Question: <ins> --- layout: blog title: "Kubernetes 1.26：Pod 调度就绪态" date: 2022-12-26 slug: pod-scheduling-readiness-alpha --- <!-- layout: blog title: "Kubernetes 1.26: Pod Scheduling Readiness" date: 2022-12-26 slug: pod-scheduling-readiness-alpha --> <!-- **Author:** Wei Huang (Apple), Abdullah Gharaibeh (Google) --> **作者：** Wei Huang (Apple), Abdullah Gharaibeh (Google) **译者：** XiaoYang Zhang (HuaWei) <!-- Kubernetes 1.26 introduced a new Pod feature: _scheduling gates_. In Kubernetes, scheduling gates are keys that tell the scheduler when a Pod is ready to be considered for scheduling. --> Kubernetes 1.26 引入了一个新的 Pod 特性：**调度门控**。 在 Kubernetes 中，调度门控是通知调度器何时可以考虑 Pod 调度的关键。 <!-- ## What problem does it solve? When a Pod is created, the scheduler will continuously attempt to find a node that fits it. This infinite loop continues until the scheduler either finds a node for the Pod, or the Pod gets deleted. --> ## 它解决了什么问题？ 当 Pod 被创建时，调度器会不断尝试寻找适合它的节点。这个无限循环一直持续到调度程序为 Pod 找到节点，或者 Pod 被删除。 <!-- Pods that remain unschedulable for long periods of time (e.g., ones that are blocked on some external event) waste scheduling cycles. A scheduling cycle may take ≅20ms or more depending on the complexity of the Pod's scheduling constraints. Therefore, at scale, those wasted cycles significantly impact the scheduler's performance. See the arrows in the "scheduler" box below. --> 长时间无法被调度的 Pod（例如，被某些外部事件阻塞的 Pod）会浪费调度周期。 一个调度周期可能需要约 20ms 或更长时间，这取决于 Pod 的调度约束的复杂度。 因此，大量浪费的被调度周期会严重影响调度器的性能。请参阅下面 “调度器” 框中的箭头。 {{< mermaid >}} graph LR; pod((新 Pod))-->queue subgraph 调度器 queue(调度器队列) sched_cycle[/调度周期/] schedulable{可调度?} queue==>|弹出|sched_cycle sched_cycle==>schedulable schedulable==>|否|queue subgraph note [循环浪费在不断重新安排 'unready' 状态的 Pod 上] end end classDef plain fill:#ddd,stroke:#fff,stroke-width:1px,color:#000; classDef k8s fill:#326ce5,stroke:#fff,stroke-width:1px,color:#fff; classDef Scheduler fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; classDef note fill:#edf2ae,stroke:#fff,stroke-width:1px; class queue,sched_cycle,schedulable k8s; class pod plain; class note note; class Scheduler Scheduler; {{< /mermaid >}} <!-- Scheduling gates helps address this problem. It allows declaring that newly created Pods are not ready for scheduling. When scheduling gates are present on a Pod, the scheduler ignores the Pod and therefore saves unnecessary scheduling attempts. Those Pods will also be ignored by Cluster Autoscaler if you have it installed in the cluster. --> 调度门控有助于解决这个问题。它允许声明新创建的 Pod 尚未准备好进行调度。 当 Pod 上设置了调度门控时，调度程序会忽略该 Pod，从而避免不必要的调度尝试。 如果你在集群中安装了 Cluster Autoscaler，这些 Pod 也将被忽略。 <!-- Clearing the gates is the responsibility of external controllers with knowledge of when the Pod should be considered for scheduling (e.g., a quota manager). --> 清除门控是外部控制器的责任，外部控制器知道何时应考虑对 Pod 进行调度（例如，配额管理器）。 {{< mermaid >}} graph LR; pod((新 Pod))-->queue subgraph 调度器 queue(调度器队列) sched_cycle[/调度周期/] schedulable{可调度?} popout{弹出?} queue==>|PreEnqueue 检查|popout popout-->|是|sched_cycle popout==>|否|queue sched_cycle-->schedulable schedulable-->|否|queue subgraph note [控制 Pod 调度的开关] end end classDef plain fill:#ddd,stroke:#fff,stroke-width:1px,color:#000; classDef k8s fill:#326ce5,stroke:#fff,stroke-width:1px,color:#fff; classDef Scheduler fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; classDef note fill:#edf2ae,stroke:#fff,stroke-width:1px; classDef popout fill:#f96,stroke:#fff,stroke-width:1px; class queue,sched_cycle,schedulable k8s; class pod plain; class note note; class popout popout; class Scheduler Scheduler; {{< /mermaid >}} <!-- ## How does it work? Scheduling gates in general works very similar to Finalizers. Pods with a non-empty `spec.schedulingGates` field will show as status `SchedulingGated` and be blocked from scheduling. Note that more than one gate can be added, but they all should be added upon Pod creation (e.g., you can add them as part of the spec or via a mutating webhook). --> ## 它是如何工作的？ 总体而言，调度门控的工作方式与 Finalizer 非常相似。具有非空 `spec.schedulingGates` 字段的 Pod 的状态将显示为 `SchedulingGated`，并阻止被调度。请注意，添加多个门控是可以的，但它们都应该在创建 Pod 时添加（例如，你可以将它们作为规约的一部分或者通过变更性质的 Webhook）。 ``` NAME       READY   STATUS            RESTARTS   AGE test-pod   0/1     SchedulingGated   0          10s ``` <!-- To clear the gates, you update the Pod by removing all of the items from the Pod's `schedulingGates` field. The gates do not need to be removed all at once, but only when all the gates are removed the scheduler will start to consider the Pod for scheduling. --> 要清除这些门控，你可以通过删除 Pod 的 `schedulingGates` 字段中的所有条目来更新 Pod。 不需要一次性移除所有门控，但是，只有当所有门控都移除后，调度器才会开始考虑对 Pod 进行调度。 <!-- Under the hood, scheduling gates are implemented as a PreEnqueue scheduler plugin, a new scheduler framework extension point that is invoked at the beginning of each scheduling cycle. --> 在后台，调度门控以 PreEnqueue 调度器插件的方式实现，这是调度器框架的新扩展点，在每个调度周期开始时调用。 <!-- ## Use Cases An important use case this feature enables is dynamic quota management. Kubernetes supports [ResourceQuota](/docs/concepts/policy/resource-quotas/), however the API Server enforces quota at the time you attempt Pod creation. For example, if a new Pod exceeds the CPU quota, it gets rejected. The API Server doesn't queue the Pod; therefore, whoever created the Pod needs to continuously attempt to recreate it again. This either means a delay between resources becoming available and the Pod actually running, or it means load on the API server and Scheduler due to constant attempts. --> ## 用例 此特性所支持的一个重要使用场景是动态配额管理。Kubernetes 支持[资源配额](/zh-cn/docs/concepts/policy/resource-quotas/)， 但是 API Server 会在你尝试创建 Pod 时强制执行配额。例如，如果一个新的 Pod 超过了 CPU 配额，它就会被拒绝。 API Server 不会对 Pod 进行排队；因此，无论是谁创建了 Pod，都需要不断尝试重新创建它。 这意味着在资源可用和 Pod 实际运行之间会有延迟，或者意味着由于不断尝试，会增加 API Server 和 Scheduler 的负载。 <!-- Scheduling gates allows an external quota manager to address the above limitation of ResourceQuota. Specifically, the manager could add a `example.com/quota-check` scheduling gate to all Pods created in the cluster (using a mutating webhook). The manager would then remove the gate when there is quota to start the Pod. --> 调度门控允许外部配额管理器解决 ResourceQuota 的上述限制。具体来说， 管理员可以（使用变更性质的 Webhook）为集群中创建的所有 Pod 添加一个 `example.com/quota-check` 调度门控。当存在用于启动 Pod 的配额时，管理器将移除此门控 <!-- ## Whats next? To use this feature, the `PodSchedulingReadiness` feature gate must be enabled in the API Server and scheduler. You're more than welcome to test it out and tell us (SIG Scheduling) what you think! --> ## 接下来 要使用此特性，必须在 API Server 和调度器中启用 `PodScheduleingReadiness` 特性门控。 非常欢迎你对其进行测试并告诉我们（SIG Scheduling）你的想法！ <!-- ## Additional resources - [Pod Scheduling Readiness](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-scheduling-readiness/) in the Kubernetes documentation - [Kubernetes Enhancement Proposal](https://github.com/kubernetes/enhancements/blob/master/keps/sig-scheduling/3521-pod-scheduling-readiness/README.md) --> ## 附加资源 - Kubernetes 文档中的 [Pod 调度就绪态](/zh-cn/docs/concepts/scheduling-eviction/pod-scheduling-readiness/) - [Kubernetes 增强提案](https://github.com/kubernetes/enhancements/blob/master/keps/sig-scheduling/3521-pod-scheduling-readiness/README.md) </ins>  No newline at end of file

This is a Feature Request This page has no Chinese version What would you like to be Translate Chinese version for blog2022-12-26-pod-scheduling- Comments /language zh /assign
/triage accepted
Please consider add your name (id) as the translator as we are now requesting for blog translations.


