Kubernetes v1.36: ハル (Haru) 릴리즈 소식

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: kubelet-metrics-reader rules: - apiGroups: [""] resources: ["nodes/metrics", "nodes/stats"] verbs: ["get"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: kubelet-metrics-reader roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: kubelet-metrics-reader subjects: - kind: ServiceAccount name: metrics-agent namespace: monitoring

apiVersion: v1 kind: Pod metadata: name: userns-demo spec: hostUsers: false containers: - name: app image: registry.k8s.io/e2e-test-images/agnhost:2.53 command: ["/bin/sh", "-c", "id && sleep 3600"]

apiVersion: admissionregistration.k8s.io/v1 kind: MutatingAdmissionPolicy metadata: name: add-team-label spec: matchConstraints: resourceRules: - apiGroups: [""] apiVersions: ["v1"] operations: ["CREATE"] resources: ["pods"] mutations: - patchType: ApplyConfiguration applyConfiguration: expression: 'Object{metadata: Object.metadata{labels: {"team": "platform"}}}' --- apiVersion: admissionregistration.k8s.io/v1 kind: MutatingAdmissionPolicyBinding metadata: name: add-team-label spec: policyName: add-team-label

kube-apiserver \ --service-account-issuer=https://kubernetes.default.svc \ --service-account-signing-endpoint=unix:///var/run/k8s-sa-signer/socket.sock

apiVersion: groupsnapshot.storage.k8s.io/v1 kind: VolumeGroupSnapshot metadata: name: mysql-group-snapshot namespace: database spec: volumeGroupSnapshotClassName: csi-group-snapclass source: selector: matchLabels: app: mysql snapshot-group: primary --- apiVersion: groupsnapshot.storage.k8s.io/v1 kind: VolumeGroupSnapshotClass metadata: name: csi-group-snapclass driver: example.csi.k8s.io deletionPolicy: Delete

kubectl get csinode <node-name> -o yaml kubectl describe node <node-name> | grep -i attach -A3 kubectl get events -A --field-selector involvedObject.kind=Pod | grep -i attach

apiVersion: v1 kind: Pod metadata: name: selinux-volume-demo spec: securityContext: seLinuxOptions: level: s0:c123,c456 seLinuxChangePolicy: MountOption containers: - name: app image: registry.k8s.io/e2e-test-images/agnhost:2.53 volumeMounts: - name: data mountPath: /data volumes: - name: data persistentVolumeClaim: claimName: data-pvc

kubectl get resourceclaims -A kubectl describe resourceclaim -n <namespace> <claim-name> kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\t"}{.spec.resourceClaims}{"\n"}{end}'

kubectl get pod <pod-name> -n <namespace> -o yaml | grep -A20 allocatedResourcesStatus

status: containerStatuses: - name: trainer allocatedResourcesStatus: - name: example.com/gpu resources: - resourceID: gpu-0 health: Healthy

apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration featureGates: MemoryQoS: true memoryReservationPolicy: TieredReservation

curl -sk https://localhost:10250/metrics | grep memory_qos

apiVersion: v1 kind: Pod metadata: name: shared-pool-app spec: resources: requests: cpu: "2" memory: 2Gi limits: cpu: "4" memory: 4Gi containers: - name: app image: registry.k8s.io/e2e-test-images/agnhost:2.53 - name: sidecar image: registry.k8s.io/e2e-test-images/agnhost:2.53

kubectl patch pod shared-pool-app --subresource resize --patch '{"spec":{"resources":{"requests":{"cpu":"3","memory":"3Gi"},"limits":{"cpu":"5","memory":"5Gi"}}}}'

kube-apiserver \ --peer-ca-file=/etc/kubernetes/pki/peer-ca.crt \ --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt \ --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key \ --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt

kubectl get --raw /metrics | grep -E 'apiserver_rerouted_request_total|apiserver_peer_proxy_errors_total|apiserver_peer_discovery_sync_errors_total'

kubectl get --raw /api/v1/nodes/<node-name>/proxy/stats/summary | grep -i psi

cat /proc/pressure/cpu cat /proc/pressure/memory cat /proc/pressure/io

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: node-log-reader rules: - apiGroups: [""] resources: ["nodes/log"] verbs: ["get"]

kubectl auth can-i get nodes/log --as=system:serviceaccount:ops:node-log-reader

kube-scheduler \ --feature-gates=WorkloadAwareScheduling=true,TopologyAwareWorkloadScheduling=true

apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: queue-worker spec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: queue-worker minReplicas: 0 maxReplicas: 20 metrics: - type: External external: metric: name: queue_messages_ready target: type: AverageValue averageValue: "10"

apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration staticManifestsDir: /etc/kubernetes/admission-static

kube-apiserver \ --feature-gates=ManifestBasedAdmissionControlConfig=true \ --admission-control-config-file=/etc/kubernetes/admission-config.yaml

kube-apiserver \ --feature-gates=ComponentSLIs=true,PrometheusNativeHistograms=true

kubectl get --raw /metrics | grep -E 'native|histogram|apiserver_request_duration_seconds'

apiVersion: resource.k8s.io/v1beta2 kind: ResourceClaim metadata: name: gpu-with-codecs spec: devices: requests: - name: gpu exactly: deviceClassName: gpu.example.com selectors: - cel: expression: 'device.attributes["gpu.example.com"].codecs.includes("h264")'