You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/zh-cn/docs/tasks/administer-cluster/developing-cloud-controller-manager.md
+2-4Lines changed: 2 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,6 @@ title: 开发云控制器管理器
3
3
content_type: task
4
4
weight: 190
5
5
---
6
-
7
6
<!--
8
7
reviewers:
9
8
- luxas
@@ -27,7 +26,7 @@ weight: 190
27
26
28
27
Since cloud providers develop and release at a different pace compared to the Kubernetes project, abstracting the provider-specific code to the `cloud-controller-manager` binary allows cloud vendors to evolve independently from the core Kubernetes code.
Copy file name to clipboardExpand all lines: content/zh-cn/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods.md
+13-6Lines changed: 13 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,12 +3,20 @@ title: 关键插件 Pod 的调度保证
3
3
content_type: concept
4
4
weight: 220
5
5
---
6
+
<!--
7
+
reviewers:
8
+
- davidopp
9
+
- filipg
10
+
- piosz
11
+
title: Guaranteed Scheduling For Critical Add-On Pods
12
+
content_type: concept
13
+
weight: 220
14
+
-->
6
15
7
16
<!-- overview -->
8
17
9
18
<!--
10
-
Kubernetes core components such as the API server, scheduler, and controller-manager run on a control plane node.
11
-
However, add-ons must run on a regular cluster node.
19
+
Kubernetes core components such as the API server, scheduler, and controller-manager run on a control plane node. However, add-ons must run on a regular cluster node.
12
20
Some of these add-ons are critical to a fully functional cluster, such as metrics-server, DNS, and UI.
13
21
A cluster may stop working properly if a critical add-on is evicted (either manually or as a side effect of another operation like upgrade)
14
22
and becomes pending (for example when the cluster is highly utilized and either there are other pending pods that schedule into the space
@@ -18,7 +26,8 @@ Kubernetes 核心组件（如 API 服务器、调度器、控制器管理器）
18
26
但是插件必须在常规集群节点上运行。
19
27
其中一些插件对于功能完备的集群至关重要，例如 Heapster、DNS 和 UI。
20
28
如果关键插件被逐出（手动或作为升级等其他操作的副作用）或者变成挂起状态，集群可能会停止正常工作。
21
-
关键插件进入挂起状态的例子有：集群利用率过高；被逐出的关键插件 Pod 释放了空间，但该空间被之前悬决的 Pod 占用；由于其它原因导致节点上可用资源的总量发生变化。
29
+
关键插件进入挂起状态的例子有：集群利用率过高；被逐出的关键插件 Pod 释放了空间，但该空间被之前悬决的
30
+
Pod 占用；由于其它原因导致节点上可用资源的总量发生变化。
22
31
23
32
<!--
24
33
Note that marking a pod as critical is not meant to prevent evictions entirely; it only prevents the pod from becoming permanently unavailable.
@@ -35,9 +44,7 @@ A static pod marked as critical, can't be evicted. However, a non-static pods ma
35
44
### 标记关键 Pod
36
45
37
46
<!--
38
-
To mark a Pod as critical, set priorityClassName for that Pod to `system-cluster-critical` or `system-node-critical`. `system-node-critical` is the highest available priority, even higher than `system-cluster-critical`
47
+
To mark a Pod as critical, set priorityClassName for that Pod to `system-cluster-critical` or `system-node-critical`. `system-node-critical` is the highest available priority, even higher than `system-cluster-critical`.
39
48
-->
40
49
要将 Pod 标记为关键性（critical），设置 Pod 的 priorityClassName 为 `system-cluster-critical` 或者 `system-node-critical`。
Copy file name to clipboardExpand all lines: content/zh-cn/docs/tasks/administer-cluster/ip-masq-agent.md
+60-21Lines changed: 60 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,10 +23,12 @@ This page shows how to configure and enable the `ip-masq-agent`.
23
23
<!--
24
24
## IP Masquerade Agent User Guide
25
25
-->
26
-
## IP Masquerade Agent 用户指南
26
+
## IP Masquerade Agent 用户指南 {#ip-masquerade-agent-user-guide}
27
27
28
28
<!--
29
-
The `ip-masq-agent` configures iptables rules to hide a pod's IP address behind the cluster node's IP address. This is typically done when sending traffic to destinations outside the cluster's pod [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) range.