Question: ### Linux ```shell <del> export KUBECONFIG=$KUBECONFIG:$HOME/.kube/config </del> <ins> export KUBECONFIG="${KUBECONFIG}:${HOME}/.kube/config" </ins> ``` ### Windows Powershell

Setting KUBECONFIG variable doesn't work very well on macOS (Monterey 12.2.1). In the line: The first colon (:) will make the following character (c) dissappear: What I get is the mangled text: What works for me better is explicitly using full paths:
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
Thanks for reporting, I can open a PR to fix this! /remove-lifecycle stale /assign


Question:
{{ end }}

 <form class="td-sidebar__search d-flex align-items-center"> {{ partial "search-input.html" . }} <button class="btn btn-link td-sidebar__toggle d-md-none p-0 ml-3 fas fa-bars" type="button" data-toggle="collapse" data-target="#td-section-nav" aria-controls="td-docs-nav" aria-expanded="false" aria-label="Toggle section navigation"> </button> </form>

{{ .Title }}
 {{ if .Site.Params.gcs_engine_id }}  <gcse:searchresults-only></gcse:searchresults-only> {{ else if .Site.Params.k8s_search }}  <gcse:searchresults-only linktarget="_parent">
{{ T "layouts_docs_search_fetching" }}

 </gcse:searchresults-only> {{ end }}

 <form class="td-sidebar__search d-flex align-items-center"> {{ partial "search-input.html" . }} </form>

{{ .Title }}
 {{ if .Site.Params.gcs_engine_id }}  <gcse:searchresults-only></gcse:searchresults-only> {{ else if .Site.Params.k8s_search }}  <gcse:searchresults-only linktarget="_parent">
{{ T "layouts_docs_search_fetching" }}

 </gcse:searchresults-only> {{ end }}

   {{ partial "footer.html" . }}

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Navbar prevents search input field from being clicked on Can reproduce on Firefox, Chrome on latest builds Proposed Solution: Remove navbar from search page Page to Update: !
is not supposed to look like that screenshot /kind bug /priority critical-urgent /area web-development Thanks for reporting this.
/triage accepted
/retitle Navbar prevents search inputfield from being clicked
Actually /retitle Search page rendering incorrectly


Question: 38s        37s        2    {kubelet gke-test-cluster-default-pool-a07e5d30-siqd}                Warning        FailedSync    Error syncing pod, skipping: failed to "StartContainer" for "main" with RunContainerError: "PostStart handler: Error executing in Docker Container: 1" 1m         22s         2     {kubelet gke-test-cluster-default-pool-a07e5d30-siqd}    spec.containers{main}    Warning        FailedPostStartHook ``` <ins> ## What's Next - See an example of [using container lifecycle hooks](/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/) </ins>

It's a nice description of what hooks are and options the user has. But where to configure it? How about an example?
you can find examples of container lifecycle hooks here: I am afraid it is currently a bit hard to find. Thanks for reporting. We should add a link to this /task from the /concept.
That's awesome, thanks a lot!


Question: description: > Learn about ServiceAccount objects in Kubernetes. content_type: concept <del> weight: 10 </del> <ins> weight: 25 </ins> --- <!-- overview -->

This is a Refactor request <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The overview page at is a bit out of date: no reference to I'm not convinced that the “Four Cs of cloud native security” model is useful for readers to learn Does not align with other CNCF documents, such as Proposed Solution: Either: remove outright migrate content from into several destinations (keep this brief but on-point) …and then redirect to Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /sig docs /sig security /language en
If we keep the link to then we should update it to be as this is the English docs.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale /triage accepted
Also see
/assign
I'd appreciate a (fresh) review on .


Question:
 --- title: kube-apiserver content_type: tool-reference weight: 30 auto_generated: true ---  ## {{% heading "synopsis" %}} The Kubernetes API server validates and configures data for the api objects which include pods, services, replicationcontrollers, and others. The API Server services REST operations and provides the frontend to the cluster's shared state through which all other components interact. ``` kube-apiserver [flags] ``` ## {{% heading "options" %}}
 <colgroup> <col span="1" style="width: 10px;" /> <col span="1" /> </colgroup>

 --add-dir-header

If true, adds the file directory to the header of the log messages

 --admission-control-config-file string

File with admission control configuration.

 --advertise-address string

The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.

 --allow-metric-labels stringToString     Default: []

The map from metric-label to value allow-list of this label. The key's format is <MetricName>,<LabelName>. The value's format is <allowed_value>,<allowed_value>...e.g. metric1,label1='v1,v2,v3', metric1,label2='v1,v2,v3' metric2,label1='v1,v2,v3'.

 --allow-privileged

If true, allow privileged containers. [default=false]

 --alsologtostderr

log to standard error as well as files

 --anonymous-auth     Default: true

Enables anonymous requests to the secure port of the API server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated.

 --api-audiences strings

Identifiers of the API. The service account token authenticator will validate that tokens used against the API are bound to at least one of these audiences. If the --service-account-issuer flag is configured and this flag is not, this field defaults to a single element list containing the issuer URL.

 --apiserver-count int     Default: 1

The number of apiservers running in the cluster, must be a positive number. (In use when --endpoint-reconciler-type=master-count is enabled.)

 --audit-log-batch-buffer-size int     Default: 10000

The size of the buffer to store events before batching and writing. Only used in batch mode.

 --audit-log-batch-max-size int     Default: 1

The maximum size of a batch. Only used in batch mode.

 --audit-log-batch-max-wait duration

The amount of time to wait before force writing the batch that hadn't reached the max size. Only used in batch mode.

 --audit-log-batch-throttle-burst int

Maximum number of requests sent at the same moment if ThrottleQPS was not utilized before. Only used in batch mode.

 --audit-log-batch-throttle-enable

Whether batching throttling is enabled. Only used in batch mode.

 --audit-log-batch-throttle-qps float

Maximum average number of batches per second. Only used in batch mode.

 --audit-log-compress

If set, the rotated log files will be compressed using gzip.

 --audit-log-format string     Default: "json"

Format of saved audits. "legacy" indicates 1-line text format for each event. "json" indicates structured json format. Known formats are legacy,json.

 --audit-log-maxage int

The maximum number of days to retain old audit log files based on the timestamp encoded in their filename.

 --audit-log-maxbackup int

The maximum number of old audit log files to retain.

 --audit-log-maxsize int

The maximum size in megabytes of the audit log file before it gets rotated.

 --audit-log-mode string     Default: "blocking"

Strategy for sending audit events. Blocking indicates sending events should block server responses. Batch causes the backend to buffer and write events asynchronously. Known modes are batch,blocking,blocking-strict.

 --audit-log-path string

If set, all requests coming to the apiserver will be logged to this file.  '-' means standard out.

 --audit-log-truncate-enabled

Whether event and batch truncating is enabled.

 --audit-log-truncate-max-batch-size int     Default: 10485760

Maximum size of the batch sent to the underlying backend. Actual serialized size can be several hundreds of bytes greater. If a batch exceeds this limit, it is split into several batches of smaller size.

 --audit-log-truncate-max-event-size int     Default: 102400

Maximum size of the audit event sent to the underlying backend. If the size of an event is greater than this number, first request and response are removed, and if this doesn't reduce the size enough, event is discarded.

 --audit-log-version string     Default: "audit.k8s.io/v1"

API group and version used for serializing audit events written to log.

 --audit-policy-file string

Path to the file that defines the audit policy configuration.

 --audit-webhook-batch-buffer-size int     Default: 10000

The size of the buffer to store events before batching and writing. Only used in batch mode.

 --audit-webhook-batch-max-size int     Default: 400

The maximum size of a batch. Only used in batch mode.

 --audit-webhook-batch-max-wait duration     Default: 30s

The amount of time to wait before force writing the batch that hadn't reached the max size. Only used in batch mode.

 --audit-webhook-batch-throttle-burst int     Default: 15

Maximum number of requests sent at the same moment if ThrottleQPS was not utilized before. Only used in batch mode.

 --audit-webhook-batch-throttle-enable     Default: true

Whether batching throttling is enabled. Only used in batch mode.

 --audit-webhook-batch-throttle-qps float     Default: 10

Maximum average number of batches per second. Only used in batch mode.

 --audit-webhook-config-file string

Path to a kubeconfig formatted file that defines the audit webhook configuration.

 --audit-webhook-initial-backoff duration     Default: 10s

The amount of time to wait before retrying the first failed request.

 --audit-webhook-mode string     Default: "batch"

Strategy for sending audit events. Blocking indicates sending events should block server responses. Batch causes the backend to buffer and write events asynchronously. Known modes are batch,blocking,blocking-strict.

 --audit-webhook-truncate-enabled

Whether event and batch truncating is enabled.

 --audit-webhook-truncate-max-batch-size int     Default: 10485760

Maximum size of the batch sent to the underlying backend. Actual serialized size can be several hundreds of bytes greater. If a batch exceeds this limit, it is split into several batches of smaller size.

