github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-29 14:37:00 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #96699 from tengqm/kubelet-config-norm

Browse Source 
Tweak kubelet config comments for consistency and readability
This commit is contained in:
Kubernetes Prow Robot 2021-06-28 23:26:40 -07:00 committed by GitHub
commit adf561fb96
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 188 additions and 108 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

296
staging/src/k8s.io/kubelet/config/v1beta1/types.go
View File

@ -147,6 +147,7 @@ type KubeletConfiguration struct {
// +optional
Address string `json:"address,omitempty"`
// port is the port for the Kubelet to serve on.
// The port number must be between 1 and 65535, inclusive.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may disrupt components that interact with the Kubelet server.
// Default: 10250
@ -154,6 +155,8 @@ type KubeletConfiguration struct {
Port int32 `json:"port,omitempty"`
// readOnlyPort is the read-only port for the Kubelet to serve on with
// no authentication/authorization.
// The port number must be between 1 and 65535, inclusive.
// Setting this field to 0 disables the read-only service.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may disrupt components that interact with the Kubelet server.
// Default: 0 (disabled)
@ -175,14 +178,14 @@ type KubeletConfiguration struct {
// Default: ""
// +optional
TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty"`
// TLSCipherSuites is the list of allowed cipher suites for the server.
// tlsCipherSuites is the list of allowed cipher suites for the server.
// Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants).
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may disrupt components that interact with the Kubelet server.
// Default: nil
// +optional
TLSCipherSuites []string `json:"tlsCipherSuites,omitempty"`
// TLSMinVersion is the minimum TLS version supported.
// tlsMinVersion is the minimum TLS version supported.
// Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants).
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may disrupt components that interact with the Kubelet server.
@ -200,9 +203,9 @@ type KubeletConfiguration struct {
RotateCertificates bool `json:"rotateCertificates,omitempty"`
// serverTLSBootstrap enables server certificate bootstrap. Instead of self
// signing a serving certificate, the Kubelet will request a certificate from
// the certificates.k8s.io API. This requires an approver to approve the
// certificate signing requests. The RotateKubeletServerCertificate feature
// must be enabled.
// the 'certificates.k8s.io' API. This requires an approver to approve the
// certificate signing requests (CSR). The RotateKubeletServerCertificate feature
// must be enabled when setting this field.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// disabling it will stop the renewal of Kubelet server certificates, which can
// disrupt components that interact with the Kubelet server in the long term,
@ -232,7 +235,8 @@ type KubeletConfiguration struct {
// +optional
Authorization KubeletAuthorization `json:"authorization"`
// registryPullQPS is the limit of registry pulls per second.
// Set to 0 for no limit.
// The value must not be a negative number.
// Setting it to 0 means no limit.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may impact scalability by changing the amount of traffic produced
// by image pulls.
@ -241,7 +245,8 @@ type KubeletConfiguration struct {
RegistryPullQPS *int32 `json:"registryPullQPS,omitempty"`
// registryBurst is the maximum size of bursty pulls, temporarily allows
// pulls to burst to this number, while still not exceeding registryPullQPS.
// Only used if registryPullQPS > 0.
// The value must not be a negative number.
// Only used if registryPullQPS is greater than 0.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may impact scalability by changing the amount of traffic produced
// by image pulls.
@ -249,7 +254,7 @@ type KubeletConfiguration struct {
// +optional
RegistryBurst int32 `json:"registryBurst,omitempty"`
// eventRecordQPS is the maximum event creations per second. If 0, there
// is no limit enforced.
// is no limit enforced. The value cannot be a negative number.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may impact scalability by changing the amount of traffic produced by
// event creations.
@ -258,7 +263,8 @@ type KubeletConfiguration struct {
EventRecordQPS *int32 `json:"eventRecordQPS,omitempty"`
// eventBurst is the maximum size of a burst of event creations, temporarily
// allows event creations to burst to this number, while still not exceeding
// eventRecordQPS. Only used if eventRecordQPS > 0.
// eventRecordQPS. This field canot be a negative number and it is only used
// when eventRecordQPS > 0.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may impact scalability by changing the amount of traffic produced by
// event creations.
@ -280,6 +286,7 @@ type KubeletConfiguration struct {
// +optional
EnableContentionProfiling bool `json:"enableContentionProfiling,omitempty"`
// healthzPort is the port of the localhost healthz endpoint (set to 0 to disable)
// A valid number is between 1 and 65535.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may disrupt components that monitor Kubelet health.
