Merge pull request #46642 from chanieljdan/merged-main-dev-1.31

Merged main dev 1.31

Author: k8s-ci-robot

OWNERS_ALIASES

@@ -54,7 +54,6 @@ aliases:
     - bene2k1
     - rlenferink
   sig-docs-en-owners: # Admins for English content
-    - celestehorgan
     - dipesh-rawat
     - divya-mohan0209
     - katcosgrove
@@ -65,7 +64,6 @@ aliases:
     - sftim
     - tengqm
   sig-docs-en-reviews: # PR reviews for English content
-    - celestehorgan
     - dipesh-rawat
     - divya-mohan0209
     - katcosgrove
@@ -98,12 +96,12 @@ aliases:
     - rekcah78
     - remyleone
   sig-docs-hi-owners: # Admins for Hindi content
-    - anubha-v-ardhan
+    - dipesh-rawat
     - divya-mohan0209
   sig-docs-hi-reviews: # PR reviews for Hindi content
-    - anubha-v-ardhan
     - Babapool
     - bishal7679
+    - dipesh-rawat
     - divya-mohan0209
   sig-docs-id-owners: # Admins for Indonesian content
     - ariscahyadi

content/de/docs/concepts/architecture/nodes.md

@@ -45,7 +45,7 @@ Das `conditions` Feld beschreibt den Zustand, aller `Running` Nodes.
 | Node Condition | Beschreibung |
 |----------------|-------------|
 | `OutOfDisk`    | `True` wenn auf dem Node nicht genügend freier Speicherplatz zum Hinzufügen neuer Pods vorhanden ist, andernfalls `False` |
-| `Ready`        | `True` wenn der Node in einem guten Zustand und bereit ist Pods aufzunehmen, `False` wenn der Node nicht in einem guten Zustand ist und nicht bereit ist Pods aufzunehmeb, und `Unknown` wenn der Node-Controller seit der letzten `node-monitor-grace-period` nichts von dem Node gehört hat (Die Standardeinstellung beträgt 40 Sekunden) |
+| `Ready`        | `True` wenn der Node in einem guten Zustand und bereit ist Pods aufzunehmen, `False` wenn der Node nicht in einem guten Zustand ist und nicht bereit ist Pods aufzunehmen, und `Unknown` wenn der Node-Controller seit der letzten `node-monitor-grace-period` nichts von dem Node gehört hat (Die Standardeinstellung beträgt 40 Sekunden) |
 | `MemoryPressure`    | `True` wenn der verfügbare Speicher des Nodes niedrig ist; Andernfalls`False` |
 | `PIDPressure`    | `True` wenn zu viele Prozesse auf dem Node vorhanden sind; Andernfalls`False` |
 | `DiskPressure`    | `True` wenn die Festplattenkapazität niedrig ist. Andernfalls `False` |

content/en/_index.html

@@ -47,12 +47,15 @@ <h2>The Challenges of Migrating 150+ Microservices to Kubernetes</h2>
         <button id="desktopShowVideoButton" onclick="kub.showVideo()">Watch Video</button>
         <br>
         <br>
-        <a href="https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/" button id="desktopKCButton">Attend KubeCon + CloudNativeCon Europe on March 19-22, 2024</a>
+        <a href="https://events.linuxfoundation.org/kubecon-cloudnativecon-open-source-summit-ai-dev-china/" button id="desktopKCButton">Attend KubeCon + CloudNativeCon China on August 21-23</a>
         <br>
         <br>
         <br>
+        <a href="https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america-2024/" button id="desktopKCButton">Attend KubeCon + CloudNativeCon North America on November 12-15</a>
         <br>
-        <a href="https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america-2024/" button id="desktopKCButton">Attend KubeCon + CloudNativeCon North America on November 12-15, 2024</a>
+        <br>
+        <br>
+        <a href="https://events.linuxfoundation.org/kubecon-cloudnativecon-india/" button id="desktopKCButton">Attend KubeCon + CloudNativeCon India on December 11-12</a>
 </div>
 <div id="videoPlayer">
     <iframe data-url="https://www.youtube.com/embed/H06qrNmGqyE?autoplay=1" frameborder="0" allowfullscreen></iframe>

