Question: card: name: contribute weight: 50 <del> title: Translating the docs </del> <ins> title: Localizing the docs </ins> --- <!-- overview -->

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be /enhanced? I could have directly raised a PR for it, but i didn't found the file where its written, so raising it as issue. I think "Localizing" word could be better fit here than "Translating", and across K8s site "Localization" term is used everywhere so... Page: ! <!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --<!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --
/language en /sig docs
/retitle Update link text terminology to 'Localizing' instead of 'Translating' on docs home page
/priority backlog /triage accepted
plz plz i want work this. /assign
Can you please let me know how to proceed with making the change? I'm relatvely new contributor. Any pointers will be help me. Thanks:)
The employs to render the Markdown file as a corresponding HTML page. (See and ) To address the issue with link text displayed on the page. Navigate to the markdown file  , go to , and change the attribute in the markdown front matter, to see if it resolves the problem. I hope this suggestion will be of assistance!
wow thanks for taking effort to explain this. Would have taken you less time to fix this yourself than explain me here(lol). Appreciate it, thanks a lot!
Submitted pull request please review when get time. thanks!


Question: <!-- overview --> <del> Kubernetes reserves all labels and annotations in the kubernetes.io namespace. </del> <ins> Kubernetes reserves all labels and annotations in the kubernetes.io and k8s.io namespaces. </ins> This document serves both as a reference to the values and as a coordination point for assigning values.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: "Well-Known Labels, Annotations and Taints" says Except it's actually AND (?) cc Proposed Solution: Add Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--Filing an issue so I don't forget this. See discussion
/assign
I think and both hold the same meaning.
/triage accepted


Question: ### Access to key and certificate <del> As described earlier, you need to create a Kubernetes CA key and certificate, and distribute it to the master nodes. </del> <ins> As described earlier, you need to create a Kubernetes CA key and certificate, and distribute it to the control plane nodes. </ins> These will be used by the controller-manager to sign the kubelet certificates. Since these signed certificates will, in turn, be used by the kubelet to authenticate as a regular kubelet to kube-apiserver, it is important that the CA

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: uses the outdated term “master” and “master node”. Proposed Solution: Replace references to the control plane that use the term “master” with the current term: “control plane”. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /language en /kind cleanup /wg naming
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/retitle “Kubelet TLS Bootstrapping” uses outdated wording
I would like to take up this issue
/assign


Question:
Type: Gauge

kube_apiserver_nodeport_allocator_allocation_errors_total

Number of errors trying to allocate NodePort

Stability Level:ALPHA

Type: Counter

Labels:scope

kube_apiserver_nodeport_allocator_allocation_total

Number of NodePort allocations

Stability Level:ALPHA

Type: Counter

Labels:scope

kube_apiserver_nodeport_allocator_available_ports

Gauge measuring the number of available NodePorts for Services

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: removed metric from the documented metrics for Kubernetes v1.30, but the metric is still collected for the API server (ref: and ). Proposed Solution: Reinstate the documentation for such metric. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--Kubernetes Version: v1.30 <!--Additional Information:--
/sig instrumentation
/triage accepted
This metrics exists in the file generated by . Or there is a problem with the file generated by before. Let me generate the metrics file again and see. /assign
After I re-ran the script, some metrics were indeed missing (not just metrics ), it was a problem with the generated script, I will take a closer look.


Question: <ins> --- title: 从 dockershim 迁移遥测和安全代理 content_type: task weight: 70 --- <!-- title: Migrating telemetry and security agents from dockershim content_type: task reviewers: - SergeyKanzhelev weight: 70 --> <!-- overview --> <!-- With Kubernetes 1.20 dockershim was deprecated. From the [Dockershim Deprecation FAQ](/blog/2020/12/02/dockershim-faq/) you might already know that most apps do not have a direct dependency on runtime hosting containers. However, there are still a lot of telemetry and security agents that has a dependency on docker to collect containers metadata, logs and metrics. This document aggregates information on how to detect tese dependencies and links on how to migrate these agents to use generic tools or alternative runtimes. --> 在 Kubernetes 1.20 版本中，dockershim 被弃用。 在博文[弃用 Dockershim 常见问题](/zh/blog/2020/12/02/dockershim-faq/)中， 你大概已经了解到，大多数应用并没有直接通过运行时来托管容器。 但是，仍然有大量的遥测和安全代理依赖 docker 来收集容器元数据、日志和指标。 本文汇总了一些信息和链接：信息用于阐述如何探查这些依赖，链接用于解释如何迁移这些代理去使用通用的工具或其他容器运行。 <!-- ## Telemetry and security agents --> ## 遥测和安全代理 {#telemetry-and-security-agents} <!-- There are a few ways agents may run on Kubernetes cluster. Agents may run on nodes directly or as DaemonSets. --> 为了让代理运行在 Kubernetes 集群中，我们有几种办法。 代理既可以直接在节点上运行，也可以作为守护进程运行。 <!-- ### Why do telemetry agents rely on Docker? --> ### 为什么遥测代理依赖于 Docker？ {#why-do-telemetry-agents-relyon-docker} <!-- Historically, Kubernetes was built on top of Docker. Kubernetes is managing networking and scheduling, Docker was placing and operating containers on a node. So you can get scheduling-related metadata like a pod name from Kubernetes and containers state information from Docker. Over time more runtimes were created to manage containers. Also there are projects and Kubernetes features that generalize container status information extraction across many runtimes. --> 因为历史原因，Kubernetes 建立在 Docker 之上。 Kubernetes 管理网络和调度，Docker 则在具体的节点上定位并操作容器。 所以，你可以从 Kubernetes 取得调度相关的元数据，比如 Pod 名称；从 Docker 取得容器状态信息。 后来，人们开发了更多的运行时来管理容器。 同时一些项目和 Kubernetes 特性也不断涌现，支持跨多个运行时收集容器状态信息。 <!-- Some agents are tied specifically to the Docker tool. The agents may run commands like [`docker ps`](https://docs.docker.com/engine/reference/commandline/ps/) or [`docker top`](https://docs.docker.com/engine/reference/commandline/top/) to list containers and processes or [docker logs](https://docs.docker.com/engine/reference/commandline/logs/) to subscribe on docker logs. With the deprecating of Docker as a container runtime, these commands will not work any longer. --> 一些代理和 Docker 工具紧密绑定。此类代理可以这样运行命令，比如用 [`docker ps`](https://docs.docker.com/engine/reference/commandline/ps/) 或 [`docker top`](https://docs.docker.com/engine/reference/commandline/top/) 这类命令来列出容器和进程，用 [docker logs](https://docs.docker.com/engine/reference/commandline/logs/) 订阅 Docker 的日志。 但随着 Docker 作为容器运行时被弃用，这些命令将不再工作。 <!-- ### Identify DaemonSets that depend on Docker {#identify-docker-dependency } --> ### 识别依赖于 Docker 的 DaemonSet {#identify-docker-dependency} <!-- If a pod wants to make calls to the `dockerd` running on the node, the pod must either: - mount the filesystem containing the Docker daemon's privileged socket, as a {{< glossary_tooltip text="volume" term_id="volume" >}}; or - mount the specific path of the Docker daemon's privileged socket directly, also as a volume. --> 如果某 Pod 想调用运行在节点上的 `dockerd`，该 Pod 必须满足以下两个条件之一： - 将包含 Docker 守护进程特权套接字的文件系统挂载为一个{{< glossary_tooltip text="卷" term_id="volume" >}}；或 - 直接以卷的形式挂载 Docker 守护进程特权套接字的特定路径。 <!-- For example: on COS images, Docker exposes its Unix domain socket at `/var/run/docker.sock` This means that the pod spec will include a `hostPath` volume mount of `/var/run/docker.sock`. --> 举例来说：在 COS 镜像中，Docker 通过 `/var/run/docker.sock` 开放其 Unix 域套接字。 这意味着 Pod 的规约中需要包含 `hostPath` 卷以挂载 `/var/run/docker.sock`。 <!-- Here's a sample shell script to find Pods that have a mount directly mapping the Docker socket. This script outputs the namespace and name of the pod. You can remove the grep `/var/run/docker.sock` to review other mounts. --> 下面是一个 shell 示例脚本，用于查找包含直接映射 Docker 套接字的挂载点的 Pod。 你也可以删掉 grep `/var/run/docker.sock` 这一代码片段以查看其它挂载信息。 ```bash kubectl get pods --all-namespaces  -o=jsonpath='{range .items[*]}{"n"}{.metadata.namespace}{":t"}{.metadata.name}{":t"}{range .spec.volumes[*]}{.hostPath.path}{", "}{end}{end}'  | sort  | grep '/var/run/docker.sock' ``` <!-- There are alternative ways for a pod to access Docker on the host. For instance, the parent directory `/var/run` may be mounted instead of the full path (like in [this example](https://gist.github.com/itaysk/7bc3e56d69c4d72a549286d98fd557dd)). The script above only detects the most common uses. --> {{< note >}} 对于 Pod 来说，访问宿主机上的 Docker 还有其他方式。 例如，可以挂载 `/var/run` 的父目录而非其完整路径 （就像[这个例子](https://gist.github.com/itaysk/7bc3e56d69c4d72a549286d98fd557dd)）。 上述脚本只检测最常见的使用方式。 {{< /note >}} <!-- ### Detecting Docker dependency from node agents --> ### 检测节点代理对 Docker 的依赖性 {#detecting-docker-dependency-from-node-agents} <!-- In case your cluster nodes are customized and install additional security and telemetry agents on the node, make sure to check with the vendor of the agent whether it has dependency on Docker. --> 在你的集群节点被定制、且在各个节点上均安装了额外的安全和遥测代理的场景下， 一定要和代理的供应商确认：该代理是否依赖于 Docker。 <!-- ### Telemetry and security agent vendors --> ### 遥测和安全代理的供应商 {#telemetry-and-security-agent-vendors} <!-- We keep the work in progress version of migration instructions for various telemetry and security agent vendors in [Google doc](https://docs.google.com/document/d/1ZFi4uKit63ga5sxEiZblfb-c23lFhvy6RXVPikS8wf0/edit#). Please contact the vendor to get up to date instructions for migrating from dockershim. --> 我们通过 [谷歌文档](https://docs.google.com/document/d/1ZFi4uKit63ga5sxEiZblfb-c23lFhvy6RXVPikS8wf0/edit#) 提供了为各类遥测和安全代理供应商准备的持续更新的迁移指导。 请与供应商联系，获取从 dockershim 迁移的最新说明。 </ins>