// Default: 10248
@ -352,6 +359,7 @@ type KubeletConfiguration struct {
// in the kube-node-lease namespace. If the lease expires, the node can be considered unhealthy.
// The lease is currently renewed every 10s, per KEP-0009. In the future, the lease renewal interval
// may be set based on the lease duration.
// The field value must be greater than 0.
// Requires the NodeLease feature gate to be enabled.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// decreasing the duration may reduce tolerance for issues that temporarily prevent
@ -368,8 +376,10 @@ type KubeletConfiguration struct {
// +optional
ImageMinimumGCAge metav1.Duration `json:"imageMinimumGCAge,omitempty"`
// imageGCHighThresholdPercent is the percent of disk usage after which
// image garbage collection is always run. The percent is calculated as
// this field value out of 100.
// image garbage collection is always run. The percent is calculated by
// dividing this field value by 100, so this field must be between 0 and
// 100, inclusive. When specified, the value must be greater than
// imageGCLowThresholdPercent.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may trigger or delay garbage collection, and may change the image overhead
// on the node.
@ -378,14 +388,17 @@ type KubeletConfiguration struct {
ImageGCHighThresholdPercent *int32 `json:"imageGCHighThresholdPercent,omitempty"`
// imageGCLowThresholdPercent is the percent of disk usage before which
// image garbage collection is never run. Lowest disk usage to garbage
// collect to. The percent is calculated as this field value out of 100.
// collect to. The percent is calculated by dividing this field value by 100,
// so the field value must be between 0 and 100, inclusive. When specified, the
// value must be less than imageGCHighThresholdPercent.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may trigger or delay garbage collection, and may change the image overhead
// on the node.
// Default: 80
// +optional
ImageGCLowThresholdPercent *int32 `json:"imageGCLowThresholdPercent,omitempty"`
// How frequently to calculate and cache volume disk usage for all pods
// volumeStatsAggPeriod is the frequency for calculating and caching volume
// disk usage for all pods.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// shortening the period may carry a performance impact.
// Default: "1m"
@ -400,6 +413,7 @@ type KubeletConfiguration struct {
// systemCgroups is absolute name of cgroups in which to place
// all non-kernel processes that are not already in a container. Empty
// for no container. Rolling back the flag requires a reboot.
// The cgroupRoot must be specified if this field is not empty.
// Dynamic Kubelet Config (beta): This field should not be updated without a full node
// reboot. It is safest to keep this value the same as the local config.
// Default: ""
@ -412,50 +426,65 @@ type KubeletConfiguration struct {
// Default: ""
// +optional
CgroupRoot string `json:"cgroupRoot,omitempty"`
// Enable QoS based Cgroup hierarchy: top level cgroups for QoS Classes
// And all Burstable and BestEffort pods are brought up under their
// specific top level QoS cgroup.
// cgroupsPerQOS enable QoS based CGroup hierarchy: top level CGroups for QoS classes
// and all Burstable and BestEffort Pods are brought up under their specific top level
// QoS CGroup.
// Dynamic Kubelet Config (beta): This field should not be updated without a full node
// reboot. It is safest to keep this value the same as the local config.
// Default: true
// +optional
CgroupsPerQOS *bool `json:"cgroupsPerQOS,omitempty"`
// driver that the kubelet uses to manipulate cgroups on the host (cgroupfs or systemd)
// cgroupDriver is the driver kubelet uses to manipulate CGroups on the host (cgroupfs
// or systemd).
// Dynamic Kubelet Config (beta): This field should not be updated without a full node
// reboot. It is safest to keep this value the same as the local config.
// Default: "cgroupfs"
// +optional
CgroupDriver string `json:"cgroupDriver,omitempty"`
// CPUManagerPolicy is the name of the policy to use.
// cpuManagerPolicy is the name of the policy to use.
// Requires the CPUManager feature gate to be enabled.
// Dynamic Kubelet Config (beta): This field should not be updated without a full node
// reboot. It is safest to keep this value the same as the local config.
// Default: "None"
// +optional
CPUManagerPolicy string `json:"cpuManagerPolicy,omitempty"`
// CPU Manager reconciliation period.
// cpuManagerReconcilePeriod is the reconciliation period for the CPU Manager.
// Requires the CPUManager feature gate to be enabled.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// shortening the period may carry a performance impact.
// Default: "10s"
// +optional
CPUManagerReconcilePeriod metav1.Duration `json:"cpuManagerReconcilePeriod,omitempty"`
// MemoryManagerPolicy is the name of the policy to use by memory manager.