content/en/blog/_posts/2023-12-14-disabling-in-tree-cloud-provider-goes-beta.md

@@ -40,7 +40,7 @@ These updated default settings affect a large proportion of Kubernetes users,
 and **will require changes** for users who were previously using the in-tree
 provider integrations. The legacy integrations offered compatibility with
 Azure, AWS, GCE, OpenStack, and vSphere; however for AWS and OpenStack the
-compiled-in integrations were removed in Kubernetes versions 1.26 and 1.27,
+compiled-in integrations were removed in Kubernetes versions 1.27 and 1.26,
 respectively.
 
 ## What has changed?

content/en/blog/_posts/2024-04-17-kubernetes-1.30.md

@@ -145,7 +145,7 @@ You need to enable the `CRDValidationRatcheting` [feature
 gate](/docs/reference/command-line-tools-reference/feature-gates/) to use this behavior, which then
 applies to all CustomResourceDefinitions in your cluster.
 
-Provided you enabled the feature gate, Kubernetes implements _validation racheting_ for
+Provided you enabled the feature gate, Kubernetes implements _validation ratcheting_ for
 CustomResourceDefinitions. The API server is willing to accept updates to resources that are not valid
 after the update, provided that each part of the resource that failed to validate was not changed by
 the update operation. In other words, any invalid part of the resource that remains invalid must

content/en/docs/concepts/architecture/garbage-collection.md

@@ -148,8 +148,17 @@ To configure the setting, enable the `ImageMaximumGCAge`
 [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) for the kubelet,
 and also set a value for the `ImageMaximumGCAge` field in the kubelet configuration file.
 
-The value is specified as a Kubernetes _duration_; for example, you can set the configuration
-field to `3d12h`, which means 3 days and 12 hours.
+The value is specified as a Kubernetes _duration_; 
+Valid time units for the `ImageMaximumGCAge` field in the kubelet configuration file are:
+- "ns" for nanoseconds
+- "us" or "µs" for microseconds
+- "ms" for milliseconds
+- "s" for seconds
+- "m" for minutes
+- "h" for hours
+
+For example, you can set the configuration field to `12h45m`,
+which means 12 hours and 45 minutes. 
 
 {{< note >}}
 This feature does not track image usage across kubelet restarts. If the kubelet

content/en/docs/concepts/extend-kubernetes/api-extension/custom-resources.md

@@ -325,7 +325,7 @@ selectable fields.
 
 {{% code_sample file="customresourcedefinition/shirt-resource-definition.yaml" %}}
 
