Merge pull request #8599 from caesarxuchao/minions-to-nodes

in docs, update "minions" to "nodes"
This commit is contained in:
Dawn Chen 2015-05-21 11:34:36 -07:00
commit eaba2c1ab4
6 changed files with 9 additions and 9 deletions

View File

@ -65,7 +65,7 @@ Cluster in Large organization:
Org-run cluster:
- organization that runs K8s master components is same as the org that runs apps on K8s.
- Minions may be on-premises VMs or physical machines; Cloud VMs; or a mix.
- Nodes may be on-premises VMs or physical machines; Cloud VMs; or a mix.
Hosted cluster:
- Offering K8s API as a service, or offering a Paas or Saas built on K8s
@ -223,7 +223,7 @@ Initially:
Improvements:
- allow one namespace to charge the quota for one or more other namespaces. This would be controlled by a policy which allows changing a billing_namespace= label on an object.
- allow quota to be set by namespace owners for (namespace x label) combinations (e.g. let "webserver" namespace use 100 cores, but to prevent accidents, don't allow "webserver" namespace and "instance=test" use more than 10 cores.
- tools to help write consistent quota config files based on number of minions, historical namespace usages, QoS needs, etc.
- tools to help write consistent quota config files based on number of nodes, historical namespace usages, QoS needs, etc.
- way for K8s Cluster Admin to incrementally adjust Quota objects.
Simple profile:

View File

@ -104,7 +104,7 @@ A pod runs in a *security context* under a *service account* that is defined by
### TODO: authorization, authentication
### Isolate the data store from the minions and supporting infrastructure
### Isolate the data store from the nodes and supporting infrastructure
Access to the central data store (etcd) in Kubernetes allows an attacker to run arbitrary containers on hosts, to gain access to any protected information stored in either volumes or in pods (such as access tokens or shared secrets provided as environment variables), to intercept and redirect traffic from running services by inserting middlemen, or to simply delete the entire history of the custer.
@ -114,7 +114,7 @@ Both the Kubelet and Kube Proxy need information related to their specific roles
The controller manager for Replication Controllers and other future controllers act on behalf of a user via delegation to perform automated maintenance on Kubernetes resources. Their ability to access or modify resource state should be strictly limited to their intended duties and they should be prevented from accessing information not pertinent to their role. For example, a replication controller needs only to create a copy of a known pod configuration, to determine the running state of an existing pod, or to delete an existing pod that it created - it does not need to know the contents or current state of a pod, nor have access to any data in the pods attached volumes.
The Kubernetes pod scheduler is responsible for reading data from the pod to fit it onto a minion in the cluster. At a minimum, it needs access to view the ID of a pod (to craft the binding), its current state, any resource information necessary to identify placement, and other data relevant to concerns like anti-affinity, zone or region preference, or custom logic. It does not need the ability to modify pods or see other resources, only to create bindings. It should not need the ability to delete bindings unless the scheduler takes control of relocating components on failed hosts (which could be implemented by a separate component that can delete bindings but not create them). The scheduler may need read access to user or project-container information to determine preferential location (underspecified at this time).
The Kubernetes pod scheduler is responsible for reading data from the pod to fit it onto a node in the cluster. At a minimum, it needs access to view the ID of a pod (to craft the binding), its current state, any resource information necessary to identify placement, and other data relevant to concerns like anti-affinity, zone or region preference, or custom logic. It does not need the ability to modify pods or see other resources, only to create bindings. It should not need the ability to delete bindings unless the scheduler takes control of relocating components on failed hosts (which could be implemented by a separate component that can delete bindings but not create them). The scheduler may need read access to user or project-container information to determine preferential location (underspecified at this time).
[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/security.md?pixel)]()

View File

@ -8,7 +8,7 @@ Display one or many resources
Display one or many resources.
Possible resources include pods (po), replication controllers (rc), services
(svc), minions (mi), events (ev), or component statuses (cs).
(svc), nodes, events (ev), or component statuses (cs).
By specifying the output as 'template' and providing a Go template as the value
of the --template flag, you can filter the attributes of the fetched resource(s).
@ -84,6 +84,6 @@ $ kubectl get rc/web service/frontend pods/web-pod-13je7
### SEE ALSO
* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager
###### Auto generated by spf13/cobra at 2015-05-15 00:05:04.549637372 +0000 UTC
###### Auto generated by spf13/cobra at 2015-05-20 23:52:21.968486735 +0000 UTC
[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_get.md?pixel)]()

View File

@ -17,7 +17,7 @@ Display one or many resources.
.PP
Possible resources include pods (po), replication controllers (rc), services
(svc), minions (mi), events (ev), or component statuses (cs).
(svc), nodes, events (ev), or component statuses (cs).
.PP
By specifying the output as 'template' and providing a Go template as the value

View File

@ -1,6 +1,6 @@
# Kubernetes OpenVSwitch GRE/VxLAN networking
This document describes how OpenVSwitch is used to setup networking between pods across minions.
This document describes how OpenVSwitch is used to setup networking between pods across nodes.
The tunnel type could be GRE or VxLAN. VxLAN is preferable when large scale isolation needs to be performed within the network.
![ovs-networking](./ovs-networking.png "OVS Networking")

View File

@ -32,7 +32,7 @@ const (
get_long = `Display one or many resources.
Possible resources include pods (po), replication controllers (rc), services
(svc), minions (mi), events (ev), or component statuses (cs).
(svc), nodes, events (ev), or component statuses (cs).
By specifying the output as 'template' and providing a Go template as the value
of the --template flag, you can filter the attributes of the fetched resource(s).`