// memoryManagerPolicy is the name of the policy to use by memory manager.
// Requires the MemoryManager feature gate to be enabled.
// Dynamic Kubelet Config (beta): This field should not be updated without a full node
// reboot. It is safest to keep this value the same as the local config.
// Default: "none"
// +optional
MemoryManagerPolicy string `json:"memoryManagerPolicy,omitempty"`
// TopologyManagerPolicy is the name of the policy to use.
// topologyManagerPolicy is the name of the topology manager policy to use.
// Valid values include:
//
// - `restricted`: kubelet only allows pods with optimal NUMA node alignment for
// requested resources;
// - `best-effort`: kubelet will favor pods with NUMA alignment of CPU and device
// resources;
// - `none`: kublet has no knowledge of NUMA alignment of a pod's CPU and device resources.
// - `single-numa-node`: kubelet only allows pods with a single NUMA alignment
// of CPU and device resources.
//
// Policies other than "none" require the TopologyManager feature gate to be enabled.
// Dynamic Kubelet Config (beta): This field should not be updated without a full node
// reboot. It is safest to keep this value the same as the local config.
// Default: "none"
// +optional
TopologyManagerPolicy string `json:"topologyManagerPolicy,omitempty"`
// TopologyManagerScope represents the scope of topology hint generation
// that topology manager requests and hint providers generate.
// topologyManagerScope represents the scope of topology hint generation
// that topology manager requests and hint providers generate. Valid values include:
//
// - `container`: topology policy is applied on a per-container basis.
// - `pod`: topology policy is applied on a per-pod basis.
//
// "pod" scope requires the TopologyManager feature gate to be enabled.
// Default: "container"
// +optional
@ -481,17 +510,20 @@ type KubeletConfiguration struct {
// bridge for hairpin packets.
// Setting this flag allows endpoints in a Service to loadbalance back to
// themselves if they should try to access their own Service. Values:
// "promiscuous-bridge": make the container bridge promiscuous.
// "hairpin-veth": set the hairpin flag on container veth interfaces.
// "none": do nothing.
// Generally, one must set --hairpin-mode=hairpin-veth to achieve hairpin NAT,
//
// - "promiscuous-bridge": make the container bridge promiscuous.
// - "hairpin-veth": set the hairpin flag on container veth interfaces.
// - "none": do nothing.
//
// Generally, one must set `--hairpin-mode=hairpin-veth to` achieve hairpin NAT,
// because promiscuous-bridge assumes the existence of a container bridge named cbr0.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may require a node reboot, depending on the network plugin.
// Default: "promiscuous-bridge"
// +optional
HairpinMode string `json:"hairpinMode,omitempty"`
// maxPods is the number of pods that can run on this Kubelet.
// maxPods is the maximum number of Pods that can run on this Kubelet.
// The value must be a non-negative integer.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// changes may cause Pods to fail admission on Kubelet restart, and may change
// the value reported in Node.Status.Capacity[v1.ResourcePods], thus affecting
@ -500,20 +532,20 @@ type KubeletConfiguration struct {
// Default: 110
// +optional
MaxPods int32 `json:"maxPods,omitempty"`
// The CIDR to use for pod IP addresses, only used in standalone mode.
// In cluster mode, this is obtained from the master.
// podCIDR is the CIDR to use for pod IP addresses, only used in standalone mode.
// In cluster mode, this is obtained from the control plane.
// Dynamic Kubelet Config (beta): This field should always be set to the empty default.
// It should only set for standalone Kubelets, which cannot use Dynamic Kubelet Config.
// Default: ""
// +optional
PodCIDR string `json:"podCIDR,omitempty"`
// PodPidsLimit is the maximum number of pids in any pod.
// podPidsLimit is the maximum number of PIDs in any pod.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// lowering it may prevent container processes from forking after the change.
// Default: -1
// +optional
PodPidsLimit *int64 `json:"podPidsLimit,omitempty"`
// ResolverConfig is the resolver configuration file used as the basis
// resolvConf is the resolver configuration file used as the basis
// for the container DNS resolution configuration.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// changes will only take effect on Pods created after the update. Draining
@ -521,7 +553,7 @@ type KubeletConfiguration struct {
// Default: "/etc/resolv.conf"
// +optional
ResolverConfig string `json:"resolvConf,omitempty"`
// RunOnce causes the Kubelet to check the API server once for pods,
// runOnce causes the Kubelet to check the API server once for pods,
// run those in addition to the pods specified by static pod files, and exit.