This is a Feature Request translate /docs/tasks/administer-cluster/migrating-from-dockershim/migrating-telemetry-and-security- What would you like to be /zh/docs/tasks/administer-cluster/migrating-from-dockershim/migrating-telemetry-and-security- /assign /language zh
/triage accepted


Question: title: Secret and configuration management description: > Deploy and update secrets and application configuration without rebuilding your image and without exposing secrets in your stack configuration. <del> weight: 50 </del> <ins> weight: 30 </ins> --- {{% capture overview %}}

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be write a new concept page: (or possibly ) If the does not work as the page overview, consider tweaking the glossary entry so that it does. Then use a Hugo shortcode. Why is this needed ConfigMap is a core object type for Kubernetes; as such, it needs documenting properly. Comments Consider using as an example for page structure. It's better to put Task-style documentation in task pages such as and then hyperlink to those from the Concept page. Also see: /docs/user-guide/configmap need more details on ConfigMap updates Actionable user-guide/configmap does not document self-updating It's unclear what happens when ConfigMap is changed Need doc on using ConfigMap updates Wanted: ConfigMap Rollout Options Doc
/language en /sig apps
/priority important-longterm
This is worth prioritizing /priority important-soon
/remove-priority important-longterm
/project Doc Sprints
/assign
/unassign
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
Still worth documenting /remove-lifecycle stale
/reopen let's collaborate on this!


Question: ``` Find out more information about container runtimes <del> on [Container Runtimes](/docs/setup/production-environment/container-runtimes/) page. </del> <ins> on [Container Runtimes](/docs/setup/production-environment/container-runtimes/) page. ## Find out what container runtime endpoint you use {#which-endpoint} The container runtime talks to the kubelet over a Unix socket using the [CRI protocol](/docs/concepts/architecture/cri/), which is based on the gRPC framework. The kubelet acts as a client, and the runtime acts as the server. In some cases, you might find it useful to know which socket your nodes use. For example, with the removal of dockershim in Kubernetes 1.24 and later, you might want to know whether you use Docker Engine with dockershim. {{<note>}} If you currently use Docker Engine in your nodes with `cri-dockerd`, you aren't affected by the dockershim removal. {{</note>}} You can check which socket you use by checking the kubelet configuration on your nodes. 1.  Read the starting commands for the kubelet process: ``` tr 0 ' ' < /proc/"$(pgrep kubelet)"/cmdline ``` If you don't have `tr` or `pgrep`, check the command line for the kubelet process manually. 1.  In the output, look for the `--container-runtime` flag and the `--container-runtime-endpoint` flag. *   If your nodes use Kubernetes v1.23 and earlier and these flags aren't present or if the `--container-runtime` flag is not `remote`, you use the dockershim socket with Docker Engine. *   If the `--container-runtime-endpoint` flag is present, check the socket name to find out which runtime you use. For example, `unix:///run/containerd/containerd.sock` is the containerd endpoint. If you use Docker Engine with the dockershim, [migrate to a different runtime](/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd/), or, if you want to continue using Docker Engine in v1.24 and later, migrate to a CRI-compatible adapter like [`cri-dockerd`](https://github.com/Mirantis/cri-dockerd). </ins>  No newline at end of file

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Update to explain how to tell apart two cases that involve Docker Engine as a container runtime Docker Engine + dockershim + kubelet Docker Engine + cri-dockerd + kubelet The second case, using 2 third-party components, is not affected by the dockership deprecation. As a project we are not telling cri-dockerd users to migrate away. Why is this needed If someone is using cri-dockerd with Docker Engine, they don't need to take action relating to the deprecation of dockershim. That person might visit and then be confused about whether they still need to take action. Comments /sig node /priority important-soon /language en /kind feature Part of
Very relevant to
It really should say , rather than It doesn't say "for cri-containerd" or "for containerd with cri plugin", either. Adding an example could be done too, but not relevant here. It is covered on
Neither nor seem to have a way to tell the CRI in use ? They only describe the container runtime, and in some cases the API version... Needed to look at directly. The output of didn't help.
Looks like crictl is only documented under "debugging", even if required ? That is, is now required even for Docker (it wasn't, for dockershim)
/triage accepted
I think it would be more interesting to look at users using the "docker" container runtime, to see if they have changed CRI... They would need to change their CRI, from to cri- Including kubelet and crictl configuration ? But they don't need to relearn everything or transfer images, etc.
This should say "docker" (which the command does), and not (not really relevant) They main reason is in the confusion between container runtimes, and the CRI being used for them ? "This section presents information you need to know when migrating from dockershim to other container runtimes." Which of course doesn't make any sense to begin with, since dockershim is not a container runtime.

So it should be divided into two: 1) how to change dockershim to cri-dockerd 2) how to change docker to containerd Of course, if you are already set on replacing the container runtime, then you don't need to bother with the first one.
That seems fair enough. We can also add instructions for switching your node from Docker Engine to something else, if we want.
where feasible we prefer to link to external docs that are specific to external tools, rather than document them ourselves. This case seems like a reasonable case for doing the documenting ourselves.
Unfortunately it also assumes that there are any good external docs, which doesn't seem to be the case for either CRI ? It is a big problem for minikube, the only container runtime which is easy to install (i.e. ) is no longer supported. So we end up having to pre-install all three of them, rather than doing some simple provisioning before the bootstrapping. "Patches accepted", I suppose...
Visual summary: ! The top diagram would be when running Kubernetes 1.23, and the bottom diagram would be when running Kubernetes 1.24 The docker installation () stays the same, the only introduction is the new cri-dockerd ()
From what I understand, needs to add info about how cri-dockerd users aren't affected, and how to check the CRI socket to tell if you do use cri-dockerd. (how? if crictl is not installed, is there another way?) Also, needs more guidance for migrating from dockershim to cri-dockerd (in addition to migrating from Docker Engine to containerd). Is this out of scope for this issue? /assign
I'd say yes: it is out of scope for this issue. It's fine to track a separate issue to add docs for that.
I believe that is mandatory, without dockershim But I assume you would look at kubelet configuration If it doesn't have any configuration, it is using dockershim. And thus it would be affected by this change. So far, we don't know what the minimum requirements on Kubernetes version and Docker version is, for it. But we can assume that anything after 1.20 and 19.03 should be fine, for changing to cri-dockerd 0.2.x.

The recommendation would probably be to go with 1.24 and 20.10, and assuming a real release of 0.2.1 ? This is now up to Mirantis to describe, for cri-dockerd. Kubernetes version | Validated version --- | ---- 12 | 17.03 13 | 18.06 14 | 18.09 18 | 19.03 20 | ???
There is a . If you talk CRI to some unidentified CRI socket and the thing at the other end identifies itself as Docker Engine, odds on you're talking to or . You can narrow it down by running . That's likely to give you either the PID and name of the daemon involved, or possibly point to a socket-activation tool such as systemd. If it is systemd owning the socket, you'd grep through systemd config to find what's configured to listen on that socket.
Is this essentially an umbrella issue for and now?
It's all done!


