update k8s [sync git]

khs1994 · khs1994 · commit 2441504c9fa7 · 2025-08-23T11:47:31.000+08:00
Signed-off-by: Kang Huaishuai &lt;khs1994@khs1994.com&gt;
diff --git a/dockerfile/php/nightly/cli/Dockerfile b/dockerfile/php/nightly/cli/Dockerfile
@@ -403,29 +403,30 @@ RUN --mount=type=bind,from=php:alpine,source=/usr/local/bin,target=/opt/bin,rw \
                            --with-phpize-path=/usr/local/bin/phpize \
                            --skip-enable-extension \
                            --force" \
-      && pie download kjdev/zstd:0.14.0+pie \
-      && cd /root/.pie/$(ls /root/.pie)/vendor/kjdev/zstd/zstd-0.14.0+pie \
-      && curl -fL https://github.com/kjdev/php-ext-zstd/commit/96d5dcea944a188e9a388bf19ed81ee41f1a990c.diff -O \
-      && patch -p1 < 96d5dcea944a188e9a388bf19ed81ee41f1a990c.diff \
+      # && pie download kjdev/zstd:0.14.0+pie \
+      # && cd /root/.pie/$(ls /root/.pie)/vendor/kjdev/zstd/zstd-0.14.0+pie \
+      # && curl -fL https://github.com/kjdev/php-ext-zstd/commit/96d5dcea944a188e9a388bf19ed81ee41f1a990c.diff -O \
+      # && patch -p1 < 96d5dcea944a188e9a388bf19ed81ee41f1a990c.diff \
       && apk del --no-network patch \
-      && mv /root/.pie/$(ls /root/.pie)/vendor/kjdev/zstd/zstd-0.14.0+pie /usr/src/php/ext/zstd \
-      && cd /usr/src/php/ext/zstd \
-      && docker-php-ext-configure zstd \
-      && docker-php-ext-install zstd \
+      # && mv /root/.pie/$(ls /root/.pie)/vendor/kjdev/zstd/zstd-0.14.0+pie /usr/src/php/ext/zstd \
+      # && cd /usr/src/php/ext/zstd \
+      # && docker-php-ext-configure zstd \
+      # && docker-php-ext-install zstd \
       && apk add --no-cache --virtual .pecl_build_deps $PECL_BUILD_DEPS $PHPIZE_DEPS \
       && apk add --no-cache --virtual .pecl_run_deps $PECL_RUN_DEPS \
-      # && pie -n install ${PIE_CONFIG} \
-      #                kjdev/zstd \
+      && pie -n install ${PIE_CONFIG} \
+                     kjdev/zstd \
       # && pie -n install ${PIE_CONFIG} \
       #                igbinary/igbinary:dev-main \
       && pie -n install ${PIE_CONFIG} \
                      phpredis/phpredis:dev-develop \
-                     --enable-redis-igbinary --enable-redis-zstd \
+                     --enable-redis-igbinary \
+                     --enable-redis-zstd \
       && pie -n install ${PIE_CONFIG} \
                      php-memcached/php-memcached:dev-master \
                      --enable-memcached-igbinary \
-      # && pie -n install ${PIE_CONFIG} \
-      #                xdebug/xdebug:dev-master \
+      && pie -n install ${PIE_CONFIG} \
+                     xdebug/xdebug:dev-master \
       && docker-php-ext-enable zstd \
       && echo "extension=redis" > $PHP_INI_DIR/conf.d/docker-php-ext-z-redis.ini \
       && echo "extension=memcached" > $PHP_INI_DIR/conf.d/docker-php-ext-z-memcached.ini \
diff --git a/dockerfile/php/nightly/fpm/Dockerfile b/dockerfile/php/nightly/fpm/Dockerfile
@@ -415,29 +415,30 @@ RUN --mount=type=bind,from=ghcr.io/dpsigs/php:alpine,source=/usr/local/bin,targe
                            --with-phpize-path=/usr/local/bin/phpize \