-Field selectors can then be used to get only resources with with a `color` of `blue`:
+Field selectors can then be used to get only resources with a `color` of `blue`:
 
 ```shell
 kubectl get shirts.stable.example.com --field-selector spec.color=blue

content/en/docs/concepts/policy/resource-quotas.md

@@ -185,17 +185,17 @@ a poorly configured CronJob. CronJobs that create too many Jobs in a namespace c
 There is another syntax only to set the same type of quota for certain resources.
 The following types are supported:
 
-| Resource Name | Description |
-| ------------------------------- | ------------------------------------------------- |
-| `configmaps` | The total number of ConfigMaps that can exist in the namespace. |
-| `persistentvolumeclaims` | The total number of [PersistentVolumeClaims](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace. |
-| `pods` | The total number of Pods in a non-terminal state that can exist in the namespace.  A pod is in a terminal state if `.status.phase in (Failed, Succeeded)` is true.  |
-| `replicationcontrollers` | The total number of ReplicationControllers that can exist in the namespace. |
-| `resourcequotas` | The total number of ResourceQuotas that can exist in the namespace. |
-| `services` | The total number of Services that can exist in the namespace. |
-| `services.loadbalancers` | The total number of Services of type `LoadBalancer` that can exist in the namespace. |
-| `services.nodeports` | The total number of Services of type `NodePort` that can exist in the namespace. |
-| `secrets` | The total number of Secrets that can exist in the namespace. |
+| Resource Name | Description                                                                                                                                                        |
+| ------------------------------- |--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `configmaps` | The total number of ConfigMaps that can exist in the namespace.                                                                                                    |
+| `persistentvolumeclaims` | The total number of [PersistentVolumeClaims](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace.                   |
+| `pods` | The total number of Pods in a non-terminal state that can exist in the namespace.  A pod is in a terminal state if `.status.phase in (Failed, Succeeded)` is true. |
+| `replicationcontrollers` | The total number of ReplicationControllers that can exist in the namespace.                                                                                        |
+| `resourcequotas` | The total number of ResourceQuotas that can exist in the namespace.                                                                                                |
+| `services` | The total number of Services that can exist in the namespace.                                                                                                      |
+| `services.loadbalancers` | The total number of Services of type `LoadBalancer` that can exist in the namespace.                                                                               |
+| `services.nodeports` | The total number of `NodePorts` allocated to Services of type `NodePort` or `LoadBalancer` that can exist in the namespace.                                                      |
+| `secrets` | The total number of Secrets that can exist in the namespace.                                                                                                       |
 
 For example, `pods` quota counts and enforces a maximum on the number of `pods`
 created in a single namespace that are not terminal. You might want to set a `pods`

content/en/docs/concepts/services-networking/dual-stack.md

@@ -91,9 +91,8 @@ set the `.spec.ipFamilyPolicy` field to one of the following values:
 
 * `SingleStack`: Single-stack service. The control plane allocates a cluster IP for the Service,
   using the first configured service cluster IP range.
-* `PreferDualStack`:
-  * Allocates IPv4 and IPv6 cluster IPs for the Service.
-* `RequireDualStack`: Allocates Service `.spec.ClusterIPs` from both IPv4 and IPv6 address ranges.
+* `PreferDualStack`: Allocates both IPv4 and IPv6 cluster IPs for the Service when dual-stack is enabled. If dual-stack is not enabled or supported, it falls back to single-stack behavior.
+* `RequireDualStack`: Allocates Service `.spec.clusterIPs` from both IPv4 and IPv6 address ranges when dual-stack is enabled. If dual-stack is not enabled or supported, the Service API object creation fails.
   * Selects the `.spec.ClusterIP` from the list of `.spec.ClusterIPs` based on the address family
     of the first element in the `.spec.ipFamilies` array.
 

content/en/docs/concepts/services-networking/windows-networking.md

@@ -52,9 +52,9 @@ with recommendations on when to use each CNI:
 
 | Network Driver | Description | Container Packet Modifications | Network Plugins | Network Plugin Characteristics |
 | -------------- | ----------- | ------------------------------ | --------------- | ------------------------------ |
-| L2bridge       | Containers are attached to an external vSwitch. Containers are attached to the underlay network, although the physical network doesn't need to learn the container MACs because they are rewritten on ingress/egress. | MAC is rewritten to host MAC, IP may be rewritten to host IP using HNS OutboundNAT policy. | [win-bridge](https://github.com/containernetworking/plugins/tree/master/plugins/main/windows/win-bridge), [Azure-CNI](https://github.com/Azure/azure-container-networking/blob/master/docs/cni.md), Flannel host-gateway uses win-bridge | win-bridge uses L2bridge network mode, connects containers to the underlay of hosts, offering best performance. Requires user-defined routes (UDR) for inter-node connectivity. |
+| L2bridge       | Containers are attached to an external vSwitch. Containers are attached to the underlay network, although the physical network doesn't need to learn the container MACs because they are rewritten on ingress/egress. | MAC is rewritten to host MAC, IP may be rewritten to host IP using HNS OutboundNAT policy. | [win-bridge](https://www.cni.dev/plugins/current/main/win-bridge/), [Azure-CNI](https://github.com/Azure/azure-container-networking/blob/master/docs/cni.md), [Flannel host-gateway](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#host-gw) uses win-bridge | win-bridge uses L2bridge network mode, connects containers to the underlay of hosts, offering best performance. Requires user-defined routes (UDR) for inter-node connectivity. |
 | L2Tunnel | This is a special case of l2bridge, but only used on Azure. All packets are sent to the virtualization host where SDN policy is applied. | MAC rewritten, IP visible on the underlay network | [Azure-CNI](https://github.com/Azure/azure-container-networking/blob/master/docs/cni.md) | Azure-CNI allows integration of containers with Azure vNET, and allows them to leverage the set of capabilities that [Azure Virtual Network provides](https://azure.microsoft.com/en-us/services/virtual-network/). For example, securely connect to Azure services or use Azure NSGs. See [azure-cni for some examples](https://docs.microsoft.com/azure/aks/concepts-network#azure-cni-advanced-networking) |
-| Overlay | Containers are given a vNIC connected to an external vSwitch. Each overlay network gets its own IP subnet, defined by a custom IP prefix.The overlay network driver uses VXLAN encapsulation. | Encapsulated with an outer header. | [win-overlay](https://github.com/containernetworking/plugins/tree/master/plugins/main/windows/win-overlay), Flannel VXLAN (uses win-overlay) | win-overlay should be used when virtual container networks are desired to be isolated from underlay of hosts (e.g. for security reasons). Allows for IPs to be re-used for different overlay networks (which have different VNID tags)  if you are restricted on IPs in your datacenter.  This option requires [KB4489899](https://support.microsoft.com/help/4489899) on Windows Server 2019. |
+| Overlay | Containers are given a vNIC connected to an external vSwitch. Each overlay network gets its own IP subnet, defined by a custom IP prefix.The overlay network driver uses VXLAN encapsulation. | Encapsulated with an outer header. | [win-overlay](https://www.cni.dev/plugins/current/main/win-overlay/), [Flannel VXLAN](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#vxlan) (uses win-overlay) | win-overlay should be used when virtual container networks are desired to be isolated from underlay of hosts (e.g. for security reasons). Allows for IPs to be re-used for different overlay networks (which have different VNID tags)  if you are restricted on IPs in your datacenter.  This option requires [KB4489899](https://support.microsoft.com/help/4489899) on Windows Server 2019. |
 | Transparent (special use case for [ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes)) | Requires an external vSwitch. Containers are attached to an external vSwitch which enables intra-pod communication via logical networks (logical switches and routers). | Packet is encapsulated either via [GENEVE](https://datatracker.ietf.org/doc/draft-gross-geneve/) or [STT](https://datatracker.ietf.org/doc/draft-davie-stt/) tunneling to reach pods which are not on the same host.  <br/> Packets are forwarded or dropped via the tunnel metadata information supplied by the ovn network controller. <br/> NAT is done for north-south communication. | [ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes) | [Deploy via ansible](https://github.com/openvswitch/ovn-kubernetes/tree/master/contrib). Distributed ACLs can be applied via Kubernetes policies. IPAM support. Load-balancing can be achieved without kube-proxy. NATing is done without using iptables/netsh. |
 | NAT (*not used in Kubernetes*) | Containers are given a vNIC connected to an internal vSwitch. DNS/DHCP is provided using an internal component called [WinNAT](https://techcommunity.microsoft.com/t5/virtualization/windows-nat-winnat-capabilities-and-limitations/ba-p/382303) | MAC and IP is rewritten to host MAC/IP. | [nat](https://github.com/Microsoft/windows-container-networking/tree/master/plugins/nat) | Included here for completeness |