器证书。 如果 serverName 为空，则会使用联系服务器时所用的主机名。

certFile [必需]
 string
服务器端所要求的 TLS 客户端证书认证。

keyFile [必需]
 string
服务器端所要求的 TLS 客户端秘钥认证。

caFile [必需]
 string
服务器端被信任的根证书。

certData [必需]
 []byte
certData 包含 PEM 编码的字节流（通常从某客户端证书文件读入）。 此字段优先级高于 certFile 字段。

keyData [必需]
 []byte
keyData 包含 PEM 编码的字节流（通常从某客户端证书秘钥文件读入）。 此字段优先级高于 keyFile 字段。

caData [必需]
 []byte
caData 包含 PEM 编码的字节流（通常从某根证书包文件读入）。 此字段优先级高于 caFile 字段。

 ## `KubeSchedulerProfile`     {#kubescheduler-config-k8s-io-v1-KubeSchedulerProfile}  **出现在：** - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1-KubeSchedulerConfiguration)
KubeSchedulerProfile 是一个调度方案。

字段	描述

schedulerName [必需]
 string
schedulerName 是与此调度方案相关联的调度器的名称。 如果 schedulerName 与 Pod 的 spec.schedulerName 匹配， 则该 Pod 会使用此方案来调度。

plugins [必需]
 Plugins
plugins 设置一组应该被启用或禁止的插件。 被启用的插件是指除了默认插件之外需要被启用的插件。 被禁止的插件是指需要被禁用的默认插件。

如果针对某个扩展点没有设置被启用或被禁止的插件， 则使用该扩展点的默认插件（如果有的话）。如果设置了 QueueSort 插件， 则同一个 QueueSort 插件和 pluginConfig 要被设置到所有调度方案之上。

pluginConfig [必需]
 []PluginConfig
pluginConfig 是为每个插件提供的一组可选的定制插件参数。 如果忽略了插件的配置参数，则意味着使用该插件的默认配置。

 ## `Plugin`     {#kubescheduler-config-k8s-io-v1-Plugin}  **出现在：** - [PluginSet](#kubescheduler-config-k8s-io-v1-PluginSet)
Plugin 指定插件的名称及其权重（如果适用的话）。权重仅用于评分（Score）插件。

字段	描述

name [必需]
 string
插件的名称。

weight [必需]
 int32
插件的权重；仅适用于评分（Score）插件。

 ## `PluginConfig`     {#kubescheduler-config-k8s-io-v1-PluginConfig}  **出现在：** - [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1-KubeSchedulerProfile)
PluginConfig 给出初始化阶段要传递给插件的参数。 在多个扩展点被调用的插件仅会被初始化一次。 参数可以是任意结构。插件负责处理这里所传的参数。

字段	描述

name [必需]
 string
name 是所配置的插件的名称。

args [必需]
 k8s.io/apimachinery/pkg/runtime.RawExtension
args 定义在初始化阶段要传递给插件的参数。参数可以为任意结构。

 ## `PluginSet`     {#kubescheduler-config-k8s-io-v1-PluginSet}  **出现在：** - [Plugins](#kubescheduler-config-k8s-io-v1-Plugins)
PluginSet 为某扩展点设置要启用或禁用的插件。 如果数组为空，或者取值为 null，则使用该扩展点的默认插件集合。

字段	描述

enabled [必需]
 []Plugin
enabled 设置在默认插件之外要启用的插件。 如果在调度器的配置文件中也配置了默认插件，则对应插件的权重会被覆盖。 此处所设置的插件会在默认插件之后被调用，调用顺序与数组中元素顺序相同。

disabled [必需]
 []Plugin
disabled 设置要被禁用的默认插件。 如果需要禁用所有的默认插件，应该提供仅包含一个元素 "∗" 的数组。

 ## `Plugins`     {#kubescheduler-config-k8s-io-v1-Plugins}  **出现在：** - [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1-KubeSchedulerProfile)
Plugins 结构中包含多个扩展点。当此结构被设置时， 针对特定扩展点所启用的所有插件都在这一列表中。 如果配置中不包含某个扩展点，则使用该扩展点的默认插件集合。 被启用的插件的调用顺序与这里指定的顺序相同，都在默认插件之后调用。 如果它们需要在默认插件之前调用，则需要先行禁止默认插件， 之后在这里按期望的顺序重新启用。

字段	描述

queueSort [必需]
 PluginSet
queueSort 是一个在对调度队列中 Pod 排序时要调用的插件列表。

preFilter [必需]
 PluginSet
preFilter 是一个在调度框架中 "PreFilter（预过滤）"扩展点上要调用的插件列表。

filter [必需]
 PluginSet
filter 是一个在需要过滤掉无法运行 Pod 的节点时被调用的插件列表。

postFilter [必需]
 PluginSet
postFilter 是一个在过滤阶段结束后会被调用的插件列表； 这里的插件只有在找不到合适的节点来运行 Pod 时才会被调用。

preScore [必需]
 PluginSet
preScore 是一个在打分之前要调用的插件列表。

score [必需]
 PluginSet
score 是一个在对已经通过过滤阶段的节点进行排序时调用的插件的列表。

reserve [必需]
 PluginSet
reserve 是一组在运行 Pod 的节点已被选定后，需要预留或者释放资源时调用的插件的列表。

permit [必需]
 PluginSet
permit 是一个用来控制 Pod 绑定关系的插件列表。 这些插件可以禁止或者延迟 Pod 的绑定。

preBind [必需]
 PluginSet
preBind 是一个在 Pod 被绑定到某节点之前要被调用的插件的列表。

bind [必需]
 PluginSet
 bind 是一个在调度框架中 "Bind（绑定）"扩展点上要调用的插件的列表。 调度器按顺序调用这些插件。只要其中某个插件返回成功，则调度器就略过余下的插件。

postBind [必需]
 PluginSet
postBind 是一个在 Pod 已经被成功绑定之后要调用的插件的列表。

multiPoint [必需]
 PluginSet
multiPoint 是一个简化的配置段落，用来为所有合法的扩展点启用插件。 通过 multiPoint 启用的插件会自动注册到插件所实现的每个独立的扩展点上。 通过 multiPoint 禁用的插件会禁用对应的操作行为。 通过 multiPoint 所禁止的 "∗" 也是如此，意味着所有默认插件都不会被自动注册。 插件也可以通过各个独立的扩展点来禁用。