29
+
The `ip-masq-agent` configures iptables rules to hide a pod's IP address behind the cluster
30
+
node's IP address. This is typically done when sending traffic to destinations outside the
31
+
cluster's pod [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) range.
30
32
-->
31
33
`ip-masq-agent` 配置 iptables 规则以隐藏位于集群节点 IP 地址后面的 Pod 的 IP 地址。
32
34
这通常在将流量发送到集群的 Pod
@@ -36,19 +38,22 @@ The `ip-masq-agent` configures iptables rules to hide a pod's IP address behind
36
38
<!--
37
39
### **Key Terms**
38
40
-->
39
-
### **关键术语**
41
+
### **关键术语** {#key-terms}
40
42
41
43
<!--
42
44
* **NAT (Network Address Translation)**
43
-
Is a method of remapping one IP address to another by modifying either the source and/or destination address information in the IP header. Typically performed by a device doing IP routing.
45
+
Is a method of remapping one IP address to another by modifying either the source and/or
46
+
destination address information in the IP header. Typically performed by a device doing IP routing.
44
47
-->
45
-
***NAT (网络地址转译)**
48
+
***NAT (网络地址转换)**
46
49
是一种通过修改 IP 地址头中的源和/或目标地址信息将一个 IP 地址重新映射
47
50
到另一个 IP 地址的方法。通常由执行 IP 路由的设备执行。
48
51
49
52
<!--
50
53
* **Masquerading**
51
-
A form of NAT that is typically used to perform a many to one address translation, where multiple source IP addresses are masked behind a single address, which is typically the device doing the IP routing. In Kubernetes this is the Node's IP address.
54
+
A form of NAT that is typically used to perform a many to one address translation, where
55
+
multiple source IP addresses are masked behind a single address, which is typically the
56
+
device doing the IP routing. In Kubernetes this is the Node's IP address.
52
57
-->
53
58
***伪装**
54
59
NAT 的一种形式，通常用于执行多对一地址转换，其中多个源 IP 地址被隐藏在
@@ -57,7 +62,10 @@ The `ip-masq-agent` configures iptables rules to hide a pod's IP address behind
57
62
58
63
<!--
59
64
* **CIDR (Classless Inter-Domain Routing)**
60
-
Based on the variable-length subnet masking, allows specifying arbitrary-length prefixes. CIDR introduced a new method of representation for IP addresses, now commonly known as **CIDR notation**, in which an address or routing prefix is written with a suffix indicating the number of bits of the prefix, such as 192.168.2.0/24.
65
+
Based on the variable-length subnet masking, allows specifying arbitrary-length prefixes.
66
+
CIDR introduced a new method of representation for IP addresses, now commonly known as
67
+
**CIDR notation**, in which an address or routing prefix is written with a suffix indicating
68
+
the number of bits of the prefix, such as 192.168.2.0/24.
61
69
-->
62
70
***CIDR (无类别域间路由)**
63
71
基于可变长度子网掩码，允许指定任意长度的前缀。
@@ -66,14 +74,29 @@ The `ip-masq-agent` configures iptables rules to hide a pod's IP address behind
66
74
67
75
<!--
68
76
* **Link Local**
69
-
A link-local address is a network address that is valid only for communications within the network segment or the broadcast domain that the host is connected to. Link-local addresses for IPv4 are defined in the address block 169.254.0.0/16 in CIDR notation.
77
+
A link-local address is a network address that is valid only for communications within the
78
+
network segment or the broadcast domain that the host is connected to. Link-local addresses
79
+
for IPv4 are defined in the address block 169.254.0.0/16 in CIDR notation.