 --audit-webhook-truncate-max-event-size int     Default: 102400

Maximum size of the audit event sent to the underlying backend. If the size of an event is greater than this number, first request and response are removed, and if this doesn't reduce the size enough, event is discarded.

 --audit-webhook-version string     Default: "audit.k8s.io/v1"

API group and version used for serializing audit events written to webhook.

 --authentication-token-webhook-cache-ttl duration     Default: 2m0s

The duration to cache responses from the webhook token authenticator.

 --authentication-token-webhook-config-file string

File with webhook configuration for token authentication in kubeconfig format. The API server will query the remote service to determine authentication for bearer tokens.

 --authentication-token-webhook-version string     Default: "v1beta1"

The API version of the authentication.k8s.io TokenReview to send to and expect from the webhook.

 --authorization-mode strings     Default: "AlwaysAllow"

Ordered list of plug-ins to do authorization on secure port. Comma-delimited list of: AlwaysAllow,AlwaysDeny,ABAC,Webhook,RBAC,Node.

 --authorization-policy-file string

File with authorization policy in json line by line format, used with --authorization-mode=ABAC, on the secure port.

 --authorization-webhook-cache-authorized-ttl duration     Default: 5m0s

The duration to cache 'authorized' responses from the webhook authorizer.

 --authorization-webhook-cache-unauthorized-ttl duration     Default: 30s

The duration to cache 'unauthorized' responses from the webhook authorizer.

 --authorization-webhook-config-file string

File with webhook configuration in kubeconfig format, used with --authorization-mode=Webhook. The API server will query the remote service to determine access on the API server's secure port.

 --authorization-webhook-version string     Default: "v1beta1"

The API version of the authorization.k8s.io SubjectAccessReview to send to and expect from the webhook.

 --azure-container-registry-config string

Path to the file containing Azure container registry configuration information.

 --bind-address string     Default: 0.0.0.0

The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank or an unspecified address (0.0.0.0 or ::), all interfaces will be used.

 --cert-dir string     Default: "/var/run/kubernetes"

The directory where the TLS certs are located. If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored.

 --client-ca-file string

If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.

 --cloud-config string

The path to the cloud provider configuration file. Empty string for no configuration file.

 --cloud-provider string

The provider for cloud services. Empty string for no provider.

 --cloud-provider-gce-l7lb-src-cidrs cidrs     Default: 130.211.0.0/22,35.191.0.0/16

CIDRs opened in GCE firewall for L7 LB traffic proxy & health checks

 --contention-profiling

Enable lock contention profiling, if profiling is enabled

 --cors-allowed-origins strings

List of allowed origins for CORS, comma separated.  An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled.

 --default-not-ready-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for notReady:NoExecute that is added by default to every pod that does not already have such a toleration.

 --default-unreachable-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for unreachable:NoExecute that is added by default to every pod that does not already have such a toleration.

 --default-watch-cache-size int     Default: 100

Default watch cache size. If zero, watch cache will be disabled for resources that do not have a default watch size set.

 --delete-collection-workers int     Default: 1

Number of workers spawned for DeleteCollection call. These are used to speed up namespace cleanup.

 --disable-admission-plugins strings

admission plugins that should be disabled although they are in the default enabled plugins list (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PersistentVolumeLabel, PodNodeSelector, PodSecurity, PodSecurityPolicy, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, SecurityContextDeny, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter.

 --disabled-metrics strings

This flag provides an escape hatch for misbehaving metrics. You must provide the fully qualified metric name in order to disable it. Disclaimer: disabling metrics is higher in precedence than showing hidden metrics.

 --egress-selector-config-file string

File with apiserver egress selector configuration.

 --enable-admission-plugins strings

admission plugins that should be enabled in addition to default enabled ones (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PersistentVolumeLabel, PodNodeSelector, PodSecurity, PodSecurityPolicy, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, SecurityContextDeny, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter.

 --enable-aggregator-routing

Turns on aggregator routing requests to endpoints IP rather than cluster IP.

 --enable-bootstrap-token-auth

Enable to allow secrets of type 'bootstrap.kubernetes.io/token' in the 'kube-system' namespace to be used for TLS bootstrapping authentication.

 --enable-garbage-collector     Default: true

Enables the generic garbage collector. MUST be synced with the corresponding flag of the kube-controller-manager.

 --enable-priority-and-fairness     Default: true

If true and the APIPriorityAndFairness feature gate is enabled, replace the max-in-flight handler with an enhanced one that queues and dispatches with priority and fairness

 --encryption-provider-config string

The file containing configuration for encryption providers to be used for storing secrets in etcd

 --endpoint-reconciler-type string     Default: "lease"

Use an endpoint reconciler (master-count, lease, none)

 --etcd-cafile string

SSL Certificate Authority file used to secure etcd communication.

 --etcd-certfile string

SSL certification file used to secure etcd communication.

 --etcd-compaction-interval duration     Default: 5m0s

The interval of compaction requests. If 0, the compaction request from apiserver is disabled.

 --etcd-count-metric-poll-period duration     Default: 1m0s

Frequency of polling etcd for number of resources per type. 0 disables the metric collection.

 --etcd-db-metric-poll-interval duration     Default: 30s

The interval of requests to poll etcd and update metric. 0 disables the metric collection

 --etcd-healthcheck-timeout duration     Default: 2s

The timeout to use when checking etcd health.

 --etcd-keyfile string

SSL key file used to secure etcd communication.

 --etcd-prefix string     Default: "/registry"

The prefix to prepend to all resource paths in etcd.

 --etcd-servers strings

List of etcd servers to connect with (scheme://ip:port), comma separated.

 --etcd-servers-overrides strings

Per-resource etcd servers overrides, comma separated. The individual override format: group/resource#servers, where servers are URLs, semicolon separated. Note that this applies only to resources compiled into this server binary.

 --event-ttl duration     Default: 1h0m0s

Amount of time to retain events.

 --experimental-logging-sanitization

[Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens).
Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.

 --external-hostname string

The hostname to use when generating externalized URLs for this master (e.g. Swagger API Docs or OpenID Discovery).

 --feature-gates <comma-separated 'key=True|False' pairs>

A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
APIListChunking=true|false (BETA - default=true)
APIPriorityAndFairness=true|false (BETA - default=true)
APIResponseCompression=true|false (BETA - default=true)
APIServerIdentity=true|false (ALPHA - default=false)
APIServerTracing=true|false (ALPHA - default=false)
AllAlpha=true|false (ALPHA - default=false)
AllBeta=true|false (BETA - default=false)
AnyVolumeDataSource=true|false (ALPHA - default=false)
AppArmor=true|false (BETA - default=true)
CPUManager=true|false (BETA - default=true)
CPUManagerPolicyOptions=true|false (ALPHA - default=false)
CSIInlineVolume=true|false (BETA - default=true)
CSIMigration=true|false (BETA - default=true)
CSIMigrationAWS=true|false (BETA - default=false)
CSIMigrationAzureDisk=true|false (BETA - default=false)
CSIMigrationAzureFile=true|false (BETA - default=false)
CSIMigrationGCE=true|false (BETA - default=false)
CSIMigrationOpenStack=true|false (BETA - default=true)
CSIMigrationvSphere=true|false (BETA - default=false)
CSIStorageCapacity=true|false (BETA - default=true)
CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
CSIVolumeHealth=true|false (ALPHA - default=false)
CSRDuration=true|false (BETA - default=true)
ConfigurableFSGroupPolicy=true|false (BETA - default=true)
ControllerManagerLeaderMigration=true|false (BETA - default=true)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
DaemonSetUpdateSurge=true|false (BETA - default=true)
DefaultPodTopologySpread=true|false (BETA - default=true)
DelegateFSGroupToCSIDriver=true|false (ALPHA - default=false)
DevicePlugins=true|false (BETA - default=true)
DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
DisableCloudProviders=true|false (ALPHA - default=false)
DownwardAPIHugePages=true|false (BETA - default=false)
EfficientWatchResumption=true|false (BETA - default=true)
EndpointSliceTerminatingCondition=true|false (BETA - default=true)
EphemeralContainers=true|false (ALPHA - default=false)
ExpandCSIVolumes=true|false (BETA - default=true)
ExpandInUsePersistentVolumes=true|false (BETA - default=true)
ExpandPersistentVolumes=true|false (BETA - default=true)
ExpandedDNSConfig=true|false (ALPHA - default=false)
ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
GenericEphemeralVolume=true|false (BETA - default=true)
GracefulNodeShutdown=true|false (BETA - default=true)
HPAContainerMetrics=true|false (ALPHA - default=false)
HPAScaleToZero=true|false (ALPHA - default=false)
IPv6DualStack=true|false (BETA - default=true)
InTreePluginAWSUnregister=true|false (ALPHA - default=false)
InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
InTreePluginGCEUnregister=true|false (ALPHA - default=false)
InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
IndexedJob=true|false (BETA - default=true)
IngressClassNamespacedParams=true|false (BETA - default=true)
JobTrackingWithFinalizers=true|false (ALPHA - default=false)
KubeletCredentialProviders=true|false (ALPHA - default=false)
KubeletInUserNamespace=true|false (ALPHA - default=false)
KubeletPodResources=true|false (BETA - default=true)
KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
LocalStorageCapacityIsolation=true|false (BETA - default=true)
LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
LogarithmicScaleDown=true|false (BETA - default=true)
MemoryManager=true|false (BETA - default=true)
MemoryQoS=true|false (ALPHA - default=false)
MixedProtocolLBService=true|false (ALPHA - default=false)
NetworkPolicyEndPort=true|false (BETA - default=true)
NodeSwap=true|false (ALPHA - default=false)
NonPreemptingPriority=true|false (BETA - default=true)
PodAffinityNamespaceSelector=true|false (BETA - default=true)
PodDeletionCost=true|false (BETA - default=true)
PodOverhead=true|false (BETA - default=true)
PodSecurity=true|false (ALPHA - default=false)
PreferNominatedNode=true|false (BETA - default=true)
ProbeTerminationGracePeriod=true|false (BETA - default=false)
ProcMountType=true|false (ALPHA - default=false)
ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
QOSReserved=true|false (ALPHA - default=false)
ReadWriteOncePod=true|false (ALPHA - default=false)
RemainingItemCount=true|false (BETA - default=true)
RemoveSelfLink=true|false (BETA - default=true)
RotateKubeletServerCertificate=true|false (BETA - default=true)
SeccompDefault=true|false (ALPHA - default=false)
ServiceInternalTrafficPolicy=true|false (BETA - default=true)
ServiceLBNodePortControl=true|false (BETA - default=true)
ServiceLoadBalancerClass=true|false (BETA - default=true)
SizeMemoryBackedVolumes=true|false (BETA - default=true)
StatefulSetMinReadySeconds=true|false (ALPHA - default=false)
StorageVersionAPI=true|false (ALPHA - default=false)
StorageVersionHash=true|false (BETA - default=true)
SuspendJob=true|false (BETA - default=true)
TTLAfterFinished=true|false (BETA - default=true)
TopologyAwareHints=true|false (ALPHA - default=false)
TopologyManager=true|false (BETA - default=true)
VolumeCapacityPriority=true|false (ALPHA - default=false)
WinDSR=true|false (ALPHA - default=false)
WinOverlay=true|false (BETA - default=true)
WindowsHostProcessContainers=true|false (ALPHA - default=false)