Question: <ins> <?xml version="1.0" encoding="utf-8"?> <svg xmlns="http://www.w3.org/2000/svg" role="img" viewBox="-4.48 -0.73 440.96 431.46"> <style>svg {enable-background:new 0 0 432 432}</style> <style>.st0{fill:#fff}</style> <path d="M417.8 258.6c-1.1-.2-2.5-.6-3.5-.8-4.2-.7-7.6-.6-11.5-1-8.5-.8-15.3-1.6-21.6-3.6-2.5-1-4.3-4-5.2-5.2l-4.9-1.4c2.5-18.2 1.8-37.3-2.5-56.2-4.4-19.2-12.2-36.7-22.5-52.2 1.3-1.2 3.6-3.2 4.2-3.8.2-2.1 0-4.4 2.2-6.8 4.8-4.4 10.7-8.1 17.9-12.6 3.4-2 6.6-3.3 10.1-5.8.7-.5 1.8-1.5 2.6-2.1 5.8-4.7 7.1-12.6 3-17.8-4.1-5.2-12.2-5.7-18-1.1-.8.6-1.9 1.5-2.6 2.1-3.3 2.8-5.2 5.5-7.9 8.5-5.9 6-10.9 11.1-16.2 14.7-2.3 1.4-5.7.8-7.3.8l-4.6 3.3c-26.1-27.4-61.7-44.9-100-48.4-.1-1.6-.2-4.6-.3-5.4-1.6-1.5-3.5-2.8-3.9-6-.5-6.5.3-13.4 1.4-21.8.5-3.9 1.5-7.2 1.7-11.4v-3.4c0-7.4-5.4-13.3-12.1-13.3s-12.1 6-12.1 13.3v.3c0 1-.1 2.2 0 3.1.1 4.2 1.1 7.5 1.7 11.4 1.1 8.4 1.9 15.3 1.4 21.8-.5 2.4-2.3 4.7-3.9 6.2l-.3 5.1c-7.2.6-14.5 1.7-21.8 3.4-31.3 7.1-58.2 23.2-78.7 45-1.4-1-3.7-2.5-4.3-3.1-2.1.3-4.3 1-7.2-.7-5.4-3.6-10.3-8.7-16.2-14.7-2.8-2.9-4.7-5.6-7.9-8.5-.7-.6-1.9-1.5-2.6-2.1-2.5-2-5.5-3.1-8.4-3.2-3.7-.1-7.3 1.3-9.6 4.2-4.1 5.2-2.9 13.1 3 17.8.1 0 .1.1.2.1.8.6 1.8 1.5 2.5 2 3.4 2.5 6.6 3.8 9.9 5.8 7.2 4.4 13.2 8.1 17.9 12.6 1.8 2 2.2 5.4 2.4 7l3.8 3.5c-20.6 31.1-30.3 69.5-24.6 108.7l-5.1 1.5c-1.4 1.7-3.2 4.4-5.2 5.2-6.2 1.9-13.2 2.6-21.6 3.6-3.9.3-7.4.1-11.5 1-1 .2-2.2.5-3.2.7h-.3c-7.1 1.7-11.6 8.3-10.2 14.7 1.5 6.5 8.4 10.4 15.6 8.8h.2c.1 0 .1-.1.2-.1 1-.2 2.2-.4 3.1-.7 4.1-1.1 7.1-2.8 10.8-4.1 7.9-2.9 14.6-5.3 21-6.1 2.6-.2 5.5 1.7 6.9 2.4l5.3-1c12.1 37.5 37.4 67.7 69.4 86.8l-2.2 5.3c.7 2 1.7 4.8 1.1 6.8-2.3 6-6.3 12.5-10.9 19.6-2.2 3.3-4.4 5.8-6.5 9.6-.5 1-1.1 2.3-1.6 3.3-3.1 6.7-.8 14.3 5.1 17.1 6 2.9 13.4-.1 16.6-6.8.4-1 1.1-2.2 1.5-3.1 1.7-3.9 2.2-7.3 3.5-11 3.2-8 5-16.4 9.3-21.7 1.2-1.5 3.2-2 5.2-2.5l2.8-5c27.9 10.7 59.3 13.7 90.5 6.6 7.1-1.6 14-3.7 20.6-6.2.7 1.4 2.2 4 2.5 4.7 2 .6 4.3 1.1 6.1 3.7 3.3 5.6 5.5 12.3 8.3 20.2 1.2 3.8 1.8 7.1 3.5 11 .4.8 1.1 2.1 1.5 3.1 3.2 6.7 10.7 9.7 16.6 6.8 5.9-2.9 8.3-10.5 5.1-17.1-.4-1-1.1-2.3-1.6-3.3-2-3.8-4.2-6.3-6.5-9.6-4.6-7.1-8.4-13-10.7-19.2-1-3.2.2-5.1 1-7.1-.4-.5-1.5-3.5-2-4.9 33.3-19.7 57.9-51.1 69.4-87.4 1.6.2 4.2.7 5.2 1 1.8-1.2 3.5-2.8 6.8-2.5 6.5 1 13 3.3 21 6.1 3.7 1.4 6.7 3.1 10.8 4.1.8.2 2.1.4 3.1.6.1 0 .1.1.2.1h.2c7.1 1.6 14.1-2.3 15.6-8.8 1.4-6.3-3.1-12.8-10.2-14.5zM293 126.9h-60.5l-1.5-25.8c22.9 2.8 44.3 11.9 62 25.8zm-105-23.7c4.3-1 8.6-1.7 12.8-2.2l-1.5 25.8h-61.1c14.3-11 31.1-19.2 49.8-23.6zM148.8 330c-7.1-4.6-13.7-9.7-19.7-15.7h26.1l-6.4 15.7zm95.2 16.7c-23.5 5.3-46.8 3.7-67.9-3.5l15.9-28.8h48.3l16 28.9c-4 1.3-8.2 2.5-12.3 3.4zm39.5-16.4l-6.6-15.9h26.6c-6.2 6-12.8 11.3-20 15.9zm45.6-34.9H102.8V246h226.3v49.4zM113 219.3c.6-.7 1.3-1.5 1.9-2.2s1.2-1.5 1.7-2.1c.5-.6 1.1-1.3 1.4-1.7h7.4c-1.5 1.8-3 3.5-4.3 5.1-1.4 1.6-3 3.3-4.7 5 .8.7 1.7 1.7 2.6 2.8.8 1.1 1.8 2.2 2.6 3.4.8 1.2 1.6 2.3 2.3 3.5.7 1.2 1.3 2.2 1.8 3.2h-7.2c-.4-.7-1-1.6-1.5-2.5s-1.2-1.8-1.8-2.8c-.6-1-1.3-1.8-2-2.6s-1.4-1.6-2.1-2.1v10.1h-6.5v-32.6l6.2-1.1v19c.8-.9 1.4-1.6 2.2-2.4zm22.5 10.4c.5 1 1.5 1.4 3 1.4.4 0 1 0 1.4-.1.5 0 1-.1 1.4-.1v-17.6h6.2v22c-1.1.3-2.4.6-4.1.8-1.7.2-3.5.4-5.3.4-1.9 0-3.4-.2-4.7-.7s-2.2-1.3-3-2.2c-.7-1-1.3-2-1.6-3.4-.3-1.3-.4-2.8-.4-4.3v-12.7h6.2v12c.2 2.1.4 3.7.9 4.5zm26.4-16.6c.7-.2 1.6-.2 2.4-.2 1.6 0 3 .3 4.1.8 1.2.5 2.2 1.4 3.1 2.4.8 1.1 1.4 2.3 1.8 3.7.4 1.4.6 3.1.6 4.9s-.2 3.5-.7 5-1.3 2.8-2.2 3.8c-1 1.1-2.2 1.8-3.6 2.4-1.5.5-3.1.8-4.9.8-.7 0-1.6 0-2.3-.1l-2.4-.3c-.8-.1-1.6-.2-2.3-.4-.7-.1-1.4-.3-1.9-.5v-31.9l6.2-1.1v11.3c.6-.2 1.3-.4 2.1-.6zM186 230c1.1.7 2.5 1.2 4.2 1.2 1.2 0 2.2-.1 3.4-.3 1.1-.2 2-.5 2.8-.8l.8 5.3c-.3.2-.7.3-1.4.5-.5.2-1.2.3-1.9.4-.7.1-1.4.2-2.2.3-.7.1-1.6.1-2.3.1-2 0-3.7-.3-5.2-1s-2.6-1.5-3.7-2.5c-1-1.1-1.7-2.3-2.1-3.7-.4-1.5-.7-3-.7-4.7 0-2 .3-3.8 1-5.3s1.4-2.8 2.3-3.8 2.1-1.8 3.4-2.3 2.5-.7 3.9-.7c3.2 0 5.6 1 7.4 3s2.8 4.9 2.8 8.8v1.3c0 .4-.1.8-.1 1.2h-14.2c.1 1.2.7 2.3 1.8 3zm17.4 6.2v-21.6c1.2-.4 2.4-.7 4-1.2 1.5-.3 3.2-.5 5.1-.5.3 0 .7 0 1.3.1.4 0 1 .1 1.4.2.4.1 1 .2 1.4.2.4.1.8.2 1.3.3l-1.1 5.3c-.5-.1-1.3-.3-2-.4-.7-.1-1.6-.2-2.4-.2-.4 0-.8 0-1.4.1s-1 .1-1.3.2v17.5h-6.3zm29.7-16.5c-.5-.8-1.5-1.3-3-1.3-.4 0-1 0-1.4.1-.5 0-1 .1-1.4.1v17.6h-6.2v-22c1.1-.3 2.4-.6 4.1-.8 1.7-.2 3.5-.4 5.3-.4 1.9 0 3.4.2 4.7.7 1.3.5 2.2 1.3 3 2.1.7 1 1.3 2 1.6 3.3s.4 2.6.4 4.2v12.9h-6.3v-12.1c-.1-2.1-.3-3.6-.8-4.4zM253 230c1.1.7 2.5 1.2 4.2 1.2 1.2 0 2.2-.1 3.4-.3 1.1-.2 2-.5 2.8-.8l.8 5.3c-.3.2-.7.3-1.4.5-.5.2-1.2.3-1.9.4s-1.4.2-2.2.3c-.7.1-1.6.1-2.3.1-2 0-3.7-.3-5.2-1s-2.6-1.5-3.7-2.5c-1-1.1-1.7-2.3-2.1-3.7-.4-1.5-.7-3-.7-4.7 0-2 .3-3.8 1-5.3.6-1.5 1.4-2.8 2.3-3.8 1-1.1 2.1-1.8 3.4-2.3 1.3-.5 2.5-.7 3.9-.7 3.2 0 5.6 1 7.4 3 1.8 2 2.8 4.9 2.8 8.8v1.3c0 .4-.1.8-.1 1.2h-14.2c.1 1.2.7 2.3 1.8 3zm30.9-16.7v5.4h-7.5v8c0 1.4.2 2.4.7 3.3.4.8 1.4 1.2 2.8 1.2.6 0 1.4-.1 2.1-.2.7-.1 1.4-.3 1.9-.5l.8 5.1c-.7.3-1.6.6-2.5.8-1 .2-2 .3-3.4.3-1.7 0-3.2-.2-4.2-.7-1.2-.5-2-1.2-2.6-2-.6-.8-1.2-1.9-1.4-3.1-.3-1.2-.4-2.5-.4-4v-19.2l6.2-1.1v6.8h7.5v-.1zm11.4 16.7c1.1.7 2.5 1.2 4.2 1.2 1.2 0 2.2-.1 3.4-.3 1.1-.2 2-.5 2.8-.8l.8 5.3c-.3.2-.7.3-1.4.5-.5.2-1.2.3-1.9.4s-1.4.2-2.2.3c-.7.1-1.6.1-2.3.1-2 0-3.7-.3-5.2-1-1.5-.6-2.6-1.5-3.7-2.5-1-1.1-1.7-2.3-2.1-3.7-.4-1.5-.7-3-.7-4.7 0-2 .3-3.8 1-5.3.6-1.5 1.4-2.8 2.3-3.8 1-1.1 2.1-1.8 3.4-2.3 1.3-.5 2.5-.7 3.9-.7 3.2 0 5.6 1 7.4 3s2.8 4.9 2.8 8.8v1.3c0 .4-.1.8-.1 1.2h-14.2c.1 1.2.8 2.3 1.8 3zm26-1.6c-.6-.4-1.6-.8-2.9-1.3-1-.4-1.9-.7-2.6-1.2-.8-.4-1.5-.8-2-1.5-.5-.6-1-1.3-1.3-2-.3-.7-.4-1.7-.4-2.9 0-2.1.7-3.8 2.3-5.1 1.6-1.3 3.7-1.9 6.3-1.9 1.4 0 2.6.1 3.9.3 1.3.2 2.2.5 3 .8l-1.1 5.1c-.7-.2-1.5-.5-2.3-.7-.8-.2-1.8-.3-2.9-.3-2 0-3 .5-3 1.7 0 .2 0 .5.1.7.1.2.2.4.5.6.3.2.6.4 1.1.6.4.2 1 .4 1.7.7 1.4.5 2.5 1.1 3.4 1.6.8.5 1.6 1.1 2.1 1.7.5.6.8 1.3 1.1 2 .2.7.3 1.6.3 2.5 0 2.2-.8 3.9-2.4 5.1-1.6 1.2-3.9 1.7-7 1.7-2 0-3.6-.2-4.9-.5-1.3-.3-2.2-.6-2.8-.8l1.1-5.3c1.1.4 2.1.7 3.3 1.1 1.2.2 2.2.3 3.3.3 1.2 0 2-.1 2.4-.3.4-.2.7-.6.7-1.4-.1-.4-.4-.8-1-1.3zm7.8-32.7H102.8v-49.3h226.3v49.3z" class="st0"/> <path d="M301.6 220.8c-.1-.5-.4-1-.7-1.4-.3-.4-.7-.7-1.3-1-.5-.2-1.1-.4-1.8-.4s-1.3.1-1.8.3c-.5.2-1 .5-1.3 1-.3.4-.6.8-.7 1.4-.2.5-.3 1.1-.4 1.6h8.3c-.1-.4-.2-1-.3-1.5zm-43.1-1.4c-.3-.4-.7-.7-1.3-1-.5-.2-1.1-.4-1.8-.4s-1.3.1-1.8.3c-.5.2-1 .5-1.3 1-.3.4-.6.8-.7 1.4-.2.5-.3 1.1-.4 1.6h8.3c0-.5-.1-1.1-.3-1.6s-.4-.8-.7-1.3zM159.7 231c.3.1.7.1 1.2.1.4 0 1 .1 1.6.1 1.7 0 3-.6 3.9-1.8.8-1.2 1.3-2.9 1.3-4.9 0-4.1-1.5-6.2-4.4-6.2-.6 0-1.3.1-1.9.2-.6.2-1.2.4-1.5.6V231h-.2zm31.8-11.6c-.3-.4-.7-.7-1.3-1-.5-.2-1.1-.4-1.8-.4s-1.3.1-1.8.3c-.5.2-1 .5-1.3 1-.3.4-.6.8-.7 1.4-.2.5-.3 1.1-.4 1.6h8.3c0-.5-.1-1.1-.3-1.6-.3-.5-.4-.8-.7-1.3zm-54.1-39.2l-3.5-3.6c-2 1.8-3.7 3-6.6 3-4.3 0-7.3-3.6-7.3-7.8v-.1c0-4.3 3.1-7.8 7.3-7.8 2.5 0 4.4 1.1 6.5 2.9l3.5-4c-2.3-2.3-5.2-3.9-9.8-3.9-7.7 0-13.1 5.8-13.1 13v.1c0 7.2 5.5 12.9 12.9 12.9 4.6-.2 7.5-2 10.1-4.7zm10.8-6.2H160v-4.8h-11.8v-5.1h13.5v-4.9h-19v25.1h19.1v-5h-13.6zm40.3-6.4c0-2.4-.7-4.4-2.1-5.8-1.7-1.7-4.1-2.5-7.3-2.5h-11.4v25.1h5.5v-8h4.3l5.4 8h6.5l-6.1-9c3-1.3 5.2-3.8 5.2-7.8zm-15.4 3.8v-7.2h5.5c2.6 0 4.3 1.3 4.3 3.6v.1c0 2.1-1.6 3.6-4.2 3.6l-5.6-.1zm19.5-12.2v5.1h7.7v20h5.5v-20h7.6v-5.1zm26.2 0h5.5v25.1h-5.5zm12.7 0v25.1h5.5v-9.7h12v-5.1h-12v-5.3h13.6v-5zm24.6 0h5.5v25.1h-5.5zm12.7 25.1h19.1v-5h-13.6V174h11.8v-4.8h-11.8v-5.1h13.4v-4.9h-18.9zm34.7 0c7.8 0 13.3-5.5 13.3-12.6v-.1c0-7.1-5.4-12.5-13.3-12.5h-9.7v25.1h9.7v.1zm-4.3-20.1h4.2c4.6 0 7.5 3.1 7.5 7.5v.1c0 4.4-3.1 7.5-7.5 7.5h-4.2v-15.1zM117.9 278.8l1.5-3.7h6.9l1.5 3.7h3.7l-7-16.4h-3.3l-7 16.4h3.7zm4.9-12.1l2.1 5.3h-4.3l2.2-5.3zm17.6-4.2H134v16.3h6.3c5.1 0 8.7-3.6 8.7-8.1.1-4.7-3.5-8.2-8.6-8.2zm4.9 8.3c0 2.9-2 4.9-4.9 4.9h-2.8v-9.8h2.8c3-.1 4.9 1.9 4.9 4.9zm19.6 8h3.6v-16.3h-3.9l-4.2 6.9-4.3-6.9h-3.9v16.3h3.5v-10.6l4.6 6.9h.1l4.5-6.9zm7.7-16.3h3.6v16.3h-3.6zm11.2 5.9l7.9 10.4h3.1v-16.3h-3.6v10.1l-7.6-10.1h-3.3v16.3h3.5zm15-5.9h3.6v16.3h-3.6zm13.6 13.3c-1.9 0-3.4-.7-4.9-2l-2.1 2.5c1.9 1.8 4.4 2.6 6.9 2.6 3.5 0 6-1.8 6-5.1 0-2.9-1.9-4-5.2-4.9-2.9-.7-3.5-1.1-3.5-2.1 0-.7.7-1.4 2.1-1.4s2.8.6 4.2 1.6l1.9-2.8c-1.7-1.4-3.7-2.1-6-2.1-3.3 0-5.7 1.9-5.7 4.9 0 3.3 2.1 4.1 5.4 5 2.8.7 3.3 1.2 3.3 2.1-.1 1.2-1 1.7-2.4 1.7zm12.4 3h3.6v-13h4.9v-3.3h-13.4v3.3h4.9zm14.9-5.2h2.8l3.5 5.2h4.2l-4-5.8c2.1-.7 3.5-2.4 3.5-5.1 0-1.6-.5-2.9-1.4-3.7-1.1-1.1-2.6-1.7-4.8-1.7h-7.4v16.3h3.6v-5.2zm0-7.8h3.6c1.8 0 2.9.7 2.9 2.3 0 1.4-1 2.3-2.8 2.3h-3.6l-.1-4.6zm17 9.4h6.9l1.5 3.7h3.7l-7-16.4h-3.3l-7 16.4h3.7l1.5-3.7zm3.4-8.5l2.1 5.3h-4.3l2.2-5.3zm7.9-.9h5v13h3.6v-13h5v-3.3H268zm23.6-3.5c-5.1 0-8.7 3.8-8.7 8.5s3.6 8.4 8.7 8.4 8.7-3.8 8.7-8.5c-.1-4.7-3.7-8.4-8.7-8.4zm4.9 8.5c0 2.8-2 5.1-4.9 5.1s-5-2.3-5-5.1 2-5.1 4.9-5.1c3-.1 5 2.2 5 5.1zm6.9-8.3v16.3h3.6v-5.2h2.8l3.5 5.2h4.2l-4-5.8c2.1-.7 3.5-2.4 3.5-5.1 0-1.6-.5-2.9-1.4-3.7-1.1-1.1-2.6-1.7-4.8-1.7h-7.4zm10 5.6c0 1.4-1 2.3-2.8 2.3H307v-4.7h3.6c1.7.1 2.8.8 2.8 2.4z" class="st0"/> </svg> </ins>