70
80
-->
71
81
***本地链路**
72
82
本地链路是仅对网段或主机所连接的广播域内的通信有效的网络地址。
73
83
IPv4 的本地链路地址在 CIDR 表示法的地址块 169.254.0.0/16 中定义。
74
84
75
85
<!--
76
-
The ip-masq-agent configures iptables rules to handle masquerading node/pod IP addresses when sending traffic to destinations outside the cluster node's IP and the Cluster IP range. This essentially hides pod IP addresses behind the cluster node's IP address. In some environments, traffic to "external" addresses must come from a known machine address. For example, in Google Cloud, any traffic to the internet must come from a VM's IP. When containers are used, as in Google Kubernetes Engine, the Pod IP will be rejected for egress. To avoid this, we must hide the Pod IP behind the VM's own IP address - generally known as "masquerade". By default, the agent is configured to treat the three private IP ranges specified by [RFC 1918](https://tools.ietf.org/html/rfc1918) as non-masquerade [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). These ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The agent will also treat link-local (169.254.0.0/16) as a non-masquerade CIDR by default. The agent is configured to reload its configuration from the location */etc/config/ip-masq-agent* every 60 seconds, which is also configurable.
86
+
The ip-masq-agent configures iptables rules to handle masquerading node/pod IP addresses when
87
+
sending traffic to destinations outside the cluster node's IP and the Cluster IP range. This
88
+
essentially hides pod IP addresses behind the cluster node's IP address. In some environments,
89
+
traffic to "external" addresses must come from a known machine address. For example, in Google
90
+
Cloud, any traffic to the internet must come from a VM's IP. When containers are used, as in
91
+
Google Kubernetes Engine, the Pod IP will be rejected for egress. To avoid this, we must hide
92
+
the Pod IP behind the VM's own IP address - generally known as "masquerade". By default, the
93
+
agent is configured to treat the three private IP ranges specified by
94
+
[RFC 1918](https://tools.ietf.org/html/rfc1918) as non-masquerade
@@ -120,7 +145,11 @@ The agent configuration file must be written in YAML or JSON syntax, and may con
120
145
例如 '30s'，其中 's' 是秒，'ms' 是毫秒。
121
146
122
147
<!--
123
-
Traffic to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16) ranges will NOT be masqueraded. Any other traffic (assumed to be internet) will be masqueraded. An example of a local destination from a pod could be its Node's IP address as well as another node's address or one of the IP addresses in Cluster's IP range. Any other traffic will be masqueraded by default. The below entries show the default set of rules that are applied by the ip-masq-agent:
148
+
Traffic to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 ranges will NOT be masqueraded. Any
149
+
other traffic (assumed to be internet) will be masqueraded. An example of a local destination
150
+
from a pod could be its Node's IP address as well as another node's address or one of the IP
151
+
addresses in Cluster's IP range. Any other traffic will be masqueraded by default. The
152
+
below entries show the default set of rules that are applied by the ip-masq-agent:
RETURN all -- anywhere 169.254.0.0/16 /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL
136
166
RETURN all -- anywhere 10.0.0.0/8 /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL
137
167
RETURN all -- anywhere 172.16.0.0/12 /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL
138
168
RETURN all -- anywhere 192.168.0.0/16 /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL
139
169
MASQUERADE all -- anywhere anywhere /* ip-masq-agent: outbound traffic should be subject to MASQUERADE (this match must come after cluster-local CIDR matches) */ ADDRTYPE match dst-type !LOCAL
140
-
141
170
```
142
171
143
172
<!--
@@ -159,7 +188,7 @@ to your cluster.
159
188
## Create an ip-masq-agent
160
189
To create an ip-masq-agent, run the following kubectl command:
In most cases, the default set of rules should be sufficient; however, if this is not the case for your cluster, you can create and apply a [ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap/) to customize the IP ranges that are affected. For example, to allow only 10.0.0.0/8 to be considered by the ip-masq-agent, you can create the following [ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap/) in a file called "config".
215
+
In most cases, the default set of rules should be sufficient; however, if this is not the case
216
+
for your cluster, you can create and apply a
217
+
[ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap/) to customize the IP
218
+
ranges that are affected. For example, to allow
219
+
only 10.0.0.0/8 to be considered by the ip-masq-agent, you can create the following
220
+
[ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap/) in a file called
By default, the link local range (169.254.0.0/16) is also handled by the ip-masq agent, which sets up the appropriate iptables rules. To have the ip-masq-agent ignore link local, you can set `masqLinkLocal` to true in the ConfigMap.
275
+
By default, the link local range (169.254.0.0/16) is also handled by the ip-masq agent, which
276
+
sets up the appropriate iptables rules. To have the ip-masq-agent ignore link local, you can
0 commit comments