 --goaway-chance float

To prevent HTTP/2 clients from getting stuck on a single apiserver, randomly close a connection (GOAWAY). The client's other in-flight requests won't be affected, and the client will reconnect, likely landing on a different apiserver after going through the load balancer again. This argument sets the fraction of requests that will be sent a GOAWAY. Clusters with single apiservers, or which don't use a load balancer, should NOT enable this. Min is 0 (off), Max is .02 (1/50 requests); .001 (1/1000) is a recommended starting point.

 -h, --help

help for kube-apiserver

 --http2-max-streams-per-connection int

The limit that the server gives to clients for the maximum number of streams in an HTTP/2 connection. Zero means to use golang's default.

 --identity-lease-duration-seconds int     Default: 3600

The duration of kube-apiserver lease in seconds, must be a positive number. (In use when the APIServerIdentity feature gate is enabled.)

 --identity-lease-renew-interval-seconds int     Default: 10

The interval of kube-apiserver renewing its lease in seconds, must be a positive number. (In use when the APIServerIdentity feature gate is enabled.)

 --kubelet-certificate-authority string

Path to a cert file for the certificate authority.

 --kubelet-client-certificate string

Path to a client cert file for TLS.

 --kubelet-client-key string

Path to a client key file for TLS.

 --kubelet-preferred-address-types strings     Default: "Hostname,InternalDNS,InternalIP,ExternalDNS,ExternalIP"

List of the preferred NodeAddressTypes to use for kubelet connections.

 --kubelet-timeout duration     Default: 5s

Timeout for kubelet operations.

 --kubernetes-service-node-port int

If non-zero, the Kubernetes master service (which apiserver creates/maintains) will be of type NodePort, using this as the value of the port. If zero, the Kubernetes master service will be of type ClusterIP.

 --lease-reuse-duration-seconds int     Default: 60

The time in seconds that each lease is reused. A lower value could avoid large number of objects reusing the same lease. Notice that a too small value may cause performance problems at storage layer.

 --livez-grace-period duration

This option represents the maximum amount of time it should take for apiserver to complete its startup sequence and become live. From apiserver's start time to when this amount of time has elapsed, /livez will assume that unfinished post-start hooks will complete successfully and therefore return true.

 --log-backtrace-at <a string in the form 'file:N'>     Default: :0

when logging hits line file:N, emit a stack trace

 --log-dir string

If non-empty, write log files in this directory

 --log-file string

If non-empty, use this log file

 --log-file-max-size uint     Default: 1800

Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited.

 --log-flush-frequency duration     Default: 5s

Maximum number of seconds between log flushes

 --logging-format string     Default: "text"

Sets the log format. Permitted formats: "text".
Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule, --log-flush-frequency.
Non-default choices are currently alpha and subject to change without warning.

 --logtostderr     Default: true

log to standard error instead of files

 --master-service-namespace string     Default: "default"

DEPRECATED: the namespace from which the Kubernetes master services should be injected into pods.

 --max-connection-bytes-per-sec int

If non-zero, throttle each user connection to this number of bytes/sec. Currently only applies to long-running requests.

 --max-mutating-requests-inflight int     Default: 200

This and --max-requests-inflight are summed to determine the server's total concurrency limit (which must be positive) if --enable-priority-and-fairness is true. Otherwise, this flag limits the maximum number of mutating requests in flight, or a zero value disables the limit completely.

 --max-requests-inflight int     Default: 400

This and --max-mutating-requests-inflight are summed to determine the server's total concurrency limit (which must be positive) if --enable-priority-and-fairness is true. Otherwise, this flag limits the maximum number of non-mutating requests in flight, or a zero value disables the limit completely.

 --min-request-timeout int     Default: 1800

An optional field indicating the minimum number of seconds a handler must keep a request open before timing it out. Currently only honored by the watch request handler, which picks a randomized value above this number as the connection timeout, to spread out load.

 --oidc-ca-file string

If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file, otherwise the host's root CA set will be used.

 --oidc-client-id string

The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set.

 --oidc-groups-claim string

If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be a string or array of strings. This flag is experimental, please see the authentication documentation for further details.

 --oidc-groups-prefix string

If provided, all groups will be prefixed with this value to prevent conflicts with other authentication strategies.

 --oidc-issuer-url string

The URL of the OpenID issuer, only HTTPS scheme will be accepted. If set, it will be used to verify the OIDC JSON Web Token (JWT).

 --oidc-required-claim <comma-separated 'key=value' pairs>

A key=value pair that describes a required claim in the ID Token. If set, the claim is verified to be present in the ID Token with a matching value. Repeat this flag to specify multiple claims.

 --oidc-signing-algs strings     Default: "RS256"

Comma-separated list of allowed JOSE asymmetric signing algorithms. JWTs with a 'alg' header value not in this list will be rejected. Values are defined by RFC 7518 https://tools.ietf.org/html/rfc7518#section-3.1.

 --oidc-username-claim string     Default: "sub"

The OpenID claim to use as the user name. Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. This flag is experimental, please see the authentication documentation for further details.

 --oidc-username-prefix string

If provided, all usernames will be prefixed with this value. If not provided, username claims other than 'email' are prefixed by the issuer URL to avoid clashes. To skip any prefixing, provide the value '-'.

 --one-output

If true, only write logs to their native severity level (vs also writing to each lower severity level)

 --permit-address-sharing

If true, SO_REUSEADDR will be used when binding the port. This allows binding to wildcard IPs like 0.0.0.0 and specific IPs in parallel, and it avoids waiting for the kernel to release sockets in TIME_WAIT state. [default=false]

 --permit-port-sharing

If true, SO_REUSEPORT will be used when binding the port, which allows more than one instance to bind on the same address and port. [default=false]

 --profiling     Default: true

Enable profiling via web interface host:port/debug/pprof/

 --proxy-client-cert-file string

Client certificate used to prove the identity of the aggregator or kube-apiserver when it must call out during a request. This includes proxying requests to a user api-server and calling out to webhook admission plugins. It is expected that this cert includes a signature from the CA in the --requestheader-client-ca-file flag. That CA is published in the 'extension-apiserver-authentication' configmap in the kube-system namespace. Components receiving calls from kube-aggregator should use that CA to perform their half of the mutual TLS verification.

 --proxy-client-key-file string

Private key for the client certificate used to prove the identity of the aggregator or kube-apiserver when it must call out during a request. This includes proxying requests to a user api-server and calling out to webhook admission plugins.

 --request-timeout duration     Default: 1m0s

An optional field indicating the duration a handler must keep a request open before timing it out. This is the default request timeout for requests but may be overridden by flags such as --min-request-timeout for specific types of requests.