就优先序而言，插件配置遵从以下基本层次：

特定的扩展点；

显式配置的 multiPoint 插件；

默认插件的集合，以及 multiPoint 插件。

这意味着优先序较高的插件会先被运行，并且覆盖 multiPoint 中的任何配置。

用户显式配置的插件也会比默认插件优先序高。

在这样的层次结构设计之下，enabled 的优先序高于 disabled。 例如，某插件同时出现在 multiPoint.enabled 和 multiPoint.disalbed 时， 该插件会被启用。类似的， 同时设置 multiPoint.disabled = '∗'和 multiPoint.enabled = pluginA 时， 插件 pluginA 仍然会被注册。这一设计与所有其他扩展点的配置行为是相符的。

 ## `PodTopologySpreadConstraintsDefaulting`     {#kubescheduler-config-k8s-io-v1-PodTopologySpreadConstraintsDefaulting}  （`string` 类型的别名） **出现在：** - [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1-PodTopologySpreadArgs)
PodTopologySpreadConstraintsDefaulting 定义如何为 PodTopologySpread 插件设置默认的约束。
 ## `RequestedToCapacityRatioParam`     {#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioParam}  **出现在：** - [ScoringStrategy](#kubescheduler-config-k8s-io-v1-ScoringStrategy)
RequestedToCapacityRatioParam 结构定义 RequestedToCapacityRatio 的参数。

字段	描述

shape [必需]
 []UtilizationShapePoint
shape 是一个定义评分函数曲线的计分点的列表。

 ## `ResourceSpec`     {#kubescheduler-config-k8s-io-v1-ResourceSpec}  **出现在：** - [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1-NodeResourcesBalancedAllocationArgs) - [ScoringStrategy](#kubescheduler-config-k8s-io-v1-ScoringStrategy)
ResourceSpec 用来代表某个资源。

字段	描述

name [必需]
 string
资源名称。

weight [必需]
 int64
资源权重。

 ## `ScoringStrategy`     {#kubescheduler-config-k8s-io-v1-ScoringStrategy}  **出现在：** - [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1-NodeResourcesFitArgs)
ScoringStrategy 为节点资源插件定义 ScoringStrategyType。

字段	描述

type [必需]
 ScoringStrategyType
type 用来选择要运行的策略。

resources [必需]
 []ResourceSpec
resources 设置在评分时要考虑的资源。

默认的资源集合包含 "cpu" 和 "memory"，且二者权重相同。

权重的取值范围为 1 到 100。

当权重未设置或者显式设置为 0 时，意味着使用默认值 1。

requestedToCapacityRatio [必需]
 RequestedToCapacityRatioParam
特定于 RequestedToCapacityRatio 策略的参数。

 ## `ScoringStrategyType`     {#kubescheduler-config-k8s-io-v1-ScoringStrategyType}  （`string` 数据类型的别名） **出现在：** - [ScoringStrategy](#kubescheduler-config-k8s-io-v1-ScoringStrategy)
ScoringStrategyType 是 NodeResourcesFit 插件所使用的的评分策略类型。
 ## `UtilizationShapePoint`     {#kubescheduler-config-k8s-io-v1-UtilizationShapePoint}  **出现在：** - [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1-VolumeBindingArgs) - [RequestedToCapacityRatioParam](#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioParam)
UtilizationShapePoint 代表的是优先级函数曲线中的一个评分点。

字段	描述

utilization [必需]
 int32
利用率（x 轴）。合法值为 0 到 100。完全被利用的节点映射到 100。

score [必需]
 int32
score 分配给指定利用率的分值（y 轴）。合法值为 0 到 10。

 ## `ClientConnectionConfiguration`     {#ClientConnectionConfiguration}  **出现在：** - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1-KubeSchedulerConfiguration)
ClientConnectionConfiguration 中包含用来构造客户端所需的细节。

字段	描述

kubeconfig [必需]
 string
kubeconfig 字段为指向 KubeConfig 文件的路径。

acceptContentTypes [必需]
 string
 acceptContentTypes 定义的是客户端与服务器建立连接时要发送的 Accept 头部， 这里的设置值会覆盖默认值 "application/json"。此字段会影响某特定客户端与服务器的所有连接。

contentType [必需]
 string
 contentType 包含的是此客户端向服务器发送数据时使用的内容类型（Content Type）。

qps [必需]
 float32
qps 控制此连接允许的每秒查询次数。

burst [必需]
 int32
burst 允许在客户端超出其速率限制时可以累积的额外查询个数。

 ## `DebuggingConfiguration`     {#DebuggingConfiguration}  **出现在：** - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1-KubeSchedulerConfiguration)
DebuggingConfiguration 保存与调试功能相关的配置。

字段	描述

enableProfiling [必需]
 bool
enableProfiling 字段允许通过 Web 接口 host:port/debug/pprof/ 执行性能分析。

enableContentionProfiling [必需]
 bool
enableContentionProfiling 字段在 enableProfiling 为 true 时允许执行锁竞争分析。

 ## `LeaderElectionConfiguration`     {#LeaderElectionConfiguration}  **出现在：** - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1-KubeSchedulerConfiguration)
 LeaderElectionConfiguration 为能够支持领导者选举的组件定义其领导者选举客户端的配置。

