v1.22 beta.0

feloy · feloy · commit 02d18a3ce189 · 2021-08-04T22:22:35.000+02:00
diff --git a/api-ref-assets/api/swagger.json b/api-ref-assets/api/swagger.json
diff --git a/api-ref-assets/config/fields.yaml b/api-ref-assets/config/fields.yaml
@@ -392,6 +392,7 @@
     - succeeded
     - completedIndexes
     - conditions
+    - uncountedTerminatedPods
 
 - definition: io.k8s.api.batch.v1.CronJobSpec
   field_categories:
@@ -570,6 +571,7 @@
   - name: Alpha level
     fields:
     - dataSource
+    - dataSourceRef
 
 - definition: io.k8s.api.core.v1.PersistentVolumeSpec
   field_categories:
diff --git a/content/en/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1.md b/content/en/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1.md
@@ -49,7 +49,7 @@ This API can be used to request client certificates to authenticate to kube-apis
 
 - **spec** (<a href="{{< ref "../authentication-resources/certificate-signing-request-v1#CertificateSigningRequestSpec" >}}">CertificateSigningRequestSpec</a>), required
 
-  spec contains the certificate request, and is immutable after creation. Only the request, signerName, and usages fields can be set on creation. Other fields are derived by Kubernetes and cannot be modified by users.
+  spec contains the certificate request, and is immutable after creation. Only the request, signerName, expirationSeconds, and usages fields can be set on creation. Other fields are derived by Kubernetes and cannot be modified by users.
 
 - **status** (<a href="{{< ref "../authentication-resources/certificate-signing-request-v1#CertificateSigningRequestStatus" >}}">CertificateSigningRequestStatus</a>)
 
@@ -95,6 +95,23 @@ CertificateSigningRequestSpec contains the certificate request.
    5. Expiration/certificate lifetime: whether it is fixed by the signer, configurable by the admin.
    6. Whether or not requests for CA certificates are allowed.
 
+- **expirationSeconds** (int32)
+
+  expirationSeconds is the requested duration of validity of the issued certificate. The certificate signer may issue a certificate with a different validity duration so a client must check the delta between the notBefore and and notAfter fields in the issued certificate to determine the actual duration.
+  
+  The v1.22+ in-tree implementations of the well-known Kubernetes signers will honor this field as long as the requested duration is not greater than the maximum duration they will honor per the --cluster-signing-duration CLI flag to the Kubernetes controller manager.
+  
+  Certificate signers may not honor this field for various reasons:
+  
+    1. Old signer that is unaware of the field (such as the in-tree
+       implementations prior to v1.22)
+    2. Signer whose configured maximum is shorter than the requested duration
+    3. Signer whose configured minimum is longer than the requested duration
+  
+  The minimum valid value for expirationSeconds is 600, i.e. 10 minutes.
+  
+  As of v1.22, this field is beta and is controlled via the CSRDuration feature gate.
+
 - **extra** (map[string][]string)
 
   extra contains extra attributes of the user that created the CertificateSigningRequest. Populated by the API server on creation and immutable.
diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/flow-schema-v1beta1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/flow-schema-v1beta1.md
@@ -106,10 +106,11 @@ FlowSchemaSpec describes how the FlowSchema's specification looks like.
 
     - **rules.subjects.kind** (string), required
 
-      Required
+      `kind` indicates which one of the other fields is non-empty. Required
 
     - **rules.subjects.group** (GroupSubject)
 
+      `group` matches based on user group name.
 
       <a name="GroupSubject"></a>
       *GroupSubject holds detailed information for group-kind subject.*
@@ -120,6 +121,7 @@ FlowSchemaSpec describes how the FlowSchema's specification looks like.
 
     - **rules.subjects.serviceAccount** (ServiceAccountSubject)
 
+      `serviceAccount` matches ServiceAccounts.
 
       <a name="ServiceAccountSubject"></a>
       *ServiceAccountSubject holds detailed information for service-account-kind subject.*
@@ -134,6 +136,7 @@ FlowSchemaSpec describes how the FlowSchema's specification looks like.
 
     - **rules.subjects.user** (UserSubject)
 
+      `user` matches based on username.
 
       <a name="UserSubject"></a>
       *UserSubject holds detailed information for user-kind subject.*
diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/node-v1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/node-v1.md
@@ -62,17 +62,17 @@ NodeSpec describes the attributes that a node is created with.
 
 - **configSource** (NodeConfigSource)
 
-  If specified, the source to get node configuration from The DynamicKubeletConfig feature gate must be enabled for the Kubelet to use this field
+  Deprecated. If specified, the source of the node's configuration. The DynamicKubeletConfig feature gate must be enabled for the Kubelet to use this field. This field is deprecated as of 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configuration
 
   <a name="NodeConfigSource"></a>
-  *NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil.*
+  *NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22*
 
   - **configSource.configMap** (ConfigMapNodeConfigSource)
 
     ConfigMap is a reference to a Node's ConfigMap
 
     <a name="ConfigMapNodeConfigSource"></a>
-    *ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node.*
+    *ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configuration*
 
     - **configSource.configMap.kubeletConfigKey** (string), required
 
@@ -226,14 +226,14 @@ NodeStatus is information about the current status of a node.
     Active reports the checkpointed config the node is actively using. Active will represent either the current version of the Assigned config, or the current LastKnownGood config, depending on whether attempting to use the Assigned config results in an error.
 
     <a name="NodeConfigSource"></a>
-    *NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil.*
+    *NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22*
 
     - **config.active.configMap** (ConfigMapNodeConfigSource)
 
       ConfigMap is a reference to a Node's ConfigMap
 
       <a name="ConfigMapNodeConfigSource"></a>
-      *ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node.*
+      *ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configuration*
 
       - **config.active.configMap.kubeletConfigKey** (string), required
 
@@ -260,14 +260,14 @@ NodeStatus is information about the current status of a node.
     Assigned reports the checkpointed config the node will try to use. When Node.Spec.ConfigSource is updated, the node checkpoints the associated config payload to local disk, along with a record indicating intended config. The node refers to this record to choose its config checkpoint, and reports this record in Assigned. Assigned only updates in the status after the record has been checkpointed to disk. When the Kubelet is restarted, it tries to make the Assigned config the Active config by loading and validating the checkpointed payload identified by Assigned.
 
     <a name="NodeConfigSource"></a>
-    *NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil.*
+    *NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22*
 
     - **config.assigned.configMap** (ConfigMapNodeConfigSource)
 
       ConfigMap is a reference to a Node's ConfigMap
 
       <a name="ConfigMapNodeConfigSource"></a>
-      *ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node.*
+      *ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configuration*
 
       - **config.assigned.configMap.kubeletConfigKey** (string), required
 
@@ -298,14 +298,14 @@ NodeStatus is information about the current status of a node.
     LastKnownGood reports the checkpointed config the node will fall back to when it encounters an error attempting to use the Assigned config. The Assigned config becomes the LastKnownGood config when the node determines that the Assigned config is stable and correct. This is currently implemented as a 10-minute soak period starting when the local record of Assigned config is updated. If the Assigned config is Active at the end of this period, it becomes the LastKnownGood. Note that if Spec.ConfigSource is reset to nil (use local defaults), the LastKnownGood is also immediately reset to nil, because the local default config is always assumed good. You should not make assumptions about the node's method of determining config stability and correctness, as this may change or become configurable in the future.
 
     <a name="NodeConfigSource"></a>
-    *NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil.*
+    *NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22*
 
     - **config.lastKnownGood.configMap** (ConfigMapNodeConfigSource)
 
       ConfigMap is a reference to a Node's ConfigMap
 
       <a name="ConfigMapNodeConfigSource"></a>
-      *ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node.*
+      *ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configuration*
 
       - **config.lastKnownGood.configMap.kubeletConfigKey** (string), required
 
diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-driver-v1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-driver-v1.md
@@ -84,8 +84,6 @@ CSIDriverSpec is the specification of a CSIDriver.
   RequiresRepublish indicates the CSI driver wants `NodePublishVolume` being periodically called to reflect any possible change in the mounted volume. This field defaults to false.
   
   Note: After a successful initial NodePublishVolume call, subsequent calls to NodePublishVolume should only update the contents of the volume. New mount points will not be seen by a running container.
-  
-  This is a beta feature and only available when the CSIServiceAccountToken feature is enabled.
 
 - **storageCapacity** (boolean)
 
@@ -112,8 +110,6 @@ CSIDriverSpec is the specification of a CSIDriver.
   }
   
   Note: Audience in each TokenRequest should be different and at most one token is empty string. To receive a new token after expiry, RequiresRepublish can be used to trigger NodePublishVolume periodically.
-  
-  This is a beta feature and only available when the CSIServiceAccountToken feature is enabled.
 
   <a name="TokenRequest"></a>
   *TokenRequest contains parameters of a service account token.*
diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1.md
@@ -102,7 +102,16 @@ PersistentVolumeClaimSpec describes the common attributes of storage devices and
 
 - **dataSource** (<a href="{{< ref "../common-definitions/typed-local-object-reference#TypedLocalObjectReference" >}}">TypedLocalObjectReference</a>)
 
-  This field can be used to specify either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) * An existing custom resource that implements data population (Alpha) In order to use custom resource types that implement data population, the AnyVolumeDataSource feature gate must be enabled. If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source.
+  This field can be used to specify either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. If the AnyVolumeDataSource feature gate is enabled, this field will always have the same contents as the DataSourceRef field.
+
+- **dataSourceRef** (<a href="{{< ref "../common-definitions/typed-local-object-reference#TypedLocalObjectReference" >}}">TypedLocalObjectReference</a>)
+
+  Specifies the object from which to populate the volume with data, if a non-empty volume is desired. This may be any local object from a non-empty API group (non core object) or a PersistentVolumeClaim object. When this field is specified, volume binding will only succeed if the type of the specified object matches some installed volume populator or dynamic provisioner. This field will replace the functionality of the DataSource field and as such if both fields are non-empty, they must have the same value. For backwards compatibility, both fields (DataSource and DataSourceRef) will be set to the same value automatically if one of them is empty and the other is non-empty. There are two important differences between DataSource and DataSourceRef: * While DataSource only allows two specific types of objects, DataSourceRef
+    allows any non-core object, as well as PersistentVolumeClaim objects.
+  * While DataSource ignores disallowed values (dropping them), DataSourceRef
+    preserves all values, and generates an error if a disallowed value is
+    specified.
+  (Alpha) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
 
 
 
diff --git a/content/en/docs/reference/kubernetes-api/service-resources/endpoints-v1.md b/content/en/docs/reference/kubernetes-api/service-resources/endpoints-v1.md
@@ -134,7 +134,7 @@ Endpoints is a collection of endpoints that implement the actual service. Exampl
 
     - **subsets.ports.appProtocol** (string)
 
-      The application protocol for this port. This field follows standard Kubernetes label syntax. Un-prefixed names are reserved for IANA standard service names (as per RFC-6335 and http://www.iana.org/assignments/service-names). Non-standard protocols should use prefixed names such as mycompany.com/my-custom-protocol. This is a beta field that is guarded by the ServiceAppProtocol feature gate and enabled by default.
+      The application protocol for this port. This field follows standard Kubernetes label syntax. Un-prefixed names are reserved for IANA standard service names (as per RFC-6335 and http://www.iana.org/assignments/service-names). Non-standard protocols should use prefixed names such as mycompany.com/my-custom-protocol.
 
 
 
diff --git a/content/en/docs/reference/kubernetes-api/service-resources/ingress-v1.md b/content/en/docs/reference/kubernetes-api/service-resources/ingress-v1.md
@@ -107,11 +107,7 @@ IngressSpec describes the Ingress the user wishes to exist.
 
         Backend defines the referenced service endpoint to which the traffic will be forwarded to.
 
-      - **rules.http.paths.path** (string)
-
-        Path is matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a '/' and must be present when using PathType with value "Exact" or "Prefix".
-
-      - **rules.http.paths.pathType** (string)
+      - **rules.http.paths.pathType** (string), required
 
         PathType determines the interpretation of the Path matching. PathType can be one of the following values: * Exact: Matches the URL path exactly. * Prefix: Matches based on a URL path prefix split by '/'. Matching is
           done on a path element by element basis. A path element refers is the
@@ -125,6 +121,10 @@ IngressSpec describes the Ingress the user wishes to exist.
           or treat it identically to Prefix or Exact path types.
         Implementations are required to support all path types.
 
+      - **rules.http.paths.path** (string)
+
+        Path is matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a '/' and must be present when using PathType with value "Exact" or "Prefix".
+
 - **tls** ([]IngressTLS)
 
   *Atomic: will be replaced during a merge*
diff --git a/content/en/docs/reference/kubernetes-api/service-resources/service-v1.md b/content/en/docs/reference/kubernetes-api/service-resources/service-v1.md
@@ -100,7 +100,7 @@ ServiceSpec describes the attributes that a user creates on a service.
 
   - **ports.appProtocol** (string)
 
-    The application protocol for this port. This field follows standard Kubernetes label syntax. Un-prefixed names are reserved for IANA standard service names (as per RFC-6335 and http://www.iana.org/assignments/service-names). Non-standard protocols should use prefixed names such as mycompany.com/my-custom-protocol. This is a beta field that is guarded by the ServiceAppProtocol feature gate and enabled by default.
+    The application protocol for this port. This field follows standard Kubernetes label syntax. Un-prefixed names are reserved for IANA standard service names (as per RFC-6335 and http://www.iana.org/assignments/service-names). Non-standard protocols should use prefixed names such as mycompany.com/my-custom-protocol.
 
 - **type** (string)
 
@@ -190,7 +190,7 @@ ServiceSpec describes the attributes that a user creates on a service.
 
 - **allocateLoadBalancerNodePorts** (boolean)
 
-  allocateLoadBalancerNodePorts defines if NodePorts will be automatically allocated for services with type LoadBalancer.  Default is "true". It may be set to "false" if the cluster load-balancer does not rely on NodePorts. allocateLoadBalancerNodePorts may only be set for services with type LoadBalancer and will be cleared if the type is changed to any other type. This field is alpha-level and is only honored by servers that enable the ServiceLBNodePortControl feature.
+  allocateLoadBalancerNodePorts defines if NodePorts will be automatically allocated for services with type LoadBalancer.  Default is "true". It may be set to "false" if the cluster load-balancer does not rely on NodePorts.  If the caller requests specific NodePorts (by specifying a value), those requests will be respected, regardless of this field. This field may only be set for services with type LoadBalancer and will be cleared if the type is changed to any other type. This field is beta-level and is only honored by servers that enable the ServiceLBNodePortControl feature.
 
 
 
diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/daemon-set-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/daemon-set-v1.md
@@ -99,7 +99,7 @@ DaemonSetSpec is the specification of a daemon set.
 
     - **updateStrategy.rollingUpdate.maxUnavailable** (IntOrString)
 
-      The maximum number of DaemonSet pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of total number of DaemonSet pods at the start of the update (ex: 10%). Absolute number is calculated from percentage by rounding down to a minimum of one. This cannot be 0 if MaxSurge is 0 Default value is 1. Example: when this is set to 30%, at most 30% of the total number of nodes that should be running the daemon pod (i.e. status.desiredNumberScheduled) can have their pods stopped for an update at any given time. The update starts by stopping at most 30% of those DaemonSet pods and then brings up new DaemonSet pods in their place. Once the new pods are available, it then proceeds onto other DaemonSet pods, thus ensuring that at least 70% of original number of DaemonSet pods are available at all times during the update.
+      The maximum number of DaemonSet pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of total number of DaemonSet pods at the start of the update (ex: 10%). Absolute number is calculated from percentage by rounding up. This cannot be 0 if MaxSurge is 0 Default value is 1. Example: when this is set to 30%, at most 30% of the total number of nodes that should be running the daemon pod (i.e. status.desiredNumberScheduled) can have their pods stopped for an update at any given time. The update starts by stopping at most 30% of those DaemonSet pods and then brings up new DaemonSet pods in their place. Once the new pods are available, it then proceeds onto other DaemonSet pods, thus ensuring that at least 70% of original number of DaemonSet pods are available at all times during the update.
 
       <a name="IntOrString"></a>
       *IntOrString is a type that can hold an int32 or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a name or number.*
diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/job-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/job-v1.md
diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/pod-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/pod-v1.md

Original file line number	Diff line number	Diff line change
`@@ -134,7 +134,7 @@ Endpoints is a collection of endpoints that implement the actual service. Exampl`
`134`	`134`
`135`	`135`	`- subsets.ports.appProtocol (string)`
`136`	`136`
`137`		`- The application protocol for this port. This field follows standard Kubernetes label syntax. Un-prefixed names are reserved for IANA standard service names (as per RFC-6335 and http://www.iana.org/assignments/service-names). Non-standard protocols should use prefixed names such as mycompany.com/my-custom-protocol. This is a beta field that is guarded by the ServiceAppProtocol feature gate and enabled by default.`
	`137`	`+ The application protocol for this port. This field follows standard Kubernetes label syntax. Un-prefixed names are reserved for IANA standard service names (as per RFC-6335 and http://www.iana.org/assignments/service-names). Non-standard protocols should use prefixed names such as mycompany.com/my-custom-protocol.`
`138`	`138`
`139`	`139`
`140`	`140`