 --requestheader-allowed-names strings

List of client certificate common names to allow to provide usernames in headers specified by --requestheader-username-headers. If empty, any client certificate validated by the authorities in --requestheader-client-ca-file is allowed.

 --requestheader-client-ca-file string

Root certificate bundle to use to verify client certificates on incoming requests before trusting usernames in headers specified by --requestheader-username-headers. WARNING: generally do not depend on authorization being already done for incoming requests.

 --requestheader-extra-headers-prefix strings

List of request header prefixes to inspect. X-Remote-Extra- is suggested.

 --requestheader-group-headers strings

List of request headers to inspect for groups. X-Remote-Group is suggested.

 --requestheader-username-headers strings

List of request headers to inspect for usernames. X-Remote-User is common.

 --runtime-config <comma-separated 'key=value' pairs>

A set of key=value pairs that enable or disable built-in APIs. Supported options are:
v1=true|false for the core API group
<group>/<version>=true|false for a specific API group and version (e.g. apps/v1=true)
api/all=true|false controls all API versions
api/ga=true|false controls all API versions of the form v[0-9]+
api/beta=true|false controls all API versions of the form v[0-9]+beta[0-9]+
api/alpha=true|false controls all API versions of the form v[0-9]+alpha[0-9]+
api/legacy is deprecated, and will be removed in a future version

 --secure-port int     Default: 6443

The port on which to serve HTTPS with authentication and authorization. It cannot be switched off with 0.

 --service-account-extend-token-expiration     Default: true

Turns on projected service account expiration extension during token generation, which helps safe transition from legacy token to bound service account token feature. If this flag is enabled, admission injected tokens would be extended up to 1 year to prevent unexpected failure during transition, ignoring value of service-account-max-token-expiration.

 --service-account-issuer strings

Identifier of the service account token issuer. The issuer will assert this identifier in "iss" claim of issued tokens. This value is a string or URI. If this option is not a valid URI per the OpenID Discovery 1.0 spec, the ServiceAccountIssuerDiscovery feature will remain disabled, even if the feature gate is set to true. It is highly recommended that this value comply with the OpenID spec: https://openid.net/specs/openid-connect-discovery-1_0.html. In practice, this means that service-account-issuer must be an https URL. It is also highly recommended that this URL be capable of serving OpenID discovery documents at {service-account-issuer}/.well-known/openid-configuration. When this flag is specified multiple times, the first is used to generate tokens and all are used to determine which issuers are accepted.

 --service-account-jwks-uri string

Overrides the URI for the JSON Web Key Set in the discovery doc served at /.well-known/openid-configuration. This flag is useful if the discovery docand key set are served to relying parties from a URL other than the API server's external (as auto-detected or overridden with external-hostname). Only valid if the ServiceAccountIssuerDiscovery feature gate is enabled.

 --service-account-key-file strings

File containing PEM-encoded x509 RSA or ECDSA private or public keys, used to verify ServiceAccount tokens. The specified file can contain multiple keys, and the flag can be specified multiple times with different files. If unspecified, --tls-private-key-file is used. Must be specified when --service-account-signing-key is provided

 --service-account-lookup     Default: true

If true, validate ServiceAccount tokens exist in etcd as part of authentication.

 --service-account-max-token-expiration duration

The maximum validity duration of a token created by the service account token issuer. If an otherwise valid TokenRequest with a validity duration larger than this value is requested, a token will be issued with a validity duration of this value.

 --service-account-signing-key-file string

Path to the file that contains the current private key of the service account token issuer. The issuer will sign issued ID tokens with this private key.

 --service-cluster-ip-range string

A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes or pods. Max of two dual-stack CIDRs is allowed.

 --service-node-port-range <a string in the form 'N1-N2'>     Default: 30000-32767

A port range to reserve for services with NodePort visibility. Example: '30000-32767'. Inclusive at both ends of the range.

 --show-hidden-metrics-for-version string

The previous version for which you want to show hidden metrics. Only the previous minor version is meaningful, other values will not be allowed. The format is <major>.<minor>, e.g.: '1.16'. The purpose of this format is make sure you have the opportunity to notice if the next release hides additional metrics, rather than being surprised when they are permanently removed in the release after that.

 --shutdown-delay-duration duration

Time to delay the termination. During that time the server keeps serving requests normally. The endpoints /healthz and /livez will return success, but /readyz immediately returns failure. Graceful termination starts after this delay has elapsed. This can be used to allow load balancer to stop sending traffic to this server.

 --skip-headers

If true, avoid header prefixes in the log messages

 --skip-log-headers

If true, avoid headers when opening log files

 --stderrthreshold int     Default: 2

logs at or above this threshold go to stderr

 --storage-backend string

The storage backend for persistence. Options: 'etcd3' (default).

 --storage-media-type string     Default: "application/vnd.kubernetes.protobuf"

The media type to use to store objects in storage. Some resources or storage backends may only support a specific media type and will ignore this setting.

 --strict-transport-security-directives strings

List of directives for HSTS, comma separated. If this list is empty, then HSTS directives will not be added. Example: 'max-age=31536000,includeSubDomains,preload'

 --tls-cert-file string

File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to the directory specified by --cert-dir.

 --tls-cipher-suites strings

Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.
Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384.
Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA.

 --tls-min-version string

Minimum TLS version supported. Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13

 --tls-private-key-file string

File containing the default x509 private key matching --tls-cert-file.

 --tls-sni-cert-key string

A pair of x509 certificate and private key file paths, optionally suffixed with a list of domain patterns which are fully qualified domain names, possibly with prefixed wildcard segments. The domain patterns also allow IP addresses, but IPs should only be used if the apiserver has visibility to the IP address requested by a client. If no domain patterns are provided, the names of the certificate are extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns trump over extracted names. For multiple key/certificate pairs, use the --tls-sni-cert-key multiple times. Examples: "example.crt,example.key" or "foo.crt,foo.key:*.foo.com,foo.com".

 --token-auth-file string

If set, the file that will be used to secure the secure port of the API server via token authentication.

 --tracing-config-file string

File with apiserver tracing configuration.

 -v, --v int

number for the log level verbosity

 --version version[=true]

Print version information and quit

 --vmodule <comma-separated 'pattern=N' settings>

comma-separated list of pattern=N settings for file-filtered logging

 --watch-cache     Default: true

Enable watch caching in the apiserver

 --watch-cache-sizes strings

Watch cache size settings for some resources (pods, nodes, etc.), comma separated. The individual setting format: resource[.group]#size, where resource is lowercase plural (no version), group is omitted for resources of apiVersion v1 (the legacy core API) and included for others, and size is a number. It takes effect when watch-cache is enabled. Some resources (replicationcontrollers, endpoints, nodes, pods, services, apiservices.apiregistration.k8s.io) have system defaults set by heuristics, others default to default-watch-cache-size

Translate into Japanese. This page has not been translated. /language ja /assign
/triage accepted


Question: <ins> apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: csr-signer rules: - apiGroups: - certificates.k8s.io resources: - certificatesigningrequests verbs: - get - list - watch - apiGroups: - certificates.k8s.io resources: - certificatesigningrequests/status verbs: - update - apiGroups: - certificates.k8s.io resources: - signers resourceName: - example.com/my-signer-name # example.com/* can be used to authorize for all signers in the 'example.com' domain verbs: - sign </ins>

/language zh
/reopen This was incorrectly
Reopened this issue. <detailsIn response to : /reopen This was incorrectly Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign


Question: <!-- overview --> <img src="https://raw.githubusercontent.com/kubernetes/kubeadm/master/logos/stacked/color/kubeadm-stacked-color.png" align="right" width="150px">This page shows how to install the `kubeadm` toolbox. <del> For information how to create a cluster with kubeadm once you have performed this installation process, see the [Using kubeadm to Create a Cluster](/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/) page. </del> <ins> For information on how to create a cluster with kubeadm once you have performed this installation process, see the [Using kubeadm to Create a Cluster](/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/) page. </ins>

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: The statement seems grammatically incorrect due to missing "on" after "information". Proposed Solution: -Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--/language en /good-first-issue <!--Kubernetes Version:--<!--Additional Information:--
This request has been marked as suitable for new contributors. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : This is a Bug Report <!-- See for guidance on writing an actionable issue description. --Problem: The statement seems grammatically incorrect due to missing "on" after "information". /language en /good-first-issue <!--Kubernetes Version:--</details
/assign
/sig cluster-lifecycle /triage accepted


Question: | `app.kubernetes.io/version`         | The current version of the application (e.g., a [SemVer 1.0](https://semver.org/spec/v1.0.0.html), revision hash, etc.) | `5.7.21` | string | | `app.kubernetes.io/component`       | The component within the architecture | `database` | string | | `app.kubernetes.io/part-of`         | The name of a higher level application this one is part of | `wordpress` | string | <del> | `app.kubernetes.io/managed-by`      | The tool being used to manage the operation of an application | `helm` | string | </del> <ins> | `app.kubernetes.io/managed-by`      | The tool being used to manage the operation of an application | `Helm` | string | </ins> To illustrate these labels in action, consider the following {{< glossary_tooltip text="StatefulSet" term_id="statefulset" >}} object:

There is a suggested annotation of: But Helm actually : Which will insert a value of "Helm", with a first character in uppercase. According to , labels are case-sensitive, except for the prefix. (You can notice this discrepancy if you are using the plug-in, as your chart with a lower-case word will always be replaced with upper-case, so a three-way-merge diff shows this as changing every time. I also imagine you could find this if you tried to use the label as a selector) Therefore I recommend that the suggested annotation in this document be replaced with: Caveat: I have no idea if the case changed between helm v2 and v3, but v2 is defunct now, so should be safe to make this change.
This is just an example of what could go in, but I think it might be a good first issue. If you want to work on this, assign yourself to this issue. Update all instances of to , including in the table. You should be able to complete this in GitHub without needing to work on a local clone. For instructions, read .
/language en
Let me help with this. /assign
/triage accepted /good-first-issue
This request has been marked as suitable for new contributors. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /triage accepted /good-first-issue Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: <ins> --- title: Master id: master date: 2020-04-16 short_description: > Legacy term, used as synonym for nodes running the control plane. aka: tags: - fundamental --- Legacy term, used as synonym for {{< glossary_tooltip text="nodes" term_id="node" >}} hosting the {{< glossary_tooltip text="control plane" term_id="control-plane" >}}. <!--more--> The term is still being used by some provisioning tools, such as {{< glossary_tooltip text="kubeadm" term_id="kubeadm" >}}, and managed services, to {{< glossary_tooltip text="label" term_id="label" >}} {{< glossary_tooltip text="nodes" term_id="node" >}} with `kubernetes.io/role` and control placement of {{< glossary_tooltip text="control plane" term_id="control-plane" >}} {{< glossary_tooltip text="pods" term_id="pod" >}}. </ins>  No newline at end of file

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Proposed Solution: Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
The glossary does not contain a definition for Kubernetes object, or Kubernetes master.
Good point /priority backlog /language en We could possibly add a “master” for a synonym for “control plane”, and then in the entry for “control plane” explain the similarities and differences between the two terms.
/help
I'll work on that! /remove-help /assign
and What about creating a entry explaining the concept and listing and as most common values used on it?
Hmm. That term “master” has nuances (it's not as controversial as “slave”, but the implication is still there). Newer thinking seems to favor “control plane” rather than “master”. So you can have nodes that also run the control plane. Does that help guide how to approach this?
I understand your point, but may tools still uses and for the label (ex. ). Also, looks like we already have covered in the glossary (). What about to refactor entry, explaining that nodes can also have a role label, and these are the most common values (and linking to )?
the "master" node role is exclusive to deployers like kubeadm (+some others) and has been excluded from core k8s.


Question: left: 0; background: #fff; } <del> .dropdown-menu { left: -80px; } &.dropdown:hover { color: $medium-grey; } </del> } }

Expected behavior: https://v1- (drop-downs work) Actual behavior: (drop-downs do not work) This may be a issue or a result of non-translated pages not showing up in autogenerated navs. I'm unsure.
/assign /priority important-soon /kind bug
Hello, calestehorgan I investigated this problem quickly and found that (this is the version and language box) seemed to remain when the mouse cursor has hovered. ! Adding the following style makes the problem disappeared: ! Maybe some style is missing or something blocks a style applied.
Thank you for the help!! I'll try it out.
I'm glad to help!


Question: - PRの説明を読み、行われた変更について理解し、関連するissueがあればそれも読みます。 - 他のレビュアのコメントがあれば読みます。 - **Files changed**タブをクリックし、変更されたファイルと行を確認します。 <del> - **Conversation**タブの下にあるPRのbuild checkセクションまでスクロールし、**deploy/netlify**の行の**Details**リンクをクリックして、Netlifyのプレビュービルドで変更点をプレビューします。 </del> <ins> - **Conversation**タブの下にあるPRのbuild checkセクションまでスクロールし、Netlifyのプレビュービルドで変更点をプレビューします。これはスクリーンショットです(これは、GitHubのデスクトップサイトを見せています。タブレットやスマートフォンデバイスでレビューしている場合は、GitHubウェブのUIは少し異なります): {{< figure src="/images/docs/github_netlify_deploy_preview.png" alt="GitHub pull request details including link to Netlify preview" >}} プレビューを開くには、チェックリストの**deploy/netlify**行の**Details**リンクをクリックします。 </ins> 4.  **Files changed**タブに移動してレビューを始めます。 1. コメントしたい場合は行の横の`+`マークをクリックします。 2. その行に関するコメントを書き、**Add single comment**(1つのコメントだけを残したい場合)または**Start a review**(複数のコメントを行いたい場合)のいずれかをクリックします。 <del> 3. コメントをすべて書いたら、ページ上部の**Review changes**をクリックします。ここでは、レビューの要約を追加できます(コントリビューターにポジティブなコメントも書きましょう！)。必要に応じて、PRを承認したり、コメントしたり、変更をリクエストします。新しいコントリビューターの場合は**Comment**だけが行えます。 </del> <ins> 3. コメントをすべて書いたら、ページ上部の**Review changes**をクリックします。ここでは、レビューの要約を追加できます(コントリビューターにポジティブなコメントも書きましょう！)。常に「Comment」を使用してください。 - レビューの終了時、「Request changes」ボタンをクリックしないでください。さらに変更される前にマージされるのをブロックしたい場合、「/hold」コメントを残すことができます。Holdを設定する理由を説明し、必要に応じて、自分や他のレビューアがHoldを解除できる条件を指定してください。 - レビューの終了時、「Approve」ボタンをクリックしないでください。大抵の場合、「/approve」コメントを残すことが推奨されます。 </ins> ## レビューのチェックリスト

This is a Feature Request What would you like to be We need to update content/ja/docs/concepts/architecture/garbage- according to the English text, because it is outdated. Why is this needed content/ja/docs/concepts/architecture/garbage- is outdated. It contains important information for contributors. Comments /language ja /assign
/triage accepted


Question: - smarterclayton title: StatefulSets content_type: concept <del> weight: 40 </del> <ins> weight: 30 </ins> --- <!-- overview -->

This is an enhancement Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Change to list Deployment and ReplicaSet early (Deployment first), with ReplicationController at or near the end of the list. It is also OK to replace this page with a hand-written overview that achieves the same effect. Why is this needed ReplicationController is deprecated. Comments You can make this change by editing the attribute in the of pages inside . /language en /priority backlog /good-first-issue /kind cleanup
This request has been marked as suitable for new contributors. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : This is an enhancement Request <!-- See for guidance on writing an actionable issue description. --Change to list Deployment and ReplicaSet early (Deployment first), with ReplicationController at or near the end of the list. ReplicationController is deprecated. You can make this change by editing the attribute in the of pages inside . /priority backlog /good-first-issue /kind cleanup Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Just the order of list needs to be changed to list Deployments and then ReplicaSet early and ReplicationController at the end in the , right?
(and to anyone else) you can make the minimal change you described, or you can consider further tidying. Either approach is valid; if you like, there is a spectrum of thoroughness in how you deal with this.
Oh, I've fixed the link to front matter; it should be to
Hey folks, I can take care of it if OK with that.
Sure you can go ahead!
Thanks! /assign


Question: `kubectl logs` restituirà una risposta vuota. {{< /note >}} <del> [cosConfigureHelper]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/cluster/gce/gci/configure-helper.sh </del> <ins> [cosConfigureHelper]: https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh </ins> ### System component logs

This is a Bug Report Problem: Regarding , I found the similar broken links on other pages. English pages have already been fixed. ref: it pages also need to be fixed. Proposed Solution: Fixes broken links including {{< param "githubbranch" }} to master. In the case of link to , fixes to {{< param "fullversion" }}. ref:
/assign
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: 复制动作发生在修订版本创建时。你可以通过以下方式设置 `CHANGE-CAUSE` 消息： <!-- <del> * Annotating the Deployment with `kubectl annotate deployment/nginx-deployment kubernetes.io/change-cause="image updated to 1.9.1"` </del> <ins> * Annotating the Deployment with `kubectl annotate deployment/nginx-deployment kubernetes.io/change-cause="image updated to 1.16.1"` </ins> * Manually editing the manifest of the resource. --> * 使用 `kubectl annotate deployment/nginx-deployment kubernetes.io/change-cause="image updated to 1.16.1"`

There are some bugs: ,nginx%3Dnginx%3A1.9.1,-%2D%2Drecord%3Dtrue%0A3 "nginx=nginx:1.9.1" should be changed to "nginx=nginx:1.16.1" ,nginx%3Dnginx%3A1.91,-%2D%2Drecord%3Dtrue "nginx=nginx:1.91" should be changed to "nginx=nginx:1.161" "image updated to 1.9.1" should be changed to "image updated to 1.16.1" The content of this article has many "", it could be changed to "deployment". For example: ,,-%E8%BE%93%E5%87%BA%E7%B1%BB%E4%BC%BC%E4%BA%8E "kubectl rollout history " could be changed to "kubectl rollout history deployment/nginx-deployment"
/language zh
/triage accepted
The label cannot be applied. Only GitHub organization members can add the label. <detailsIn response to : /triage accepted Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
looks like docs is already updated to nginx:1.16.1. Do you mind closing this issue?
There should still be a few places left unfinished.
Could you please edit the issue which needs to be still updated?
Bug1: ,nginx%3Dnginx%3A1.9.1,-%2D%2Drecord%3Dtrue%0A3 "nginx=nginx:1.9.1" should be changed to "nginx=nginx:1.16.1" Bug2: ,nginx%3Dnginx%3A1.91,-%2D%2Drecord%3Dtrue "nginx=nginx:1.91" should be changed to "nginx=nginx:1.161" Bug3: "image updated to 1.9.1" should be changed to "image updated to 1.16.1" Bug4: The content of this article has many "", it could be changed to "deployment".