字段	描述

leaderElect [必需]
 bool
 leaderElect 允许领导者选举客户端在进入主循环执行之前先获得领导者角色。 运行多副本组件时启用此功能有助于提高可用性。

leaseDuration [必需]
 meta/v1.Duration
 leaseDuration 是非领导角色候选者在观察到需要领导席位更新时要等待的时间； 只有经过所设置时长才可以尝试去获得一个仍处于领导状态但需要被刷新的席位。 这里的设置值本质上意味着某个领导者在被另一个候选者替换掉之前可以停止运行的最长时长。 只有当启用了领导者选举时此字段有意义。

renewDeadline [必需]
 meta/v1.Duration
 renewDeadline 设置的是当前领导者在停止扮演领导角色之前需要刷新领导状态的时间间隔。 此值必须小于或等于租约期限的长度。只有到启用了领导者选举时此字段才有意义。

retryPeriod [Required[必需]
 meta/v1.Duration
 retryPeriod 是客户端在连续两次尝试获得或者刷新领导状态之间需要等待的时长。 只有当启用了领导者选举时此字段才有意义。

resourceLock [必需]
 string
resourceLock 字段给出在领导者选举期间要作为锁来使用的资源对象类型。

resourceName [必需]
 string
resourceName 字段给出在领导者选举期间要作为锁来使用的资源对象名称。

resourceNamespace [必需]
 string
resourceNamespace 字段给出在领导者选举期间要作为锁来使用的资源对象所在名字空间。

   No newline at end of file

This is a Feature Request This page has no Chinese version What would you like to be Translate Chinese version for kube-scheduler- Comments /language zh /assign
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: LOCALIZED="$1" # Try get the English version <del> EN_VERSION=`echo $LOCALIZED | sed "s/content/..//content/en//g"` </del> <ins> EN_VERSION=`echo $LOCALIZED | sed "s/content/.{2,5}//content/en//g"` </ins> if [ ! -e $EN_VERSION ]; then echo "$EN_VERSION has been removed." exit 3

This is a Bug Report cannot sync files under correctly. This problem should exist with $LOCALIZED more than 2 characters. When happened when zh -zh-cn see <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Proposed Solution:** needs to be updated to <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/cc /language zh
/triage accepted
I found this problem when reviewing this PR , the commit time of the version is later than the version, but did not correctly find the difference between the 2 versions.
nice catch!
When the script was developed, I was only focusing on markdown files.


Question: You can modify Node objects regardless of the setting of `--register-node`. For example, you can set labels on an existing Node, or mark it unschedulable. --> <del> ### 手动节点管理 </del> <ins> ### 手动节点管理 {#manual-node-administration} </ins> 你可以使用 {{< glossary_tooltip text="kubectl" term_id="kubectl" >}} 来创建和修改 Node 对象。

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: ! URL #self-registration-of-nodes #manual-node-administration # # Proposed Solution: {#self-registration-of-nodes} {#manual-node-administration} Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/language zh /assign


Question: check-headers-file: scripts/check-headers-file.sh <del> production-build: build check-headers-file ## Build the production site and ensure that noindex headers aren't added </del> <ins> production-build: module-check ## Build the production site and ensure that noindex headers aren't added hugo --minify --environment production HUGO_ENV=production $(MAKE) check-headers-file </ins> <del> non-production-build: ## Build the non-production site, which adds noindex headers to prevent indexing hugo --enableGitInfo </del> <ins> non-production-build: module-check ## Build the non-production site, which adds noindex headers to prevent indexing hugo --enableGitInfo --environment nonprod </ins> serve: module-check ## Boot the development server. <del> hugo server --buildFuture </del> <ins> hugo server --buildFuture --environment development </ins> docker-image: @echo -e "$(CCRED)**** The use of docker-image is deprecated. Use container-image instead. ****$(CCEND)"

Problem: Google search for "kubernetes secrets v2" returns: ! (notice the URL subdomains) Proposed Solution: I need to do some more research but a few things come to mind: is in and set in the couple repos I checked. is set in . I believe this is for non-prod sites that are running, however I believe even the old released sites are considered "production" That is assuming robots tag is the culprit. What's also strange is that the above robot config is set in but doesn't appear in the search results I also think looking at might help. It's possible this problem has been solved and phased out with future releases. /priority important-soon /triage accepted /help /cc
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : Problem: is in and set in the couple repos I checked. is set in . I believe this is for non-prod sites that are running, however I believe even the old released sites are considered "production" /triage accepted /help /cc </details
https://v1- does look wrong. We could override this file explicitly for the older releases (perhaps just as an interim measure?)
In the v1.19 docs, appears in the page head. That's wrong.
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-contributor-experience at . /lifecycle stale
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity. If this issue is safe to close now please do so with . Send feedback to sig-contributor-experience at . /lifecycle rotten
/lifecycle frozen
/retitle Search engines indexing old releases Also, the upcoming release is also being indexed and we don't actually want that. Same cause I think.
Hi and I would like to work on this issue. I can see the proposed solution has already been implemented.

May I know, what new things we need to work on for this issue? Now, Google search for "kubernetes secrets v2" returns: ! /assign
I've proposed a PR to fix this. :crossed_fingers:
/reopen We also need to merge 4 backport PRs.
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
[Backport PRs]
It's fixed. I checked. /close
Closing this issue. <detailsIn response to : It's fixed. I checked. /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: `attach` and `port-forward` requests. - `SupportIPVSProxyMode`: Enable providing in-cluster service load balancing using IPVS. <del> See [service proxies](/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies) for more details. </del> <ins> See [service proxies](/docs/reference/networking/virtual-ips/) for more details. </ins> - `SupportNodePidsLimit`: Enable the support to limiting PIDs on the Node.  The parameter `pid=<number>` in the `--system-reserved` and `--kube-reserved` options can be specified to

This is a Bug Report Problem: The link for under is wrong. It is redirected to the instead of that it should redirect to the . It is due to the following PR: Proposed Solution: It should redirect to instead of Page to Update:
/assign /sig docs
/retitle Incorrect link for Service Proxies /language en /triage accepted /priority backlog
Fixed it here:


Question: returned. In this case, the client will need to start from the beginning or omit the `limit` parameter. <del> For example, if there are 1,253 pods on the cluster and you wants to receive chunks </del> <ins> For example, if there are 1,253 pods on the cluster and you want to receive chunks </ins> of 500 pods at a time, request those chunks as follows: 1. List all of the pods on a cluster, retrieving up to 500 pods each time.

in
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/language en /sig docs
I would to like to work on this issue.
/assign
The issue is fixed .


Question: --> 此页面显示如何创建公开外部 IP 地址的 Kubernetes 服务对象。 ## {{% heading "prerequisites" %}} <!-- * Install [kubectl](/docs/tasks/tools/install-kubectl/).

This is a Bug Report Chinese page contentzhdocstutorialsstateless-applicationexpose-external-ip- outdated <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Chinese page contentzhdocstutorialsstateless-applicationexpose-external-ip- is different with English version page. Proposed Solution: Update Chinese page Page to Update: contentzhdocstutorialsstateless-applicationexpose-external-ip- <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
/language zh
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle rotten
/remove-lifecycle rotten
/assign


Question: See the [Kubernetes Authz library](https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz) godoc for more information. <ins> ### Kubernetes quantity library Kubernetes 1.28 adds support for manipulating quantity strings (ex 1.5G, 512k, 20Mi) - `isQuantity(string)` checks if a string is a valid Quantity according to [Kubernetes' resource.Quantity](https://pkg.go.dev/k8s.io/apimachinery/pkg/api/resource#Quantity). - `quantity(string) Quantity` converts a string to a Quantity or results in an error if the string is not a valid quantity. Once parsed via the `quantity` function, the resulting Quantity object has the following library of member functions: {{< table caption="Available member functions of a Quantity" >}} | Member Function               | CEL Return Value  | Description                                                                                | |-------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `isInteger()`                 | bool              | returns true if and only if asInteger is safe to call without an error                                                                                | | `asInteger()`                 | int               | returns a representation of the current value as an int64 if possible or results in an error if conversion would result in overflow or loss of precision.             | | `asApproximateFloat()`        | float              | returns a float64 representation of the quantity which may lose precision. If the value of the quantity is outside the range of a float64 +Inf/-Inf will be returned.  | | `sign()`                      | int               | Returns `1` if the quantity is positive, `-1` if it is negative. `0` if it is zero                                                                                | | `add(<Quantity>)`             | Quantity          | Returns sum of two quantities                                                                                | | `add(<int>)`                  | Quantity          | Returns sum of quantity and an integer                                                                                | | `sub(<Quantity>)`             | Quantity          | Returns difference between two quantities                                                                                | | `sub(<int>)`                  | Quantity          | Returns difference between a quantity and an integer                                                                                | | `isLessThan(<Quantity>)`      | bool              | Returns true if and only if the receiver is less than the operand                                                                                | | `isGreaterThan(<Quantity>)`   | bool              | Returns true if and only if the receiver is greater than the operand                                                                                | | `compareTo(<Quantity>)`       | int               | Compares receiver to operand and returns 0 if they are equal, 1 if the receiver is greater, or -1 if the receiver is less than the operand                           | {{< /table >}} Examples: {{< table caption="Examples of CEL expressions using URL library functions" >}} | CEL Expression                                                            | Purpose                                               | |---------------------------------------------------------------------------|-------------------------------------------------------| | `quantity("500000G").isInteger()`                                         | Test if conversion to integer would throw an error    | | `quantity("50k").asInteger()`                                             | Precise conversion to integer                         | | `quantity("9999999999999999999999999999999999999G").asApproximateFloat()` | Lossy conversion to float                              | | `quantity("50k").add("20k")`                                              | Add two quantities                                    | | `quantity("50k").sub(20000)`                                              | Subtract an integer from a quantity                   | | `quantity("50k").add(20).sub(quantity("100k")).sub(-50000)`               | Chain adding and subtracting integers and quantities  | | `quantity("200M").compareTo(quantity("0.2G"))`                            | Compare two quantities                                | | `quantity("150Mi").isGreaterThan(quantity("100Mi"))`                      | Test if a quantity is greater than the receiver       | | `quantity("50M").isLessThan(quantity("100M"))`                            | Test if a quantity is less than the receiver          | {{< /table >}} </ins> ## Type checking CEL is a [gradually typed language](https://github.com/google/cel-spec/blob/master/doc/langdef.md#gradual-type-checking).

This is a Bug Report Problem: has an entry for "Standard functions - See official list of standard definitions". Both link to which just shows an error page ("Were you looking for..."). Proposed Solution: I'm not sure :sweat_smile: - I am new to CEL and don't know where the standard lib is defined. Page to Update: /cc
/triage accepted /assign Hi , thanks for raising this! I will open an pr to fix it shortly :)
/language en /priority backlog
This is due to the reference for the hyperlinks mentioned after the table, which are not working. see the code here: we have to update the links in the table. For example, the hyperlink for Standard functions is mentioned like but it should be
Thanks for pointing out. I have raised the PR to address this and please feel free to take a look. :)


Question: The following methods exist for installing kubectl on Windows: <del> - [Install kubectl binary with curl on Windows](#install-kubectl-binary-with-curl-on-windows) </del> <ins> - [Install kubectl binary on Windows (via direct download or curl)](#install-kubectl-binary-on-windows-via-direct-download-or-curl) </ins> - [Install on Windows using Chocolatey, Scoop, or winget](#install-nonstandard-package-tools) <del> ### Install kubectl binary with curl on Windows </del> <ins> ### Install kubectl binary on Windows (via direct download or curl) </ins> <del> 1. Download the latest {{< skew currentVersion >}} patch release: [kubectl {{< skew currentPatchVersion >}}](https://dl.k8s.io/release/v{{< skew currentPatchVersion >}}/bin/windows/amd64/kubectl.exe). </del> <ins> 1. You have two options for installing kubectl on your Windows device </ins> <del> Or if you have `curl` installed, use this command: </del> <ins> - Direct download: Download the latest {{< skew currentVersion >}} patch release binary directly for your specific architecture by visiting the [Kubernetes release page](https://kubernetes.io/releases/download/#binaries). Be sure to select the correct binary for your architecture (e.g., amd64, arm64, etc.). - Using curl: </ins> <del> ```powershell curl.exe -LO "https://dl.k8s.io/release/v{{< skew currentPatchVersion >}}/bin/windows/amd64/kubectl.exe" ``` </del> <ins> If you have `curl` installed, use this command: ```powershell curl.exe -LO "https://dl.k8s.io/release/v{{< skew currentPatchVersion >}}/bin/windows/amd64/kubectl.exe" ``` </ins> {{< note >}} To find out the latest stable version (for example, for scripting), take a look at

There's million users which have no direct internet access from the workplace other than downloading from HTTP/HTTPS websites for security reasons. Others do not have chocolatey installed or cannot copy/paste curl commands from an external website to their local workstation, also for security reasons. Currently the HTTP link to download kubectl is inside a curl command. It could be possible to provide a more explicit HTML link, for clarity.
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
We could have the kubectl install pages link to Historically, we had this guide to installing kubectl before existed. Now that is a thing, we can link to it. would that suit you? /retitle Task page for installing kubectl should explain how to find direct download link /kind feature /language en
This was originally filed about
I did read that page and I can see that there's already a direct download link for This is under a slightly misleading heading; the text is headed: so maybe we'd like to change the heading as well? I still recommend linking to the list of binaries you can download. The existing link does assume amd64 architecture; on the other hand, AMD processors (and Intel clones) are the market leader. /priority awaiting-more-evidence
Thank you yes the misleading text is probably the main problem - but the list of binaries can also be very useful as the organizations who prevent direct internet access are often the ones who don't run the latest version of any tool :) The idea is to make it as clearer as possible as it's gonna be the first option for many as opposite to run curs or package managers which aren't so common on Windows.
OK, so: which fix do you advocate ? We should recommend one so that someone picking up this work knows what approach to take.
Hey I'd like to work on this. Based on the discussion, here are my suggestions: Let's update the header title to specify a direct download or curl option. We should add new paragraphs describing a direct download option for all supported architectures. /assign


Question: } ``` <del> If the application is deployed as a Pod in the cluster, see [Accessing the API from within a Pod](#accessing-the-api-from-within-a-pod). </del> <ins> If the application is deployed as a Pod in the cluster, see [Accessing the API from within a Pod](/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod). </ins> #### Python client

Link broken or pointing to a wrong link. Under section: Programmatic access to the API. The link provided in the below line seems to be broken to wrong.
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
I think this report is about the page can you paste in the text (or HTML source) of the broken hyperlink /triage needs-information


Question: <ins> --- title: Affinity id: affinity date: 2019-01-11 full_link: /docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity short_description: > Rules used by the scheduler to determine where to place pods aka: tags: - fundamental --- In Kubernetes, _affinity_ is a set of rules that give hints to the scheduler about where to place pods. <!--more--> There are two kinds of affinity: * [node affinity](/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity) * [pod-to-pod affinity](/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity) The rules are defined using the Kubernetes {{< glossary_tooltip term_id="label" text="labels">}}, and {{< glossary_tooltip term_id="selector" text="selectors">}} specified in {{< glossary_tooltip term_id="pod" text="pods" >}}, and they can be either required or preferred, depending on how strictly you want the scheduler to enforce them. </ins>

This is a feature request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be should use a glossary tooltip for “affinity” Why is this needed Kubernetes uses the term “affinity” to mean a specific thing. A tooltip (and the hyperlink it implies) helps a reader learn more about this term if they are not sure. Comments /language en
/triage accepted
Hey, I will like to work on this !! Please let me know how can I proceed with this !! !!
/assign


Question: <ins> --- title: オーナーと従属 content_type: concept weight: 90 --- <!-- overview --> Kubernetesでは、いくつかのオブジェクトは他のオブジェクトの*オーナー*になっています。 例えば、{{<glossary_tooltip text="ReplicaSet" term_id="replica-set">}}はPodの集合のオーナーです。 これらの所有されているオブジェクトはオーナーに*従属*しています。 オーナーシップはいくつかのリソースでも使われている[ラベルとセレクター](/ja/docs/concepts/overview/working-with-objects/labels/)とは仕組みが異なります。 例として、`EndpointSlice`オブジェクトを作成するServiceオブジェクトを考えてみます。 Serviceはラベルを使ってどの`EndpointSlice`がどのServiceに利用されているかをコントロールプレーンに判断させています。 ラベルに加えて、Serviceの代わりに管理される各`EndpointSlice`はオーナーリファレンスを持ちます。 オーナーリファレンスは、Kubernetesの様々な箇所で管理外のオブジェクトに干渉してしまうのを避けるのに役立ちます。 ## オブジェクト仕様におけるオーナーリファレンス 従属オブジェクトはオーナーオブジェクトを参照するための`metadata.ownerReferences`フィールドを持っています。 有効なオーナーリファレンスは従属オブジェクトと同じ名前空間に存在するオブジェクトの名前とUIDで構成されます。 KubernetesはReplicaSet、DaemonSet、Deployment、Job、CronJob、ReplicationControllerのようなオブジェクトの従属オブジェクトに、自動的に値を設定します。 このフィールドの値を手動で変更することで、これらの関係性を自分で設定することもできます。 ただし、通常はその必要はなく、Kubernetesが自動で管理するようにすることができます。 従属オブジェクトは、オーナーオブジェクトが削除されたときにガベージコレクションをブロックするかどうかを管理する真偽値を取る`ownerReferences.blockOwnerDeletion`フィールドも持っています。 Kubernetesは、{{<glossary_tooltip text="コントローラー" term_id="controller">}} (例：Deploymentコントローラー)が`metadata.ownerReferences`フィールドに値を設定している場合、自動的にこのフィールドを`true`に設定します。 `blockOwnerDeletion`フィールドに手動で値を設定することで、どの従属オブジェクトがガベージコレクションをブロックするかを設定することもできます。 Kubernetesのアドミッションコントローラーはオーナーの削除権限に基づいて、ユーザーが従属リソースのこのフィールドを変更できるかを管理しています。 これにより、認証されていないユーザーがオーナーオブジェクトの削除を遅らせることを防ぎます。 {{< note >}} 名前空間をまたぐオーナーリファレンスは仕様により許可されていません。 名前空間付き従属オブジェクトには、クラスタースコープ、または名前空間付きのオーナーを指定することができます。名前空間付きオーナーは**必ず**従属オブジェクトと同じ名前空間に存在していなければなりません。 そうでない場合、オーナーリファレンスはないものとして扱われ、全てのオーナーがいなくなった時点で従属オブジェクトは削除対象となります。 クラスタースコープの従属オブジェクトはクラスタースコープのオーナーのみ指定できます。 v1.20以降では、クラスタースコープの従属オブジェクトが名前空間付きのオブジェクトをオーナーとした場合、 解決できないオーナーリファレンスを持っているものとして扱われ、ガベージコレクションの対象とすることができません。 v1.20以降で、ガベージコレクターが無効な名前空間またぎの`ownerReference`や名前空間付きのオーナーに依存するクラスタースコープのオブジェクトなどを検知した場合、`OwnerRefInvalidNamespace`を理由とした警告のEventを出し、`involvedObject`で無効な従属オブジェクトを報告します。 `kubectl get events -A --field-selector=reason=OwnerRefInvalidNamespace`を実行することで、この種類のEventを確認することができます。 {{< /note >}} ## オーナーシップとファイナライザー Kubernetesでリソースを削除するとき、APIサーバーはリソースを管理するコントローラーに[ファイナライザールール](/ja/docs/concepts/overview/working-with-objects/finalizers/)を処理させることができます。 {{<glossary_tooltip text="ファイナライザー" term_id="finalizer">}}はクラスターが正しく機能するために必要なリソースを誤って削除してしまうことを防ぎます。 例えば、まだPodが使用中の`PersistentVolume`を削除しようとするとき、`PersistentVolume`が持っている`kubernetes.io/pv-protection`ファイナライザーにより、削除は即座には行われません。 その代わり、Kubernetesがファイナライザーを削除するまでボリュームは`Terminating`ステータスのまま残り、`PersistentVolume`がPodにバインドされなくなった後で削除が行われます。 またKubernetesは[フォアグラウンド、孤立したオブジェクトのカスケード削除](/ja/docs/concepts/architecture/garbage-collection/#cascading-deletion)を行ったとき、オーナーリソースにファイナライザーを追加します。 フォアグラウンド削除では、`foreground`ファイナライザーを追加し、オーナーを削除する前にコントローラーが`ownerReferences.blockOwnerDeletion=true`を持っている従属リソースを削除するようにします。 孤立したオブジェクトの削除を行う場合、Kubernetesは`orphan`ファイナライザーを追加し、オーナーオブジェクトを削除した後にコントローラーが従属リソースを無視するようにします。 ## {{% heading "whatsnext" %}} * [Kubernetesのファイナライザー](/ja/docs/concepts/overview/working-with-objects/finalizers/)についてさらに学習しましょう。 * [ガベージコレクション](/ja/docs/concepts/architecture/garbage-collection)について学習しましょう。 * [オブジェクトのメタデータ](/docs/reference/kubernetes-api/common-definitions/object-meta/#System)のAPIリファレンスをご覧ください。 </ins>  No newline at end of file

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Translate into Japanese Why is this needed Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/language ja /assign
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: description: "プロジェクトに不慣れでも、長い間関わっていたとしても、誰でもコントリビュートすることができます。" button: "ドキュメントにコントリビュートする" button_path: /docs/contribute <del> - name: release-notes title: "K8sリリースノート" </del> <ins> - name: training title: "トレーニング" description: "Kubernetesの資格を取得して、クラウドネイティブプロジェクトを成功させます！" button: "トレーニングを見る" button_path: "/training" - name: Download title: "Kubernetesをダウンロードする" </ins> description: "もしKubernetesをインストールする、また最新バージョンにアップグレードする場合、最新のリリースノートを参照してください。" button: "Kubernetesをダウンロードする" button_path: "/releases/download"

This is a Feature Request Update Why is this needed Many people view this page. Updating the links on this page is useful for many people. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/assign /language ja /area localization
/triage accepted


Question: title: "bash auto-completion on macOS" description: "Some optional configuration for bash auto-completion on macOS." headless: true <ins> _build: list: never render: never publishResources: false </ins> --- ### Introduction

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The source Markdown needs to exist for pages such as but we don't need to make those turn into actual web pages. Proposed Solution: Edit every file within : Page to Update: and its contents /area web-development /help /priority backlog /good-first-issue
This request has been marked as suitable for new contributors. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : This is a Bug Report <!-- See for guidance on writing an actionable issue description. --Problem: The source Markdown needs to exist for pages such as but we don't need to make those turn into actual web pages. Edit every file within : Page to Update: and its contents /help /priority backlog /good-first-issue </details
/retitle Include files for install are rendered and served /triage accepted
/assign
/unassign
Thanks !


Question: A ServiceAccount controller manages the ServiceAccounts inside namespaces, and ensures a ServiceAccount named "default" exists in every active namespace.

says about : Since 1.22 is released, the text shall not say what is planned to happen in the 1.22 versions, as if those were in the future.
/triage accepted /kind bug /assign
/language en


Question: * Kubernetes API Versions * [1.6](/docs/api-reference/v1.6/) * [1.5](/docs/api-reference/v1.5/) <del> * Federation API * [v1 Operations](docs/reference/federation/v1/operations.html) * [v1 Model Definitions](docs/reference/federation/v1/definitions.html) * [federation/v1beta1 Operations](docs/reference/federation/v1beta1/operations.html) * [federation/v1beta1 Model Definitions](docs/reference/federation/v1beta1/definitions.html) * [extensions/v1beta1 Operations](docs/reference/federation/extensions/v1beta1/operations.html) * [extensions/v1beta1 Model Definitions](docs/reference/federation/extensions/v1beta1/definitions.html) </del> ## CLI Reference

<!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!--Required Information--This is a... <!-- choose one by changing [ ] to [x] --- [ ] Feature Request [x] Bug Report Problem: Link points to non-existent page Proposed Solution: Fix the link. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--


Question: * 'Distribute volume': `volumetype: none` 有关可用的卷类型和管理选项， <del> 请参阅[管理指南](https://access.redhat.com/documentation/en-US/Red_Hat_Storage/3.1/html/Administration_Guide/part-Overview.html)。 </del> <ins> 请参阅[管理指南](https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/)。 </ins> 更多相关的参考信息， 请参阅[如何配置 Heketi](https://github.com/heketi/heketi/wiki/Setting-up-the-topology)。

stay In the page, the link at the text "vSphereVolume CSI " should be -csi-migration
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
/language zh
Are you still working on it?
I submitted PR to solve this issue and put you as the co-author.


Question: - sigs.k8s.io/kustomize: v2.0.3+incompatible <del> ## Dependencies ### Added - github.com/go-errors/errors: [v1.0.1](https://github.com/go-errors/errors/tree/v1.0.1) - github.com/gobuffalo/here: [v0.6.0](https://github.com/gobuffalo/here/tree/v0.6.0) - github.com/google/shlex: [e7afc7f](https://github.com/google/shlex/tree/e7afc7f) - github.com/markbates/pkger: [v0.17.1](https://github.com/markbates/pkger/tree/v0.17.1) - github.com/moby/spdystream: [v0.2.0](https://github.com/moby/spdystream/tree/v0.2.0) - github.com/monochromegane/go-gitignore: [205db1a](https://github.com/monochromegane/go-gitignore/tree/205db1a) - github.com/niemeyer/pretty: [a10e7ca](https://github.com/niemeyer/pretty/tree/a10e7ca) - github.com/xlab/treeprint: [a009c39](https://github.com/xlab/treeprint/tree/a009c39) - go.starlark.net: 8dd3e2e - golang.org/x/term: 6a3ed07 - sigs.k8s.io/kustomize/api: v0.8.5 - sigs.k8s.io/kustomize/cmd/config: v0.9.7 - sigs.k8s.io/kustomize/kustomize/v4: v4.0.5 - sigs.k8s.io/kustomize/kyaml: v0.10.15 ### Changed - dmitri.shuralyov.com/gpu/mtl: 666a987 → 28db891 - github.com/Azure/go-autorest/autorest: [v0.11.1 → v0.11.12](https://github.com/Azure/go-autorest/autorest/compare/v0.11.1...v0.11.12) - github.com/NYTimes/gziphandler: [56545f4 → v1.1.1](https://github.com/NYTimes/gziphandler/compare/56545f4...v1.1.1) - github.com/cilium/ebpf: [1c8d4c9 → v0.2.0](https://github.com/cilium/ebpf/compare/1c8d4c9...v0.2.0) - github.com/container-storage-interface/spec: [v1.2.0 → v1.3.0](https://github.com/container-storage-interface/spec/compare/v1.2.0...v1.3.0) - github.com/containerd/console: [v1.0.0 → v1.0.1](https://github.com/containerd/console/compare/v1.0.0...v1.0.1) - github.com/containerd/containerd: [v1.4.1 → v1.4.4](https://github.com/containerd/containerd/compare/v1.4.1...v1.4.4) - github.com/coredns/corefile-migration: [v1.0.10 → v1.0.11](https://github.com/coredns/corefile-migration/compare/v1.0.10...v1.0.11) - github.com/creack/pty: [v1.1.7 → v1.1.11](https://github.com/creack/pty/compare/v1.1.7...v1.1.11) - github.com/docker/docker: [bd33bbf → v20.10.2+incompatible](https://github.com/docker/docker/compare/bd33bbf...v20.10.2) - github.com/go-logr/logr: [v0.2.0 → v0.4.0](https://github.com/go-logr/logr/compare/v0.2.0...v0.4.0) - github.com/go-openapi/spec: [v0.19.3 → v0.19.5](https://github.com/go-openapi/spec/compare/v0.19.3...v0.19.5) - github.com/go-openapi/strfmt: [v0.19.3 → v0.19.5](https://github.com/go-openapi/strfmt/compare/v0.19.3...v0.19.5) - github.com/go-openapi/validate: [v0.19.5 → v0.19.8](https://github.com/go-openapi/validate/compare/v0.19.5...v0.19.8) - github.com/gogo/protobuf: [v1.3.1 → v1.3.2](https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2) - github.com/golang/mock: [v1.4.1 → v1.4.4](https://github.com/golang/mock/compare/v1.4.1...v1.4.4) - github.com/google/cadvisor: [v0.38.5 → v0.39.0](https://github.com/google/cadvisor/compare/v0.38.5...v0.39.0) - github.com/heketi/heketi: [c2e2a4a → v10.2.0+incompatible](https://github.com/heketi/heketi/compare/c2e2a4a...v10.2.0) - github.com/kisielk/errcheck: [v1.2.0 → v1.5.0](https://github.com/kisielk/errcheck/compare/v1.2.0...v1.5.0) - github.com/konsorten/go-windows-terminal-sequences: [v1.0.3 → v1.0.2](https://github.com/konsorten/go-windows-terminal-sequences/compare/v1.0.3...v1.0.2) - github.com/kr/text: [v0.1.0 → v0.2.0](https://github.com/kr/text/compare/v0.1.0...v0.2.0) - github.com/mattn/go-runewidth: [v0.0.2 → v0.0.7](https://github.com/mattn/go-runewidth/compare/v0.0.2...v0.0.7) - github.com/miekg/dns: [v1.1.4 → v1.1.35](https://github.com/miekg/dns/compare/v1.1.4...v1.1.35) - github.com/moby/sys/mountinfo: [v0.1.3 → v0.4.0](https://github.com/moby/sys/mountinfo/compare/v0.1.3...v0.4.0) - github.com/moby/term: [672ec06 → df9cb8a](https://github.com/moby/term/compare/672ec06...df9cb8a) - github.com/mrunalp/fileutils: [abd8a0e → v0.5.0](https://github.com/mrunalp/fileutils/compare/abd8a0e...v0.5.0) - github.com/olekukonko/tablewriter: [a0225b3 → v0.0.4](https://github.com/olekukonko/tablewriter/compare/a0225b3...v0.0.4) - github.com/opencontainers/runc: [v1.0.0-rc92 → v1.0.0-rc93](https://github.com/opencontainers/runc/compare/v1.0.0-rc92...v1.0.0-rc93) - github.com/opencontainers/runtime-spec: [4d89ac9 → e6143ca](https://github.com/opencontainers/runtime-spec/compare/4d89ac9...e6143ca) - github.com/opencontainers/selinux: [v1.6.0 → v1.8.0](https://github.com/opencontainers/selinux/compare/v1.6.0...v1.8.0) - github.com/sergi/go-diff: [v1.0.0 → v1.1.0](https://github.com/sergi/go-diff/compare/v1.0.0...v1.1.0) - github.com/sirupsen/logrus: [v1.6.0 → v1.7.0](https://github.com/sirupsen/logrus/compare/v1.6.0...v1.7.0) - github.com/syndtr/gocapability: [d983527 → 42c35b4](https://github.com/syndtr/gocapability/compare/d983527...42c35b4) - github.com/willf/bitset: [d5bec33 → v1.1.11](https://github.com/willf/bitset/compare/d5bec33...v1.1.11) - github.com/yuin/goldmark: [v1.1.27 → v1.2.1](https://github.com/yuin/goldmark/compare/v1.1.27...v1.2.1) - golang.org/x/crypto: 7f63de1 → 5ea612d - golang.org/x/exp: 6cc2880 → 85be41e - golang.org/x/mobile: d2bd2a2 → e6ae53a - golang.org/x/mod: v0.3.0 → ce943fd - golang.org/x/net: 69a7880 → 3d97a24 - golang.org/x/sync: cd5d95a → 67f06af - golang.org/x/sys: 5cba982 → a50acf3 - golang.org/x/time: 3af7569 → f8bda1e - golang.org/x/tools: c1934b7 → v0.1.0 - gopkg.in/check.v1: 41f04d3 → 8fa4692 - gopkg.in/yaml.v2: v2.2.8 → v2.4.0 - gotest.tools/v3: v3.0.2 → v3.0.3 - k8s.io/gengo: 83324d8 → b6c5ce2 - k8s.io/klog/v2: v2.4.0 → v2.8.0 - k8s.io/kube-openapi: d219536 → 591a79e - k8s.io/system-validators: v1.2.0 → v1.4.0 - sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.0.14 → v0.0.15 - sigs.k8s.io/structured-merge-diff/v4: v4.0.2 → v4.1.0 ### Removed - github.com/codegangsta/negroni: [v1.0.0](https://github.com/codegangsta/negroni/tree/v1.0.0) - github.com/docker/spdystream: [449fdfc](https://github.com/docker/spdystream/tree/449fdfc) - github.com/golangplus/bytes: [45c989f](https://github.com/golangplus/bytes/tree/45c989f) - github.com/golangplus/fmt: [2a5d6d7](https://github.com/golangplus/fmt/tree/2a5d6d7) - github.com/gorilla/context: [v1.1.1](https://github.com/gorilla/context/tree/v1.1.1) - github.com/kr/pty: [v1.1.5](https://github.com/kr/pty/tree/v1.1.5) - rsc.io/quote/v3: v3.1.0 - rsc.io/sampler: v1.3.0 - sigs.k8s.io/kustomize: v2.0.3+incompatible </del> # v1.21.0-rc.0

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: There exist bugs in . [Part number 1] [Part number 2] Proposed Solution: [Part number 1] [Part number 2] Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/assign
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
[As-is] [To-be]
Hello . Note: The release notes are auto-generated. What do you think about logging an issue with the release team (release notes)?
Hi Following your advice, I posted an on . Thank you!
release notes team here. yes this was autogenerated but we had to make manual fix to k/k (ref: ) a few days after the official release went out. i think it's the right move to fix it here as well