Question: <del> --- title: 使用 AppArmor 限制容器对资源的访问 content_type: tutorial weight: 10 --- <!-- --- reviewers: - stclair title: Restrict a Container's Access to Resources with AppArmor content_type: tutorial weight: 10 --- --> <!-- overview --> {{< feature-state for_k8s_version="v1.4" state="beta" >}} <!-- AppArmor is a Linux kernel security module that supplements the standard Linux user and group based permissions to confine programs to a limited set of resources. AppArmor can be configured for any application to reduce its potential attack surface and provide greater in-depth defense. It is configured through profiles tuned to allow the access needed by a specific program or container, such as Linux capabilities, network access, file permissions, etc. Each profile can be run in either *enforcing* mode, which blocks access to disallowed resources, or *complain* mode, which only reports violations. --> Apparmor 是一个 Linux 内核安全模块，它补充了标准的基于 Linux 用户和组的安全模块将程序限制为有限资源集的权限。 AppArmor 可以配置为任何应用程序减少潜在的攻击面，并且提供更加深入的防御。 AppArmor 是通过配置文件进行配置的，这些配置文件被调整为允许特定程序或者容器访问，如 Linux 功能、网络访问、文件权限等。 每个配置文件都可以在*强制（enforcing）*模式（阻止访问不允许的资源）或*投诉（complain）*模式 （仅报告冲突）下运行。 ## {{% heading "objectives" %}} <!-- * See an example of how to load a profile on a node * Learn how to enforce the profile on a Pod * Learn how to check that the profile is loaded * See what happens when a profile is violated * See what happens when a profile cannot be loaded --> * 查看如何在节点上加载配置文件示例 * 了解如何在 Pod 上强制执行配置文件 * 了解如何检查配置文件是否已加载 * 查看违反配置文件时会发生什么情况 * 查看无法加载配置文件时会发生什么情况 ## {{% heading "prerequisites" %}} <!-- Make sure: --> 务必： <!-- 1. Kubernetes version is at least v1.4 -- Kubernetes support for AppArmor was added in v1.4. Kubernetes components older than v1.4 are not aware of the new AppArmor annotations, and will **silently ignore** any AppArmor settings that are provided. To ensure that your Pods are receiving the expected protections, it is important to verify the Kubelet version of your nodes: ```shell kubectl get nodes -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.status.nodeInfo.kubeletVersion}n{end}' ``` ``` gke-test-default-pool-239f5d02-gyn2: v1.4.0 gke-test-default-pool-239f5d02-x1kf: v1.4.0 gke-test-default-pool-239f5d02-xwux: v1.4.0 ``` --> 1. Kubernetes 版本至少是 v1.4 -- AppArmor 在 Kubernetes v1.4 版本中才添加了对 AppArmor 的支持。早于 v1.4 版本的 Kubernetes 组件不知道新的 AppArmor 注释，并且将会 **默认忽略** 提供的任何 AppArmor 设置。为了确保您的 Pods 能够得到预期的保护，必须验证节点的 Kubelet 版本： ```shell kubectl get nodes -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.status.nodeInfo.kubeletVersion}n{end}' ``` ``` gke-test-default-pool-239f5d02-gyn2: v1.4.0 gke-test-default-pool-239f5d02-x1kf: v1.4.0 gke-test-default-pool-239f5d02-xwux: v1.4.0 ``` <!-- 2. AppArmor kernel module is enabled -- For the Linux kernel to enforce an AppArmor profile, the AppArmor kernel module must be installed and enabled. Several distributions enable the module by default, such as Ubuntu and SUSE, and many others provide optional support. To check whether the module is enabled, check the `/sys/module/apparmor/parameters/enabled` file: ```shell cat /sys/module/apparmor/parameters/enabled Y ``` If the Kubelet contains AppArmor support (>= v1.4), it will refuse to run a Pod with AppArmor options if the kernel module is not enabled. {{< note >}} Ubuntu carries many AppArmor patches that have not been merged into the upstream Linux kernel, including patches that add additional hooks and features. Kubernetes has only been tested with the upstream version, and does not promise support for other features. {{< /note >}} --> 2. AppArmor 内核模块已启用 -- 要使 Linux 内核强制执行 AppArmor 配置文件，必须安装并且启动 AppArmor 内核模块。默认情况下，有几个发行版支持该模块，如 Ubuntu 和 SUSE，还有许多发行版提供可选支持。要检查模块是否已启用，请检查 `/sys/module/apparmor/parameters/enabled` 文件： ```shell cat /sys/module/apparmor/parameters/enabled Y ``` 如果 Kubelet 包含 AppArmor 支持(>=v1.4)，如果内核模块未启用，它将拒绝运行带有 AppArmor 选项的 Pod。 {{< note >}} Ubuntu 携带了许多没有合并到上游 Linux 内核中的 AppArmor 补丁，包括添加附加钩子和特性的补丁。Kubernetes 只在上游版本中测试过，不承诺支持其他特性。 {{< /note >}} <!-- 3. Container runtime is Docker -- Currently the only Kubernetes-supported container runtime that also supports AppArmor is Docker. As more runtimes add AppArmor support, the options will be expanded. You can verify that your nodes are running docker with: ```shell kubectl get nodes -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.status.nodeInfo.containerRuntimeVersion}n{end}' ``` ``` gke-test-default-pool-239f5d02-gyn2: docker://1.11.2 gke-test-default-pool-239f5d02-x1kf: docker://1.11.2 gke-test-default-pool-239f5d02-xwux: docker://1.11.2 ``` If the Kubelet contains AppArmor support (>= v1.4), it will refuse to run a Pod with AppArmor options if the runtime is not Docker. --> 3. Docker 作为容器运行环境 -- 目前，支持 Kubernetes 运行的容器中只有 Docker 也支持 AppArmor。随着更多的运行时添加 AppArmor 的支持，可选项将会增多。您可以使用以下命令验证节点是否正在运行 Docker: ```shell kubectl get nodes -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.status.nodeInfo.containerRuntimeVersion}n{end}' ``` ``` gke-test-default-pool-239f5d02-gyn2: docker://1.11.2 gke-test-default-pool-239f5d02-x1kf: docker://1.11.2 gke-test-default-pool-239f5d02-xwux: docker://1.11.2 ``` 如果 Kubelet 包含 AppArmor 支持(>=v1.4)，如果运行环境不是 Docker，它将拒绝运行带有 AppArmor 选项的 Pod。 <!-- 4. Profile is loaded -- AppArmor is applied to a Pod by specifying an AppArmor profile that each container should be run with. If any of the specified profiles is not already loaded in the kernel, the Kubelet (>= v1.4) will reject the Pod. You can view which profiles are loaded on a node by checking the `/sys/kernel/security/apparmor/profiles` file. For example: ```shell ssh gke-test-default-pool-239f5d02-gyn2 "sudo cat /sys/kernel/security/apparmor/profiles | sort" ``` ``` apparmor-test-deny-write (enforce) apparmor-test-audit-write (enforce) docker-default (enforce) k8s-nginx (enforce) ``` For more details on loading profiles on nodes, see [Setting up nodes with profiles](#setting-up-nodes-with-profiles). --> 4. 配置文件已加载 -- 通过指定每个容器都应使用 AppArmor 配置文件，AppArmor 应用于 Pod。如果指定的任何配置文件尚未加载到内核， Kubelet (>=v1.4) 将拒绝 Pod。通过检查 `/sys/kernel/security/apparmor/profiles` 文件，可以查看节点加载了哪些配置文件。例如: ```shell ssh gke-test-default-pool-239f5d02-gyn2 "sudo cat /sys/kernel/security/apparmor/profiles | sort" ``` ``` apparmor-test-deny-write (enforce) apparmor-test-audit-write (enforce) docker-default (enforce) k8s-nginx (enforce) ``` <!-- For more details on loading profiles on nodes, see [Setting up nodes with profiles](#setting-up-nodes-with-profiles). --> 有关在节点上加载配置文件的详细信息，请参见[使用配置文件设置节点](#setting-up-nodes-with-profiles)。 <!-- As long as the Kubelet version includes AppArmor support (>= v1.4), the Kubelet will reject a Pod with AppArmor options if any of the prerequisites are not met. You can also verify AppArmor support on nodes by checking the node ready condition message (though this is likely to be removed in a later release): --> 只要 Kubelet 版本包含 AppArmor 支持(>=v1.4)，如果不满足任何先决条件，Kubelet 将拒绝带有 AppArmor 选项的 Pod。您还可以通过检查节点就绪状况消息来验证节点上的 AppArmor 支持(尽管这可能会在以后的版本中删除)： ```shell kubectl get nodes -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {.status.conditions[?(@.reason=="KubeletReady")].message}n{end}' ``` ``` gke-test-default-pool-239f5d02-gyn2: kubelet is posting ready status. AppArmor enabled gke-test-default-pool-239f5d02-x1kf: kubelet is posting ready status. AppArmor enabled gke-test-default-pool-239f5d02-xwux: kubelet is posting ready status. AppArmor enabled ``` <!-- lessoncontent --> <!-- ## Securing a Pod --> ## 保护 Pod {{< note >}} <!-- AppArmor is currently in beta, so options are specified as annotations. Once support graduates to general availability, the annotations will be replaced with first-class fields (more details in [Upgrade path to GA](#upgrade-path-to-general-availability)). --> AppArmor 目前处于测试阶段，因此选项被指定为注释。一旦 AppArmor 被授予支持通用，注释将替换为首要的字段(更多详情参见[升级到 GA 的途径](#upgrade-path-to-general-availability))。 {{< /note >}} <!-- AppArmor profiles are specified *per-container*. To specify the AppArmor profile to run a Pod container with, add an annotation to the Pod's metadata: --> AppArmor 配置文件被指定为 *per-container*。要指定要用其运行 Pod 容器的 AppArmor 配置文件，请向 Pod 的元数据添加注释： ```yaml container.apparmor.security.beta.kubernetes.io/<container_name>: <profile_ref> ``` <!-- Where `<container_name>` is the name of the container to apply the profile to, and `<profile_ref>` specifies the profile to apply. The `profile_ref` can be one of: --> `<container_name>` 的名称是容器的简称，用以描述简介，并且简称为 `<profile_ref>` 。`<profile_ref>` 可以作为其中之一： <!-- * `runtime/default` to apply the runtime's default profile * `localhost/<profile_name>` to apply the profile loaded on the host with the name `<profile_name>` * `unconfined` to indicate that no profiles will be loaded --> * `runtime/default` 应用运行时的默认配置 * `localhost/<profile_name>` 应用在名为 `<profile_name>` 的主机上加载的配置文件 * `unconfined` 表示不加载配置文件 <!-- See the [API Reference](#api-reference) for the full details on the annotation and profile name formats. --> 有关注释和配置文件名称格式的详细信息，请参阅[API 参考](#api-reference)。 <!-- Kubernetes AppArmor enforcement works by first checking that all the prerequisites have been met, and then forwarding the profile selection to the container runtime for enforcement. If the prerequisites have not been met, the Pod will be rejected, and will not run. --> Kubernetes AppArmor 强制执行方式首先通过检查所有先决条件都已满足，然后将配置文件选择转发到容器运行时进行强制执行。如果未满足先决条件， Pod 将被拒绝，并且不会运行。 <!-- To verify that the profile was applied, you can look for the AppArmor security option listed in the container created event: --> 要验证是否应用了配置文件，可以查找容器创建事件中列出的 AppArmor 安全选项： ```shell kubectl get events | grep Created ``` ``` 22s        22s         1         hello-apparmor     Pod       spec.containers{hello}   Normal    Created     {kubelet e2e-test-stclair-node-pool-31nt}   Created container with docker id 269a53b202d3; Security:[seccomp=unconfined apparmor=k8s-apparmor-example-deny-write] ``` <!-- You can also verify directly that the container's root process is running with the correct profile by checking its proc attr: --> 您还可以通过检查容器的 proc attr，直接验证容器的根进程是否以正确的配置文件运行： ```shell kubectl exec <pod_name> cat /proc/1/attr/current ``` ``` k8s-apparmor-example-deny-write (enforce) ``` <!-- ## Example --> ## 举例 <!-- *This example assumes you have already set up a cluster with AppArmor support.* --> *本例假设您已经使用 AppArmor 支持设置了一个集群。* <!-- First, we need to load the profile we want to use onto our nodes. This profile denies all file writes: --> 首先，我们需要将要使用的配置文件加载到节点上。配置文件拒绝所有文件写入： ```shell #include <tunables/global> profile k8s-apparmor-example-deny-write flags=(attach_disconnected) { #include <abstractions/base> file, # Deny all file writes. deny /** w, } ``` <!-- Since we don't know where the Pod will be scheduled, we'll need to load the profile on all our nodes. For this example we'll use SSH to install the profiles, but other approaches are discussed in [Setting up nodes with profiles](#setting-up-nodes-with-profiles). --> 由于我们不知道 Pod 将被调度到哪里，我们需要在所有节点上加载配置文件。 在本例中，我们将使用 SSH 来安装概要文件，但是在[使用配置文件设置节点](#setting-up-nodes-with-profiles) 中讨论了其他方法。 ```shell NODES=( # The SSH-accessible domain names of your nodes gke-test-default-pool-239f5d02-gyn2.us-central1-a.my-k8s gke-test-default-pool-239f5d02-x1kf.us-central1-a.my-k8s gke-test-default-pool-239f5d02-xwux.us-central1-a.my-k8s) for NODE in ${NODES[*]}; do ssh $NODE 'sudo apparmor_parser -q <<EOF #include <tunables/global> profile k8s-apparmor-example-deny-write flags=(attach_disconnected) { #include <abstractions/base> file, # Deny all file writes. deny /** w, } EOF' done ``` <!-- Next, we'll run a simple "Hello AppArmor" pod with the deny-write profile: --> 接下来，我们将运行一个带有拒绝写入配置文件的简单 "Hello AppArmor" pod： {{< codenew file="pods/security/hello-apparmor.yaml" >}} ```shell kubectl create -f ./hello-apparmor.yaml ``` <!-- If we look at the pod events, we can see that the Pod container was created with the AppArmor profile "k8s-apparmor-example-deny-write": --> 如果我们查看 pod 事件，我们可以看到 pod 容器是用 AppArmor 配置文件 "k8s-apparmor-example-deny-write" 所创建的： ```shell kubectl get events | grep hello-apparmor ``` ``` 14s        14s         1         hello-apparmor   Pod                                Normal    Scheduled   {default-scheduler }                           Successfully assigned hello-apparmor to gke-test-default-pool-239f5d02-gyn2 14s        14s         1         hello-apparmor   Pod       spec.containers{hello}   Normal    Pulling     {kubelet gke-test-default-pool-239f5d02-gyn2}   pulling image "busybox" 13s        13s         1         hello-apparmor   Pod       spec.containers{hello}   Normal    Pulled      {kubelet gke-test-default-pool-239f5d02-gyn2}   Successfully pulled image "busybox" 13s        13s         1         hello-apparmor   Pod       spec.containers{hello}   Normal    Created     {kubelet gke-test-default-pool-239f5d02-gyn2}   Created container with docker id 06b6cd1c0989; Security:[seccomp=unconfined apparmor=k8s-apparmor-example-deny-write] 13s        13s         1         hello-apparmor   Pod       spec.containers{hello}   Normal    Started     {kubelet gke-test-default-pool-239f5d02-gyn2}   Started container with docker id 06b6cd1c0989 ``` <!-- We can verify that the container is actually running with that profile by checking its proc attr: --> 我们可以通过检查该配置文件的 proc attr 来验证容器是否实际使用该配置文件运行： ```shell kubectl exec hello-apparmor -- cat /proc/1/attr/current ``` ``` k8s-apparmor-example-deny-write (enforce) ``` <!