For example: ,,-%E8%BE%93%E5%87%BA%E7%B1%BB%E4%BC%BC%E4%BA%8E "kubectl rollout history " could be changed to "kubectl rollout history deployment/nginx-deployment"
Thanks for clarifying. /assign
/retitle [zh] Localization bugs / work required for Deployment concept
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale
/triage accepted


Question: ## How Disruption Budgets Work <ins> {{< feature-state for_k8s_version="v1.5" state="beta" >}} </ins> An Application Owner can create a `PodDisruptionBudget` object (PDB) for each application. A PDB limits the number of pods of a replicated application that are down simultaneously from voluntary disruptions.  For example, a quorum-based application would

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: does not mention that PodDisruptionBudget is beta. Proposed Solution: Add a shortcode to Page to Update: There may well be other pages that describe PodDisruptionBudget without mentioning its feature state. <!--Optional Information (remove the comment tags around information you would like to include)--Kubernetes Version: v1.18 <!--Additional Information:--/help /kind bug /priority backlog
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : This is a Bug Report <!-- See for guidance on writing an actionable issue description. --Problem: does not mention that PodDisruptionBudget is beta. Add a shortcode to There may well be other pages that describe PodDisruptionBudget without mentioning its feature state. Kubernetes Version: v1.18 /help /kind bug /priority backlog Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
I don't see on this page -
Looks like it is since .
/assign


Question: ### Background cascading deletion {#background-deletion} In background cascading deletion, the Kubernetes API server deletes the owner <del> object immediately and the controller cleans up the dependent objects in the background. By default, Kubernetes uses background cascading deletion unless </del> <ins> object immediately and the garbage collector controller (custom or default) cleans up the dependent objects in the background. If a finalizer exists, it ensures that objects are not deleted until all necessary clean-up tasks are completed. By default, Kubernetes uses background cascading deletion unless </ins> you manually use foreground deletion or choose to orphan the dependent objects. See [Use background cascading deletion](/docs/tasks/administer-cluster/use-cascading-deletion/#use-background-cascading-deletion)

Page: I have problems understanding this text. First: If I read that, then I think Finalizers seem to get ignored if you use background-deletion. But I don't think so. Second: "... the controller cleans up the dependent objects". What is "the controller" here? If I have a custom controller for my CRDs. Is that meant with "the controller"?
/language en
I also agree there is room of improving the existing content in the page.
Finalizers are not ignored during background deletion. The owner object is marked for deletion, but finalizers still execute before fully deleting it. The controller refers to the Kubernetes controller that manages the lifecycle of resources, which could include your custom controller for CRDs. It's responsible for cleaning up dependent objects in the background.
/retitle Garbage Collection: Background deletion explanation is hard to understand
/triage accepted /priority backlog
If there is still room to work on this issue, I would like to work on this. Kindly /assign this to me


Question: title: 云控制器管理器（Cloud Controller Manager） id: cloud-controller-manager date: 2018-04-12 <del> full_link: /zh/docs/tasks/administer-cluster/running-cloud-controller/ </del> <ins> full_link: /zh/docs/concepts/architecture/cloud-controller/ </ins> short_description: > <del> 云控制器管理器是 1.8 的 alpha 特性。在未来发布的版本中，这是将 Kubernetes 与任何其他云集成的最佳方式。 </del> <ins> 将 Kubernetes 与第三方云提供商进行集成的控制面组件。 </ins> aka: tags:

This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: in reference/glossary/cloud-controller- is wrong Proposed Solution: In , In : In : and so on... Page to Update: [No webpage should be affected by the changes which this issue is suggesting.] <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/language zh
/triage accepted /language zh /kind bug /assign


Question: import: "k8s.io/api/coordination/v1" kind: "Lease" content_type: "api_reference" <del> description: "Lease defines a lease concept." </del> <ins> description: "Lease 定义了租约的概念。" </ins> title: "Lease" weight: 5 ---

Hi,I am interested to translate the "cluster-resources/lease-" page. There is a description that has not been translated. I will modify this file. /language zh
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign


Question: ### プライベートレジストリへの認証をNodeに設定する <del> Node上でDockerを実行している場合、プライベートコンテナレジストリへの認証をDockerコンテナランタイムに設定できます。 </del> <ins> 認証情報を設定するための具体的な手順は、使用するコンテナランタイムとレジストリに依存します。最も正確な情報として、ソリューションのドキュメントを参照する必要があります。 </ins> <del> Node構成を制御できる場合は、この方法が適しています。 {{< note >}} KubernetesはDocker構成の`auths`と`HttpHeaders`セクションのみをサポートしています。 Docker認証情報ヘルパー(`credHelpers`または`credsStore`)はサポートされていません。 {{< /note >}} </del> <ins> プライベートなコンテナイメージレジストリを設定する例として、[プライベートレジストリからイメージをPullする](/docs/tasks/configure-pod-container/pull-image-private-registry)タスクを参照してください。その例では、Docker Hubのプライベートレジストリを使用しています。 </ins> <del> Dockerは、`$HOME/.dockercfg`または`$HOME/.docker/config.json`ファイルの中に、プライベートレジストリのキーを保持します。 下記リストの検索パスに同じファイルを配置した場合、kubeletはイメージをPullする時に認証情報プロバイダーとして利用します。 </del> <ins> ### config.jsonの解釈 {#config-json} `config.json`の解釈は、Dockerのオリジナルの実装とKubernetesの解釈で異なります。 Dockerでは、`auths`キーはルートURLしか指定できませんが、Kubernetesではプレフィックスのマッチしたパスだけでなく、グロブパターンのURLも指定できます。 以下のような`config.json`が有効であるということです。 </ins> <del> * `{--root-dir:-/var/lib/kubelet}/config.json` * `{cwd of kubelet}/config.json` * `${HOME}/.docker/config.json` * `/.docker/config.json` * `{--root-dir:-/var/lib/kubelet}/.dockercfg` * `{cwd of kubelet}/.dockercfg` * `${HOME}/.dockercfg` * `/.dockercfg` {{< note >}} kubeletプロセスの環境では、明示的に`HOME=/root`を設定する必要がある場合があります。 {{< /note >}} 以下は、プライベートレジストリを使用する為にNodeを構成する推奨の手順です。この例では、デスクトップ/ノートPC上で実行します。 1. 使用したい認証情報のセット毎に `docker login [server]`を実行する。これであなたのPC上の`$HOME/.docker/config.json`が更新される 1. 使用したい認証情報が含まれているかを確認するため、エディターで`$HOME/.docker/config.json`を見る 1. Nodeの一覧を取得 例: - 名称が必要な場合: `nodes=$( kubectl get nodes -o jsonpath='{range.items[*].metadata}{.name} {end}' )` - IPアドレスを取得したい場合: `nodes=$( kubectl get nodes -o jsonpath='{range .items[*].status.addresses[?(@.type=="ExternalIP")]}{.address} {end}' )` 1. ローカルの`.docker/config.json`を上記の検索パスのいずれかにコピーする - 例えば、これでテストを実施する: `for n in $nodes; do scp ~/.docker/config.json root@"$n":/var/lib/kubelet/config.json; done` {{< note >}} 本番環境用クラスターでは、構成管理ツールを使用して必要なすべてのNodeに設定を反映してください。 {{< /note >}} プライベートイメージを使用するPodを作成し確認します。 例: ```shell kubectl apply -f - <<EOF apiVersion: v1 kind: Pod metadata: name: private-image-test-1 spec: containers: - name: uses-private-image image: $PRIVATE_IMAGE_NAME imagePullPolicy: Always command: [ "echo", "SUCCESS" ] EOF ``` ``` pod/private-image-test-1 created </del> <ins> ```json { "auths": { "*my-registry.io/images": { "auth": "…" } } } </ins> ``` <del> すべてが機能している場合は、しばらくしてから以下のコマンドを実行します。 </del> <ins> ルートURL(`*my-registry.io`)は、以下の構文でマッチングされます: </ins> <del> ```shell kubectl logs private-image-test-1 </del> ``` <del> コマンドの結果を確認してください。 ``` SUCCESS </del> <ins> pattern: { term } term: '*'         セパレーター以外の任意の文字列にマッチする '?'         セパレーター以外の任意の一文字にマッチする '[' [ '^' ] { character-range } ']' 文字クラス (空であってはならない) c           文字 c とマッチする (c != '*', '?', '', '[') '' c      文字 c とマッチする character-range: c           文字 c とマッチする (c != '', '-', ']') '' c      文字 c とマッチする lo '-' hi   lo <= c <= hi の文字 c とマッチする </ins> ``` <del> コマンドが失敗したと思われる場合には、以下を実行します。 ```shell kubectl describe pods/private-image-test-1 | grep 'Failed' ``` 失敗している場合、結果が次のようになります。 ``` Fri, 26 Jun 2015 15:36:13 -0700    Fri, 26 Jun 2015 15:39:13 -0700    19    {kubelet node-i2hq}    spec.containers{uses-private-image}    failed        Failed to pull image "user/privaterepo:v1": Error: image user/privaterepo:v1 not found </del> <ins> イメージのPull操作では、有効なパターンごとに認証情報をCRIコンテナランタイムに渡すようになりました。例えば、以下のようなコンテナイメージ名は正常にマッチングされます。 - `my-registry.io/images` - `my-registry.io/images/my-image` - `my-registry.io/images/another-image` - `sub.my-registry.io/images/my-image` - `a.sub.my-registry.io/images/my-image` kubeletは、見つかったすべての認証情報に対してイメージのPullを順次実行します。これは、次のように`config.json`に複数のエントリーを書くことも可能であることを意味します。 ```json { "auths": { "my-registry.io/images": { "auth": "…" }, "my-registry.io/images/subpath": { "auth": "…" } } } </ins> ``` <ins> コンテナが`my-registry.io/images/subpath/my-image`をPullするイメージとして指定した場合、kubeletが認証ソースの片方からダウンロードに失敗すると、両方の認証ソースからダウンロードを試みます。 </ins> <del> クラスターのすべてのNodeが同じ`.docker/config.json`になっているかを確認する必要があります。 そうでない場合、Podは一部のNodeで実行できますが他のNodeでは実行に失敗します。 例えば、Nodeのオートスケールを使用している場合、各インスタンスのテンプレートに`.docker/config.json`が含まれている、またはこのファイルが含まれているドライブをマウントする必要があります。 プライベートレジストリキーを`.docker/config.json`に追加した時点で、すべてのPodがプライベートレジストリのイメージに読み取りアクセス権も持つようになります。 ### 事前にPullしたイメージ </del> <ins> ### 事前にPullしたイメージ {#pre-pulled-images} </ins> {{< note >}} Node構成を制御できる場合、この方法が適しています。