This is feedback by email from within the CNCF/Linux Foundation: add the CKA/CKAD logos from to the page.
I'll take care of this, so assign it to me :)
/assign


Question: {{ end }} </tbody> </table> <ins> {{- end -}} </ins>

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Migrate to instead of Hugo's Why is this needed Upstream Hugo has deprecated , which we use. We should aim to migrate to use ; see Comments We may need to upgrade to a newer Hugo as part of this work, or related to it. /area web-development /lifecycle frozen
/triage accepted /priority backlog
Let me see if I can assist with this. Edit: Proposed fix in /assign


Question: See [Participating in SIG Docs](/docs/contribute/participate/) for more details about roles and permissions. --> <del> ## 入门 </del> <ins> ## 入门 {#getting-started} </ins> 任何人都可以提出文档方面的问题（issue），或贡献一个变更，用拉取请求（PR）的方式提交到 [GitHub 上的 `kubernetes/website` 仓库](https://github.com/kubernetes/website)。

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Chinese page is different with English version page. Proposed Solution: Update Chinese page Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
/language zh /assign
thanks reviews and approvement from xichengliudui, tengqm and idealhack


Question: ### Cloud native security {#further-reading-cloud-native} <del> * CNCF [white paper](https://github.com/cncf/tag-security/tree/main/security-whitepaper) </del> <ins> * CNCF [white paper](https://github.com/cncf/tag-security/blob/main/community/resources/security-whitepaper/v2/CNCF_cloud-native-security-whitepaper-May2022-v2.pdf) </ins> on cloud native security. * CNCF [white paper](https://github.com/cncf/tag-security/blob/f80844baaea22a358f5b20dca52cd6f72a32b066/supply-chain-security/supply-chain-security-paper/CNCF_SSCP_v1.pdf) on good practices for securing a software supply chain.

The CNCF on cloud native security defines security controls and practices that are appropriate to different lifecycle phases 404 link
/language en
/assign
/retitle Broken link to CNCF white paper in "Cloud Native Security" page /kind bug Page reported in issue (based on initial title):
/priority backlog /triage accepted


Question: --days=10000  build-server-full server nopass <del> <!-- 1.  Copy `pki/ca.crt`, `pki/issued/server.crt`, and `pki/private/server.key` to your directory. 1.  Fill in and add the following parameters into the API server start parameters: --> 1.  拷贝文件 `pki/ca.crt`、`pki/issued/server.crt` 和 `pki/private/server.key` 到你的目录中。 1.  在 API 服务器的启动参数中添加以下参数： </del> <ins> <!-- 4.  Copy `pki/ca.crt`, `pki/issued/server.crt`, and `pki/private/server.key` to your directory. --> 4.  拷贝文件 `pki/ca.crt`、`pki/issued/server.crt` 和 `pki/private/server.key` 到你的目录中。 <!-- 5.  Fill in and add the following parameters into the API server start parameters: --> 5.  在 API 服务器的启动参数中添加以下参数： </ins> --client-ca-file=/yourdirectory/ca.crt --tls-cert-file=/yourdirectory/server.crt

Link to The secondary list elements in the page are all "1." , they are not in order, it looks weird
/sig docs
Hi can you please elaborate which page are you talking about?
Sorry, I forgot to check the link in my issue, the correct link is
/language zh /triage accepted /retitle [zh] Wrong list numbering in page FYI: Page to update: page: file:
/assign
/assign
This fixes this issue.
please avoid assigning yourself to a issue that is already assigned to somebody else.