-- Finally, we can see what happens if we try to violate the profile by writing to a file: --> 最后，我们可以看到如果试图通过写入文件来违反配置文件，会发生什么情况： ```shell kubectl exec hello-apparmor -- touch /tmp/test ``` ``` touch: /tmp/test: Permission denied error: error executing remote command: command terminated with non-zero exit code: Error executing in Docker Container: 1 ``` <!-- To wrap up, let's look at what happens if we try to specify a profile that hasn't been loaded: --> 最后，让我们看看如果我们试图指定一个尚未加载的配置文件会发生什么： ```shell kubectl create -f /dev/stdin <<EOF ``` ```yaml apiVersion: v1 kind: Pod metadata: name: hello-apparmor-2 annotations: container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-allow-write spec: containers: - name: hello image: busybox command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ] EOF pod/hello-apparmor-2 created ``` ```shell kubectl describe pod hello-apparmor-2 ``` ``` Name:          hello-apparmor-2 Namespace:     default Node:          gke-test-default-pool-239f5d02-x1kf/ Start Time:    Tue, 30 Aug 2016 17:58:56 -0700 Labels:        <none> Annotations:   container.apparmor.security.beta.kubernetes.io/hello=localhost/k8s-apparmor-example-allow-write Status:        Pending Reason:        AppArmor Message:       Pod Cannot enforce AppArmor: profile "k8s-apparmor-example-allow-write" is not loaded IP: Controllers:   <none> Containers: hello: Container ID: Image:     busybox Image ID: Port: Command: sh -c echo 'Hello AppArmor!' && sleep 1h State:              Waiting Reason:           Blocked Ready:              False Restart Count:      0 Environment:        <none> Mounts: /var/run/secrets/kubernetes.io/serviceaccount from default-token-dnz7v (ro) Conditions: Type          Status Initialized   True Ready         False PodScheduled  True Volumes: default-token-dnz7v: Type:    Secret (a volume populated by a Secret) SecretName:    default-token-dnz7v Optional:   false QoS Class:      BestEffort Node-Selectors: <none> Tolerations:    <none> Events: FirstSeen    LastSeen    Count    From                        SubobjectPath    Type        Reason        Message ---------    --------    -----    ----                        -------------    --------    ------        ------- 23s          23s         1        {default-scheduler }                         Normal      Scheduled     Successfully assigned hello-apparmor-2 to e2e-test-stclair-node-pool-t1f5 23s          23s         1        {kubelet e2e-test-stclair-node-pool-t1f5}             Warning        AppArmor    Cannot enforce AppArmor: profile "k8s-apparmor-example-allow-write" is not loaded ``` <!-- Note the pod status is Pending, with a helpful error message: `Pod Cannot enforce AppArmor: profile "k8s-apparmor-example-allow-write" is not loaded`. An event was also recorded with the same message. --> 注意 pod 呈现 Pending 状态，并且显示一条有用的错误信息：`Pod Cannot enforce AppArmor: profile "k8s-apparmor-example-allow-write" 未加载`。还用相同的消息记录了一个事件。 <!-- ## Administration --> ## 管理 <!-- ### Setting up nodes with profiles --> ### 使用配置文件设置节点 <!-- Kubernetes does not currently provide any native mechanisms for loading AppArmor profiles onto nodes. There are lots of ways to setup the profiles though, such as: --> Kubernetes 目前不提供任何本地机制来将 AppArmor 配置文件加载到节点上。有很多方法可以设置配置文件，例如： <!-- * Through a [DaemonSet](/docs/concepts/workloads/controllers/daemonset/) that runs a Pod on each node to ensure the correct profiles are loaded. An example implementation can be found [here](https://git.k8s.io/kubernetes/test/images/apparmor-loader). * At node initialization time, using your node initialization scripts (e.g. Salt, Ansible, etc.) or image. * By copying the profiles to each node and loading them through SSH, as demonstrated in the [Example](#example). --> * 通过在每个节点上运行 Pod 的[DaemonSet](/zh/docs/concepts/workloads/controllers/daemonset/)确保加载了正确的配置文件。可以找到一个示例实现[这里](https://git.k8s.io/kubernetes/test/images/apparmor-loader)。 * 在节点初始化时，使用节点初始化脚本(例如 Salt 、Ansible 等)或镜像。 * 通过将配置文件复制到每个节点并通过 SSH 加载它们，如[示例](#example)。 <!-- The scheduler is not aware of which profiles are loaded onto which node, so the full set of profiles must be loaded onto every node.  An alternative approach is to add a node label for each profile (or class of profiles) on the node, and use a [node selector](/docs/concepts/configuration/assign-pod-node/) to ensure the Pod is run on a node with the required profile. --> 调度程序不知道哪些配置文件加载到哪个节点上，因此必须将全套配置文件加载到每个节点上。另一种方法是为节点上的每个配置文件(或配置文件类)添加节点标签，并使用[节点选择器](/zh/docs/concepts/configuration/assign pod node/)确保 Pod 在具有所需配置文件的节点上运行。 <!-- ### Restricting profiles with the PodSecurityPolicy --> ### 使用 PodSecurityPolicy 限制配置文件 {{< note >}} <!-- PodSecurityPolicy is deprecated in Kubernetes v1.21, and will be removed in v1.25. See [PodSecurityPolicy documentation](/docs/concepts/policy/pod-security-policy/) for more information. --> PodSecurityPolicy 在 Kubernetes v1.21 版本中已被废弃，将在 v1.25 版本移除。 查看 [PodSecurityPolicy 文档](/zh/docs/concepts/policy/pod-security-policy/)获取更多信息。 {{< /note >}} <!-- If the PodSecurityPolicy extension is enabled, cluster-wide AppArmor restrictions can be applied. To enable the PodSecurityPolicy, the following flag must be set on the `apiserver`: --> 如果启用了 PodSecurityPolicy 扩展，则可以应用群集范围的 AppArmor 限制。要启用 PodSecurityPolicy，必须在“apiserver”上设置以下标志： ``` --enable-admission-plugins=PodSecurityPolicy[,others...] ``` <!-- The AppArmor options can be specified as annotations on the PodSecurityPolicy: --> AppArmor 选项可以指定为 PodSecurityPolicy 上的注释： ```yaml apparmor.security.beta.kubernetes.io/defaultProfileName: <profile_ref> apparmor.security.beta.kubernetes.io/allowedProfileNames: <profile_ref>[,others...] ``` <!-- The default profile name option specifies the profile to apply to containers by default when none is specified. The allowed profile names option specifies a list of profiles that Pod containers are allowed to be run with. If both options are provided, the default must be allowed. The profiles are specified in the same format as on containers. See the [API Reference](#api-reference) for the full specification. --> 默认配置文件名选项指定默认情况下在未指定任何配置文件时应用于容器的配置文件。节点允许配置文件名选项指定允许 Pod 容器运行时的配置文件列表。配置文件的指定格式与容器上的相同。完整规范见[API 参考](#api-reference)。 <!-- ### Disabling AppArmor --> ### 禁用 AppArmor <!-- If you do not want AppArmor to be available on your cluster, it can be disabled by a command-line flag: --> 如果您不希望 AppArmor 在集群上可用，可以通过命令行标志禁用它： ``` --feature-gates=AppArmor=false ``` <!-- When disabled, any Pod that includes an AppArmor profile will fail validation with a "Forbidden" error. Note that by default docker always enables the "docker-default" profile on non-privileged pods (if the AppArmor kernel module is enabled), and will continue to do so even if the feature-gate is disabled. The option to disable AppArmor will be removed when AppArmor graduates to general availability (GA). --> 禁用时，任何包含 AppArmor 配置文件的 Pod 都将因 "Forbidden" 错误而导致验证失败。注意，默认情况下，docker 总是在非特权 pods 上启用 "docker-default" 配置文件(如果 AppArmor 内核模块已启用)，并且即使功能门已禁用，也将继续启用该配置文件。当 AppArmor 应用于通用(GA)时，禁用 Apparmor 的选项将被删除。 <!-- ### Upgrading to Kubernetes v1.4 with AppArmor --> ### 使用 AppArmor 升级到 Kubernetes v1.4 <!-- No action is required with respect to AppArmor to upgrade your cluster to v1.4. However, if any existing pods had an AppArmor annotation, they will not go through validation (or PodSecurityPolicy admission). If permissive profiles are loaded on the nodes, a malicious user could pre-apply a permissive profile to escalate the pod privileges above the docker-default. If this is a concern, it is recommended to scrub the cluster of any pods containing an annotation with `apparmor.security.beta.kubernetes.io`. --> 不需要对 AppArmor 执行任何操作即可将集群升级到 v1.4。但是，如果任何现有的 pods 有一个 AppArmor 注释，它们将不会通过验证(或 PodSecurityPolicy 认证)。如果节点上加载了许可配置文件，恶意用户可以预先应用许可配置文件，将 pod 权限提升到 docker-default 权限之上。如果存在这个问题，建议清除包含 `apparmor.security.beta.kubernetes.io` 注释的任何 pods 的集群。 <!-- ### Upgrade path to General Availability --> ### 升级到一般可用性的途径 <!-- When AppArmor is ready to be graduated to general availability (GA), the options currently specified through annotations will be converted to fields. Supporting all the upgrade and downgrade paths through the transition is very nuanced, and will be explained in detail when the transition occurs. We will commit to supporting both fields and annotations for at least 2 releases, and will explicitly reject the annotations for at least 2 releases after that. --> 当 Apparmor 准备升级到通用(GA)时，当前指定的选项通过注释将转换为字段。通过转换支持所有升级和降级路径是非常微妙的，并将在转换发生时详细解释。我们将承诺在至少两个版本中同时支持字段和注释，并在之后的至少两个版本中显式拒绝注释。 <!-- ## Authoring Profiles --> ## 编写配置文件 <!-- Getting AppArmor profiles specified correctly can be a tricky business. Fortunately there are some tools to help with that: --> 获得正确指定的 AppArmor 配置文件可能是一件棘手的事情。幸运的是，有一些工具可以帮助您做到这一点： <!-- * `aa-genprof` and `aa-logprof` generate profile rules by monitoring an application's activity and logs, and admitting the actions it takes. Further instructions are provided by the [AppArmor documentation](https://gitlab.com/apparmor/apparmor/wikis/Profiling_with_tools). * [bane](https://github.com/jfrazelle/bane) is an AppArmor profile generator for Docker that uses a simplified profile language. --> * `aa-genprof` and `aa-logprof` 通过监视应用程序的活动和日志并承认它所采取的操作来生成配置文件规则。更多说明由[AppArmor 文档](https://gitlab.com/apparmor/apparmor/wikis/Profiling_with_tools)提供。 * [bane](https://github.com/jfrazelle/bane)是一个用于 Docker的 AppArmor 档案生成器，它使用简化的档案语言。 <!-- It is recommended to run your application through Docker on a development workstation to generate the profiles, but there is nothing preventing running the tools on the Kubernetes node where your Pod is running. --> 建议在开发工作站上通过 Docker 运行应用程序以生成配置文件，但是没有什么可以阻止在运行 Pod 的 Kubernetes 节点上运行工具。 <!-- To debug problems with AppArmor, you can check the system logs to see what, specifically, was denied. AppArmor logs verbose messages to `dmesg`, and errors can usually be found in the system logs or through `journalctl`. More information is provided in [AppArmor failures](https://gitlab.com/apparmor/apparmor/wikis/AppArmor_Failures). --> 想要调试 AppArmor 的问题，您可以检查系统日志，查看具体拒绝了什么。AppArmor 将详细消息记录到 `dmesg` ，错误通常可以在系统日志中或通过 `journalctl` 找到。更多详细信息见[AppArmor 失败](https://gitlab.com/apparmor/apparmor/wikis/AppArmor_Failures)。 <!-- ## API Reference --> ## API 参考 <!-- ### Pod Annotation --> ### Pod 注释 <!-- Specifying the profile a container will run with: --> 指定容器将使用的配置文件： <!-- - **key**: `container.apparmor.security.beta.kubernetes.io/<container_name>` Where `<container_name>` matches the name of a container in the Pod. A separate profile can be specified for each container in the Pod. - **value**: a profile reference, described below --> - **key**: `container.apparmor.security.beta.kubernetes.io/<container_name>` 中的 `<container_name>` 匹配 Pod 中的容器名称。 可以为 Pod 中的每个容器指定单独的配置文件。 - **value**: 配置文件参考，如下所述 <!-- ### Profile Reference --> ### 配置文件参考 <!-- - `runtime/default`: Refers to the default runtime profile. - Equivalent to not specifying a profile (without a PodSecurityPolicy default), except it still requires AppArmor to be enabled. - For Docker, this resolves to the [`docker-default`](https://docs.docker.com/engine/security/apparmor/) profile for non-privileged containers, and unconfined (no profile) for privileged containers. - `localhost/<profile_name>`: Refers to a profile loaded on the node (localhost) by name. - The possible profile names are detailed in the [core policy reference](https://gitlab.com/apparmor/apparmor/wikis/AppArmor_Core_Policy_Reference#profile-names-and-attachment-specifications). - `unconfined`: This effectively disables AppArmor on the container. --> - `runtime/default`: 指默认运行时配置文件。 - 等同于不指定配置文件(没有 PodSecurityPolicy 默认值)，除非它仍然需要启用 AppArmor。 - 对于 Docker，这将解析为非特权容器的[`Docker default`](https://docs.docker.com/engine/security/apparmor/)配置文件，特权容器的配置文件为未定义(无配置文件)。 - `localhost/<profile_name>`: 指按名称加载到节点(localhost)上的配置文件。 - 可能的配置文件名在 [核心策略参考](https://gitlab.com/apparmor/apparmor/wikis/AppArmor_Core_Policy_Reference#profile-names-and-attachment-specifications)。 - `unconfined`: 这有效地禁用了容器上的 AppArmor 。 <!-- Any other profile reference format is invalid. --> 任何其他配置文件引用格式无效。 <!-- ### PodSecurityPolicy Annotations --> ### PodSecurityPolicy 注解 <!-- Specifying the default profile to apply to containers when none is provided: --> 指定在未提供容器时应用于容器的默认配置文件： <!-- * **key**: `apparmor.security.beta.kubernetes.io/defaultProfileName` * **value**: a profile reference, described above --> * **key**: `apparmor.security.beta.kubernetes.io/defaultProfileName` * **value**: 如上述文件参考所述 <!-- Specifying the list of profiles Pod containers is allowed to specify: --> 上面描述的指定配置文件， Pod 容器列表的配置文件引用允许指定： <!-- * **key**: `apparmor.security.beta.kubernetes.io/allowedProfileNames` * **value**: a comma-separated list of profile references (described above) - Although an escaped comma is a legal character in a profile name, it cannot be explicitly allowed here. --> * **key**: `apparmor.security.beta.kubernetes.io/allowedProfileNames` * **value**: 配置文件引用的逗号分隔列表(如上所述) - 尽管转义逗号是配置文件名中的合法字符，但此处不能显式允许。 ## {{% heading "whatsnext" %}} <!-- Additional resources: --> 其他资源 <!-- * [Quick guide to the AppArmor profile language](https://gitlab.com/apparmor/apparmor/wikis/QuickProfileLanguage) * [AppArmor core policy reference](https://gitlab.com/apparmor/apparmor/wikis/Policy_Layout) --> * [Apparmor 配置文件语言快速指南](https://gitlab.com/apparmor/apparmor/wikis/QuickProfileLanguage) * [Apparmor 核心策略参考](https://gitlab.com/apparmor/apparmor/wikis/Policy_Layout) </del>