// Default: false
// +optional
@ -533,14 +565,17 @@ type KubeletConfiguration struct {
// Default: true
// +optional
CPUCFSQuota *bool `json:"cpuCFSQuota,omitempty"`
// CPUCFSQuotaPeriod is the CPU CFS quota period value, cpu.cfs_period_us.
// cpuCFSQuotaPeriod is the CPU CFS quota period value, `cpu.cfs_period_us`.
// The value must be between 1 us and 1 second, inclusive.
// Requires the CustomCPUCFSQuotaPeriod feature gate to be enabled.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// limits set for containers will result in different cpu.cfs_quota settings. This
// will trigger container restarts on the node being reconfigured.
// Default: "100ms"
// +optional
CPUCFSQuotaPeriod *metav1.Duration `json:"cpuCFSQuotaPeriod,omitempty"`
// nodeStatusMaxImages caps the number of images reported in Node.Status.Images.
// nodeStatusMaxImages caps the number of images reported in Node.status.images.
// The value must be greater than -2.
// Note: If -1 is specified, no cap will be applied. If 0 is specified, no image is returned.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// different values can be reported on node status.
@ -548,6 +583,7 @@ type KubeletConfiguration struct {
// +optional
NodeStatusMaxImages *int32 `json:"nodeStatusMaxImages,omitempty"`
// maxOpenFiles is Number of files that can be opened by Kubelet process.
// The value must be a non-negative number.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may impact the ability of the Kubelet to interact with the node's filesystem.
// Default: 1000000
@ -568,7 +604,8 @@ type KubeletConfiguration struct {
// Default: 5
// +optional
KubeAPIQPS *int32 `json:"kubeAPIQPS,omitempty"`
// kubeAPIBurst is the burst to allow while talking with kubernetes apiserver
// kubeAPIBurst is the burst to allow while talking with kubernetes API server.
// This field cannot be a negative number.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may impact scalability by changing the amount of traffic the Kubelet
// sends to the API server.
@ -584,7 +621,8 @@ type KubeletConfiguration struct {
// Default: true
// +optional
SerializeImagePulls *bool `json:"serializeImagePulls,omitempty"`
// Map of signal names to quantities that defines hard eviction thresholds. For example: {"memory.available": "300Mi"}.
// evictionHard is a map of signal names to quantities that defines hard eviction
// thresholds. For example: `{"memory.available": "300Mi"}`.
// To explicitly disable, pass a 0% or 100% threshold on an arbitrary resource.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may trigger or delay Pod evictions.
@ -595,30 +633,31 @@ type KubeletConfiguration struct {
// imagefs.available: "15%"
// +optional
EvictionHard map[string]string `json:"evictionHard,omitempty"`
// Map of signal names to quantities that defines soft eviction thresholds.
// For example: {"memory.available": "300Mi"}.
// evictionSoft is a map of signal names to quantities that defines soft eviction thresholds.
// For example: `{"memory.available": "300Mi"}`.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may trigger or delay Pod evictions, and may change the allocatable reported
// by the node.
// Default: nil
// +optional
EvictionSoft map[string]string `json:"evictionSoft,omitempty"`
// Map of signal names to quantities that defines grace periods for each soft eviction signal.
// For example: {"memory.available": "30s"}.
// evictionSoftGracePeriod is a map of signal names to quantities that defines grace
// periods for each soft eviction signal. For example: `{"memory.available": "30s"}`.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may trigger or delay Pod evictions.
// Default: nil
// +optional
EvictionSoftGracePeriod map[string]string `json:"evictionSoftGracePeriod,omitempty"`
// Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition.
// evictionPressureTransitionPeriod is the duration for which the kubelet has to wait
// before transitioning out of an eviction pressure condition.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// lowering it may decrease the stability of the node when the node is overcommitted.
// Default: "5m"
// +optional
EvictionPressureTransitionPeriod metav1.Duration `json:"evictionPressureTransitionPeriod,omitempty"`
// Maximum allowed grace period (in seconds) to use when terminating pods in
// response to a soft eviction threshold being met. This value effectively caps
// the Pod's TerminationGracePeriodSeconds value during soft evictions.
// evictionMaxPodGracePeriod is the maximum allowed grace period (in seconds) to use
// when terminating pods in response to a soft eviction threshold being met. This value
// effectively caps the Pod's terminationGracePeriodSeconds value during soft evictions.
// Note: Due to issue #64530, the behavior has a bug where this value currently just
// overrides the grace period during soft eviction, which can increase the grace
// period from what is set on the Pod. This bug will be fixed in a future release.