This is a Feature Request What would you like to be We need to update according to the English text, because it is outdated. Why is this needed is outdated. Comments /language ja /assign
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details


Question: web       NodePort   10.104.133.249   <none>        8080:31637/TCP   12m ``` <del> 1. Visit the Service via NodePort: </del> <ins> 1. Visit the Service via NodePort, using the [`minikube service`](https://minikube.sigs.k8s.io/docs/handbook/accessing/#using-minikube-service-with-tunnel) command. Follow the instructions for your platform: {{< tabs name="minikube_service" >}} {{% tab name="Linux" %}} </ins> ```shell minikube service web --url ``` The output is similar to: ```none http://172.17.0.15:31637 ``` <ins> Invoke the URL obtained in the output of the previous step: </ins> ```shell curl http://172.17.0.15:31637 ``` <ins> {{% /tab %}} {{% tab name="MacOS" %}} ```shell # The command must be run in a separate terminal. minikube service web --url ``` The output is similar to: ```none http://127.0.0.1:62445 ! Because you are using a Docker driver on darwin, the terminal needs to be open to run it. ``` From a different terminal, invoke the URL obtained in the output of the previous step: ```shell curl http://127.0.0.1:62445 ``` {{% /tab %}} {{< /tabs >}} <br> </ins> The output is similar to: ```none

Problem: Going through the documentation provided by the link such issue has being met on the step of verification that Ingress controller is directing the traffic using the command below: curl --resolve "hello-$( minikube ip )" -i http://hello- After running this command the terminal returns: Failed to connect to hello- port 80 after ms: Couldn't connect to server Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Kubernetes version: v1.28.3 <!--Additional Information:--Environment that is used: Macbook M1 Pro Minikube version: v1.32.0 Minikube uses the docker driver. Step on which problem has been met:
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Page reported in issue: /language en
This is same as issue /triage duplicate I believe this should be fixed by updating the page by mentioning the instructions to create a for MacOS and Windows users. I'll try to work on a PR for this. Till the time the page is modified, the way around this is mentioned . The reason why it fails on MacOS and Windows is documented here , , You can also visit the page and view the tab in Step 4 Deploy applications.
/assign

you need start and then to solve same problem in mac
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/triage needs-information Hi. Is this about a particular web page?
sorry, this is about following tutorial Create an Ingress step 4
/retitle Ingress tutorial does not mention commands needed for Mac /remove-triage needs-information
/kind bug /language en
I can confirm that this is a valid issue on MacOS and the page needs to be updated. I think we should move this to /triage accepted. I cannot test this on Windows at the moment, but suggests that the behaviour on Windows will be the same as MacOS. The network is limited if using the Docker driver on Darwin, Windows, or WSL, and the Node IP is not reachable directly.
/assign


Question: <ins> --- title: Generating reference documentation for metrics content_type: task weight: 100 --- <!-- overview --> This page demonstrates the generation of metrics reference documentation ## {{% heading "prerequisites" %}} {{< include "prerequisites-ref-docs.md" >}} <!-- steps --> ## Cloning the Kubernetes repository The metric generation happens in the Kubernetes repository. To clone the repository, Change directories to where you want the clone to exist. Then, execute the following command: ```shell git clone https://www.github.com/kubernetes/kubernetes ``` This creates a `kubernetes` folder in your current working directory. ## Generate the metrics Inside the cloned Kubernetes repository, locate the `test/instrumentation/documentation` directory. The metrics documentation is generated in this directory. With each release, new metrics are added. After you run the metrics documentation generator script, copy the metrics documentation to the Kubernetes website and publish the updated metrics documentation. To generate the latest metrics, Make sure you are in the root of the cloned Kubernetes directory. Then, execute the following command: ```shell ./test/instrumentation/update-documentation.sh ``` To check for changes, execute: ```shell git status ``` The output is similar to ``` ./test/instrumentation/documentation/documentation.md ./test/instrumentation/documentation/documentation-list.yaml ``` ## Copy the generated metrics documentation file to the Kubernetes website repository 1. Set the Kubernetes website root environment variable Execute the following command to set the website root: ```shell export WEBSITE_ROOT=<path to website root> ``` 2. Copy operation Copy the generated metrics file to the Kubernetes website repository. ```shell cp ./test/instrumentation/documentation/documentation.md "${WEBSITE_ROOT}/content/en/docs/reference/instrumentation/metrics.md" ``` {{< note >}} If you get an error, check that you have permission to copy the file. You can use `chown` to change the file ownership back to your own user. {{< /note >}} ## Creating a pull request To create a pull request, Follow the instructions in [Opening a pull request](/docs/contribute/new-content/open-a-pr/) ## {{% heading "whatsnext" %}} * [Contribute-upstream](/docs/contribute/generate-ref-docs/contribute-upstream/) * [Generating Reference Docs for Kubernetes Components and Tools](/docs/contribute/generate-ref-docs/kubernetes-components/) * [Generating Reference Documentation for kubectl Commands](/docs/contribute/generate-ref-docs/kubectl/) </ins>

This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Add a section to that explains how to keep the generated pages within up to date. Why is this needed docs generation code into . We can tweak that code and then rely upon it. We'd want (I'm reasonably sure) to document what needs to happen for each major release so that we can keep the reference document up to date. got close to doing what we need, so this issue is about staffing the work to take it that last stretch to being mergeable. Comments /sig instrumentation /sig release /lifecycle frozen /triage accepted /priority important-longterm
Hey well i understood from the issue that we need to write documentation for kubernetes/kubernetes For every file present in the pr ,is that right??? Well i have some experience in writing docs can work on this /assign
can you review/assist here?
We need to document how someone in the release docs team can use automation to update the pages within that are automatically generated. To work out which pages within are generated automatically generated, you can either: ask contributors (eg from SIG Instrumentation - wrote all the generator code so far as I know) look at each page within and see whether that page is marked as automatically generated. The outcome is likely to be a change to either one or two pages within So long as the change allows a contributor in release docs to understand what to do, we've done enough to close this issue.
already started the process u can check my pr to review that if possible , many pr's are expected to come ,I'm working on it and has reviewed some part of it
I'm happy for anyone to review that PR. To ask for feedback more widely, join the Kubernetes Slack workspace - (visit for an invitation) - and ask in
is a good starting point.
It would be nice to have the steps documented. I'll help with this