/language zh
/triage accepted
Please notice that: Moved in EN: ZH version exists: Suggestion: Move to Resync, if needed. This might reduce someone's effort to translate the document from scratch!
/assign


Question: ## Clean up <del> Run `kind delete cluster --name psa-with-cluster-pss` and `kind delete cluster --name psa-wo-cluster-pss` to delete the clusters you created. </del> <ins> Now delete the clusters which you created above by running the following command: ```shell kind delete cluster --name psa-with-cluster-pss ``` ```shell kind delete cluster --name psa-wo-cluster-pss ``` </ins> ## {{% heading "whatsnext" %}}

This is a Feature Request What would you like to be Add the commands which are under the Clean up section of the and tutorials into the shell code block snippet. Currently, it is under the triple backticks () as shown in the following screenshot: ! ! Which is not look more prominent. Why is this needed It provides a better structure to the section. and then it will be highlighted on the page. Comments None
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig docs /language en
/assign
Fixed it here:
I'm not sure I agree with the issue description. I was nevertheless happy to merge the actual PR.
thank you, I opened this for the content so that commands under Cleanup should more clear like others command mentioned on the page.


Question: ```yaml apiVersion: rbac.authorization.k8s.io/v1 <del> # 此角色绑定使得用户 "dave" 能够读取 "default" 名字空间中的 Secrets </del> <ins> # 此角色绑定使得用户 "dave" 能够读取 "development" 名字空间中的 Secrets </ins> # 你需要一个名为 "secret-reader" 的 ClusterRole kind: RoleBinding metadata: name: read-secrets # RoleBinding 的名字空间决定了访问权限的授予范围。 <del> # 这里仅授权在 "development" 名字空间内的访问权限。 </del> <ins> # 这里隐含授权仅在 "development" 名字空间内的访问权限。 </ins> namespace: development subjects: - kind: User

! ! There is a problem with the Chinese version translated here, it should be in the "development" namespace.
/triage accepted /kind bug /assign
/language zh


Question:
-->

Kubernetes 与合作伙伴携手打造一个强大、活跃的代码库，支持一系列互补平台。

Kubernetes 认证服务提供商

  Kubernetes 认证服务提供商

经过审核的服务提供商在帮助企业成功采用 Kubernetes 方面有深厚的经验。

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Missing partners in You can see to find the different. Proposed Solution: Update Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
/language zh /assign
The label(s) cannot be applied, because the repository doesn't have them <detailsIn response to : /language zh /assign Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign


Question: アクセスモードは次の通りです。 <del> * ReadWriteOnce –ボリュームは単一のNodeで読み取り/書き込みとしてマウントできます * ReadOnlyMany –ボリュームは多数のNodeで読み取り専用としてマウントできます * ReadWriteMany –ボリュームは多数のNodeで読み取り/書き込みとしてマウントできます </del> <ins> `ReadWriteOnce` : ボリュームは単一のNodeで読み取り/書き込みとしてマウントできます `ReadOnlyMany` : ボリュームは多数のNodeで読み取り専用としてマウントできます `ReadWriteMany` : ボリュームは多数のNodeで読み取り/書き込みとしてマウントできます `ReadWriteOncePod` : ボリュームは、単一のPodで読み取り/書き込みとしてマウントできます。クラスタ全体で1つのPodのみがそのPVCの読み取りまたは書き込みを行えるようにする場合は、ReadWriteOncePodアクセスモードを使用します。これは、CSIボリュームとKubernetesバージョン1.22以降でのみサポートされます。 これについてはブログ[Introducing Single Pod Access Mode for PersistentVolumes](/blog/2021/09/13/read-write-once-pod-access-mode-alpha/)に詳細が記載されています。 </ins> CLIではアクセスモードは次のように略されます。

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Apply the change which was by to Japanese website. Why is this needed The change which was by is not applied to Japanese page yet. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/language ja /assign
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: # kubeadm-config.yaml kind: ClusterConfiguration apiVersion: kubeadm.k8s.io/v1beta2 <del> kubernetesVersion: v1.21 </del> <ins> kubernetesVersion: v1.21.0 </ins> --- kind: KubeletConfiguration apiVersion: kubelet.config.k8s.io/v1beta1

I'm at this page : If I follow the guide with the default configuration it will failed. The config from the webapge but if I remove the line : kubernetesVersion: v1.21 it will works. `
you should use the semver format is being followed by kubeadm and k8s. /kind support /close /sig cluster-lifecycle
Closing this issue. <detailsIn response to : kubernetesVersion: v1.21 /close /sig cluster-lifecycle </details
/reopen /remove-kind support actually...i see that you are reporting this as a problem on the page. we should change -there. /help
Reopened this issue. <detailsIn response to : /reopen /remove-kind support </details
you closed it too fast :) thanks to reopen it. I'll continue to filled issues each time a found a problem (second issue found in two days.. Happy to help the community)
sure, thanks for finding these. /triage accepted
PR is here /remove-help /lifecycle active


Question: of cluster (node) autoscaling may cause voluntary disruptions to defragment and compact nodes. Your cluster administrator or hosting provider should have documented what level of voluntary disruptions, if any, to expect. Certain configuration options, such as <del> [using PriorityClasses](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/) </del> <ins> [using PriorityClasses](/docs/concepts/configuration/pod-priority-preemption/) </ins> in your pod spec can also cause voluntary (and involuntary) disruptions.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The href of contains unwanted . A slash () is missing in the href of . Proposed Solution: Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/language en /assign
/triage accepted


Question: {{< note >}} {{< feature-state state="deprecated" for_k8s_version="v1.11" >}} <del> This internal provisioner of OpenStack is deprecated. Please use [the external cloud provider for OpenStack](https://github.com/kubernetes/cloud-provider-openstack). </del> <ins> This internal provisioner of OpenStack is deprecated. Please use [the external cloud provider for OpenStack](https://github.com/kubernetes/cloud-provider-openstack). </ins> {{< /note >}} ### vSphere

There's a section for ReclaimPolicy, which states that this can be or . It is not clear as to what those states mean, there's NO explanation. I was researching how to expand disk, and one guide says that the must be , but I cannot find reference as to what this means. My expectation was that these would be explained what they mean, rather than this is the only do option.
Page related to issue: /retitle Lack of explanation for options - Retain and Delete /language en
These concepts are well explained in 'concepts/storage/persistent-'. Maybe a pointer or two suffices?
Please refer link here you will find the brief introduction about the retain or delete. I think this link will be helpful to understand.
/assign
/triage accepted


Question: </tbody> </table> </div> <del> </div> </del>  No newline at end of file <ins> </div> {{- end -}} </ins>  No newline at end of file

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Migrate to instead of Hugo's Why is this needed Upstream Hugo has deprecated , which we use. We should aim to migrate to use ; see Comments We may need to upgrade to a newer Hugo as part of this work, or related to it. /area web-development /lifecycle frozen
/triage accepted /priority backlog
Let me see if I can assist with this. Edit: Proposed fix in /assign


Question: For our production clusters, we specify a lower time limit so as to avoid the impacted Pods serving traffic abidingly. The *kube-exec-controller* internally sets and tracks a timer for each Pod that matches the associated TTL. Once the timer is up, the controller evicts that Pod using K8s API. The eviction (rather than deletion) is to ensure service availability, since the cluster respects any configured [PodDisruptionBudget](/docs/concepts/workloads/pods/disruptions/) (PDB). Let's say if a user has defined *x* number of Pods as critical in their PDB, the eviction (as requested by *kube-exec-controller*) does not continue when the target workload has fewer than *x* Pods running. <del> Here comes a sequence diagram of the entire workflow mentioned above: {{< figure src="workflow-diagram.svg" alt="Workflow Diagram" class="diagram-medium" >}} </del> <ins> Here comes a sequence diagram of the entire workflow mentioned above: <!-- Mermaid Live Editor link - https://mermaid-js.github.io/mermaid-live-editor/edit/#pako:eNp9kjFPAzEMhf-KlalIbWd0QpUQdGJB3JrFTUyJmjhHzncFof53nGtpqYTYEuu958-Wv4zLnkxjenofiB09BtwWTJbRSS6QCLCHu01ZPdJIMXdUYNZTGYOjRd4zlRvLHRYJLnTIArvbtozV83TbAnZhUcVUrkXo04OU2I6uKu99Cn0fMsNDZik5Rm3SHntYTrRYrabUBl4GBmt2w4acRKAPcrBcLq0Bl1NC9pYnoRouHZopX9RX9aotddJeADaf4DDGwFuQN4IRY_Ao9bunzVvOO13COeYCcR9j3k-OCQDP9KfgC8TJsFbZIHSxnGljzp1lgKs2v9HXugMBwe2WPHTZ94CvottB6Ap5eg2s9cBaUnrLVEP_Yp5ynrOf3fxPV2V1lBOhmZtEJWHweiFfldQa1SWyptGnAuAQxRrLB5UOna6P1j7o4ZhGykBzg4Pk9pPdz_-oOR3ZsXj4BjrP5rU--> ![Sequence Diagram](/images/sequence_diagram.svg) </ins> ## A new kubectl plugin for better user experience Our admission controller component works great for solving the container drift issue we had on the platform. It is also able to submit all related Events to the target Pod that has been affected. However, K8s clusters don't retain Events very long (the default retention period is one hour). We need to provide other ways for developers to get their Pod interaction activity. A [kubectl plugin](/docs/tasks/extend-kubectl/kubectl-plugins/) is a perfect choice for us to expose this information. We named our plugin `kubectl pi` (short for `pod-interaction`) and provide two subcommands: `get` and `extend`.