Question: <ins> --- # Removed from Kubernetes title: ReadOnlyAPIDataVolumes content_type: feature_gate _build: list: never render: false stages: - stage: beta defaultValue: true fromVersion: "1.8" toVersion: "1.9" - stage: stable fromVersion: "1.10" toVersion: "1.10" removed: true --- Set [`configMap`](/docs/concepts/storage/volumes/#configmap), [`secret`](/docs/concepts/storage/volumes/#secret), [`downwardAPI`](/docs/concepts/storage/volumes/#downwardapi) and [`projected`](/docs/concepts/storage/volumes/#projected) {{< glossary_tooltip term_id="volume" text="volumes" >}} to be mounted read-only. Since Kubernetes v1.10, these volume types are always read-only and you cannot opt out. </ins>

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: It seems that Kubernetes previously had a feature gate named ; however, does not mention that feature gate. Proposed Solution: Update to mention . Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
A web page that mentions the former feature gate:
/assign
/triage accepted /language en
/sig storage
According to CHANGELOG:
Hi so from this reference we don't need to add feature gate? and if so can we close this issue ?
We do need to update that page. Because the feature gate is no longer in active use, we'd add it to
This is a low-priority issue!
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle rotten [1]:
/remove-lifecycle rotten
/priority important-longterm
I don't see any updates; so unassigning you. Please feel free to assign, if you come back here again and are willing to work on /unassign
/assign
How's this work going?
i would like to work on it. /assign
Thanks


Question: --- title: Extending your Kubernetes Cluster reviewers: - erictune - lavalamp - cheftako - chenopis content_type: concept weight: 10 ---  Kubernetes is highly configurable and extensible. As a result, there is rarely a need to fork or submit patches to the Kubernetes project code. This guide describes the options for customizing a Kubernetes cluster. It is aimed at {{< glossary_tooltip text="cluster operators" term_id="cluster-operator" >}} who want to understand how to adapt their Kubernetes cluster to the needs of their work environment. Developers who are prospective {{< glossary_tooltip text="Platform Developers" term_id="platform-developer" >}} or Kubernetes Project {{< glossary_tooltip text="Contributors" term_id="contributor" >}} will also find it useful as an introduction to what extension points and patterns exist, and their trade-offs and limitations.  ## Overview Customization approaches can be broadly divided into *configuration*, which only involves changing flags, local configuration files, or API resources; and *extensions*, which involve running additional programs or services. This document is primarily about extensions. ## Configuration *Configuration files* and *flags* are documented in the Reference section of the online documentation, under each binary: * [kubelet](/docs/reference/command-line-tools-reference/kubelet/) * [kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/) * [kube-controller-manager](/docs/reference/command-line-tools-reference/kube-controller-manager/) * [kube-scheduler](/docs/reference/command-line-tools-reference/kube-scheduler/). Flags and configuration files may not always be changeable in a hosted Kubernetes service or a distribution with managed installation. When they are changeable, they are usually only changeable by the cluster administrator. Also, they are subject to change in future Kubernetes versions, and setting them may require restarting processes. For those reasons, they should be used only when there are no other options. *Built-in Policy APIs*, such as [ResourceQuota](/docs/concepts/policy/resource-quotas/), [PodSecurityPolicies](/docs/concepts/policy/pod-security-policy/), [NetworkPolicy](/docs/concepts/services-networking/network-policies/) and Role-based Access Control ([RBAC](/docs/reference/access-authn-authz/rbac/)), are built-in Kubernetes APIs. APIs are typically used with hosted Kubernetes services and with managed Kubernetes installations. They are declarative and use the same conventions as other Kubernetes resources like pods, so new cluster configuration can be repeatable and be managed the same way as applications. And, where they are stable, they enjoy a [defined support policy](/docs/reference/using-api/deprecation-policy/) like other Kubernetes APIs. For these reasons, they are preferred over *configuration files* and *flags* where suitable. ## Extensions Extensions are software components that extend and deeply integrate with Kubernetes. They adapt it to support new types and new kinds of hardware. Most cluster administrators will use a hosted or distribution instance of Kubernetes. As a result, most Kubernetes users will not need to install extensions and fewer will need to author new ones. ## Extension Patterns Kubernetes is designed to be automated by writing client programs. Any program that reads and/or writes to the Kubernetes API can provide useful automation. *Automation* can run on the cluster or off it. By following the guidance in this doc you can write highly available and robust automation. Automation generally works with any Kubernetes cluster, including hosted clusters and managed installations. There is a specific pattern for writing client programs that work well with Kubernetes called the *Controller* pattern. Controllers typically read an object's `.spec`, possibly do things, and then update the object's `.status`. A controller is a client of Kubernetes. When Kubernetes is the client and calls out to a remote service, it is called a *Webhook*. The remote service is called a *Webhook Backend*. Like Controllers, Webhooks do add a point of failure. In the webhook model, Kubernetes makes a network request to a remote service. In the *Binary Plugin* model, Kubernetes executes a binary (program). Binary plugins are used by the kubelet (e.g. [Flex Volume Plugins](/docs/concepts/storage/volumes/#flexvolume) and [Network Plugins](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/)) and by kubectl. Below is a diagram showing how the extension points interact with the Kubernetes control plane.   ## Extension Points This diagram shows the extension points in a Kubernetes system.   1. Users often interact with the Kubernetes API using `kubectl`. [Kubectl plugins](/docs/tasks/extend-kubectl/kubectl-plugins/) extend the kubectl binary. They only affect the individual user's local environment, and so cannot enforce site-wide policies. 2. The apiserver handles all requests. Several types of extension points in the apiserver allow authenticating requests, or blocking them based on their content, editing content, and handling deletion. These are described in the [API Access Extensions](/docs/concepts/extend-kubernetes/#api-access-extensions) section. 3. The apiserver serves various kinds of *resources*. *Built-in resource kinds*, like `pods`, are defined by the Kubernetes project and can't be changed. You can also add resources that you define, or that other projects have defined, called *Custom Resources*, as explained in the [Custom Resources](/docs/concepts/extend-kubernetes/#user-defined-types) section. Custom Resources are often used with API Access Extensions. 4. The Kubernetes scheduler decides which nodes to place pods on. There are several ways to extend scheduling. These are described in the [Scheduler Extensions](/docs/concepts/extend-kubernetes/#scheduler-extensions) section. 5. Much of the behavior of Kubernetes is implemented by programs called Controllers which are clients of the API-Server. Controllers are often used in conjunction with Custom Resources. 6. The kubelet runs on servers, and helps pods appear like virtual servers with their own IPs on the cluster network. [Network Plugins](/docs/concepts/extend-kubernetes/#network-plugins) allow for different implementations of pod networking. 7. The kubelet also mounts and unmounts volumes for containers. New types of storage can be supported via [Storage Plugins](/docs/concepts/extend-kubernetes/#storage-plugins). If you are unsure where to start, this flowchart can help. Note that some solutions may involve several types of extensions.   ## API Extensions ### User-Defined Types Consider adding a Custom Resource to Kubernetes if you want to define new controllers, application configuration objects or other declarative APIs, and to manage them using Kubernetes tools, such as `kubectl`. Do not use a Custom Resource as data storage for application, user, or monitoring data. For more about Custom Resources, see the [Custom Resources concept guide](/docs/concepts/extend-kubernetes/api-extension/custom-resources/). ### Combining New APIs with Automation The combination of a custom resource API and a control loop is called the [Operator pattern](/docs/concepts/extend-kubernetes/operator/). The Operator pattern is used to manage specific, usually stateful, applications. These custom APIs and control loops can also be used to control other resources, such as storage or policies. ### Changing Built-in Resources When you extend the Kubernetes API by adding custom resources, the added resources always fall into a new API Groups. You cannot replace or change existing API groups. Adding an API does not directly let you affect the behavior of existing APIs (e.g. Pods), but API Access Extensions do. ### API Access Extensions When a request reaches the Kubernetes API Server, it is first Authenticated, then Authorized, then subject to various types of Admission Control. See [Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access/) for more on this flow. Each of these steps offers extension points. Kubernetes has several built-in authentication methods that it supports. It can also sit behind an authenticating proxy, and it can send a token from an Authorization header to a remote service for verification (a webhook). All of these methods are covered in the [Authentication documentation](/docs/reference/access-authn-authz/authentication/). ### Authentication [Authentication](/docs/reference/access-authn-authz/authentication/) maps headers or certificates in all requests to a username for the client making the request. Kubernetes provides several built-in authentication methods, and an [Authentication webhook](/docs/reference/access-authn-authz/authentication/#webhook-token-authentication) method if those don't meet your needs. ### Authorization [Authorization](/docs/reference/access-authn-authz/webhook/) determines whether specific users can read, write, and do other operations on API resources. It works at the level of whole resources -- it doesn't discriminate based on arbitrary object fields. If the built-in authorization options don't meet your needs, and [Authorization webhook](/docs/reference/access-authn-authz/webhook/) allows calling out to user-provided code to make an authorization decision. ### Dynamic Admission Control After a request is authorized, if it is a write operation, it also goes through [Admission Control](/docs/reference/access-authn-authz/admission-controllers/) steps. In addition to the built-in steps, there are several extensions: *   The [Image Policy webhook](/docs/reference/access-authn-authz/admission-controllers/#imagepolicywebhook) restricts what images can be run in containers. *   To make arbitrary admission control decisions, a general [Admission webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks) can be used. Admission Webhooks can reject creations or updates. ## Infrastructure Extensions ### Storage Plugins [Flex Volumes](/docs/concepts/storage/volumes/#flexvolume) allow users to mount volume types without built-in support by having the Kubelet call a Binary Plugin to mount the volume. ### Device Plugins Device plugins allow a node to discover new Node resources (in addition to the builtin ones like cpu and memory) via a [Device Plugin](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/). ### Network Plugins Different networking fabrics can be supported via node-level [Network Plugins](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/). ### Scheduler Extensions The scheduler is a special type of controller that watches pods, and assigns pods to nodes. The default scheduler can be replaced entirely, while continuing to use other Kubernetes components, or [multiple schedulers](/docs/tasks/extend-kubernetes/configure-multiple-schedulers/) can run at the same time. This is a significant undertaking, and almost all Kubernetes users find they do not need to modify the scheduler. The scheduler also supports a [webhook](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/scheduling/scheduler_extender.md) that permits a webhook backend (scheduler extension) to filter and prioritize the nodes chosen for a pod. ## {{% heading "whatsnext" %}} * Learn more about [Custom Resources](/docs/concepts/extend-kubernetes/api-extension/custom-resources/) * Learn about [Dynamic admission control](/docs/reference/access-authn-authz/extensible-admission-controllers/) * Learn more about Infrastructure extensions * [Network Plugins](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) * [Device Plugins](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/) * Learn about [kubectl plugins](/docs/tasks/extend-kubectl/kubectl-plugins/) * Learn about the [Operator pattern](/docs/concepts/extend-kubernetes/operator/)