                            --skip-enable-extension \
                            --force " \
-      && pie download kjdev/zstd:0.14.0+pie \
-      && cd /root/.pie/$(ls /root/.pie)/vendor/kjdev/zstd/zstd-0.14.0+pie \
-      && curl -fL https://github.com/kjdev/php-ext-zstd/commit/96d5dcea944a188e9a388bf19ed81ee41f1a990c.diff -O \
-      && patch -p1 < 96d5dcea944a188e9a388bf19ed81ee41f1a990c.diff \
+      # && pie download kjdev/zstd:0.14.0+pie \
+      # && cd /root/.pie/$(ls /root/.pie)/vendor/kjdev/zstd/zstd-0.14.0+pie \
+      # && curl -fL https://github.com/kjdev/php-ext-zstd/commit/96d5dcea944a188e9a388bf19ed81ee41f1a990c.diff -O \
+      # && patch -p1 < 96d5dcea944a188e9a388bf19ed81ee41f1a990c.diff \
       && apk del --no-network patch \
-      && mv /root/.pie/$(ls /root/.pie)/vendor/kjdev/zstd/zstd-0.14.0+pie /usr/src/php/ext/zstd \
-      && cd /usr/src/php/ext/zstd \
-      && docker-php-ext-configure zstd \
-      && docker-php-ext-install zstd \
-      && apk add --no-cache --virtual .pecl_build_deps $PECL_BUILD_DEPS $PHPIZE_DEPS \
-      && apk add --no-cache --virtual .pecl_run_deps $PECL_RUN_DEPS \
-      # && pie -n install ${PIE_CONFIG} \
-      #                kjdev/zstd \
+      # && mv /root/.pie/$(ls /root/.pie)/vendor/kjdev/zstd/zstd-0.14.0+pie /usr/src/php/ext/zstd \
+      # && cd /usr/src/php/ext/zstd \
+      # && docker-php-ext-configure zstd \
+      # && docker-php-ext-install zstd \
+      # && apk add --no-cache --virtual .pecl_build_deps $PECL_BUILD_DEPS $PHPIZE_DEPS \
+      # && apk add --no-cache --virtual .pecl_run_deps $PECL_RUN_DEPS \
+      && pie -n install ${PIE_CONFIG} \
+                     kjdev/zstd \
       # && pie -n install ${PIE_CONFIG} \
       #                igbinary/igbinary:dev-main \
       && pie -n install ${PIE_CONFIG} \
                      phpredis/phpredis:dev-develop \
-                     --enable-redis-igbinary --enable-redis-zstd \
+                     --enable-redis-igbinary \
+                     --enable-redis-zstd \
       && pie -n install ${PIE_CONFIG} \
                      php-memcached/php-memcached:dev-master \
                      --enable-memcached-igbinary \
-      # && pie -n install ${PIE_CONFIG} \
-      #                xdebug/xdebug:dev-master \
+      && pie -n install ${PIE_CONFIG} \
+                     xdebug/xdebug:dev-master \
       && docker-php-ext-enable zstd \
                                redis \
                                memcached \
diff --git a/kubernetes/.env.example b/kubernetes/.env.example
@@ -13,7 +13,7 @@ LNMP_HTTPS_PORT=443
 # https://github.com/etcd-io/etcd/releases
 ETCD_VERSION=3.6.1
 # https://github.com/helm/helm/releases
-HELM_VERSION=3.18.2
+HELM_VERSION=3.18.6
 # https://github.com/containernetworking/cni/releases
 # https://github.com/containernetworking/plugins/releases
 CNI_VERSION=1.7.1
diff --git a/kubernetes/addons/istio/README.md b/kubernetes/addons/istio/README.md
@@ -14,7 +14,7 @@ $ istioctl manifest generate --set profile=default > istio.yaml
 