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Update to use the same diagram, but drawn using Mermaid. See for a guide to using Mermaid for diagrams. Why is this needed We'd like to use a consistent approach for diagrams. The existing diagram doesn't scale so well with different viewports. Note We should not change any of the meaning of the diagram. If there is any factual error in the diagram, open a separate issue about correcting that (we'll want to check in with the article authors too). Comments /area blog /kind cleanup This would be a fixup for PR
I can work on it
/help Help wanted - and someone has already stepped forward. /triage accepted
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /help /triage accepted Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: --- Allow setting the `restartPolicy` of an init container to `Always` so that the container becomes a sidecar container (restartable init containers). <del> See [Sidecar containers and restartPolicy](/docs/concepts/workloads/pods/init-containers/#sidecar-containers-and-restartpolicy) </del> <ins> See [Sidecar containers and restartPolicy](/docs/concepts/workloads/pods/sidecar-containers/) for more details. </ins>

This is a Bug Report Problem: text is no longer needed as sidecar containers are now entered into beta state and they are enable by default. reference link of sidecar containers present in page is wrongly redirecting to page. Proposed Solution: the text below from sidecar containers documentation. reference link present in page from page to page. Page to Update:
/sig docs /language en
/assign
Beta APIs are off by default with
is not a beta API though /triage accepted


Question: {{< /comment >}} [NAT](https://en.wikipedia.org/wiki/Network_address_translation) <del> : network address translation </del> <ins> : Network address translation </ins> [Source NAT](https://en.wikipedia.org/wiki/Network_address_translation#SNAT) <del> : replacing the source IP on a packet; in this page, that usually means replacing with the IP address of a node. </del> <ins> : Replacing the source IP on a packet; in this page, that usually means replacing with the IP address of a node. </ins> [Destination NAT](https://en.wikipedia.org/wiki/Network_address_translation#DNAT) <del> : replacing the destination IP on a packet; in this page, that usually means replacing with the IP address of a {{< glossary_tooltip term_id="pod" >}} </del> <ins> : Replacing the destination IP on a packet; in this page, that usually means replacing with the IP address of a {{< glossary_tooltip term_id="pod" >}} </ins> [VIP](/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies) <del> : a virtual IP address, such as the one assigned to every {{< glossary_tooltip text="Service" term_id="service" >}} in Kubernetes </del> <ins> : A virtual IP address, such as the one assigned to every {{< glossary_tooltip text="Service" term_id="service" >}} in Kubernetes </ins> [kube-proxy](/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies) <del> : a network daemon that orchestrates Service VIP management on every node </del> <ins> : A network daemon that orchestrates Service VIP management on every node </ins> ### Prerequisites

Issue: Sentences under a subsection starts with small letters. Visit this link to see the issue: <img width="645" alt="Screenshot 2023-11-22 " src=""
/language en /sig docs
Yes i do agree that the sentence must be Capitalise and if the abbrevation of any word is address it should also be Capitalize in proper format. So that it look good to the reader.
/assign
/triage accepted


Question: page for more on how to report vulnerabilities. <ins> ## What's next - [Security Checklist](/docs/concepts/security/security-checklist/) for additional information on Kubernetes security guidance. </ins>

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --We have two pages with similar aims: We should ensure that the advice in the two documents is aligned, and also make sure that the two documents link to each other. Why is this needed It's a bad idea to document multiple ways to make sure that your cluster is secure, unless those are well aligned. Comments /sig security /sig docs /language en
Relevant to
Regarding this: We can use a reference section/note/what's next section in the end of stating: -
/triage accepted
Hey I would like to work on this.
/assign


Question: 应用可以在 Kubernetes 集群中安装一次或多次。在某些情况下，可以安装在同一命名空间中。例如，可以不止一次地为不同的站点安装不同的 WordPress。 <del> 应用的名称和实例的名称是分别记录的。例如，某 WordPress 实例的 `app.kubernetes.io/name` 为 `wordpress`，而其实例名称表现为 `app.kubernetes.io/instance` 的属性值 `wordpress-abcxzy`。这使应用程序和应用程序的实例成为可能是可识别的。应用程序的每个实例都必须具有唯一的名称。 </del> <ins> 应用的名称和实例的名称是分别记录的。例如，WordPress 应用的 `app.kubernetes.io/name` 为 `wordpress`，而其实例名称 `app.kubernetes.io/instance` 为 `wordpress-abcxzy`。 这使得应用和应用的实例均可被识别，应用的每个实例都必须具有唯一的名称。 </ins> <!-- ## Examples

WordPress wordpress wordpress-abcxzy
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/language zh
/assign


Question: ### Jobs history limits <del> The `.spec.successfulJobsHistoryLimit` and `.spec.failedJobsHistoryLimit` fields are optional. These fields specify how many completed and failed Jobs should be kept. By default, they are set to 3 and 1 respectively.  Setting a limit to `0` corresponds to keeping none of the corresponding kind of Jobs after they finish. </del> <ins> The `.spec.successfulJobsHistoryLimit` and `.spec.failedJobsHistoryLimit` fields specify how many completed and failed Jobs should be kept. Both fields are optional. </ins> <del> For another way to clean up Jobs automatically, see [Clean up finished Jobs automatically](/docs/concepts/workloads/controllers/job/#clean-up-finished-jobs-automatically). </del> <ins> * `.spec.successfulJobsHistoryLimit`: This field specifies the number of successful finished jobs to keep. The default value is `3`. Setting this field to `0` will not keep any successful jobs. * `.spec.failedJobsHistoryLimit`: This field specifies the number of failed finished jobs to keep. The default value is `1`. Setting this field to `0` will not keep any failed jobs. For another way to clean up Jobs automatically, see [Clean up finished Jobs automatically](/docs/concepts/workloads/controllers/job/#clean-up-finished-jobs-automatically). </ins> ### Time zones

Does not describe the fields and , please add a list of all fields the spec can have, preferable with examples of use and format.
/triage accepted /kind feature
/retitle Mention and in CronJob concept page does link to which includes an explanation of these fields. /priority backlog /sig apps
/language en
Hmm, does not make sense to have these fields described by having to follow global doc link at the footer of the document. The exhaustive list of fields should be shown in the main page and for more information clearly linked to a detail page if needed. For starting users this is not clear and I can imagine for somebody not in the known you can only find this through the StackOverflow route. It also now fails to explain the possibilities of the definition as a person not aware of these fields is not informed of them as they would not know to look for them. Not a great Documentation Experience this way.
This issue is ready for a volunteer to work on it. Would anyone like to help out?
Let's add that This issue is now not about listing all the fields; for that, we already have (and that's why I changed the title of the issue)
There is a brief description of those fields in the document: are you asking for additional details? There isn't a lot more to say about them other than maybe rephrase it so it is more clear?
Rephrasing the page to be more clear would be a welcome improvement. Since this was filed, we've changed the page to link to the API reference from the right hand nav. We also have a long standing issue for , so work on this issue does not need to add a fact sheet. A brief tidy-up of the job history limit explanation would be fine to close this issue. if you're happy with the wording as-is, you are welcome to close the issue already.
/assign
Thanks see if you like the wording in the PR


Question: and its [resource requirements](/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources) * Read about [project quotas](https://xfs.org/index.php/XFS_FAQ#Q:_Quota:_Do_quotas_work_on_XFS.3F) in XFS * Read more about the [kube-scheduler configuration reference (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) <del> * Read more about [Quality of Service classes for Pods](/docs/concepts/workloads/pods/pod-quality/) </del> <ins> * Read more about [Quality of Service classes for Pods](/docs/concepts/workloads/pods/pod-qos/) </ins>

This is a Bug Report Problem: The Hyperlink for under of and Containers gives Error. ! Proposed Solution: It should be redirected to Instead of Page to Update:
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig docs /language en
/assign
Fixed it here:


Question: The [kubelet](/docs/reference/command-line-tools-reference/kubelet/) collects pod and container metrics via [cAdvisor](https://github.com/google/cadvisor). As an alpha feature, Kubernetes lets you configure the collection of pod and container <del> metrics via the {{< glossary_tooltip term_id="cri" text="Container Runtime Interface">}} (CRI). You </del> <ins> metrics via the {{< glossary_tooltip term_id="container-runtime-interface" text="Container Runtime Interface">}} (CRI). You </ins> must enable the `PodAndContainerStatsFromCRI` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) and use a compatible CRI implementation (containerd >= 1.6.0, CRI-O >= 1.23.0) to use the CRI based collection mechanism.

This is a Bug Report There is a wrong reference to the Container runtime interface in page. It take to container runtime instead of CRI. Should be updated with correct reference to CRI page.
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig docs
/language en
/assign
fixed it


Question: ```powershell stop-service kube-proxy <del> curl.exe -Lo <kube-proxy.exe 路径> "https://dl.k8s.io/{{< skew currentPatchVersion >}}/bin/windows/amd64/kube-proxy.exe" </del> <ins> curl.exe -Lo <kube-proxy.exe 路径> "https://dl.k8s.io/v{{< skew currentPatchVersion >}}/bin/windows/amd64/kube-proxy.exe" </ins> restart-service kube-proxy ```

<!--Required Information--Problem: We've deprecated the param () and now English documents are using instead. (by ) All the other documents need to change into or appropriatly. Since several languages are involved, I'd like to share this issue to check all localizations complete the task. Proposed Solution: For each localization team, search and change appropriately. (See the reference, ) Please check the following task box if the localization task is complete. Page to Update: [x] de [x] es [x] fr [x] hi [x] id [x] ja [x] ko [x] pt-br [x] ru [x] vi [ ] zh-ch [previously done]Once all localizations have switched over, we can remove the parameter from the site.
/assign for the Korean contents.
PR: [ko] Replace deprecated fullversion shortcode for Korean :) The task for Korean can be completed after is merged into the main branch.
/assign For Brazilian Portuguese changes
/triage accepted
/assign For Hindi changes
The Brazilian Portuguese localization has replaced all occurrences via /.
/assign for french content
/reopen
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/remove-help
I reopened as there is one more page to fix.
Really done! Thanks folks. /close
Closing this issue. <detailsIn response to : Really done! Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: DaemonSet | 데몬셋(DaemonSet) | API 오브젝트인 경우 Dashboard | 대시보드 | Data Plane | 데이터 플레인 | <del> Default Limit | 기본 상한 | Default Request | 기본 요청량 | </del> Deployment | 디플로이먼트(Deployment) | API 오브젝트인 경우 deprecated | 사용 중단(deprecated) | descriptor | 디스크립터, 식별자 |

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: / . '' '' . English | -- | -- Default Limit | Default Request | max limit/request ratio | / Resource Limit | Proposed Solution: / '' '' , . LimitRange API yaml English -- -- Default Limit Default Request max limit/request ratio Resource Limit limit ResourceQuota, LimitRange request ResourceQuota, LimitRange Page to Update: - <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/language ko
/assign
. before : LimitRange after : ResourceQuota, LimitRange LimitRange ResourceQuota .