Images which are located in are blocked by enterprise firewall, any plan to move the images to other places such as
Hi Can you identify the images that are blocked? For example, mention the URL of the documentation page that uses those images.
This page, , all images are blocked, such as
This will affect all users behind a state-level censoring filter that blocks Google Docs. /kind cleanup /triage accepted /language en
/assign


Question: </img> </div> <div class="includecode" id="{{ $file | anchorize }}"> <del> {{ highlight . $codelang "" }} </del> <ins> {{- highlight . $codelang "" -}} </ins> </div> </div> {{ end }}

I have a suggestion for the "copy to clipboard" option that is available at the right top of any YAML file examples in docs. The copied content when pasted on any editor seems to insert newlines, whereas if same yaml if copied manually by selecting text doesn't insert newlines. The newlines makes the content pretty much unreadable, can this be addressed please? e.g. Text copied using copy to clipboard option: apiVersion: v1 kind: Pod metadata: name: userns spec: hostUsers: false containers: name: shell command: ["sleep", "infinity"] image: debian Below is manually copied YAML: apiVersion: v1 kind: Pod metadata: name: userns spec: hostUsers: false containers: name: shell command: ["sleep", "infinity"] image: debian
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Similar to: /triage duplicate /retitle Blank lines when copying example manifests
This issue is a duplicate of . Related PR:
The Kubernetes project currently lacks enough contributors to adequately respond to all issues. This bot triages un-triaged issues according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue as fresh with Close this issue with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues. This bot triages un-triaged issues according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue as fresh with Close this issue with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at .

/lifecycle rotten [1]:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. This bot triages issues according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Reopen this issue with Mark this issue as fresh with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /close not-planned [1]:
Closing this issue, marking it as "Not Planned". <detailsIn response to : The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closedReopen this issue with Mark this issue as fresh with Offer to help out with [Issue Triage][1] Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: Example: <del> If `kube-proxy` version is **{{< skew latestVersion >}}**: </del> <ins> If `kube-proxy` version is **{{< skew oldestMinorVersion >}}**: </ins> <del> * `kubelet` version must be at the same minor version as **{{< skew latestVersion >}}**. </del> <ins> * `kubelet` version must be at the same minor version as **{{< skew oldestMinorVersion >}}**. </ins> * `kube-apiserver` version must be between **{{< skew oldestMinorVersion >}}** and **{{< skew latestVersion >}}**, inclusive.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The example used to verify the relationship between the version of kube-proxy and kube-apiserver is problematic Proposed Solution: The version of kube-proxy must be less than or euqual to the version of kube-apiserver, so if the version of kube-proxy is 1.18, the version of kube-apiserver can be 1.18, 1.19 and 1.20. The setence should be "kube-apiserver version must be between 1.18 and 1.20, inclusive". Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/kind bug /language en
thanks for finding this problem. PRs welcome! /help /good-first-issue /sig docs architecture /priority important-longterm
This request has been marked as suitable for new contributors. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : thanks for finding this problem. PRs welcome! /good-first-issue /sig docs architecture /priority important-longterm </details
/assign


Question: You should enable this admission controller if you intend to make any use of Kubernetes `ServiceAccount` objects. <ins> Regarding the annotation `kubernetes.io/enforce-mountable-secrets`: While the annotation's name suggests it only concerns the mounting of Secrets, its enforcement also extends to other ways Secrets are used in the context of a Pod. Therefore, it is crucial to ensure that all the referenced secrets are correctly specified in the ServiceAccount. </ins> ### StorageObjectInUseProtection **Type**: Mutating.

The documentation for the annotation on consists of : This leaves unclear the details of the actual effect of the annotation. By checking I was able to determine that setting this annotation to causes the following enforcements: (1) s mounted as must appear in the 's (2) s referenced in in or must appear in the 's (3) s referenced in of s must appear in the 's (1) is implied by the name of the annotation, but the lack of any mention of (2) or (3) in the documentation forced me to check the code to ensure that it wasn't only enforcing mounting of s as the name implies. The documentation also mentions only the field of the , yet the enforcement also takes into account the 's field (which the 's are checked against). The documentation would be improved by describing the actual enforcement behaviour that this feature implements. This feature may also benefit from being mentioned in the document.
/triage accepted /help /kind feature
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /triage accepted /help /kind feature </details
I see , can come up with something like: I'll take this up?
/assign


Question: title: 클러스터(Cluster) id: cluster date: 2019-06-15 <del> full_link: </del> <ins> full_link: </ins> short_description: > <del> 컨테이너화된 애플리케이션을 실행하는 {{< glossary_tooltip text="노드" term_id="node" >}}라고 하는 워커 머신의 집합. 모든 클러스터는 최소 한 개의 워커 노드를 가진다. </del> <ins> 컨테이너화된 애플리케이션을 실행하는 노드라고 하는 워커 머신의 집합. 모든 클러스터는 최소 한 개의 워커 노드를 가진다. </ins> aka: tags: - fundamental - operation --- <del> 컨테이너화된 애플리케이션을 실행하는 노드라고 하는 워커 머신의 집합. 모든 클러스터는 최소 한 개의 워커 노드를 가진다. </del> <ins> 컨테이너화된 애플리케이션을 실행하는 {{< glossary_tooltip text="노드" term_id="node" >}}라고 하는 워커 머신의 집합. 모든 클러스터는 최소 한 개의 워커 노드를 가진다. </ins> <del> <!--more--> </del> <ins> <!--more--> </ins> 워커 노드는 애플리케이션의 구성요소인 {{< glossary_tooltip text="파드" term_id="pod" >}}를 호스트한다. {{< glossary_tooltip text="컨트롤 플레인" term_id="control-plane" >}}은 워커 노드와

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Glossary tooltip code for "node" shouldn't be in the short_description section. It doesn't display it correctly. Proposed Solution: Change it like original document. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--Page to check:
/language ko /assign


Question: ### kubeadm 업그레이드 <del> 1.  모든 워커 노드에서 kubeadm을 업그레이드한다. </del> <ins> -  모든 워커 노드에서 kubeadm을 업그레이드한다. </ins> <del> {{< tabs name="k8s_install_kubeadm_worker_nodes" >}} {{% tab name="Ubuntu, Debian 또는 HypriotOS" %}} </del> <ins> {{< tabs name="k8s_install_kubeadm_worker_nodes" >}} {{% tab name="Ubuntu, Debian 또는 HypriotOS" %}} </ins> # 1.18.x-00의 x를 최신 패치 버전으로 바꾼다 apt-mark unhold kubeadm &&  apt-get update && apt-get install -y kubeadm=1.18.x-00 &&  apt-mark hold kubeadm <ins> - </ins> # apt-get 버전 1.1부터 다음 방법을 사용할 수도 있다 apt-get update &&  apt-get install -y --allow-change-held-packages kubeadm=1.18.x-00 <del> {{% /tab %}} {{% tab name="CentOS, RHEL 또는 Fedora" %}} </del> <ins> {{% /tab %}} {{% tab name="CentOS, RHEL 또는 Fedora" %}} </ins> # 1.18.x-0에서 x를 최신 패치 버전으로 바꾼다 yum install -y kubeadm-1.18.x-0 --disableexcludes=kubernetes <del> {{% /tab %}} {{< /tabs >}} </del> <ins> {{% /tab %}} {{< /tabs >}} </ins> ### 노드 드레인 <del> 1.  스케줄 불가능(unschedulable)으로 표시하고 워크로드를 축출하여 유지 보수할 노드를 준비한다. </del> <ins> -  스케줄 불가능(unschedulable)으로 표시하고 워크로드를 축출하여 유지 보수할 노드를 준비한다. </ins> ```shell # <node-to-drain>을 드레이닝하려는 노드 이름으로 바꾼다.

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Broken layout on "kubeadm " ! Proposed Solution: Check and apply upstream changes. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/language ko
/assign
/unassign This issue already has been assigned to .


Question: kubectl get pod termination-demo -o go-template="{{range .status.containerStatuses}}{{.lastState.terminated.message}}{{end}}" <ins> If you are running a multi-container pod, you can use a Go template to include the container's name. By doing so, you can discover which of the containers is failing: ```shell kubectl get pod multi-container-pod -o go-template='{{range .status.containerStatuses}}{{printf "%s:n%snn" .name .lastState.terminated.message}}{{end}}' ``` </ins> ## Customizing the termination message Kubernetes retrieves termination messages from the termination message file

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be The example works well for a single-container pod. However, it is important for multi-container pods to know which container failed. The following command would show which container failed within the pod: Why is this needed Because the current command only shows the error message, not which container is failing — thus confusing if it is a multi-container pod. This change will hopefully help people running multi-container pods figuring out the faulty container. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --None.
/language en /triage accepted /priority backlog
/assign
Hello developers! I want to contribute to this issue and give info about multi-container. If anyone can guide me to the resources, it would be really helpful.
Hello , thanks for your help. You can take a look at the PR created , and see if you find anything odd. If so, please comment or add a patch to it. Thanks!
Okay!


Question: Secrets that a Pod requests are potentially visible within its containers. Therefore, one Pod does not have access to the Secrets of another Pod. <ins> ### Configure least-privilege access to Secrets To enhance the security measures around Secrets, Kubernetes provides a mechanism: you can annotate a ServiceAccount as `kubernetes.io/enforce-mountable-secrets: "true"`. For more information, you can refer to the [documentation about this annotation](/docs/concepts/security/service-accounts/#enforce-mountable-secrets). </ins> {{< warning >}} Any containers that run with `privileged: true` on a node can access all Secrets used on that node.