@ -628,19 +667,21 @@ type KubeletConfiguration struct {
// Default: 0
// +optional
EvictionMaxPodGracePeriod int32 `json:"evictionMaxPodGracePeriod,omitempty"`
// Map of signal names to quantities that defines minimum reclaims, which describe the minimum
// amount of a given resource the kubelet will reclaim when performing a pod eviction while
// that resource is under pressure. For example: {"imagefs.available": "2Gi"}
// evictionMinimumReclaim is a map of signal names to quantities that defines minimum reclaims,
// which describe the minimum amount of a given resource the kubelet will reclaim when
// performing a pod eviction while that resource is under pressure.
// For example: `{"imagefs.available": "2Gi"}`.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may change how well eviction can manage resource pressure.
// Default: nil
// +optional
EvictionMinimumReclaim map[string]string `json:"evictionMinimumReclaim,omitempty"`
// podsPerCore is the maximum number of pods per core. Cannot exceed MaxPods.
// If 0, this field is ignored.
// podsPerCore is the maximum number of pods per core. Cannot exceed maxPods.
// The value must be a non-negative integer.
// If 0, there is no limit on the number of Pods.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// changes may cause Pods to fail admission on Kubelet restart, and may change
// the value reported in Node.Status.Capacity[v1.ResourcePods], thus affecting
// the value reported in `Node.status.capacity.pods`, thus affecting
// future scheduling decisions. Increasing this value may also decrease performance,
// as more Pods can be packed into a single node.
// Default: 0
@ -667,15 +708,16 @@ type KubeletConfiguration struct {
// Default: false
// +optional
ProtectKernelDefaults bool `json:"protectKernelDefaults,omitempty"`
// If true, Kubelet ensures a set of iptables rules are present on host.
// These rules will serve as utility rules for various components, e.g. KubeProxy.
// The rules will be created based on IPTablesMasqueradeBit and IPTablesDropBit.
// makeIPTablesUtilChains, if true, causes the Kubelet ensures a set of iptables rules
// are present on host.
// These rules will serve as utility rules for various components, e.g. kube-proxy.
// The rules will be created based on iptablesMasqueradeBit and iptablesDropBit.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// disabling it will prevent the Kubelet from healing locally misconfigured iptables rules.
// Default: true
// +optional
MakeIPTablesUtilChains *bool `json:"makeIPTablesUtilChains,omitempty"`
// iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT
// iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT.
// Values must be within the range [0, 31]. Must be different from other mark bits.
// Warning: Please match the value of the corresponding parameter in kube-proxy.
// TODO: clean up IPTablesMasqueradeBit in kube-proxy
@ -693,7 +735,7 @@ type KubeletConfiguration struct {
// Default: 15
// +optional
IPTablesDropBit *int32 `json:"iptablesDropBit,omitempty"`
// featureGates is a map of feature names to bools that enable or disable alpha/experimental
// featureGates is a map of feature names to bools that enable or disable experimental
// features. This field modifies piecemeal the built-in default values from
// "k8s.io/kubernetes/pkg/features/kube_features.go".
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider the
@ -710,21 +752,27 @@ type KubeletConfiguration struct {
// Default: true
// +optional
FailSwapOn *bool `json:"failSwapOn,omitempty"`
// A quantity defines the maximum size of the container log file before it is rotated.
// For example: "5Mi" or "256Ki".
// containerLogMaxSize is a quantity defining the maximum size of the container log
// file before it is rotated. For example: "5Mi" or "256Ki".
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may trigger log rotation.
// Default: "10Mi"
// +optional
ContainerLogMaxSize string `json:"containerLogMaxSize,omitempty"`
// Maximum number of container log files that can be present for a container.
// containerLogMaxFiles specifies the maximum number of container log files that can
// be present for a container.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// lowering it may cause log files to be deleted.
// Default: 5
// +optional
ContainerLogMaxFiles *int32 `json:"containerLogMaxFiles,omitempty"`
// ConfigMapAndSecretChangeDetectionStrategy is a mode in which
// config map and secret managers are running.
// configMapAndSecretChangeDetectionStrategy is a mode in which ConfigMap and Secret
// managers are running. Valid values include:
//
// - `Get`: kubelet fetches necessary objects directly from the API server;
// - `Cache`: kubelet uses TTL cache for object fetched from the API server;
// - `Watch`: kubelet uses watches to observe changes to objects that are in its interest.