Question: <ins> --- title: トポロジーを意識したヒント content_type: concept weight: 45 --- <!-- overview --> {{< feature-state for_k8s_version="v1.23" state="beta" >}} *Topology Aware Hint*は、クライアントがendpointをどのように使用するかについての提案を含めることにより、トポロジーを考慮したルーティングを可能にします。このアプローチでは、EndpointSliceおよび/またはEndpointオブジェクトの消費者が、これらのネットワークエンドポイントへのトラフィックを、それが発生した場所の近くにルーティングできるように、メタデータを追加します。 たとえば、局所的にトラフィックをルーティングすることで、コストを削減したり、ネットワークパフォーマンスを向上させたりできます。 <!-- body --> ## 動機 Kubernetesクラスターは、マルチゾーン環境で展開されることが多くなっています。 *Topology Aware Hint*は、トラフィックを発信元のゾーン内に留めておくのに役立つメカニズムを提供します。このコンセプトは、一般に「Topology Aware Routing」と呼ばれています。EndpointSliceコントローラーは{{< glossary_tooltip term_id="Service" >}}のendpointを計算する際に、各endpointのトポロジー(リージョンとゾーン)を考慮し、ゾーンに割り当てるためのヒントフィールドに値を入力します。 EndpointSliceコントローラーは、各endpointのトポロジー(リージョンとゾーン)を考慮し、ゾーンに割り当てるためのヒントフィールドに入力します。 {{< glossary_tooltip term_id="kube-proxy" text="kube-proxy" >}}のようなクラスターコンポーネントは、次にこれらのヒントを消費し、それらを使用してトラフィックがルーティングされる方法に影響を与えることが可能です(トポロジー的に近いendpointを優先します)。 ## Topology Aware Hintを使う `service.kubernetes.io/topology-aware-hints`アノテーションを`auto`に設定すると、サービスに対してTopology Aware Hintを有効にすることができます。これはEndpointSliceコントローラーが安全と判断した場合に、トポロジーヒントを設定するように指示します。 重要なのは、これはヒントが常に設定されることを保証するものではないことです。 ## 使い方 {#implementation} この機能を有効にする機能は、EndpointSliceコントローラーとkube-proxyの2つのコンポーネントに分かれています。このセクションでは、各コンポーネントがこの機能をどのように実装しているか、高レベルの概要を説明します。 ### EndpointSliceコントローラー {#implementation-control-plane} この機能が有効な場合、EndpointSliceコントローラーはEndpointSliceにヒントを設定する役割を担います。 コントローラーは、各ゾーンに比例した量のendpointを割り当てます。 この割合は、そのゾーンで実行されているノードの[割り当て可能な](/ja/docs/task/administer-cluster/reserve-compute-resources/#node-allocatable)CPUコアを基に決定されます。 たとえば、あるゾーンに2つのCPUコアがあり、別のゾーンに1つのCPUコアしかない場合、コントローラーは2つのCPUコアを持つゾーンに2倍のendpointを割り当てます。 次の例は、ヒントが入力されたときのEndpointSliceの様子を示しています。 ```yaml apiVersion: discovery.k8s.io/v1 kind: EndpointSlice metadata: name: example-hints labels: kubernetes.io/service-name: example-svc addressType: IPv4 ports: - name: http protocol: TCP port: 80 endpoints: - addresses: - "10.1.2.3" conditions: ready: true hostname: pod-1 zone: zone-a hints: forZones: - name: "zone-a" ``` ### kube-proxy {#implementation-kube-proxy} kube-proxyは、EndpointSliceコントローラーによって設定されたヒントに基づいて、ルーティング先のendpointをフィルター処理します。ほとんどの場合、これはkube-proxyが同じゾーン内のendpointにトラフィックをルーティングできることを意味します。コントローラーが別のゾーンからendpointを割り当てて、ゾーン間でendpointがより均等に分散されるようにする場合があります。これにより、一部のトラフィックが他のゾーンにルーティングされます。 ## セーフガード 各ノードのKubernetesコントロールプレーンとkube-proxyは、Topology Aware Hintを使用する前に、いくつかのセーフガードルールを適用します。これらがチェックアウトされない場合、kube-proxyは、ゾーンに関係なく、クラスター内のどこからでもendpointを選択します。 1. **endpointの数が不十分です:** クラスター内のゾーンよりもendpointが少ない場合、コントローラーはヒントを割り当てません。 2. **バランスの取れた割り当てを実現できません:** 場合によっては、ゾーン間でendpointのバランスの取れた割り当てを実現できないことがあります。たとえば、ゾーンaがゾーンbの2倍の大きさであるが、endpointが2つしかない場合、ゾーンaに割り当てられたendpointはゾーンbの2倍のトラフィックを受信する可能性があります。この「予想される過負荷」値が各ゾーンの許容しきい値を下回ることができない場合、コントローラーはヒントを割り当てません。重要なことに、これはリアルタイムのフィードバックに基づいていません。それでも、個々のendpointが過負荷になる可能性があります。 3. **1つ以上のノードの情報が不十分です:** ノードに`topology.kubernetes.io/zone`ラベルがないか、割り当て可能なCPUの値を報告していない場合、コントロールプレーンはtopology-aware endpoint hintsを設定しないため、kube-proxyはendpointをゾーンでフィルタリングしません。 4. **1つ以上のendpointにゾーンヒントが存在しません:** これが発生すると、kube-proxyはTopology Aware Hintから、またはTopology Aware Hintへの移行が進行中であると見なします。この状態のサービスに対してendpointをフィルタリングすることは危険であるため、kube-proxyはすべてのendpointを使用するようにフォールバックします。 5. **ゾーンはヒントで表されません:** kube-proxyが、実行中のゾーンをターゲットとするヒントを持つendpointを1つも見つけることができない場合、すべてのゾーンのendpointを使用することになります。これは既存のクラスターに新しいゾーンを追加するときに発生する可能性が最も高くなります。 ## 制約事項 * Serviceで`externalTrafficPolicy`または`internalTrafficPolicy`が`Local`に設定されている場合、Topology Aware Hintは使用されません。同じServiceではなく、異なるServiceの同じクラスターで両方の機能を使用することができます。 * このアプローチは、ゾーンのサブセットから発信されるトラフィックの割合が高いサービスではうまく機能しません。代わりに、これは着信トラフィックが各ゾーンのノードの容量にほぼ比例することを前提としています。 * EndpointSliceコントローラーは、各ゾーンの比率を計算するときに、準備ができていないノードを無視します。ノードの大部分の準備ができていない場合、これは意図しない結果をもたらす可能性があります。 * EndpointSliceコントローラーは、各ゾーンの比率を計算するデプロイ時に{{< glossary_tooltip text="toleration" term_id="toleration" >}}を考慮しません。サービスをバックアップするPodがクラスター内のノードのサブセットに制限されている場合、これは考慮されません。 * これはオートスケーリングと相性が悪いかもしれません。例えば、多くのトラフィックが1つのゾーンから発信されている場合、そのゾーンに割り当てられたendpointのみがそのトラフィックを処理することになります。その結果、{{< glossary_tooltip text="Horizontal Pod Autoscaler" term_id="horizontal-pod-autoscaler" >}}がこのイベントを拾えなくなったり、新しく追加されたPodが別のゾーンで開始されたりする可能性があります。 ## {{% heading "whatsnext" %}} * [サービスとアプリケーションの接続](/ja/docs/concepts/services-networking/connect-applications-service/)を読む。 </ins>

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Translate into Japanese Why is this needed This page has not been translated. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/language ja /assign
/triage accepted


Question: flag in the `docker run` command. - The `spec.containers[].resources.limits.cpu` is converted to its millicore value and <del> multiplied by 100. The resulting value is the total amount of CPU time that a container can use every 100ms. A container cannot use more than its share of CPU time during this interval. </del> <ins> multiplied by 100. The resulting value is the total amount of CPU time in microseconds that a container can use every 100ms. A container cannot use more than its share of CPU time during this interval. </ins> {{< note >}} The default quota period is 100ms. The minimum resolution of CPU quota is 1ms.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Reference: The spec.containers[] is converted to its millicore value and multiplied by 100. The resulting value is the total amount of CPU time that a container can use every 100ms. A container cannot use more than its share of CPU time during this interval. Problem: I'm a little confused about the description about 'millicore value'. If the is configured as ‘100m’, how long can it use every 100ms? According to the referenced text, it should be 'its millicore value', that is 100, multiplied by 100 to get a value of 10000ms. This is much longer than 100ms. Page to Update:
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
This is not fixed yet.
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle rotten
Rotten issues close after 30d of inactivity. Reopen the issue with . Mark the issue as fresh with . Send feedback to sig-testing, kubernetes/test-infra and/or . /close
Closing this issue. <detailsIn response to : Rotten issues close after 30d of inactivity. Reopen the issue with . Mark the issue as fresh with . /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/reopen
You can't reopen an issue/PR unless you authored it or you are a collaborator. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: /docs/setup/learning-environment/     /docs/tasks/tools/  302! /id/docs/setup/learning-environment/     /id/docs/tasks/tools/  302! /zh-cn/docs/setup/learning-environment/     /zh-cn/docs/tasks/tools/  302! <ins> /ja/docs/setup/learning-environment/     /ja/docs/tasks/tools/  302! </ins> /hi/docs/setup/learning-environment/     /hi/docs/tasks/tools/ 302! /docs/setup/learning-environment/kind/  /docs/tasks/tools/  302 /id/docs/setup/learning-environment/kind/  /id/docs/tasks/tools/  302

This is a Bug Report <!--Required Information--Problem: The Japanese documentation does not apply a redirect from Getting Started Learning Environment to Tasks Tools. Without this redirection, there will be inconsistencies in information access compared to the English documentation Proposed Solution: Add a redirect from to Page to Update: Additional Information: /language ja /assign
This Issue seems to point out the differences between EN and JP. On the EN page, When we click on "Getting started" - "Learning environment" in the Left-sidebar, it will jump to docs/tasks/tools/. On the JP page, When we click on the same item in the Left-sidebar, it does not jump to docs/tasks/tools/.
It's a helpful clarification!
/triage accepted
/kind bug /remove-kind feature
I think this issues is related to bug, not feature. So could you update the description?
I have updated the description to reflect the issue as a bug.


Question: /docs/reporting-security-issues/     /docs/reference/issues-security/security/ 301 /security/ /docs/reference/issues-security/security/ 302 <ins> /docs/concepts/security/overview/ /docs/concepts/security/ 301 </ins> /docs/roadmap/     https://github.com/kubernetes/kubernetes/milestones/ 301 /docs/samples/     /docs/tutorials/ 301

This is a Refactor request <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The overview page at is a bit out of date: no reference to I'm not convinced that the “Four Cs of cloud native security” model is useful for readers to learn Does not align with other CNCF documents, such as Proposed Solution: Either: remove outright migrate content from into several destinations (keep this brief but on-point) …and then redirect to Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /sig docs /sig security /language en
If we keep the link to then we should update it to be as this is the English docs.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale /triage accepted
Also see
/assign
I'd appreciate a (fresh) review on .