The documentation for the annotation on consists of : This leaves unclear the details of the actual effect of the annotation. By checking I was able to determine that setting this annotation to causes the following enforcements: (1) s mounted as must appear in the 's (2) s referenced in in or must appear in the 's (3) s referenced in of s must appear in the 's (1) is implied by the name of the annotation, but the lack of any mention of (2) or (3) in the documentation forced me to check the code to ensure that it wasn't only enforcing mounting of s as the name implies. The documentation also mentions only the field of the , yet the enforcement also takes into account the 's field (which the 's are checked against). The documentation would be improved by describing the actual enforcement behaviour that this feature implements. This feature may also benefit from being mentioned in the document.
/triage accepted /help /kind feature
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /triage accepted /help /kind feature </details
I see , can come up with something like: I'll take this up?
/assign


Question: kubeadm join --token <token> <master-ip>:<master-port> --discovery-token-ca-cert-hash sha256:<hash> ``` <ins> To let kubectl work in the following steps, you need to run these commands as a regular user (which is part of the output above): ``` mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config ``` </ins> Make a record of the `kubeadm join` command that `kubeadm init` outputs. You will need this in a moment.

<!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!--Required Information--This is a... [ ] Feature Request [x] Bug Report Problem: For users using K8S versions 1.8 and lower that don't have the fix contained in it may be necessary to set for the OpenStack cloud provider when installing on OpenStack clusters that expose their Cinder endpoint using paths rather than ports to avoid auto-detection errors such as: This includes for users trying out K8S on a devstack environment, and potentially other deployment tools. In this situation it is possible to resolve using: Valid values for are: With being the default. Proposed Solution: Highlight the bs-version parameter as optional (so not minimal configuration) but required in some circumstances. Page to Update:


Question: Install crictl (required for kubeadm / Kubelet Container Runtime Interface (CRI)) ```bash <del> CRICTL_VERSION="v1.25.0" </del> <ins> CRICTL_VERSION="v1.26.0" </ins> ARCH="amd64" curl -L "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz" | sudo tar -C $DOWNLOAD_DIR -xz ```

This is a Bug Report Problem: The versions of the cri-tools and cni-plugins dependencies was updated in packages, but not in the documentation: Proposed Solution: Update the versions, to match what is in the deb/rpm packages. Currently they are not pinned, but installs the latest: Compared with the deb installation: Page to Update: Kubernetes Version: 27.0 <!--Additional Information:--Related:
/sig cluster-lifecycle /help
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /sig cluster-lifecycle /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/triage accepted /priority backlog
/assign
/unassign


Question: In Kubernetes, there are two ways to expose Pod and container fields to a running container: <del> * [Environment variables](/docs/tasks/inject-data-application/environment-variable-expose-pod-information/#the-downward-api) </del> <ins> * [Environment variables](/docs/tasks/inject-data-application/environment-variable-expose-pod-information/) </ins> * Volume files, as explained in this task Together, these two ways of exposing Pod and container fields are called the

This is a Bug Report <!--Required Information--Problem: The link is dead. The content from the section seems moved into top of the document and glossary in . Proposed Solution: remove fragment from the link change link to or Page to Update: /docs/concepts/workloads/pods/downward-api /docs/tasks/inject-data-application/downward-api-volume-expose-pod-information /docs/tasks/job/indexed-parallel-processing-static
/assign
/language en /triage accepted /help We should find existing hyperlinks to and replace those with links to
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /language en /triage accepted /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/unassign As has already opened a PR
/assign
GitHub didn't allow me to assign the following users: hs0210. Note that only , repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time. For more information please see <detailsIn response to : /assign Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign


Question: 2. Download the Google Cloud public signing key: ```shell <del> curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-archive-keyring.gpg </del> <ins> curl -fsSL https://dl.k8s.io/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-archive-keyring.gpg </ins> ``` 3. Add the Kubernetes `apt` repository:

The documentation for fails in step 2 for debian based installs (particularly ubuntu 22.04) due to a known issue: The workaround is to use instead of the google url:
Page related to the issue: /language en
/retitle Unable to install kubeadm, kubelet and kubectl on Ubuntu 22.04 due to known GPG key issue
PRs welcome /help /sig cluster-lifecycle /triage accepted
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : PRs welcome /sig cluster-lifecycle /triage accepted </details
This is working fine for me. Here are the installation logs.
You can't close an active issue/PR unless you authored it or you are a collaborator. <detailsIn response to : /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Hi try downloading the Kubernetes GPG key and saving it in a location where apt can use it to verify the packages from the Kubernetes repository. You can run the command for same. You can also refer to this comment
it makes sense to update the pages as per the linked comment.
/assign


Question: REST objects, you can `POST` a Service definition to the API server to create a new instance. The name of a Service object must be a valid <del> [DNS label name](/docs/concepts/overview/working-with-objects/names#dns-label-names). </del> <ins> [RFC 1035 label name](/docs/concepts/overview/working-with-objects/names#rfc-1035-label-names). </ins> For example, suppose you have a set of Pods where each listens on TCP port 9376 and contains a label `app=MyApp`:

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Pod / Service names can not start with an alphanumeric character in kubernetes, but should be possible according to RFC1123 Proposed Solution: Change documentation in sections and to: or change kubernetes name check to use the specification in RFC1123. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--Kubernetes Version: 19.11 <!--Additional Information:--
Kubernetes does not strictly follow the RFC.
this might be true, but the documentation says otherwise. eg.
According to the validation logic, starting with alphanumeric characters should be okay. Can you paste the error message you have got?
I tried locally, and getting this error !
Just double checked the validation logic for core v1 Service. Its name must be a RFC1035 label rather than a RFC1123 label. This is something we need to fix in the docs. Related code:
/triage accepted /kind bug /assign


Question: {{< feature-state for_k8s_version="v1.18" state="beta" >}} <del> Podが稼働する時に関連する_オーバーヘッド_リソースを指定できます。オーバーヘッドを宣言すると、クラスター(スケジューラーを含む)がPodとリソースに関する決定を行うときにオーバーヘッドを考慮することができます。 </del> <ins> Podが稼働する時に関連する _オーバーヘッド_ リソースを指定できます。オーバーヘッドを宣言すると、クラスター(スケジューラーを含む)がPodとリソースに関する決定を行うときにオーバーヘッドを考慮することができます。 </ins> Podオーバーヘッドを使うためには、PodOverhead[フィーチャーゲート](/ja/docs/reference/command-line-tools-reference/feature-gates/)を有効にしなければなりません。(デフォルトではonです) PodのオーバーヘッドはRuntimeClass内の`overhead`フィールドによって定義されます。

ref: ! [x] [x] [x] [ ] content/ja/docs/concepts/configuration/manage-resources- [ ] [x] content/ja/docs/concepts/configuration/pod-priority- [x] [x] [ ] content/ja/docs/concepts/containers/runtime- [x] content/ja/docs/concepts/overview/kubernetes- [x] content/ja/docs/concepts/extend-kubernetes/api-extension/custom- [x] content/ja/docs/concepts/overview/working-with- [x] content/ja/docs/concepts/overview/working-with-objects/common- [x] content/ja/docs/concepts/overview/working-with-objects/field- [x] content/ja/docs/concepts/overview/working-with- [x] content/ja/docs/concepts/overview/working-with- [ ] content/ja/docs/concepts/scheduling-eviction/assign-pod- [ ] content/ja/docs/concepts/scheduling-eviction/kube- [x] content/ja/docs/concepts/scheduling-eviction/taint-and- [x] [x] content/ja/docs/concepts/security/pod-security- [x] content/ja/docs/concepts/services- [x] content/ja/docs/concepts/storage/persistent- [x] [x] content/ja/docs/concepts/workloads/controllers/cron- [x] [x] [x] [x] content/ja/docs/concepts/workloads/pods/pod- [x] content/ja/docs/reference/access-authn- [x] content/ja/docs/reference/access-authn- [x] content/ja/docs/setup/production-environment/tools/kubeadm/create-cluster- [x] content/ja/docs/setup/production-environment/tools/kubeadm/troubleshooting- [ ] content/ja/docs/tasks/access-application-cluster/web-ui- [x] content/ja/docs/tasks/debug-application-cluster/get-shell-running- [x] content/ja/docs/tasks/run-application/horizontal-pod-autoscale- [x] content/ja/docs/tasks/run-application/run-single-instance-stateful- [x] content/ja/docs/tutorials/stateful-application/basic-stateful- [x] content/ja/docs/tutorials/stateful- (grep) /language ja
/triage accepted
/assign
/kind bug
I'm facing same issue lol :smiley: Feel free to mention me for review if create PRs for this.


Question: You can delete a ReplicationController without affecting any of its pods. <del> Using kubectl, specify the `--cascade=false` option to [`kubectl delete`](/docs/reference/generated/kubectl/kubectl-commands#delete). </del> <ins> Using kubectl, specify the `--cascade=orphan` option to [`kubectl delete`](/docs/reference/generated/kubectl/kubectl-commands#delete). </ins> When using the REST API or Go client library, you can delete the ReplicationController object.

According to the can get a parameter with a value of "background", "orphan", or "foreground". proposes to use .
Hello Related PRs/issues: So, the page should be updated. /kind bug /language en /help
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : Hello is now deprecated in favor of warning: is deprecated (boolean value) and can be replaced with Cascade=false is deprecated in kubectl 1.21, according to Bug /language en /help </details
/triage accepted
/good-first-issue
This request has been marked as suitable for new contributors. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /good-first-issue </details
/assign
/assign
To : has already assigned himself/herself, and posted a PR ().