//
// Default: "Watch"
// +optional
ConfigMapAndSecretChangeDetectionStrategy ResourceChangeDetectionStrategy `json:"configMapAndSecretChangeDetectionStrategy,omitempty"`
@ -742,10 +790,11 @@ type KubeletConfiguration struct {
// Default: nil
// +optional
SystemReserved map[string]string `json:"systemReserved,omitempty"`
// A set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs
// kubeReserved is a set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs
// that describe resources reserved for kubernetes system components.
// Currently cpu, memory and local storage for root file system are supported.
// See http://kubernetes.io/docs/user-guide/compute-resources for more detail.
// See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
// for more details.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may not be possible to increase the reserved resources, because this
// requires resizing cgroups. Always look for a NodeAllocatableEnforced event
@ -753,36 +802,48 @@ type KubeletConfiguration struct {
// Default: nil
// +optional
KubeReserved map[string]string `json:"kubeReserved,omitempty"`
// This ReservedSystemCPUs option specifies the cpu list reserved for the host level system threads and kubernetes related threads.
// This provide a "static" CPU list rather than the "dynamic" list by system-reserved and kube-reserved.
// This option overwrites CPUs provided by system-reserved and kube-reserved.
// The reservedSystemCPUs option specifies the CPU list reserved for the host
// level system threads and kubernetes related threads. This provide a "static"
// CPU list rather than the "dynamic" list by systemReserved and kubeReserved.
// This option does not support systemReservedCgroup or kubeReservedCgroup.
ReservedSystemCPUs string `json:"reservedSystemCPUs,omitempty"`
// The previous version for which you want to show hidden metrics.
// showHiddenMetricsForVersion is the previous version for which you want to show
// hidden metrics.
// Only the previous minor version is meaningful, other values will not be allowed.
// The format is <major>.<minor>, e.g.: '1.16'.
// The purpose of this format is make sure you have the opportunity to notice if the next release hides additional metrics,
// rather than being surprised when they are permanently removed in the release after that.
// The format is `<major>.<minor>`, e.g.: `1.16`.
// The purpose of this format is make sure you have the opportunity to notice
// if the next release hides additional metrics, rather than being surprised
// when they are permanently removed in the release after that.
// Default: ""
// +optional
ShowHiddenMetricsForVersion string `json:"showHiddenMetricsForVersion,omitempty"`
// This flag helps kubelet identify absolute name of top level cgroup used to enforce `SystemReserved` compute resource reservation for OS system daemons.
// Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information.
// systemReservedCgroup helps the kubelet identify absolute name of top level CGroup used
// to enforce `systemReserved` compute resource reservation for OS system daemons.
// Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md)
// doc for more information.
// Dynamic Kubelet Config (beta): This field should not be updated without a full node
// reboot. It is safest to keep this value the same as the local config.
// Default: ""
// +optional
SystemReservedCgroup string `json:"systemReservedCgroup,omitempty"`
// This flag helps kubelet identify absolute name of top level cgroup used to enforce `KubeReserved` compute resource reservation for Kubernetes node system daemons.
// Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information.
// kubeReservedCgroup helps the kubelet identify absolute name of top level CGroup used
// to enforce `KubeReserved` compute resource reservation for Kubernetes node system daemons.
// Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md)
// doc for more information.
// Dynamic Kubelet Config (beta): This field should not be updated without a full node
// reboot. It is safest to keep this value the same as the local config.
// Default: ""
// +optional
KubeReservedCgroup string `json:"kubeReservedCgroup,omitempty"`
// This flag specifies the various Node Allocatable enforcements that Kubelet needs to perform.
// This flag accepts a list of options. Acceptable options are `none`, `pods`, `system-reserved` & `kube-reserved`.
// This flag accepts a list of options. Acceptable options are `none`, `pods`,
// `system-reserved` and `kube-reserved`.
// If `none` is specified, no other options may be specified.
// Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information.
// When `system-reserved` is in the list, systemReservedCgroup must be specified.
// When `kube-reserved` is in the list, kubeReservedCgroup must be specified.
// This field is supported only when `cgroupsPerQOS` is set to true.
// Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md)
// for more information.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// removing enforcements may reduce the stability of the node. Alternatively, adding
// enforcements may reduce the stability of components which were using more than
@ -792,9 +853,9 @@ type KubeletConfiguration struct {
// Default: ["pods"]
// +optional
EnforceNodeAllocatable []string `json:"enforceNodeAllocatable,omitempty"`
// A comma separated whitelist of unsafe sysctls or sysctl patterns (ending in *).
// Unsafe sysctl groups are kernel.shm*, kernel.msg*, kernel.sem, fs.mqueue.*, and net.*.