Question: <ins> <?xml version="1.0" encoding="UTF-8" standalone="no"?> <svg xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cc="http://creativecommons.org/ns#" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" id="Layer_1" data-name="Layer 1" viewBox="0 0 242.72101 230.32488" version="1.1"> <metadata id="metadata55"> <rdf:RDF> <cc:Work rdf:about=""> <dc:format>image/svg+xml</dc:format> <dc:type rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> <dc:title></dc:title> </cc:Work> </rdf:RDF> </metadata> <defs id="defs4"> <style id="style2">.cls-1{fill:#ffffff;}.cls-2{fill:#fff;}</style> </defs> <path id="path6" style="fill:#ffffff;fill-opacity:1" d="M 121.31445 0.15625 A 15.35 15.35 0 0 0 115.7207 1.1933594 C 113.1617 2.1355594 110.77583 3.4702219 108.31641 4.6386719 C 104.15534 6.6156019 99.967996 8.538515 95.822266 10.546875 C 92.141239 12.330075 88.4513 14.093991 84.751953 15.837891 C 80.853213 17.667661 76.985096 19.565141 73.103516 21.431641 C 69.958746 22.943841 66.818779 24.463301 63.667969 25.962891 C 59.261969 28.060001 54.842683 30.129662 50.439453 32.232422 C 47.185243 33.786502 43.955089 35.392759 40.699219 36.943359 C 37.455079 38.488359 34.136169 39.888737 31.005859 41.654297 A 15.06024 15.06024 0 0 0 23.488281 51.681641 C 21.130921 61.739241 18.842524 71.813419 16.527344 81.880859 C 12.131297 100.99677 7.7303719 120.11056 3.3261719 139.22461 A 16.28845 16.28845 0 0 0 6.6191406 153.95898 C 15.972961 165.52184 25.29763 177.10689 34.595703 188.71484 C 44.107123 200.54089 53.622299 212.36543 63.138672 224.1875 A 15.46263 15.46263 0 0 0 75.673828 230.16016 C 90.801948 230.17468 105.93041 230.17513 121.05859 230.16406 C 136.24193 230.16406 151.42597 230.16423 166.60938 230.16211 A 15.955 15.955 0 0 0 179.41797 224.16211 C 180.61725 222.72241 181.76906 221.24377 182.94336 219.7832 C 191.44325 209.21098 199.94336 198.63849 208.44336 188.06641 C 212.98627 182.41608 217.53005 176.76614 222.07227 171.11523 C 226.89764 165.09717 231.73645 159.0882 236.51758 153.03516 A 14.74845 14.74845 0 0 0 239.4043 140.47266 C 237.99848 133.65839 236.31263 126.90204 234.75391 120.11914 C 233.00451 112.50623 231.25834 104.8923 229.51758 97.277344 C 227.78888 89.76959 226.05407 82.264099 224.31055 74.759766 C 222.56934 67.198366 220.84998 59.630922 219.10547 52.070312 A 15.98227 15.98227 0 0 0 213.37891 42.919922 A 27.62639 27.62639 0 0 0 207.81641 39.810547 C 191.71099 32.103087 175.60044 24.409522 159.48242 16.728516 C 148.98883 11.719516 138.50555 6.6865575 127.99609 1.7109375 A 15.35 15.35 0 0 0 121.31445 0.15625 z M 115.71875 10.974609 A 7.67609 7.67609 0 0 0 115.13281 13.927734 L 115.13281 14.083984 C 115.13281 14.602044 115.08099 15.223223 115.13281 15.689453 A 51.42016 51.42016 0 0 0 116.01367 21.648438 C 116.5318 26.000307 116.99835 29.677362 116.6875 33.044922 A 6.86316 6.86316 0 0 1 114.66602 36.310547 L 114.51172 38.951172 A 78.13842 78.13842 0 0 0 103.16406 40.712891 A 80.46711 80.46711 0 0 0 62.183594 64.130859 C 61.510064 63.664609 60.266977 62.784391 59.904297 62.525391 C 58.764467 62.680791 57.676268 63.042849 56.173828 62.162109 A 57.36049 57.36049 0 0 1 47.730469 54.546875 A 46.57671 46.57671 0 0 0 43.585938 50.142578 C 43.223267 49.831728 42.600037 49.365527 42.185547 49.054688 A 7.62207 7.62207 0 0 0 39.058594 47.558594 C 39.116084 47.528804 39.166559 47.494074 39.224609 47.464844 C 43.439939 45.342544 47.726015 43.358756 51.984375 41.322266 C 55.600465 39.592886 59.223634 37.879571 62.839844 36.150391 C 66.604004 34.350344 70.365233 32.545615 74.125 30.736328 C 77.79052 28.982548 81.459386 27.231881 85.128906 25.486328 C 88.967893 23.651615 92.805945 21.814416 96.642578 19.974609 C 100.30774 18.223089 103.95825 16.441894 107.64648 14.740234 C 110.34295 13.496234 112.95538 12.060549 115.71875 10.974609 z M 127.13477 11.115234 C 129.07091 11.895444 130.91043 12.914424 132.79688 13.808594 C 147.43811 20.748534 162.06445 27.723389 176.67383 34.730469 C 185.00449 38.706549 193.33433 42.683843 201.66406 46.662109 C 202.2259 46.930849 202.77973 47.212993 203.32617 47.507812 A 7.73718 7.73718 0 0 0 200.51367 48.898438 C 200.09924 49.261108 199.52777 49.675478 199.11328 49.986328 A 54.40181 54.40181 0 0 0 194.96875 54.390625 A 60.78441 60.78441 0 0 1 186.52539 62.058594 C 185.3338 62.783944 183.5193 62.524476 182.74219 62.472656 L 180.35938 64.183594 A 82.56748 82.56748 0 0 0 128.29102 39.003906 C 128.2392 38.174986 128.18854 36.673281 128.13672 36.207031 A 4.966 4.966 0 0 1 126.06445 33.046875 C 125.80545 29.679315 126.27099 26.052128 126.78906 21.648438 A 51.40933 51.40933 0 0 0 127.66992 15.689453 L 127.66992 13.927734 A 7.62668 7.62668 0 0 0 127.13477 11.115234 z M 32.035156 55.851562 A 7.52023 7.52023 0 0 0 34.310547 58.845703 C 34.362367 58.845703 34.364196 58.898437 34.416016 58.898438 C 34.830446 59.209288 35.348257 59.674564 35.710938 59.933594 C 37.524228 61.228824 39.129155 61.956057 40.890625 62.992188 A 64.22916 64.22916 0 0 1 50.216797 69.519531 A 6.61353 6.61353 0 0 1 51.460938 73.146484 L 53.480469 74.958984 A 81.06587 81.06587 0 0 0 40.683594 131.5332 L 38.041016 132.31055 A 9.08477 9.08477 0 0 1 35.347656 135.05664 C 32.135506 136.09283 28.509159 136.45563 24.105469 136.92188 A 48.436 48.436 0 0 0 18.095703 137.38867 C 17.629393 137.49225 16.95557 137.64633 16.4375 137.75 L 16.28125 137.75 A 7.42737 7.42737 0 0 0 12.820312 139.64453 A 19.2735 19.2735 0 0 1 13.234375 137.07812 C 15.874045 125.80815 18.420782 114.51721 21.013672 103.23633 C 23.010385 94.549248 25.014697 85.863494 27.025391 77.179688 C 28.599311 70.362977 30.117974 63.533748 31.771484 56.736328 C 31.845574 56.431758 31.944916 56.144723 32.035156 55.851562 z M 210.49219 55.953125 A 17.04647 17.04647 0 0 1 210.98633 57.712891 C 211.59394 60.486941 212.22479 63.255797 212.86133 66.023438 C 213.65381 69.468927 214.46634 72.909116 215.26367 76.353516 C 216.4295 81.390196 217.63155 86.420653 218.73633 91.470703 C 219.3689 94.362036 220.01372 97.250345 220.66992 100.13672 C 221.26526 102.7591 221.91028 105.37567 222.53516 107.99414 C 223.71088 112.92059 224.80029 117.86804 225.93359 122.80469 C 226.88366 126.94336 227.8537 131.0766 228.79688 135.2168 C 229.1164 136.61963 229.46882 138.01507 229.64844 139.43945 A 7.33852 7.33852 0 0 0 226.3125 137.64648 C 225.79438 137.54285 225.01807 137.33605 224.5 137.23242 A 48.42223 48.42223 0 0 0 218.49023 136.76562 C 214.08648 136.29932 210.46015 135.9365 207.24805 134.90039 C 205.95283 134.38226 205.021 132.82977 204.55469 132.15625 L 202.01562 131.42969 A 81.19509 81.19509 0 0 0 200.7207 102.1582 A 79.90643 79.90643 0 0 0 188.95898 75.009766 C 189.63244 74.439886 190.82489 73.352904 191.1875 72.990234 A 4.95661 4.95661 0 0 1 192.37891 69.416016 A 60.43964 60.43964 0 0 1 201.70508 62.835938 A 50.54343 50.54343 0 0 0 206.9375 59.779297 C 207.35199 59.468447 207.86963 59.002246 208.33594 58.691406 A 7.4635 7.4635 0 0 0 210.49219 55.953125 z M 64.083984 73.787109 L 178.47656 73.787109 L 178.47656 101.14258 L 64.083984 101.14258 L 64.083984 73.787109 z M 76.740234 80.96875 A 6.9587 6.9587 0 0 0 76.517578 80.974609 A 6.71541 6.71541 0 0 0 69.626953 87.814453 L 69.626953 87.865234 A 6.68023 6.68023 0 0 0 76.414062 94.652344 A 6.8215 6.8215 0 0 0 81.855469 92.269531 L 79.990234 90.404297 A 4.82362 4.82362 0 0 1 76.517578 91.958984 A 3.932 3.932 0 0 1 72.683594 87.814453 L 72.683594 87.761719 A 3.93368 3.93368 0 0 1 76.517578 83.617188 A 4.72225 4.72225 0 0 1 79.886719 85.119141 L 81.75 82.996094 A 6.9587 6.9587 0 0 0 76.746094 80.96875 A 6.9587 6.9587 0 0 0 76.740234 80.96875 z M 84.185547 81.181641 L 84.185547 94.445312 L 94.289062 94.445312 L 94.289062 91.802734 L 87.087891 91.802734 L 87.087891 89.056641 L 93.355469 89.056641 L 93.355469 86.466797 L 87.087891 86.466797 L 87.087891 83.773438 L 94.185547 83.773438 L 94.185547 81.181641 L 84.185547 81.181641 z M 109.62305 81.181641 L 109.62305 83.876953 L 113.66406 83.876953 L 113.66406 94.445312 L 116.56641 94.445312 L 116.56641 83.876953 L 120.60742 83.876953 L 120.60742 81.181641 L 109.62305 81.181641 z M 122.99023 81.181641 L 122.99023 94.445312 L 125.89258 94.445312 L 125.89258 81.181641 L 122.99023 81.181641 z M 129.20703 81.181641 L 129.20703 94.445312 L 132.10938 94.445312 L 132.10938 89.263672 L 138.48047 89.263672 L 138.48047 86.621094 L 132.10938 86.621094 L 132.10938 83.824219 L 139.31055 83.824219 L 139.31055 81.181641 L 129.20703 81.181641 z M 141.79688 81.181641 L 141.79688 94.445312 L 144.69727 94.445312 L 144.69727 81.181641 L 141.79688 81.181641 z M 148.01367 81.181641 L 148.01367 94.445312 L 158.11719 94.445312 L 158.11719 91.802734 L 150.91602 91.802734 L 150.91602 89.056641 L 157.13281 89.056641 L 157.13281 86.466797 L 150.91602 86.466797 L 150.91602 83.773438 L 158.01367 83.773438 L 158.01367 81.181641 L 148.01367 81.181641 z M 160.70703 81.181641 L 160.70703 94.445312 L 165.88867 94.445312 C 170.03339 94.445312 172.93359 91.544653 172.93359 87.814453 C 172.93359 84.032453 170.03339 81.181641 165.88867 81.181641 L 160.70703 81.181641 z M 103.35352 81.222656 A 5.27661 5.27661 0 0 0 102.99219 81.234375 L 96.931641 81.234375 L 96.931641 94.445312 L 99.832031 94.445312 L 99.832031 90.197266 L 102.16406 90.197266 L 105.01367 94.445312 L 108.43164 94.445312 L 105.16797 89.730469 A 4.08546 4.08546 0 0 0 108.01758 85.636719 L 108.01758 85.585938 A 4.1457 4.1457 0 0 0 106.87891 82.580078 A 5.27661 5.27661 0 0 0 103.35352 81.222656 z M 166.05273 83.767578 A 3.80749 3.80749 0 0 1 169.87695 87.761719 L 169.87695 87.814453 A 3.76658 3.76658 0 0 1 165.88867 91.75 L 163.60742 91.75 L 163.60742 83.773438 L 163.60742 83.771484 L 165.88867 83.771484 A 3.80749 3.80749 0 0 1 166.05273 83.767578 z M 99.832031 83.773438 L 102.73242 83.773438 C 104.13124 83.773436 105.01367 84.394243 105.01367 85.689453 L 105.01367 85.740234 C 105.01367 86.880024 104.18398 87.605469 102.78516 87.605469 L 99.832031 87.605469 L 99.832031 83.773438 z M 67.296875 105.08398 L 67.296875 114.51172 C 67.607725 114.14903 67.9704 113.78648 68.28125 113.42383 C 68.64391 113.06114 68.954775 112.6986 69.265625 112.33594 C 69.576475 111.97328 69.887484 111.61163 70.146484 111.30078 A 9.18153 9.18153 0 0 0 70.871094 110.4707 L 74.652344 110.4707 C 73.875224 111.35144 73.151101 112.1799 72.425781 112.95703 C 71.700461 113.73416 70.923719 114.56364 70.042969 115.39258 A 17.48825 17.48825 0 0 1 71.388672 116.79102 A 20.88481 20.88481 0 0 1 72.736328 118.44922 C 73.150798 119.01912 73.565074 119.59027 73.927734 120.16016 C 74.238584 120.73006 74.549544 121.24662 74.808594 121.71289 L 71.130859 121.71289 C 70.923629 121.35024 70.664366 120.93696 70.353516 120.4707 C 70.042666 120.00444 69.730772 119.58933 69.419922 119.12305 A 12.60786 12.60786 0 0 0 68.384766 117.82812 A 10.03021 10.03021 0 0 0 67.296875 116.79102 L 67.296875 121.76562 L 64.083984 121.76562 L 64.083984 105.60156 L 67.296875 105.08398 z M 92.216797 105.08398 L 92.216797 110.73047 A 9.66558 9.66558 0 0 1 93.355469 110.36719 A 8.59557 8.59557 0 0 1 94.599609 110.26367 A 5.54358 5.54358 0 0 1 96.722656 110.67773 A 3.917 3.917 0 0 1 98.277344 111.86914 A 5.25965 5.25965 0 0 1 99.210938 113.73438 A 8.94591 8.94591 0 0 1 99.521484 116.16992 A 7.27054 7.27054 0 0 1 99.107422 118.60547 A 4.9 4.9 0 0 1 97.966797 120.4707 A 5.01107 5.01107 0 0 1 96.101562 121.66211 A 7.35379 7.35379 0 0 1 93.615234 122.07617 A 9.576 9.576 0 0 1 92.423828 122.02539 L 91.179688 121.86914 A 8.14215 8.14215 0 0 1 89.988281 121.66211 C 89.625621 121.55854 89.314766 121.50595 89.003906 121.40234 L 89.003906 105.60156 L 92.216797 105.08398 z M 151.84766 107.15625 L 151.84766 110.4707 L 155.68164 110.4707 L 155.68164 113.11328 L 151.84766 113.11328 L 151.84766 117.10352 A 2.95332 2.95332 0 0 0 152.21094 118.70898 A 1.55615 1.55615 0 0 0 153.66016 119.33008 A 7.72774 7.72774 0 0 0 154.74805 119.22656 A 5.46473 5.46473 0 0 0 155.73242 118.96875 L 156.19922 121.45508 A 7.61767 7.61767 0 0 1 154.9043 121.86914 A 8.90684 8.90684 0 0 1 153.14258 122.02539 A 5.3061 5.3061 0 0 1 150.9668 121.66211 A 3.11632 3.11632 0 0 1 149.56836 120.67773 A 3.91329 3.91329 0 0 1 148.84375 119.12305 A 8.34758 8.34758 0 0 1 148.63477 117.10352 L 148.63477 107.62109 L 151.84766 107.15625 z M 174.10547 109.94531 A 5.19975 5.19975 0 0 1 174.29688 109.94531 A 5.19975 5.19975 0 0 1 174.48828 109.95312 A 12.05967 12.05967 0 0 1 176.45703 110.16016 A 11.59653 11.59653 0 0 1 177.95898 110.57422 L 177.38867 113.0625 A 8.00883 8.00883 0 0 0 176.19727 112.69922 A 6.22792 6.22792 0 0 0 174.74609 112.54297 C 173.76174 112.54297 173.24414 112.80315 173.24414 113.37305 A 0.76815 0.76815 0 0 0 173.29688 113.73438 A 1.37337 1.37337 0 0 0 173.55469 114.04688 A 2.265 2.265 0 0 0 174.07422 114.35742 A 4.331 4.331 0 0 0 174.90234 114.71875 A 11.73628 11.73628 0 0 1 176.66406 115.49609 A 3.75042 3.75042 0 0 1 177.75195 116.32617 A 2.71652 2.71652 0 0 1 178.32227 117.31055 A 4.53434 4.53434 0 0 1 178.47656 118.55273 A 2.85966 2.85966 0 0 1 177.23438 121.0918 A 6.39067 6.39067 0 0 1 173.6582 121.97266 A 11.10508 11.10508 0 0 1 171.17188 121.71289 A 9.97006 9.97006 0 0 1 169.77344 121.29883 L 170.29102 118.70898 A 8.81565 8.81565 0 0 0 171.94922 119.22656 A 6.436 6.436 0 0 0 173.6582 119.43359 A 3.61452 3.61452 0 0 0 174.90234 119.2793 C 175.16138 119.17568 175.26562 118.9155 175.26562 118.44922 C 175.26564 118.19018 175.10969 117.98262 174.79883 117.77539 A 9.969 9.969 0 0 0 173.34766 117.10352 A 10.51216 10.51216 0 0 1 172.00195 116.5332 A 5.24887 5.24887 0 0 1 170.96484 115.80664 A 2.5739 2.5739 0 0 1 170.29102 114.82227 A 3.74278 3.74278 0 0 1 170.0332 113.42383 A 3.075 3.075 0 0 1 171.22461 110.88477 A 5.19975 5.19975 0 0 1 174.10547 109.94531 z M 107.08398 110.15234 A 4.9202 4.9202 0 0 1 110.60742 111.61133 A 6.10323 6.10323 0 0 1 112.00781 115.96289 L 112.00781 116.58398 C 112.00781 116.79121 111.95508 116.99876 111.95508 117.25781 L 104.70117 117.25781 A 2.15407 2.15407 0 0 0 105.63477 118.8125 A 3.74781 3.74781 0 0 0 107.81055 119.38281 A 9.53979 9.53979 0 0 0 109.51953 119.22656 A 6.49862 6.49862 0 0 0 110.91992 118.8125 L 111.33398 121.40234 A 3.05129 3.05129 0 0 1 110.66016 121.66211 C 110.40111 121.71392 110.08921 121.81733 109.72656 121.86914 C 109.36391 121.92095 109.00236 121.97358 108.58789 122.02539 A 9.171 9.171 0 0 1 107.39648 122.07617 A 7.06566 7.06566 0 0 1 104.75391 121.60938 A 5.35172 5.35172 0 0 1 102.88867 120.36719 A 5.53273 5.53273 0 0 1 101.80078 118.50195 A 7.69869 7.69869 0 0 1 101.9043 113.52734 A 5.75618 5.75618 0 0 1 103.0957 111.66211 A 4.32 4.32 0 0 1 104.80664 110.52344 A 5.55551 5.55551 0 0 1 106.82617 110.16016 A 4.9202 4.9202 0 0 1 107.08398 110.15234 z M 141.33008 110.15234 A 4.92016 4.92016 0 0 1 144.85352 111.61133 A 6.10314 6.10314 0 0 1 146.25195 115.96289 L 146.25195 116.58398 A 3.186 3.186 0 0 1 146.20117 117.25781 L 138.94727 117.25781 A 2.154 2.154 0 0 0 139.88086 118.8125 A 3.74771 3.74771 0 0 0 142.05664 119.38281 A 9.53894 9.53894 0 0 0 143.76562 119.22656 A 6.49872 6.49872 0 0 0 145.16406 118.8125 L 145.57812 121.40234 A 2.03139 2.03139 0 0 1 144.90625 121.66211 C 144.64721 121.71392 144.33533 121.81732 143.97266 121.86914 C 143.60999 121.92096 143.24844 121.97358 142.83398 122.02539 A 9.17082 9.17082 0 0 1 141.64062 122.07617 A 7.06563 7.06563 0 0 1 139 121.60938 A 5.87983 5.87983 0 0 1 137.13477 120.36719 A 5.53278 5.53278 0 0 1 136.04688 118.50195 A 7.69864 7.69864 0 0 1 136.15039 113.52734 A 5.75615 5.75615 0 0 1 137.3418 111.66211 A 4.3199 4.3199 0 0 