 $ istioctl manifest generate --set profile=demo > istio.yaml
 
-# https://istio.io/latest/zh/docs/reference/config/installation-options/
+# https://istio.io/latest/docs/setup/additional-setup/customize-installation/
 $ istioctl manifest generate --set profile=demo \
   # istio-cni
   --set components.cni.enabled=true \
diff --git a/kubernetes/cfssl/kubelet.config.yaml b/kubernetes/cfssl/kubelet.config.yaml
@@ -75,7 +75,7 @@ kubeReserved: {}
 systemReservedCgroup: ""
 kubeReservedCgroup: ""
 enforceNodeAllocatable: ["pods"]
-# volumePluginDir: /opt/k8s/usr/libexec/kubernetes/kubelet-plugins/volume/exec/
+volumePluginDir: /opt/k8s/usr/libexec/kubernetes/kubelet-plugins/volume/exec/
 # featureGates:
   # AllAlpha: true
   # IPv6DualStack: true
diff --git a/kubernetes/docker-compose.bump.yml b/kubernetes/docker-compose.bump.yml
@@ -12,7 +12,7 @@ services:
     image: registry.k8s.io/coredns/coredns:v1.12.1
 
   pause:
-    image: registry.k8s.io/pause:3.7
+    image: registry.k8s.io/pause:3.10
     # https://github.com/kubernetes/kubernetes/tree/master/build/pause
 
   calico:
diff --git a/kubernetes/lnmp-k8s b/kubernetes/lnmp-k8s
@@ -1070,6 +1070,8 @@ _containerd_cri_config(){
 
     cat <<EOF | $(_sudo) tee $CONTAINERD_CONF_ROOT/certs.d/docker.io/hosts.toml
 server = "https://docker.io"
+[host."https://ghcr.io"]
+  capabilities = ["pull", "resolve"]
 [host."https://mirror.gcr.io"]
   capabilities = ["pull", "resolve"]
 [host."https://registry-1.docker.io"]
@@ -1415,6 +1417,10 @@ csr-crb.yaml,\
 kubectl.kubeconfig,\
 kube-proxy.kubeconfig} \
     ${K8S_ROOT}/etc/kubernetes
+
+   $(_sudo) mkdir -p ${K8S_ROOT}/etc/kubernetes/kubelet.conf.d
+
+   cp systemd/etc/kubernetes/kubelet.conf.d/* ${K8S_ROOT}/etc/kubernetes/kubelet.conf.d/
 }
 
 _k8s_join_conf_replace(){
diff --git a/kubernetes/lnmp/mysql/overlays/development/kustomization.yaml b/kubernetes/lnmp/mysql/overlays/development/kustomization.yaml
@@ -20,3 +20,6 @@ generatorOptions:
     app: lnmp
     tier: mysql
   disableNameSuffixHash: true
+images:
+- name: mysql
+  newName: ghcr.io/dpsigs/mysql
diff --git a/kubernetes/lnmp/nginx/overlays/development/kustomization.yaml b/kubernetes/lnmp/nginx/overlays/development/kustomization.yaml
@@ -15,3 +15,6 @@ generatorOptions:
   labels:
     app: lnmp
     tier: nginx
+images:
+- name: nginx
+  newName: ghcr.io/dpsigs/nginx
diff --git a/kubernetes/lnmp/redis/overlays/development/kustomization.yaml b/kubernetes/lnmp/redis/overlays/development/kustomization.yaml
@@ -12,3 +12,6 @@ generatorOptions:
     app: lnmp
     tier: redis
   disableNameSuffixHash: true
+images:
+- name: redis
+  newName: ghcr.io/dpsigs/redis
diff --git a/kubernetes/systemd/etc/cri-containerd/2.1/config.toml b/kubernetes/systemd/etc/cri-containerd/2.1/config.toml
@@ -28,7 +28,7 @@ imports = []
   uid = 0
   gid = 0
   level = ''
-  format = ''
+  format = 'json'
 
 [metrics]
   address = '127.0.0.1:1338'
diff --git a/kubernetes/systemd/etc/kubernetes/kubelet.conf.d/00-kubelet.conf b/kubernetes/systemd/etc/kubernetes/kubelet.conf.d/00-kubelet.conf
@@ -0,0 +1,9 @@
+kind: KubeletConfiguration
+apiVersion: kubelet.config.k8s.io/v1beta1
+logging:
+  format: "json"
+  flushFrequency: "5s"
+  verbosity: 3
+  options:
+    json:
+      infoBufferSize: "0"
diff --git a/kubernetes/systemd/etc/kubernetes/kubelet.conf.d/99-cri-containerd.config b/kubernetes/systemd/etc/kubernetes/kubelet.conf.d/99-cri-containerd.config
@@ -0,0 +1,3 @@
+kind: KubeletConfiguration
+apiVersion: kubelet.config.k8s.io/v1beta1
+containerRuntimeEndpoint: "unix:///var/run/cri-containerd/cri-containerd.sock"
diff --git a/kubernetes/systemd/etc/kubernetes/kubelet.conf.d/99-crio.config b/kubernetes/systemd/etc/kubernetes/kubelet.conf.d/99-crio.config
@@ -0,0 +1,3 @@
+kind: KubeletConfiguration
+apiVersion: kubelet.config.k8s.io/v1beta1
+containerRuntimeEndpoint: "unix:///var/run/crio/crio.sock"
diff --git a/kubernetes/systemd/system/cri-o.service b/kubernetes/systemd/system/cri-o.service
@@ -40,6 +40,10 @@ var-log-pods.mount
 # ConditionVirtualization=wsl
 ; ConditionPathIsMountPoint=/wsl/wsl-k8s-data
 ; RequiresMountsFor=/wsl/wsl-k8s-data
+
+# https://github.com/cri-o/cri-o/pull/3545
+# After=crio-wipe.service
+# Requires=crio-wipe.service
 [Service]
 Type=notify
 EnvironmentFile=-/opt/k8s/etc/sysconfig/crio
diff --git a/kubernetes/systemd/system/kubelet@.service b/kubernetes/systemd/system/kubelet@.service
@@ -105,18 +105,18 @@ ExecStartPre=/usr/bin/env mountpoint /var/lib/kubelet
 ExecStartPre=-/usr/bin/env mountpoint __opt/k8s__/opt/cni/bin
 ExecStartPre=-/usr/bin/env mountpoint __opt/k8s__/etc/cni/net.d
 ExecStartPre=/usr/bin/env mountpoint /usr/libexec/kubernetes
+ExecStartPre=-/usr/bin/env mkdir -p __opt/k8s__/etc/kubernetes/kubelet.conf.d
+ExecStartPre=-/usr/bin/env cp __opt/k8s__/etc/kubernetes/kubelet.conf.d/99-%i.config __opt/k8s__/etc/kubernetes/kubelet.conf.d/99-cri.conf
 
 ExecStart=/opt/k8s/bin/kubelet \
 --bootstrap-kubeconfig=${K8S_ROOT}/etc/kubernetes/kubelet-bootstrap.kubeconfig \
 --cert-dir=${K8S_ROOT}/etc/kubernetes/pki \
 --root-dir=/opt/k8s/var/lib/kubelet \
 --kubeconfig=${K8S_ROOT}/etc/kubernetes/kubelet.kubeconfig \
 --config=${K8S_ROOT}/etc/kubernetes/kubelet.config.yaml \
+--config-dir=${K8S_ROOT}/etc/kubernetes/kubelet.conf.d \
 --hostname-override=${NODE_NAME} \
---volume-plugin-dir=/opt/k8s/usr/libexec/kubernetes/kubelet-plugins/volume/exec/ \
---v=2 \
---logging-format=json \
---container-runtime-endpoint=unix:///run/%i/%i.sock
+--v=2
 
 ; kubelet@cri-containerd
 ; kubelet@crio
diff --git a/windows/lnmp-windows-pm-repo/k8s/helm/lwpm.json b/windows/lnmp-windows-pm-repo/k8s/helm/lwpm.json
@@ -1,8 +1,8 @@
 {
   "name": "helm",
   "description": "The Kubernetes Package Manager",
-  "version": "3.18.2",
-  "pre-version": "3.18.2",
+  "version": "3.18.6",
+  "pre-version": "3.18.6",
   "homepage": "https://helm.sh/",
   "bug": "https://github.com/helm/helm/issues",
   "github": "helm/helm",