// These sysctls are namespaced but not allowed by default. For example: "kernel.msg*,net.ipv4.route.min_pmtu"
// A comma separated whitelist of unsafe sysctls or sysctl patterns (ending in `*`).
// Unsafe sysctl groups are `kernel.shm*`, `kernel.msg*`, `kernel.sem`, `fs.mqueue.*`,
// and `net.*`. For example: "`kernel.msg*,net.ipv4.route.min_pmtu`"
// Default: []
// +optional
AllowedUnsafeSysctls []string `json:"allowedUnsafeSysctls,omitempty"`
@ -805,23 +866,25 @@ type KubeletConfiguration struct {
// Default: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/"
// +optional
VolumePluginDir string `json:"volumePluginDir,omitempty"`
// providerID, if set, sets the unique id of the instance that an external provider (i.e. cloudprovider)
// can use to identify a specific node.
// providerID, if set, sets the unique ID of the instance that an external
// provider (i.e. cloudprovider) can use to identify a specific node.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may impact the ability of the Kubelet to interact with cloud providers.
// Default: ""
// +optional
ProviderID string `json:"providerID,omitempty"`
// kernelMemcgNotification, if set, the kubelet will integrate with the kernel memcg notification
// to determine if memory eviction thresholds are crossed rather than polling.
// kernelMemcgNotification, if set, instructs the the kubelet to integrate with the
// kernel memcg notification for determining if memory eviction thresholds are
// exceeded rather than polling.
// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
// it may impact the way Kubelet interacts with the kernel.
// Default: false
// +optional
KernelMemcgNotification bool `json:"kernelMemcgNotification,omitempty"`
// Logging specifies the options of logging.
// Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information.
// Defaults:
// logging specifies the options of logging.
// Refer to [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go)
// for more information.
// Default:
// Format: text
// + optional
Logging componentbaseconfigv1alpha1.LoggingConfiguration `json:"logging,omitempty"`
@ -829,30 +892,41 @@ type KubeletConfiguration struct {
// Default: true
// +optional
EnableSystemLogHandler *bool `json:"enableSystemLogHandler,omitempty"`
// ShutdownGracePeriod specifies the total duration that the node should delay the shutdown and total grace period for pod termination during a node shutdown.
// shutdownGracePeriod specifies the total duration that the node should delay the
// shutdown and total grace period for pod termination during a node shutdown.
// Default: "0s"
// +featureGate=GracefulNodeShutdown
// +optional
ShutdownGracePeriod metav1.Duration `json:"shutdownGracePeriod,omitempty"`
// ShutdownGracePeriodCriticalPods specifies the duration used to terminate critical pods during a node shutdown. This should be less than ShutdownGracePeriod.
// For example, if ShutdownGracePeriod=30s, and ShutdownGracePeriodCriticalPods=10s, during a node shutdown the first 20 seconds would be reserved for gracefully terminating normal pods, and the last 10 seconds would be reserved for terminating critical pods.
// shutdownGracePeriodCriticalPods specifies the duration used to terminate critical
// pods during a node shutdown. This should be less than shutdownGracePeriod.
// For example, if shutdownGracePeriod=30s, and shutdownGracePeriodCriticalPods=10s,
// during a node shutdown the first 20 seconds would be reserved for gracefully
// terminating normal pods, and the last 10 seconds would be reserved for terminating
// critical pods.
// Default: "0s"
// +featureGate=GracefulNodeShutdown
// +optional
ShutdownGracePeriodCriticalPods metav1.Duration `json:"shutdownGracePeriodCriticalPods,omitempty"`
// ReservedMemory specifies a comma-separated list of memory reservations for NUMA nodes.
// The parameter makes sense only in the context of the memory manager feature. The memory manager will not allocate reserved memory for container workloads.
// For example, if you have a NUMA0 with 10Gi of memory and the ReservedMemory was specified to reserve 1Gi of memory at NUMA0,
// the memory manager will assume that only 9Gi is available for allocation.
// reservedMemory specifies a comma-separated list of memory reservations for NUMA nodes.
// The parameter makes sense only in the context of the memory manager feature.
// The memory manager will not allocate reserved memory for container workloads.
// For example, if you have a NUMA0 with 10Gi of memory and the reservedMemory was
// specified to reserve 1Gi of memory at NUMA0, the memory manager will assume that
// only 9Gi is available for allocation.
// You can specify a different amount of NUMA node and memory types.
// You can omit this parameter at all, but you should be aware that the amount of reserved memory from all NUMA nodes
// should be equal to the amount of memory specified by the node allocatable features(https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable).
// If at least one node allocatable parameter has a non-zero value, you will need to specify at least one NUMA node.
// You can omit this parameter at all, but you should be aware that the amount of
// reserved memory from all NUMA nodes should be equal to the amount of memory specified
// by the [node allocatable](https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable).
// If at least one node allocatable parameter has a non-zero value, you will need
// to specify at least one NUMA node.
// Also, avoid specifying:
//
// 1. Duplicates, the same NUMA node, and memory type, but with a different value.
// 2. zero limits for any memory type.
// 3. NUMAs nodes IDs that do not exist under the machine.
// 4. memory types except for memory and hugepages-<size>
//
// Default: nil
// +optional
ReservedMemory []MemoryReservation `json:"reservedMemory,omitempty"`
@ -882,7 +956,7 @@ const (
type KubeletAuthorization struct {
// mode is the authorization mode to apply to requests to the kubelet server.
// Valid values are AlwaysAllow and Webhook.
// Valid values are `AlwaysAllow` and `Webhook`.
// Webhook mode uses the SubjectAccessReview API to determine authorization.
// +optional
Mode KubeletAuthorizationMode `json:"mode,omitempty"`
@ -893,36 +967,40 @@ type KubeletAuthorization struct {
}
type KubeletWebhookAuthorization struct {
// cacheAuthorizedTTL is the duration to cache 'authorized' responses from the webhook authorizer.
// cacheAuthorizedTTL is the duration to cache 'authorized' responses from the
// webhook authorizer.
// +optional
CacheAuthorizedTTL metav1.Duration `json:"cacheAuthorizedTTL,omitempty"`
// cacheUnauthorizedTTL is the duration to cache 'unauthorized' responses from the webhook authorizer.
// cacheUnauthorizedTTL is the duration to cache 'unauthorized' responses from
// the webhook authorizer.
// +optional
CacheUnauthorizedTTL metav1.Duration `json:"cacheUnauthorizedTTL,omitempty"`
}
type KubeletAuthentication struct {
// x509 contains settings related to x509 client certificate authentication
// x509 contains settings related to x509 client certificate authentication.
// +optional
X509 KubeletX509Authentication `json:"x509"`
// webhook contains settings related to webhook bearer token authentication
// webhook contains settings related to webhook bearer token authentication.
// +optional
Webhook KubeletWebhookAuthentication `json:"webhook"`
// anonymous contains settings related to anonymous authentication
// anonymous contains settings related to anonymous authentication.
// +optional
Anonymous KubeletAnonymousAuthentication `json:"anonymous"`
}
type KubeletX509Authentication struct {
// clientCAFile is the path to a PEM-encoded certificate bundle. If set, any request presenting a client certificate
// signed by one of the authorities in the bundle is authenticated with a username corresponding to the CommonName,
// clientCAFile is the path to a PEM-encoded certificate bundle. If set, any request
// presenting a client certificate signed by one of the authorities in the bundle
// is authenticated with a username corresponding to the CommonName,
// and groups corresponding to the Organization in the client certificate.
// +optional
ClientCAFile string `json:"clientCAFile,omitempty"`
}
type KubeletWebhookAuthentication struct {
// enabled allows bearer token authentication backed by the tokenreviews.authentication.k8s.io API
// enabled allows bearer token authentication backed by the
// tokenreviews.authentication.k8s.io API.
// +optional
Enabled *bool `json:"enabled,omitempty"`
// cacheTTL enables caching of authentication results
@ -932,8 +1010,10 @@ type KubeletWebhookAuthentication struct {
type KubeletAnonymousAuthentication struct {
// enabled allows anonymous requests to the kubelet server.
// Requests that are not rejected by another authentication method are treated as anonymous requests.
// Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated.
// Requests that are not rejected by another authentication method are treated as
// anonymous requests.
// Anonymous requests have a username of `system:anonymous`, and a group name of
// `system:unauthenticated`.
// +optional
Enabled *bool `json:"enabled,omitempty"`
}
@ -945,7 +1025,7 @@ type KubeletAnonymousAuthentication struct {
// It exists in the kubeletconfig API group because it is classified as a versioned input to the Kubelet.
type SerializedNodeConfigSource struct {
metav1.TypeMeta `json:",inline"`
// Source is the source that we are serializing
// source is the source that we are serializing.
// +optional
Source v1.NodeConfigSource `json:"source,omitempty" protobuf:"bytes,1,opt,name=source"`
}