1 139.05078 110.52344 A 5.55537 5.55537 0 0 1 141.07227 110.16016 A 4.92016 4.92016 0 0 1 141.33008 110.15234 z M 162.98438 110.15234 A 4.92016 4.92016 0 0 1 166.50977 111.61133 A 6.10314 6.10314 0 0 1 167.9082 115.96289 L 167.9082 116.58398 A 3.18657 3.18657 0 0 1 167.85742 117.25781 L 160.60352 117.25781 A 2.154 2.154 0 0 0 161.53516 118.8125 A 3.74774 3.74774 0 0 0 163.71094 119.38281 A 9.539 9.539 0 0 0 165.42188 119.22656 A 6.49844 6.49844 0 0 0 166.82031 118.8125 L 167.23438 121.40234 A 2.03132 2.03132 0 0 1 166.56055 121.66211 C 166.30151 121.71392 165.99158 121.81732 165.62891 121.86914 C 165.26624 121.92096 164.90275 121.97358 164.48828 122.02539 A 9.17067 9.17067 0 0 1 163.29688 122.07617 A 7.06563 7.06563 0 0 1 160.6543 121.60938 A 5.87971 5.87971 0 0 1 158.79102 120.36719 A 5.53295 5.53295 0 0 1 157.70117 118.50195 A 7.69855 7.69855 0 0 1 157.80664 113.52734 A 5.7558 5.7558 0 0 1 158.99805 111.66211 A 4.3199 4.3199 0 0 1 160.70703 110.52344 A 5.55535 5.55535 0 0 1 162.72656 110.16016 A 4.92016 4.92016 0 0 1 162.98438 110.15234 z M 128.67383 110.15625 A 6.40885 6.40885 0 0 1 130.76172 110.52344 A 3.64232 3.64232 0 0 1 132.26367 111.61133 A 4.45192 4.45192 0 0 1 133.04102 113.26953 A 9.17277 9.17277 0 0 1 133.30078 115.39258 L 133.30078 121.71289 L 130.08789 121.71289 L 130.08789 115.70312 A 4.32568 4.32568 0 0 0 129.67383 113.52734 A 1.65382 1.65382 0 0 0 128.17188 112.90625 C 127.96464 112.90625 127.70431 112.95703 127.44531 112.95703 A 2.73691 2.73691 0 0 0 126.77344 113.00977 L 126.77344 121.71289 L 123.56055 121.71289 L 123.56055 110.78125 C 124.13045 110.62578 124.85466 110.52261 125.68359 110.36719 A 14.95922 14.95922 0 0 1 128.37891 110.16016 A 6.40885 6.40885 0 0 1 128.67383 110.15625 z M 119.15625 110.21289 C 119.31168 110.21289 119.51834 110.26367 119.77734 110.26367 A 3.38479 3.38479 0 0 0 120.50391 110.26367 A 3.49821 3.49821 0 0 1 121.22852 110.36719 A 4.31811 4.31811 0 0 1 121.85156 110.57422 L 121.33203 113.2168 C 121.07299 113.165 120.71032 113.11339 120.34766 113.00977 A 8.59724 8.59724 0 0 0 119.10547 112.90625 C 118.89824 112.90625 118.63791 112.95898 118.37891 112.95898 A 1.9323 1.9323 0 0 0 117.75781 113.0625 L 117.75781 121.71289 L 114.54492 121.71289 L 114.54492 111.04102 A 13.80307 13.80307 0 0 1 116.56641 110.4707 A 12.88372 12.88372 0 0 1 119.15625 110.21289 z M 76.207031 110.41992 L 79.419922 110.41992 L 79.419922 116.32617 A 4.70262 4.70262 0 0 0 79.833984 118.55273 A 1.56769 1.56769 0 0 0 81.335938 119.22656 C 81.543167 119.22656 81.8035 119.17578 82.0625 119.17578 A 2.73691 2.73691 0 0 0 82.734375 119.12305 L 82.734375 110.41992 L 85.947266 110.41992 L 85.947266 121.35156 C 85.377366 121.50702 84.651196 121.61021 83.822266 121.76562 A 14.95919 14.95919 0 0 1 81.128906 121.97266 A 6.40882 6.40882 0 0 1 78.746094 121.60938 A 3.64251 3.64251 0 0 1 77.244141 120.52148 A 4.452 4.452 0 0 1 76.466797 118.86328 A 8.83053 8.83053 0 0 1 76.207031 116.74023 L 76.207031 110.4707 L 76.207031 110.41992 z M 106.99023 112.80078 A 1.77427 1.77427 0 0 0 106.87891 112.80273 A 2.47475 2.47475 0 0 0 105.94531 113.00977 A 1.41447 1.41447 0 0 0 105.32422 113.47656 A 1.48767 1.48767 0 0 0 104.91016 114.15039 A 6.44516 6.44516 0 0 0 104.70117 114.97852 L 108.95117 114.97852 A 4.13006 4.13006 0 0 0 108.79492 114.20117 A 1.70608 1.70608 0 0 0 108.43164 113.52734 A 1.52316 1.52316 0 0 0 107.81055 113.00977 A 1.77427 1.77427 0 0 0 106.99023 112.80078 z M 141.23438 112.80078 A 1.77423 1.77423 0 0 0 141.12305 112.80273 A 2.4748 2.4748 0 0 0 140.19141 113.00977 A 1.41432 1.41432 0 0 0 139.56836 113.47656 A 1.48748 1.48748 0 0 0 139.1543 114.15039 A 6.443 6.443 0 0 0 138.94727 114.97852 L 143.19531 114.97852 A 4.12765 4.12765 0 0 0 143.04102 114.20117 A 1.70619 1.70619 0 0 0 142.67773 113.52734 A 1.52328 1.52328 0 0 0 142.05664 113.00977 A 1.77423 1.77423 0 0 0 141.23438 112.80078 z M 162.89062 112.80078 A 1.77422 1.77422 0 0 0 162.7793 112.80273 A 2.47475 2.47475 0 0 0 161.84766 113.00977 A 1.41438 1.41438 0 0 0 161.22461 113.47656 A 1.48772 1.48772 0 0 0 160.81055 114.15039 A 6.4463 6.4463 0 0 0 160.60352 114.97852 L 164.85156 114.97852 A 4.12765 4.12765 0 0 0 164.69531 114.20117 A 1.70619 1.70619 0 0 0 164.33398 113.52734 A 1.52328 1.52328 0 0 0 163.71094 113.00977 A 1.77422 1.77422 0 0 0 162.89062 112.80078 z M 93.683594 112.95508 A 3.18847 3.18847 0 0 0 92.941406 113.0625 A 1.36142 1.36142 0 0 0 92.164062 113.42383 L 92.164062 119.22656 C 92.319493 119.22656 92.526156 119.2793 92.785156 119.2793 A 3.43048 3.43048 0 0 0 93.5625 119.33008 A 2.23921 2.23921 0 0 0 95.53125 118.44922 A 3.82185 3.82185 0 0 0 96.205078 116.06641 C 96.205078 113.99408 95.428221 112.95898 93.925781 112.95898 A 3.18847 3.18847 0 0 0 93.683594 112.95508 z M 64.083984 128.19141 L 178.47656 128.19141 L 178.47656 165.53516 L 64.083984 165.53516 L 64.083984 128.19141 z M 106.77734 133.72656 A 5.74768 5.74768 0 0 0 106.57617 133.73242 A 5.66177 5.66177 0 0 0 100.76758 139.49414 L 100.76758 139.52539 A 5.62285 5.62285 0 0 0 106.48047 145.25391 A 5.69665 5.69665 0 0 0 111.04883 143.26562 L 109.48828 141.68945 A 4.0184 4.0184 0 0 1 106.56055 142.99414 A 3.30866 3.30866 0 0 1 103.33008 139.49414 L 103.33008 139.46094 A 3.30045 3.30045 0 0 1 106.56055 135.99219 A 4.11021 4.11021 0 0 1 109.4082 137.25 L 110.96875 135.45117 A 5.74768 5.74768 0 0 0 106.77734 133.72656 z M 83.197266 133.76367 C 80.920856 133.76367 79.296875 135.10157 79.296875 137.12305 L 79.296875 137.1543 C 79.296875 139.36621 80.746094 139.9878 82.990234 140.56055 C 84.852544 141.03806 85.234375 141.35595 85.234375 141.97656 L 85.234375 142.00781 C 85.234375 142.66011 84.628953 143.05859 83.626953 143.05859 A 5.108 5.108 0 0 1 80.300781 141.70508 L 78.851562 143.43945 A 7.087 7.087 0 0 0 83.578125 145.22266 C 85.981445 145.22266 87.667969 143.98194 87.667969 141.76953 L 87.667969 141.73828 C 87.667969 139.79638 86.394536 138.9834 84.134766 138.39453 C 82.208986 137.90137 81.732422 137.66358 81.732422 136.93164 L 81.732422 136.89844 C 81.732422 136.35742 82.225584 135.92773 83.164062 135.92773 A 5.227 5.227 0 0 1 86.060547 137.02734 L 87.333984 135.17969 A 6.44831 6.44831 0 0 0 83.197266 133.76367 z M 131.2793 133.91406 A 4.44053 4.44053 0 0 0 130.92578 133.92383 L 125.83203 133.92383 L 125.83203 145.06445 L 128.2832 145.06445 L 128.2832 141.49805 L 130.20898 141.49805 L 132.5957 145.06445 L 135.46094 145.06445 L 132.74023 141.08594 A 3.46 3.46 0 0 0 135.12695 137.63086 L 135.12695 137.59961 A 3.498 3.498 0 0 0 134.17188 135.05273 A 4.44053 4.44053 0 0 0 131.2793 133.91406 z M 90.199219 133.92383 L 90.199219 145.06445 L 98.681641 145.06445 L 98.681641 142.88281 L 92.632812 142.88281 L 92.632812 140.54297 L 97.886719 140.54297 L 97.886719 138.36328 L 92.632812 138.36328 L 92.632812 136.10352 L 98.601562 136.10352 L 98.601562 133.92383 L 90.199219 133.92383 z M 113.22852 133.92383 L 113.22852 140.28906 C 113.22852 143.56738 115.05859 145.2383 118.05078 145.23828 C 121.04199 145.23828 122.93555 143.58298 122.93555 140.20898 L 122.93555 133.92383 L 120.48438 133.92383 L 120.48438 140.30469 C 120.48434 142.07129 119.57812 142.97852 118.08203 142.97852 C 116.58594 142.97852 115.67773 142.03906 115.67773 140.22461 L 115.67773 133.92383 L 113.22852 133.92383 z M 137.84766 133.92383 L 137.84766 145.06445 L 140.29883 145.06445 L 140.29883 133.92383 L 137.84766 133.92383 z M 142.68555 133.92383 L 142.68555 136.18359 L 146.07617 136.18359 L 146.07617 145.06445 L 148.52734 145.06445 L 148.52734 136.18359 L 151.91797 136.18359 L 151.91797 133.92383 L 142.68555 133.92383 z M 153.04688 133.92383 L 157.32617 140.67188 L 157.32617 145.06445 L 159.77734 145.06445 L 159.77734 140.62305 L 164.05859 133.92383 L 161.27344 133.92383 L 158.56836 138.39453 L 155.91016 133.92383 L 153.04688 133.92383 z M 128.2832 136.13477 L 130.71875 136.13477 C 131.91211 136.13477 132.64453 136.67627 132.64453 137.72656 L 132.64453 137.75781 C 132.64453 138.69727 131.95899 139.33398 130.76562 139.33398 L 128.2832 139.33398 L 128.2832 136.13477 z M 37.472656 144.12305 C 38.871456 144.01941 40.320496 145.00348 41.097656 145.41797 L 43.84375 144.95117 A 80.64786 80.64786 0 0 0 56.123047 168.67969 L 56.486328 169.14648 A 82.647 82.647 0 0 0 80.005859 190.12891 L 78.867188 192.875 A 6.0599 6.0599 0 0 1 79.435547 196.39844 A 63.33945 63.33945 0 0 1 73.738281 206.60352 A 53.00188 53.00188 0 0 0 70.369141 211.62891 C 70.110141 212.09521 69.800046 212.82178 69.541016 213.33984 A 7.67415 7.67415 0 0 0 68.847656 215.97461 A 19.54273 19.54273 0 0 1 67.373047 214.32422 C 63.393367 209.29046 59.342476 204.31225 55.322266 199.31055 C 51.440426 194.48113 47.557981 189.65325 43.675781 184.82422 C 39.359561 179.46063 35.040836 174.09869 30.720703 168.73828 C 26.597543 163.60864 22.480314 158.47326 18.369141 153.33398 C 17.444771 152.17926 16.450014 151.07556 15.583984 149.87695 A 7.47652 7.47652 0 0 0 19.080078 149.92578 L 19.183594 149.92578 A 0.18092 0.18092 0 0 0 19.287109 149.87305 C 19.805169 149.76947 20.478088 149.61539 20.892578 149.51172 A 49.02742 49.02742 0 0 0 26.541016 147.33594 C 30.685666 145.83349 34.105076 144.58936 37.472656 144.12305 z M 204.74023 144.22266 A 4.85783 4.85783 0 0 1 205.07227 144.22656 C 208.43976 144.6928 211.85919 145.93701 216.00391 147.43945 A 51.26675 51.26675 0 0 0 221.65039 149.61523 C 222.11664 149.71886 222.73778 149.87485 223.25586 149.97852 A 0.18067 0.18067 0 0 1 223.35938 150.0293 L 223.46289 150.0293 A 7.641 7.641 0 0 0 226.7207 150.00586 C 225.70343 151.37012 224.53338 152.62928 223.49609 153.97852 C 222.05572 155.85212 220.58008 157.69873 219.09961 159.54102 C 217.42682 161.62256 215.72259 163.679 214.04883 165.75977 C 211.86676 168.4726 209.71038 171.20593 207.52734 173.91797 C 205.37677 176.5896 203.19678 179.23646 201.04883 181.91016 C 199.54283 183.78473 198.0841 185.69726 196.57617 187.57031 C 195.10705 189.39514 193.58454 191.17768 192.11719 193.00391 C 190.63099 194.85352 189.20216 196.74891 187.71484 198.59766 C 186.02942 200.69282 184.29114 202.74487 182.60547 204.83984 C 181.13757 206.664 179.7466 208.55072 178.25586 210.35547 C 176.75928 212.16712 175.41638 214.125 173.79883 215.81055 C 173.77124 215.8393 173.74255 215.8641 173.71484 215.89258 A 7.59352 7.59352 0 0 0 173.00195 213.33984 C 172.74295 212.82178 172.43287 212.09521 172.17383 211.62891 A 52.06088 52.06088 0 0 0 168.80664 206.65625 C 166.42346 202.92603 164.45337 199.86932 163.26172 196.70898 C 162.74366 195.10298 163.36585 194.06745 163.72852 193.03125 A 19.27116 19.27116 0 0 1 162.69336 190.49219 A 82.53323 82.53323 0 0 0 186.31641 169.35352 L 186.41992 169.19922 A 82.79132 82.79132 0 0 0 198.85547 145.05664 C 199.68439 145.16028 201.08261 145.41791 201.54883 145.52148 A 4.85783 4.85783 0 0 1 204.74023 144.22266 z M 110.69922 148.72656 A 5.74768 5.74768 0 0 0 110.49805 148.73242 A 5.66177 5.66177 0 0 0 104.68945 154.49414 L 104.68945 154.52539 A 5.62285 5.62285 0 0 0 110.40234 160.25391 A 5.69663 5.69663 0 0 0 114.9707 158.26562 L 113.41016 156.68945 A 4.01841 4.01841 0 0 1 110.48242 157.99414 A 3.30866 3.30866 0 0 1 107.25195 154.49414 L 107.25195 154.46094 A 3.30045 3.30045 0 0 1 110.48242 150.99219 A 4.11017 4.11017 0 0 1 113.33008 152.25 L 114.89062 150.45117 A 5.74768 5.74768 0 0 0 110.69922 148.72656 z M 76.089844 148.76367 C 73.813434 148.76367 72.191406 150.10157 72.191406 152.12305 L 72.191406 152.1543 C 72.191406 154.36621 73.638672 154.9878 75.882812 155.56055 C 77.745113 156.03806 78.126953 156.35595 78.126953 156.97656 L 78.126953 157.00781 C 78.126953 157.66011 77.521481 158.05859 76.519531 158.05859 A 5.108 5.108 0 0 1 73.193359 156.70508 L 71.746094 158.43945 A 7.087 7.087 0 0 0 76.472656 160.22266 C 78.875976 160.22266 80.5625 158.98194 80.5625 156.76953 L 80.5625 156.73828 C 80.5625 154.79638 79.289057 153.9834 77.029297 153.39453 C 75.103507 152.90137 74.625 152.66358 74.625 151.93164 L 74.625 151.89844 C 74.625 151.35742 75.120124 150.92773 76.058594 150.92773 A 5.227 5.227 0 0 1 78.955078 152.02734 L 80.228516 150.17969 A 6.44828 6.44828 0 0 0 76.089844 148.76367 z M 155.61719 148.76367 C 153.34082 148.76367 151.7168 150.10157 151.7168 152.12305 L 151.7168 152.1543 C 151.7168 154.36621 153.16601 154.9878 155.41016 155.56055 C 157.27246 156.03806 157.6543 156.35595 157.6543 156.97656 L 157.6543 157.00781 C 157.6543 157.66011 157.04887 158.05859 156.04688 158.05859 A 5.108 5.108 0 0 1 152.7207 156.70508 L 151.27148 158.43945 A 7.087 7.087 0 0 0 155.99805 160.22266 C 158.40137 160.22266 160.08789 158.98194 160.08789 156.76953 L 160.08789 156.73828 C 160.08789 154.79638 158.81446 153.9834 156.55469 153.39453 C 154.62891 152.90137 154.15234 152.66358 154.15234 151.93164 L 154.15234 151.89844 C 154.15234 151.35742 154.6455 150.92773 155.58398 150.92773 A 5.227 5.227 0 0 1 158.48047 152.02734 L 159.75391 150.17969 A 6.4483 6.4483 0 0 0 155.61719 148.76367 z M 126.89062 148.84375 L 122.11523 160.06445 L 124.61523 160.06445 L 125.63281 157.56445 L 130.34375 157.56445 L 131.36328 160.06445 L 133.92383 160.06445 L 129.15039 148.84375 L 126.89062 148.84375 z M 83.091797 148.92383 L 83.091797 160.06445 L 85.542969 160.06445 L 85.542969 156.7207 L 87.404297 156.7207 C 89.903327 156.7207 91.908203 155.38477 91.908203 152.80664 L 91.908203 152.77539 C 91.908203 150.49951 90.301761 148.92383 87.644531 148.92383 L 83.091797 148.92383 z M 94.121094 148.92383 L 94.121094 160.06445 L 102.60352 160.06445 L 102.60352 157.88281 L 96.556641 157.88281 L 96.556641 155.54297 L 101.80859 155.54297 L 101.80859 153.36328 L 96.556641 153.36328 L 96.556641 151.10352 L 102.52539 151.10352 L 102.52539 148.92383 L 94.121094 148.92383 z M 117.4375 148.92383 L 117.4375 160.06445 L 119.88867 160.06445 L 119.88867 148.92383 L 117.4375 148.92383 z M 136.04297 148.92383 L 136.04297 160.06445 L 144.04688 160.06445 L 144.04688 157.83594 L 138.49414 157.83594 L 138.49414 148.92383 L 136.04297 148.92383 z M 146.40234 148.92383 L 146.40234 160.06445 L 148.85352 160.06445 L 148.85352 148.92383 L 146.40234 148.92383 z M 161.58398 148.92383 L 161.58398 151.18359 L 164.97461 151.18359 L 164.97461 160.06445 L 167.42578 160.06445 L 167.42578 151.18359 L 170.81445 151.18359 L 170.81445 148.92383 L 161.58398 148.92383 z M 85.542969 151.13477 L 87.4375 151.13477 C 88.66308 151.13477 89.425781 151.72412 89.425781 152.82227 L 89.425781 152.85352 A 1.72468 1.72468 0 0 1 87.484375 154.54102 L 85.542969 154.54102 L 85.542969 151.13477 z M 127.98828 151.78711 L 129.46875 155.40039 L 126.50781 155.40039 L 127.98828 151.78711 z M 92.388672 196.24219 A 80.59625 80.59625 0 0 0 139.48242 199.60938 A 74.131 74.131 0 0 0 150.25781 196.3457 C 150.67229 197.07098 151.3983 198.41858 151.60547 198.78125 A 4.96252 4.96252 0 0 1 154.81836 200.75 A 55.78238 55.78238 0 0 1 159.11719 211.31836 A 52.38662 52.38662 0 0 0 160.93164 217.07031 C 161.13886 217.53661 161.44989 218.20953 161.70898 218.67578 A 7.64068 7.64068 0 0 0 162.94727 220.51758 C 149.06535 220.55125 135.18279 220.53125 121.30078 220.53125 C 110.97534 220.53125 100.64962 220.53048 90.324219 220.53125 C 86.873552 220.53235 83.423323 220.54256 79.972656 220.55859 C 79.845576 220.55914 79.727362 220.54108 79.601562 220.53906 A 7.56336 7.56336 0 0 0 80.835938 218.72656 C 81.094938 218.26026 81.406061 217.5874 81.613281 217.12109 A 52.388 52.388 0 0 0 83.425781 211.37109 C 85.083681 207.22644 86.015372 202.82294 88.294922 200.12891 A 5.06922 5.06922 0 0 1 90.990234 198.83203 L 92.388672 196.24219 z " /> </svg> </ins>