Question: ## {{% heading "objectives" %}} <del> * Minikubeへのサンプルアプリケーションのデプロイ </del> <ins> * minikubeへのサンプルアプリケーションのデプロイ </ins> * アプリケーションの実行 * アプリケーションログの確認

This is a Feature Request In the documentation available in , as well as in the link, the term is written as . I'd like to suggest updating it to to align with the and . <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Change occurrences of to . Why is this needed Using the incorrect casing can be misleading, especially for newcomers. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --
/assign
/language ja
/triage accepted


Question: Gli esempi che abbiamo utilizzato fino ad ora si applicano al massimo una singola etichetta a qualsiasi risorsa. Esistono molti scenari in cui è necessario utilizzare più etichette per distinguere i set l'uno dall'altro. <del> Ad esempio, diverse applicazioni utilizzerebbero valori diversi per l'etichetta `app`, ma un'applicazione multilivello, come l'esempio [guestbook](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/), avrebbe inoltre bisogno di distinguere ogni livello. Il frontend potrebbe contenere le seguenti etichette: </del> <ins> Ad esempio, diverse applicazioni utilizzerebbero valori diversi per l'etichetta `app`, ma un'applicazione multilivello, come l'esempio [guestbook](https://github.com/kubernetes/examples/tree/master/guestbook/), avrebbe inoltre bisogno di distinguere ogni livello. Il frontend potrebbe contenere le seguenti etichette: </ins> ```yaml labels:

This is a Bug Report Problem: Regarding , I found the similar broken links on other pages. English pages have already been fixed. ref: it pages also need to be fixed. Proposed Solution: Fixes broken links including {{< param "githubbranch" }} to master. In the case of link to , fixes to {{< param "fullversion" }}. ref:
/assign
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: } window.renderBingSearchResults = () => { <del> var searchTerm  = window.location.search.split("=")[1].split("&")[0], </del> <ins> var searchTerm  = window.location.search.split("=")[1].split("&")[0].replace(/%20/g,' '), </ins> page        = window.location.search.split("=")[2], q           = "site:kubernetes.io " + searchTerm;

Searching keyword including space is not working. If you search one keyword, for example, "command", it will work. But, if "command and args" is input, the search result shows "Fetching results..." and do not return the result.
Hello, Thank you for pointing out the issue! I confirmed the same problem happens when searching the keyword "command and args" (). And I'll investigate the cause of this problem and fix it. /assign
BTW this applies to users using Bing search from China. See PR
are these symptoms still occurring? We're seeing different reports.
I have confirmed that this issue has dissapeared! Thank you for dealing with!
I'm glad to hear that!
I've had this problem now. But it disappeared because I used a different browser (chrome to Firefox).


Question: successfully, `kubectl rollout status` returns a zero exit code. ```shell <del> kubectl rollout status deployment.v1.apps/nginx-deployment </del> <ins> kubectl rollout status deployment/nginx-deployment </ins> ``` The output is similar to this: ```

I am following the minikube tutorial () and find two different ways to getting the roll-out status of an deployment: vs. I am using locally: What is the difference between these two? Might be a good idea to add a node to step number 3 which explains this.
I think that an appropriate improvement that's in line with your comment is to change to run instead. That sounds reasonable to do. /language en /kind cleanup /triage accepted /help
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : I think that an appropriate improvement that's in line with your comment is to change to run instead. /language en /kind cleanup /triage accepted /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/retitle Multiple way to refer to Deployment resource confusing in Deployment concept page
/assign


Question: Update the `simple_deployment.yaml` configuration file to change the image from `nginx:1.7.9` to `nginx:1.11.9`, and delete the `minReadySeconds` field: <del> {% include code.html language="yaml" file="update_deployment.yaml" ghlink="/docs/concepts/tools/update_deployment.yaml" %} </del> <ins> {% include code.html language="yaml" file="update_deployment.yaml" ghlink="/docs/tutorials/object-management-kubectl/update_deployment.yaml" %} </ins> Apply the changes made to the configuration file: ```shell <del> kubectl apply -f http://k8s.io/docs/concepts/tools/kubectl/update_deployment.yaml </del> <ins> kubectl apply -f http://k8s.io/docs/tutorials/object-management-kubectl/update_deployment.yaml </ins> ``` Print the live configuration using `kubectl get`: ``` <del> kubectl get -f http://k8s.io/docs/concepts/tools/kubectl/simple_deployment.yaml -o yaml </del> <ins> kubectl get -f http://k8s.io/docs/tutorials/object-management-kubectl/simple_deployment.yaml -o yaml </ins> ``` The output shows the following changes to the live configuration:

<!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!--Required Information--This is a... <!-- choose one by changing [ ] to [x] --- [ ] Feature Request [x] Bug Report Problem: 404 on Proposed Solution: Update location of Page to Update:


Question:
class: training ---

Build your cloud native career

Kubernetes is at the core of the cloud native movement. Training and certifications from the Linux Foundation and our training partners lets you invest in your career, learn Kubernetes, and make your cloud native projects successful.

Build your cloud native career

Kubernetes is at the core of the cloud native movement. Training and certifications from the Linux Foundation and our training partners lets you invest in your career, learn Kubernetes, and make your cloud native projects successful.

This is feedback by email from within the CNCF/Linux Foundation: add the CKA/CKAD logos from to the page.
I'll take care of this, so assign it to me :)
/assign


Question: ## Configure the kubelet to use containerd as its container runtime <del> Edit the file `/var/lib/kubelet/kubeadm-flags.env` and add the containerd runtime to the flags. `--container-runtime=remote` and </del> <ins> Edit the file `/var/lib/kubelet/kubeadm-flags.env` and add the containerd runtime to the flags; </ins> `--container-runtime-endpoint=unix:///run/containerd/containerd.sock`. Users using kubeadm should be aware that the `kubeadm` tool stores the CRI socket for each host as

Documentation for external etcd cluster for kubernetes 1.27 is not up to date That the documentation doesn't take into consideration the fact that was removed in version 1.27 of kubelet: Restart=always Just try to install kubernetes with an external etcd cluster (which right now doesn't work anyway also for other reasons related to this ) with version 1.27.2 and you'll get: No response <details27.2 </details<detailsself-hosted </details<details</details<detailskubeadm </details<detailscontainerd </details<detailscalico </details
There are no sig labels on this issue. Please add an appropriate label by using one of the following commands: - Please see the for a listing of the SIGs, working groups, and committees available. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/transfer website /assign
removed the comment in v1.27. is not re-generated. I opened to fix it.
/retitle flag still in the documentation for external etcd in version 1.27 despite removal /language en /triage accepted


Question: <!doctype html> <html lang="{{ .Site.Language.Lang }}" class="{{.Params.class}} no-js"> <del> <head> </del> <ins> {{- if eq hugo.Environment "preview" -}} <!-- deploy preview --> {{- end -}} <head {{- if hugo.IsProduction -}}class="live-site"{{- end -}}> </ins> {{ partial "head.html" . }} </head> <body class="td-{{ .Kind }}{{- if ne (lower .Params.cid) "" -}}{{- printf " cid-%s" (lower .Params.cid) -}}{{- end -}}">

Problem: Google search for "kubernetes secrets v2" returns: ! (notice the URL subdomains) Proposed Solution: I need to do some more research but a few things come to mind: is in and set in the couple repos I checked. is set in . I believe this is for non-prod sites that are running, however I believe even the old released sites are considered "production" That is assuming robots tag is the culprit. What's also strange is that the above robot config is set in but doesn't appear in the search results I also think looking at might help. It's possible this problem has been solved and phased out with future releases. /priority important-soon /triage accepted /help /cc
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : Problem: is in and set in the couple repos I checked. is set in . I believe this is for non-prod sites that are running, however I believe even the old released sites are considered "production" /triage accepted /help /cc </details
https://v1- does look wrong. We could override this file explicitly for the older releases (perhaps just as an interim measure?)
In the v1.19 docs, appears in the page head. That's wrong.
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-contributor-experience at . /lifecycle stale
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity. If this issue is safe to close now please do so with . Send feedback to sig-contributor-experience at . /lifecycle rotten
/lifecycle frozen
/retitle Search engines indexing old releases Also, the upcoming release is also being indexed and we don't actually want that. Same cause I think.
Hi and I would like to work on this issue. I can see the proposed solution has already been implemented.

May I know, what new things we need to work on for this issue? Now, Google search for "kubernetes secrets v2" returns: ! /assign
I've proposed a PR to fix this. :crossed_fingers:
/reopen We also need to merge 4 backport PRs.
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
[Backport PRs]
It's fixed. I checked. /close
Closing this issue. <detailsIn response to : It's fixed. I checked. /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: - The code is not generic enough for users to try out. As an example, you can embed the YAML file for creating a Pod which depends on a specific <del> [FlexVolume](/docs/concepts/storage/volumes#flexvolume) implementation. </del> <ins> [FlexVolume](/docs/concepts/storage/volumes/#flexvolume-deprecated) implementation. </ins> - The code is an incomplete example because its purpose is to highlight a portion of a larger file. For example, when describing ways to customize a [RoleBinding](/docs/reference/access-authn-authz/rbac/#role-binding-examples),

Problem: The text on is not working, it should point to these Check the page for the problem. Page to Update: Proposed Solution: It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text FlexVolume to and not to this . /kind document /assign /language en
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : Problem: The text on is not working, it should point to these Check the page for the problem. It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text FlexVolume to and not to this . /assign /language en Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: must be installed on the cluster and the `CSIMigration` and `CSIMigrationAzureDisk` features must be enabled. <ins> #### azureDisk CSI migration complete {{< feature-state for_k8s_version="v1.21" state="alpha" >}} To disable the `azureDisk` storage plugin from being loaded by the controller manager and the kubelet, set the `InTreePluginAzureDiskUnregister` flag to `true`. </ins> ### azureFile {#azurefile} The `azureFile` volume type mounts a Microsoft Azure File volume (SMB 2.1 and 3.0)

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: doesn't mention the feature gate , but it should do. Proposed Solution: Update documentation for migration from in-tree Azure File driver. Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /sig storage /language en
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign


Question: <!-- overview --> This page explains how to add versioning information to <del> [CustomResourceDefinitions](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#customresourcedefinition-v1beta1-apiextensions), to indicate the stability </del> <ins> [CustomResourceDefinitions](/docs/reference/kubernetes-api/extend-resources/custom-resource-definition-v1/), to indicate the stability </ins> level of your CustomResourceDefinitions or advance your API to a new version with conversion between API representations. It also describes how to upgrade an object from one version to another. ## {{% heading "prerequisites" %}}

The link to CustomResourceDefinitions is broken. Rather it should point to
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
The link should actually be to (at least, that's where I recommend linking to) /kind bug /language en
cool, I will update the PR with