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Update to mention the new Kubernetes Security Specialist Certification Why is this needed There is a Kubernetes Security Specialist Certification, coming in November 2020. Comments /kind feature /language en
/priority important-soon
let's collaborate to put everything in place to make this into a Good First Issue.
Design-wise, it's much easier to place 2 certification logos than 3. do you have any thoughts on how to adjust things design-wise to incorporate the 3rd certification?
/sig security
/triage accepted
/cc


Question: DaemonSetは、Podの作成し、そのPodが停止されることのないプロセスを持つことにおいて[Deployment](/ja/docs/concepts/workloads/controllers/deployment/)と同様です(例: webサーバー、ストレージサーバー)。 フロントエンドのようなServiceのように、どのホスト上にPodが稼働するか制御するよりも、レプリカ数をスケールアップまたはスケールダウンしたりローリングアップデートする方が重要であるような、状態をもたないServiceに対してDeploymentを使ってください。 <del> Podのコピーが全てまたは特定のホスト上で常に稼働していることが重要な場合や、他のPodの前に起動させる必要があるときにDaemonSetを使ってください。 </del> <ins> DaemonSetがNodeレベルの機能を提供し、他のPodがその特定のNodeで正しく動作するようにする場合、Podのコピーが全てまたは特定のホスト上で常に稼働していることが重要な場合や、他のPodの前に起動させる必要があるときにDaemonSetを使ってください。 例えば、[ネットワークプラグイン](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/)には、DaemonSetとして動作するコンポーネントが含まれていることがよくあります。DaemonSetコンポーネントは、それが動作しているNodeでクラスターネットワークが動作していることを確認します。 ## {{% heading "whatsnext" %}} * [Pod](/ja/docs/concepts/workloads/pods/)について学ぶ。 * Kubernetesの{{< glossary_tooltip text="コントロールプレーン" term_id="control-plane" >}}コンポーネントを実行するのに便利な[静的Pod](#static-pods)について学ぶ。 * DaemonSetの使用方法を確認する * [DaemonSetでローリングアップデートを実施する](/docs/tasks/manage-daemon/update-daemon-set/) * [DaemonSetでロールバックを実行する](/docs/tasks/manage-daemon/rollback-daemon-set/) (例えば、ロールアウトが期待通りに動作しなかった場合)。 * [Node上へのPodのスケジューリング](/ja/docs/concepts/scheduling-eviction/assign-pod-node/)の仕組みを理解する * よくDaemonSetとして実行される[デバイスプラグイン](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/)と[アドオン](/ja/docs/concepts/cluster-administration/addons/)について学ぶ。 * `DaemonSet`は、Kubernetes REST APIのトップレベルのリソースです。デーモンセットのAPIを理解するため{{< api-reference page="workload-resources/daemon-set-v1" >}}オブジェクトの定義を読む。 </ins>

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Updated Japanese translation for the file. Why is this needed There are several updates in and therefore this page is outdated. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --/language ja
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign