OPSaid – 资源对象

Docs: Volume

Mon, 20 Jan 2025 14:17:30 +0800

简要概述

存储卷。

kubernetes-1.26.11/staging/src/k8s.io/api/core/v1/types.go

数据结构

PersistentVolume

// PersistentVolume (PV) is a storage resource provisioned by an administrator.
// It is analogous to a node.
// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes
type PersistentVolume struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // spec defines a specification of a persistent volume owned by the cluster.
 // Provisioned by an administrator.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistent-volumes
 // +optional
 Spec PersistentVolumeSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // status represents the current information/status for the persistent volume.
 // Populated by the system.
 // Read-only.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistent-volumes
 // +optional
 Status PersistentVolumeStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

PersistentVolumeSpec

// PersistentVolumeSpec is the specification of a persistent volume.
type PersistentVolumeSpec struct {
 // capacity is the description of the persistent volume's resources and capacity.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#capacity
 // +optional
 // 分配存储资源大小
 Capacity ResourceList `json:"capacity,omitempty" protobuf:"bytes,1,rep,name=capacity,casttype=ResourceList,castkey=ResourceName"`
 // persistentVolumeSource is the actual volume backing the persistent volume.
 // 该持久卷使用的类型，必须设置一个
 PersistentVolumeSource `json:",inline" protobuf:"bytes,2,opt,name=persistentVolumeSource"`
 // accessModes contains all ways the volume can be mounted.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes
 // +optional
 AccessModes []PersistentVolumeAccessMode `json:"accessModes,omitempty" protobuf:"bytes,3,rep,name=accessModes,casttype=PersistentVolumeAccessMode"`
 // claimRef is part of a bi-directional binding between PersistentVolume and PersistentVolumeClaim.
 // Expected to be non-nil when bound.
 // claim.VolumeName is the authoritative bind between PV and PVC.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#binding
 // +optional
 // +structType=granular
 ClaimRef *ObjectReference `json:"claimRef,omitempty" protobuf:"bytes,4,opt,name=claimRef"`
 // persistentVolumeReclaimPolicy defines what happens to a persistent volume when released from its claim.
 // Valid options are Retain (default for manually created PersistentVolumes), Delete (default
 // for dynamically provisioned PersistentVolumes), and Recycle (deprecated).
 // Recycle must be supported by the volume plugin underlying this PersistentVolume.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#reclaiming
 // +optional
 PersistentVolumeReclaimPolicy PersistentVolumeReclaimPolicy `json:"persistentVolumeReclaimPolicy,omitempty" protobuf:"bytes,5,opt,name=persistentVolumeReclaimPolicy,casttype=PersistentVolumeReclaimPolicy"`
 // storageClassName is the name of StorageClass to which this persistent volume belongs. Empty value
 // means that this volume does not belong to any StorageClass.
 // +optional
 StorageClassName string `json:"storageClassName,omitempty" protobuf:"bytes,6,opt,name=storageClassName"`
 // mountOptions is the list of mount options, e.g. ["ro", "soft"]. Not validated - mount will
 // simply fail if one is invalid.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#mount-options
 // +optional
 MountOptions []string `json:"mountOptions,omitempty" protobuf:"bytes,7,opt,name=mountOptions"`
 // volumeMode defines if a volume is intended to be used with a formatted filesystem
 // or to remain in raw block state. Value of Filesystem is implied when not included in spec.
 // +optional
 VolumeMode *PersistentVolumeMode `json:"volumeMode,omitempty" protobuf:"bytes,8,opt,name=volumeMode,casttype=PersistentVolumeMode"`
 // nodeAffinity defines constraints that limit what nodes this volume can be accessed from.
 // This field influences the scheduling of pods that use this volume.
 // +optional
 NodeAffinity *VolumeNodeAffinity `json:"nodeAffinity,omitempty" protobuf:"bytes,9,opt,name=nodeAffinity"`
}

ResourceList

见 Pod/ResourceList。

PersistentVolumeSource

// PersistentVolumeSource is similar to VolumeSource but meant for the
// administrator who creates PVs. Exactly one of its members must be set.
type PersistentVolumeSource struct {
 // gcePersistentDisk represents a GCE Disk resource that is attached to a
 // kubelet's host machine and then exposed to the pod. Provisioned by an admin.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
 // +optional
 GCEPersistentDisk *GCEPersistentDiskVolumeSource `json:"gcePersistentDisk,omitempty" protobuf:"bytes,1,opt,name=gcePersistentDisk"`
 // awsElasticBlockStore represents an AWS Disk resource that is attached to a
 // kubelet's host machine and then exposed to the pod.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
 // +optional
 AWSElasticBlockStore *AWSElasticBlockStoreVolumeSource `json:"awsElasticBlockStore,omitempty" protobuf:"bytes,2,opt,name=awsElasticBlockStore"`
 // hostPath represents a directory on the host.
 // Provisioned by a developer or tester.
 // This is useful for single-node development and testing only!
 // On-host storage is not supported in any way and WILL NOT WORK in a multi-node cluster.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
 // +optional
 HostPath *HostPathVolumeSource `json:"hostPath,omitempty" protobuf:"bytes,3,opt,name=hostPath"`
 // glusterfs represents a Glusterfs volume that is attached to a host and
 // exposed to the pod. Provisioned by an admin.
 // More info: https://examples.k8s.io/volumes/glusterfs/README.md
 // +optional
 Glusterfs *GlusterfsPersistentVolumeSource `json:"glusterfs,omitempty" protobuf:"bytes,4,opt,name=glusterfs"`
 // nfs represents an NFS mount on the host. Provisioned by an admin.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
 // +optional
 NFS *NFSVolumeSource `json:"nfs,omitempty" protobuf:"bytes,5,opt,name=nfs"`
 // rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
 // More info: https://examples.k8s.io/volumes/rbd/README.md
 // +optional
 RBD *RBDPersistentVolumeSource `json:"rbd,omitempty" protobuf:"bytes,6,opt,name=rbd"`
 // iscsi represents an ISCSI Disk resource that is attached to a
 // kubelet's host machine and then exposed to the pod. Provisioned by an admin.
 // +optional
 ISCSI *ISCSIPersistentVolumeSource `json:"iscsi,omitempty" protobuf:"bytes,7,opt,name=iscsi"`
 // cinder represents a cinder volume attached and mounted on kubelets host machine.
 // More info: https://examples.k8s.io/mysql-cinder-pd/README.md
 // +optional
 Cinder *CinderPersistentVolumeSource `json:"cinder,omitempty" protobuf:"bytes,8,opt,name=cinder"`
 // cephFS represents a Ceph FS mount on the host that shares a pod's lifetime
 // +optional
 CephFS *CephFSPersistentVolumeSource `json:"cephfs,omitempty" protobuf:"bytes,9,opt,name=cephfs"`
 // fc represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.
 // +optional
 FC *FCVolumeSource `json:"fc,omitempty" protobuf:"bytes,10,opt,name=fc"`
 // flocker represents a Flocker volume attached to a kubelet's host machine and exposed to the pod for its usage. This depends on the Flocker control service being running
 // +optional
 Flocker *FlockerVolumeSource `json:"flocker,omitempty" protobuf:"bytes,11,opt,name=flocker"`
 // flexVolume represents a generic volume resource that is
 // provisioned/attached using an exec based plugin.
 // +optional
 FlexVolume *FlexPersistentVolumeSource `json:"flexVolume,omitempty" protobuf:"bytes,12,opt,name=flexVolume"`
 // azureFile represents an Azure File Service mount on the host and bind mount to the pod.
 // +optional
 AzureFile *AzureFilePersistentVolumeSource `json:"azureFile,omitempty" protobuf:"bytes,13,opt,name=azureFile"`
 // vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine
 // +optional
 VsphereVolume *VsphereVirtualDiskVolumeSource `json:"vsphereVolume,omitempty" protobuf:"bytes,14,opt,name=vsphereVolume"`
 // quobyte represents a Quobyte mount on the host that shares a pod's lifetime
 // +optional
 Quobyte *QuobyteVolumeSource `json:"quobyte,omitempty" protobuf:"bytes,15,opt,name=quobyte"`
 // azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
 // +optional
 AzureDisk *AzureDiskVolumeSource `json:"azureDisk,omitempty" protobuf:"bytes,16,opt,name=azureDisk"`
 // photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine
 PhotonPersistentDisk *PhotonPersistentDiskVolumeSource `json:"photonPersistentDisk,omitempty" protobuf:"bytes,17,opt,name=photonPersistentDisk"`
 // portworxVolume represents a portworx volume attached and mounted on kubelets host machine
 // +optional
 PortworxVolume *PortworxVolumeSource `json:"portworxVolume,omitempty" protobuf:"bytes,18,opt,name=portworxVolume"`
 // scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
 // +optional
 ScaleIO *ScaleIOPersistentVolumeSource `json:"scaleIO,omitempty" protobuf:"bytes,19,opt,name=scaleIO"`
 // local represents directly-attached storage with node affinity
 // +optional
 Local *LocalVolumeSource `json:"local,omitempty" protobuf:"bytes,20,opt,name=local"`
 // storageOS represents a StorageOS volume that is attached to the kubelet's host machine and mounted into the pod
 // More info: https://examples.k8s.io/volumes/storageos/README.md
 // +optional
 StorageOS *StorageOSPersistentVolumeSource `json:"storageos,omitempty" protobuf:"bytes,21,opt,name=storageos"`
 // csi represents storage that is handled by an external CSI driver (Beta feature).
 // +optional
 CSI *CSIPersistentVolumeSource `json:"csi,omitempty" protobuf:"bytes,22,opt,name=csi"`
}

具体各 VolumeSource 见 Pod/常见存储卷

PersistentVolumeAccessMode

// +enum
type PersistentVolumeAccessMode string

const (
 // can be mounted in read/write mode to exactly 1 host
 ReadWriteOnce PersistentVolumeAccessMode = "ReadWriteOnce"
 // can be mounted in read-only mode to many hosts
 ReadOnlyMany PersistentVolumeAccessMode = "ReadOnlyMany"
 // can be mounted in read/write mode to many hosts
 ReadWriteMany PersistentVolumeAccessMode = "ReadWriteMany"
 // can be mounted in read/write mode to exactly 1 pod
 // cannot be used in combination with other access modes
 ReadWriteOncePod PersistentVolumeAccessMode = "ReadWriteOncePod"
)

ObjectReference

TODO;

PersistentVolumeReclaimPolicy

// PersistentVolumeReclaimPolicy describes a policy for end-of-life maintenance of persistent volumes.
// +enum
type PersistentVolumeReclaimPolicy string

const (
 // PersistentVolumeReclaimRecycle means the volume will be recycled back into the pool of unbound persistent volumes on release from its claim.
 // The volume plugin must support Recycling.
 PersistentVolumeReclaimRecycle PersistentVolumeReclaimPolicy = "Recycle"
 // PersistentVolumeReclaimDelete means the volume will be deleted from Kubernetes on release from its claim.
 // The volume plugin must support Deletion.
 PersistentVolumeReclaimDelete PersistentVolumeReclaimPolicy = "Delete"
 // PersistentVolumeReclaimRetain means the volume will be left in its current phase (Released) for manual reclamation by the administrator.
 // The default policy is Retain.
 PersistentVolumeReclaimRetain PersistentVolumeReclaimPolicy = "Retain"
)

PersistentVolumeMode

// PersistentVolumeMode describes how a volume is intended to be consumed, either Block or Filesystem.
// +enum
type PersistentVolumeMode string

const (
 // PersistentVolumeBlock means the volume will not be formatted with a filesystem and will remain a raw block device.
 PersistentVolumeBlock PersistentVolumeMode = "Block"
 // PersistentVolumeFilesystem means the volume will be or is formatted with a filesystem.
 PersistentVolumeFilesystem PersistentVolumeMode = "Filesystem"
)

VolumeNodeAffinity

// VolumeNodeAffinity defines constraints that limit what nodes this volume can be accessed from.
type VolumeNodeAffinity struct {
 // required specifies hard node constraints that must be met.
 Required *NodeSelector `json:"required,omitempty" protobuf:"bytes,1,opt,name=required"`
}

NodeSelector

// A node selector represents the union of the results of one or more label queries
// over a set of nodes; that is, it represents the OR of the selectors represented
// by the node selector terms.
// +structType=atomic
type NodeSelector struct {
 // Required. A list of node selector terms. The terms are ORed.
 NodeSelectorTerms []NodeSelectorTerm `json:"nodeSelectorTerms" protobuf:"bytes,1,rep,name=nodeSelectorTerms"`
}

NodeSelectorTerm

// A null or empty node selector term matches no objects. The requirements of
// them are ANDed.
// The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
// +structType=atomic
type NodeSelectorTerm struct {
 // A list of node selector requirements by node's labels.
 // +optional
 MatchExpressions []NodeSelectorRequirement `json:"matchExpressions,omitempty" protobuf:"bytes,1,rep,name=matchExpressions"`
 // A list of node selector requirements by node's fields.
 // +optional
 MatchFields []NodeSelectorRequirement `json:"matchFields,omitempty" protobuf:"bytes,2,rep,name=matchFields"`
}

NodeSelectorRequirement

// A node selector requirement is a selector that contains values, a key, and an operator
// that relates the key and values.
type NodeSelectorRequirement struct {
 // The label key that the selector applies to.
 Key string `json:"key" protobuf:"bytes,1,opt,name=key"`
 // Represents a key's relationship to a set of values.
 // Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
 Operator NodeSelectorOperator `json:"operator" protobuf:"bytes,2,opt,name=operator,casttype=NodeSelectorOperator"`
 // An array of string values. If the operator is In or NotIn,
 // the values array must be non-empty. If the operator is Exists or DoesNotExist,
 // the values array must be empty. If the operator is Gt or Lt, the values
 // array must have a single element, which will be interpreted as an integer.
 // This array is replaced during a strategic merge patch.
 // +optional
 Values []string `json:"values,omitempty" protobuf:"bytes,3,rep,name=values"`
}

// A node selector operator is the set of operators that can be used in
// a node selector requirement.
// +enum
type NodeSelectorOperator string

const (
 NodeSelectorOpIn NodeSelectorOperator = "In"
 NodeSelectorOpNotIn NodeSelectorOperator = "NotIn"
 NodeSelectorOpExists NodeSelectorOperator = "Exists"
 NodeSelectorOpDoesNotExist NodeSelectorOperator = "DoesNotExist"
 NodeSelectorOpGt NodeSelectorOperator = "Gt"
 NodeSelectorOpLt NodeSelectorOperator = "Lt"
)

Docs: Metadata

Tue, 12 Dec 2023 11:40:58 +0800

简要概述

TODO;

数据结构

k8s.io/apimachinery/pkg/apis/meta/v1/types.go

TypeMeta

// TypeMeta describes an individual object in an API response or request
// with strings representing the type of the object and its API schema version.
// Structures that are versioned or persisted should inline TypeMeta.
//
// +k8s:deepcopy-gen=false
type TypeMeta struct {
 // Kind is a string value representing the REST resource this object represents.
 // Servers may infer this from the endpoint the client submits requests to.
 // Cannot be updated.
 // In CamelCase.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 // +optional
 Kind string `json:"kind,omitempty" protobuf:"bytes,1,opt,name=kind"`

 // APIVersion defines the versioned schema of this representation of an object.
 // Servers should convert recognized schemas to the latest internal value, and
 // may reject unrecognized values.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
 // +optional
 APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,2,opt,name=apiVersion"`
}

ObjectMeta

// ObjectMeta is metadata that all persisted resources must have, which includes all objects
// users must create.
type ObjectMeta struct {
 // Name must be unique within a namespace. Is required when creating resources, although
 // some resources may allow a client to request the generation of an appropriate name
 // automatically. Name is primarily intended for creation idempotence and configuration
 // definition.
 // Cannot be updated.
 // More info: http://kubernetes.io/docs/user-guide/identifiers#names
 // +optional
 Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`

 // GenerateName is an optional prefix, used by the server, to generate a unique
 // name ONLY IF the Name field has not been provided.
 // If this field is used, the name returned to the client will be different
 // than the name passed. This value will also be combined with a unique suffix.
 // The provided value has the same validation rules as the Name field,
 // and may be truncated by the length of the suffix required to make the value
 // unique on the server.
 //
 // If this field is specified and the generated name exists, the server will return a 409.
 //
 // Applied only if Name is not specified.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
 // +optional
 GenerateName string `json:"generateName,omitempty" protobuf:"bytes,2,opt,name=generateName"`

 // Namespace defines the space within which each name must be unique. An empty namespace is
 // equivalent to the "default" namespace, but "default" is the canonical representation.
 // Not all objects are required to be scoped to a namespace - the value of this field for
 // those objects will be empty.
 //
 // Must be a DNS_LABEL.
 // Cannot be updated.
 // More info: http://kubernetes.io/docs/user-guide/namespaces
 // +optional
 Namespace string `json:"namespace,omitempty" protobuf:"bytes,3,opt,name=namespace"`

 // Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
 // +optional
 SelfLink string `json:"selfLink,omitempty" protobuf:"bytes,4,opt,name=selfLink"`

 // UID is the unique in time and space value for this object. It is typically generated by
 // the server on successful creation of a resource and is not allowed to change on PUT
 // operations.
 //
 // Populated by the system.
 // Read-only.
 // More info: http://kubernetes.io/docs/user-guide/identifiers#uids
 // +optional
 UID types.UID `json:"uid,omitempty" protobuf:"bytes,5,opt,name=uid,casttype=k8s.io/kubernetes/pkg/types.UID"`

 // An opaque value that represents the internal version of this object that can
 // be used by clients to determine when objects have changed. May be used for optimistic
 // concurrency, change detection, and the watch operation on a resource or set of resources.
 // Clients must treat these values as opaque and passed unmodified back to the server.
 // They may only be valid for a particular resource or set of resources.
 //
 // Populated by the system.
 // Read-only.
 // Value must be treated as opaque by clients and .
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
 // +optional
 ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,6,opt,name=resourceVersion"`

 // A sequence number representing a specific generation of the desired state.
 // Populated by the system. Read-only.
 // +optional
 Generation int64 `json:"generation,omitempty" protobuf:"varint,7,opt,name=generation"`

 // CreationTimestamp is a timestamp representing the server time when this object was
 // created. It is not guaranteed to be set in happens-before order across separate operations.
 // Clients may not set this value. It is represented in RFC3339 form and is in UTC.
 //
 // Populated by the system.
 // Read-only.
 // Null for lists.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 CreationTimestamp Time `json:"creationTimestamp,omitempty" protobuf:"bytes,8,opt,name=creationTimestamp"`

 // DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
 // field is set by the server when a graceful deletion is requested by the user, and is not
 // directly settable by a client. The resource is expected to be deleted (no longer visible
 // from resource lists, and not reachable by name) after the time in this field, once the
 // finalizers list is empty. As long as the finalizers list contains items, deletion is blocked.
 // Once the deletionTimestamp is set, this value may not be unset or be set further into the
 // future, although it may be shortened or the resource may be deleted prior to this time.
 // For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react
 // by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
 // the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
 // remove the pod from the API. In the presence of network partitions, this object may still
 // exist after this timestamp, until an administrator or automated process can determine the
 // resource is fully terminated.
 // If not set, graceful deletion of the object has not been requested.
 //
 // Populated by the system when a graceful deletion is requested.
 // Read-only.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 DeletionTimestamp *Time `json:"deletionTimestamp,omitempty" protobuf:"bytes,9,opt,name=deletionTimestamp"`

 // Number of seconds allowed for this object to gracefully terminate before
 // it will be removed from the system. Only set when deletionTimestamp is also set.
 // May only be shortened.
 // Read-only.
 // +optional
 DeletionGracePeriodSeconds *int64 `json:"deletionGracePeriodSeconds,omitempty" protobuf:"varint,10,opt,name=deletionGracePeriodSeconds"`

 // Map of string keys and values that can be used to organize and categorize
 // (scope and select) objects. May match selectors of replication controllers
 // and services.
 // More info: http://kubernetes.io/docs/user-guide/labels
 // +optional
 Labels map[string]string `json:"labels,omitempty" protobuf:"bytes,11,rep,name=labels"`

 // Annotations is an unstructured key value map stored with a resource that may be
 // set by external tools to store and retrieve arbitrary metadata. They are not
 // queryable and should be preserved when modifying objects.
 // More info: http://kubernetes.io/docs/user-guide/annotations
 // +optional
 Annotations map[string]string `json:"annotations,omitempty" protobuf:"bytes,12,rep,name=annotations"`

 // List of objects depended by this object. If ALL objects in the list have
 // been deleted, this object will be garbage collected. If this object is managed by a controller,
 // then an entry in this list will point to this controller, with the controller field set to true.
 // There cannot be more than one managing controller.
 // +optional
 // +patchMergeKey=uid
 // +patchStrategy=merge
 OwnerReferences []OwnerReference `json:"ownerReferences,omitempty" patchStrategy:"merge" patchMergeKey:"uid" protobuf:"bytes,13,rep,name=ownerReferences"`

 // Must be empty before the object is deleted from the registry. Each entry
 // is an identifier for the responsible component that will remove the entry
 // from the list. If the deletionTimestamp of the object is non-nil, entries
 // in this list can only be removed.
 // Finalizers may be processed and removed in any order. Order is NOT enforced
 // because it introduces significant risk of stuck finalizers.
 // finalizers is a shared field, any actor with permission can reorder it.
 // If the finalizer list is processed in order, then this can lead to a situation
 // in which the component responsible for the first finalizer in the list is
 // waiting for a signal (field value, external system, or other) produced by a
 // component responsible for a finalizer later in the list, resulting in a deadlock.
 // Without enforced ordering finalizers are free to order amongst themselves and
 // are not vulnerable to ordering changes in the list.
 // +optional
 // +patchStrategy=merge
 Finalizers []string `json:"finalizers,omitempty" patchStrategy:"merge" protobuf:"bytes,14,rep,name=finalizers"`

 // Tombstone: ClusterName was a legacy field that was always cleared by
 // the system and never used.
 // ClusterName string `json:"clusterName,omitempty" protobuf:"bytes,15,opt,name=clusterName"`

 // ManagedFields maps workflow-id and version to the set of fields
 // that are managed by that workflow. This is mostly for internal
 // housekeeping, and users typically shouldn't need to set or
 // understand this field. A workflow can be the user's name, a
 // controller's name, or the name of a specific apply path like
 // "ci-cd". The set of fields is always in the version that the
 // workflow used when modifying the object.
 //
 // +optional
 ManagedFields []ManagedFieldsEntry `json:"managedFields,omitempty" protobuf:"bytes,17,rep,name=managedFields"`
}

LabelSelector

// Note:
// There are two different styles of label selectors used in versioned types:
// an older style which is represented as just a string in versioned types, and a
// newer style that is structured. LabelSelector is an internal representation for the
// latter style.

// A label selector is a label query over a set of resources. The result of matchLabels and
// matchExpressions are ANDed. An empty label selector matches all objects. A null
// label selector matches no objects.
// +structType=atomic
type LabelSelector struct {
 // matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
 // map is equivalent to an element of matchExpressions, whose key field is "key", the
 // operator is "In", and the values array contains only "value". The requirements are ANDed.
 // +optional
 MatchLabels map[string]string `json:"matchLabels,omitempty" protobuf:"bytes,1,rep,name=matchLabels"`
 // matchExpressions is a list of label selector requirements. The requirements are ANDed.
 // +optional
 MatchExpressions []LabelSelectorRequirement `json:"matchExpressions,omitempty" protobuf:"bytes,2,rep,name=matchExpressions"`
}

LabelSelectorRequirement

// A label selector requirement is a selector that contains values, a key, and an operator that
// relates the key and values.
type LabelSelectorRequirement struct {
 // key is the label key that the selector applies to.
 // +patchMergeKey=key
 // +patchStrategy=merge
 Key string `json:"key" patchStrategy:"merge" patchMergeKey:"key" protobuf:"bytes,1,opt,name=key"`
 // operator represents a key's relationship to a set of values.
 // Valid operators are In, NotIn, Exists and DoesNotExist.
 Operator LabelSelectorOperator `json:"operator" protobuf:"bytes,2,opt,name=operator,casttype=LabelSelectorOperator"`
 // values is an array of string values. If the operator is In or NotIn,
 // the values array must be non-empty. If the operator is Exists or DoesNotExist,
 // the values array must be empty. This array is replaced during a strategic
 // merge patch.
 // +optional
 Values []string `json:"values,omitempty" protobuf:"bytes,3,rep,name=values"`
}

// A label selector operator is the set of operators that can be used in a selector requirement.
type LabelSelectorOperator string

const (
 LabelSelectorOpIn LabelSelectorOperator = "In"
 LabelSelectorOpNotIn LabelSelectorOperator = "NotIn"
 LabelSelectorOpExists LabelSelectorOperator = "Exists"
 LabelSelectorOpDoesNotExist LabelSelectorOperator = "DoesNotExist"
)

GroupVersionKind

k8s.io/apimachinery/pkg/apis/meta/v1/group_version.go

// GroupVersionKind unambiguously identifies a kind. It doesn't anonymously include GroupVersion
// to avoid automatic coercion. It doesn't use a GroupVersion to avoid custom marshalling
//
// +protobuf.options.(gogoproto.goproto_stringer)=false
type GroupVersionKind struct {
 Group string `json:"group" protobuf:"bytes,1,opt,name=group"`
 Version string `json:"version" protobuf:"bytes,2,opt,name=version"`
 Kind string `json:"kind" protobuf:"bytes,3,opt,name=kind"`
}

func (gvk GroupVersionKind) String() string {
 return gvk.Group + "/" + gvk.Version + ", Kind=" + gvk.Kind
}

GroupVersionResource

// GroupVersionResource unambiguously identifies a resource. It doesn't anonymously include GroupVersion
// to avoid automatic coercion. It doesn't use a GroupVersion to avoid custom marshalling
//
// +protobuf.options.(gogoproto.goproto_stringer)=false
type GroupVersionResource struct {
 Group string `json:"group" protobuf:"bytes,1,opt,name=group"`
 Version string `json:"version" protobuf:"bytes,2,opt,name=version"`
 Resource string `json:"resource" protobuf:"bytes,3,opt,name=resource"`
}

func (gvr *GroupVersionResource) String() string {
 if gvr == nil {
 return "<nil>"
 }
 return strings.Join([]string{gvr.Group, "/", gvr.Version, ", Resource=", gvr.Resource}, "")
}

Status

// Status is a return value for calls that don't return other objects.
type Status struct {
 TypeMeta `json:",inline"`
 // Standard list metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 // +optional
 ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Status of the operation.
 // One of: "Success" or "Failure".
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Status string `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
 // A human-readable description of the status of this operation.
 // +optional
 Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
 // A machine-readable description of why this operation is in the
 // "Failure" status. If this value is empty there
 // is no information available. A Reason clarifies an HTTP status
 // code but does not override it.
 // +optional
 Reason StatusReason `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason,casttype=StatusReason"`
 // Extended data associated with the reason. Each reason may define its
 // own extended details. This field is optional and the data returned
 // is not guaranteed to conform to any schema except that defined by
 // the reason type.
 // +optional
 Details *StatusDetails `json:"details,omitempty" protobuf:"bytes,5,opt,name=details"`
 // Suggested HTTP return code for this status, 0 if not set.
 // +optional
 Code int32 `json:"code,omitempty" protobuf:"varint,6,opt,name=code"`
}

StatusReason

// Values of Status.Status
const (
 StatusSuccess = "Success"
 StatusFailure = "Failure"
)

// StatusReason is an enumeration of possible failure causes. Each StatusReason
// must map to a single HTTP status code, but multiple reasons may map
// to the same HTTP status code.
// TODO: move to apiserver
type StatusReason string

const (
 // StatusReasonUnknown means the server has declined to indicate a specific reason.
 // The details field may contain other information about this error.
 // Status code 500.
 StatusReasonUnknown StatusReason = ""

 // StatusReasonUnauthorized means the server can be reached and understood the request, but requires
 // the user to present appropriate authorization credentials (identified by the WWW-Authenticate header)
 // in order for the action to be completed. If the user has specified credentials on the request, the
 // server considers them insufficient.
 // Status code 401
 StatusReasonUnauthorized StatusReason = "Unauthorized"

 // StatusReasonForbidden means the server can be reached and understood the request, but refuses
 // to take any further action. It is the result of the server being configured to deny access for some reason
 // to the requested resource by the client.
 // Details (optional):
 // "kind" string - the kind attribute of the forbidden resource
 // on some operations may differ from the requested
 // resource.
 // "id" string - the identifier of the forbidden resource
 // Status code 403
 StatusReasonForbidden StatusReason = "Forbidden"

 // StatusReasonNotFound means one or more resources required for this operation
 // could not be found.
 // Details (optional):
 // "kind" string - the kind attribute of the missing resource
 // on some operations may differ from the requested
 // resource.
 // "id" string - the identifier of the missing resource
 // Status code 404
 StatusReasonNotFound StatusReason = "NotFound"

 // StatusReasonAlreadyExists means the resource you are creating already exists.
 // Details (optional):
 // "kind" string - the kind attribute of the conflicting resource
 // "id" string - the identifier of the conflicting resource
 // Status code 409
 StatusReasonAlreadyExists StatusReason = "AlreadyExists"

 // StatusReasonConflict means the requested operation cannot be completed
 // due to a conflict in the operation. The client may need to alter the
 // request. Each resource may define custom details that indicate the
 // nature of the conflict.
 // Status code 409
 StatusReasonConflict StatusReason = "Conflict"

 // StatusReasonGone means the item is no longer available at the server and no
 // forwarding address is known.
 // Status code 410
 StatusReasonGone StatusReason = "Gone"

 // StatusReasonInvalid means the requested create or update operation cannot be
 // completed due to invalid data provided as part of the request. The client may
 // need to alter the request. When set, the client may use the StatusDetails
 // message field as a summary of the issues encountered.
 // Details (optional):
 // "kind" string - the kind attribute of the invalid resource
 // "id" string - the identifier of the invalid resource
 // "causes" - one or more StatusCause entries indicating the data in the
 // provided resource that was invalid. The code, message, and
 // field attributes will be set.
 // Status code 422
 StatusReasonInvalid StatusReason = "Invalid"

 // StatusReasonServerTimeout means the server can be reached and understood the request,
 // but cannot complete the action in a reasonable time. The client should retry the request.
 // This is may be due to temporary server load or a transient communication issue with
 // another server. Status code 500 is used because the HTTP spec provides no suitable
 // server-requested client retry and the 5xx class represents actionable errors.
 // Details (optional):
 // "kind" string - the kind attribute of the resource being acted on.
 // "id" string - the operation that is being attempted.
 // "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
 // Status code 500
 StatusReasonServerTimeout StatusReason = "ServerTimeout"

 // StatusReasonTimeout means that the request could not be completed within the given time.
 // Clients can get this response only when they specified a timeout param in the request,
 // or if the server cannot complete the operation within a reasonable amount of time.
 // The request might succeed with an increased value of timeout param. The client *should*
 // wait at least the number of seconds specified by the retryAfterSeconds field.
 // Details (optional):
 // "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
 // Status code 504
 StatusReasonTimeout StatusReason = "Timeout"

 // StatusReasonTooManyRequests means the server experienced too many requests within a
 // given window and that the client must wait to perform the action again. A client may
 // always retry the request that led to this error, although the client should wait at least
 // the number of seconds specified by the retryAfterSeconds field.
 // Details (optional):
 // "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
 // Status code 429
 StatusReasonTooManyRequests StatusReason = "TooManyRequests"

 // StatusReasonBadRequest means that the request itself was invalid, because the request
 // doesn't make any sense, for example deleting a read-only object. This is different than
 // StatusReasonInvalid above which indicates that the API call could possibly succeed, but the
 // data was invalid. API calls that return BadRequest can never succeed.
 // Status code 400
 StatusReasonBadRequest StatusReason = "BadRequest"

 // StatusReasonMethodNotAllowed means that the action the client attempted to perform on the
 // resource was not supported by the code - for instance, attempting to delete a resource that
 // can only be created. API calls that return MethodNotAllowed can never succeed.
 // Status code 405
 StatusReasonMethodNotAllowed StatusReason = "MethodNotAllowed"

 // StatusReasonNotAcceptable means that the accept types indicated by the client were not acceptable
 // to the server - for instance, attempting to receive protobuf for a resource that supports only json and yaml.
 // API calls that return NotAcceptable can never succeed.
 // Status code 406
 StatusReasonNotAcceptable StatusReason = "NotAcceptable"

 // StatusReasonRequestEntityTooLarge means that the request entity is too large.
 // Status code 413
 StatusReasonRequestEntityTooLarge StatusReason = "RequestEntityTooLarge"

 // StatusReasonUnsupportedMediaType means that the content type sent by the client is not acceptable
 // to the server - for instance, attempting to send protobuf for a resource that supports only json and yaml.
 // API calls that return UnsupportedMediaType can never succeed.
 // Status code 415
 StatusReasonUnsupportedMediaType StatusReason = "UnsupportedMediaType"

 // StatusReasonInternalError indicates that an internal error occurred, it is unexpected
 // and the outcome of the call is unknown.
 // Details (optional):
 // "causes" - The original error
 // Status code 500
 StatusReasonInternalError StatusReason = "InternalError"

 // StatusReasonExpired indicates that the request is invalid because the content you are requesting
 // has expired and is no longer available. It is typically associated with watches that can't be
 // serviced.
 // Status code 410 (gone)
 StatusReasonExpired StatusReason = "Expired"

 // StatusReasonServiceUnavailable means that the request itself was valid,
 // but the requested service is unavailable at this time.
 // Retrying the request after some time might succeed.
 // Status code 503
 StatusReasonServiceUnavailable StatusReason = "ServiceUnavailable"
)

StatusDetails

// StatusDetails is a set of additional properties that MAY be set by the
// server to provide additional information about a response. The Reason
// field of a Status object defines what attributes will be set. Clients
// must ignore fields that do not match the defined type of each attribute,
// and should assume that any attribute may be empty, invalid, or under
// defined.
type StatusDetails struct {
 // The name attribute of the resource associated with the status StatusReason
 // (when there is a single name which can be described).
 // +optional
 Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`
 // The group attribute of the resource associated with the status StatusReason.
 // +optional
 Group string `json:"group,omitempty" protobuf:"bytes,2,opt,name=group"`
 // The kind attribute of the resource associated with the status StatusReason.
 // On some operations may differ from the requested resource Kind.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 // +optional
 Kind string `json:"kind,omitempty" protobuf:"bytes,3,opt,name=kind"`
 // UID of the resource.
 // (when there is a single resource which can be described).
 // More info: http://kubernetes.io/docs/user-guide/identifiers#uids
 // +optional
 UID types.UID `json:"uid,omitempty" protobuf:"bytes,6,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
 // The Causes array includes more details associated with the StatusReason
 // failure. Not all StatusReasons may provide detailed causes.
 // +optional
 Causes []StatusCause `json:"causes,omitempty" protobuf:"bytes,4,rep,name=causes"`
 // If specified, the time in seconds before the operation should be retried. Some errors may indicate
 // the client must take an alternate action - for those errors this field may indicate how long to wait
 // before taking the alternate action.
 // +optional
 RetryAfterSeconds int32 `json:"retryAfterSeconds,omitempty" protobuf:"varint,5,opt,name=retryAfterSeconds"`
}

StatusCause

// StatusCause provides more information about an api.Status failure, including
// cases when multiple errors are encountered.
type StatusCause struct {
 // A machine-readable description of the cause of the error. If this value is
 // empty there is no information available.
 // +optional
 Type CauseType `json:"reason,omitempty" protobuf:"bytes,1,opt,name=reason,casttype=CauseType"`
 // A human-readable description of the cause of the error. This field may be
 // presented as-is to a reader.
 // +optional
 Message string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"`
 // The field of the resource that has caused this error, as named by its JSON
 // serialization. May include dot and postfix notation for nested attributes.
 // Arrays are zero-indexed. Fields may appear more than once in an array of
 // causes due to fields having multiple errors.
 // Optional.
 //
 // Examples:
 // "name" - the field "name" on the current resource
 // "items[0].name" - the field "name" on the first array entry in "items"
 // +optional
 Field string `json:"field,omitempty" protobuf:"bytes,3,opt,name=field"`
}

CauseType

// CauseType is a machine readable value providing more detail about what
// occurred in a status response. An operation may have multiple causes for a
// status (whether Failure or Success).
type CauseType string

const (
 // CauseTypeFieldValueNotFound is used to report failure to find a requested value
 // (e.g. looking up an ID).
 CauseTypeFieldValueNotFound CauseType = "FieldValueNotFound"
 // CauseTypeFieldValueRequired is used to report required values that are not
 // provided (e.g. empty strings, null values, or empty arrays).
 CauseTypeFieldValueRequired CauseType = "FieldValueRequired"
 // CauseTypeFieldValueDuplicate is used to report collisions of values that must be
 // unique (e.g. unique IDs).
 CauseTypeFieldValueDuplicate CauseType = "FieldValueDuplicate"
 // CauseTypeFieldValueInvalid is used to report malformed values (e.g. failed regex
 // match).
 CauseTypeFieldValueInvalid CauseType = "FieldValueInvalid"
 // CauseTypeFieldValueNotSupported is used to report valid (as per formatting rules)
 // values that can not be handled (e.g. an enumerated string).
 CauseTypeFieldValueNotSupported CauseType = "FieldValueNotSupported"
 // CauseTypeUnexpectedServerResponse is used to report when the server responded to the client
 // without the expected return type. The presence of this cause indicates the error may be
 // due to an intervening proxy or the server software malfunctioning.
 CauseTypeUnexpectedServerResponse CauseType = "UnexpectedServerResponse"
 // FieldManagerConflict is used to report when another client claims to manage this field,
 // It should only be returned for a request using server-side apply.
 CauseTypeFieldManagerConflict CauseType = "FieldManagerConflict"
 // CauseTypeResourceVersionTooLarge is used to report that the requested resource version
 // is newer than the data observed by the API server, so the request cannot be served.
 CauseTypeResourceVersionTooLarge CauseType = "ResourceVersionTooLarge"
)

GroupKind

staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/group_version.go

// GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying
// concepts during lookup stages without having partially valid types
//
// +protobuf.options.(gogoproto.goproto_stringer)=false
type GroupKind struct {
 Group string `json:"group" protobuf:"bytes,1,opt,name=group"`
 Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
}

Docs: ConfigMap

Fri, 12 May 2023 14:23:32 +0800

简要概述

属于组：“corev1”

{Group: corev1.GroupName, Kind: "ConfigMap"}

staging/src/k8s.io/kubectl/pkg/describe/describe.go

代码路径：

staging/src/k8s.io/api/core/v1/types.go

在设计上不是用来保存大量数据的，保存的数据不可超过 1 MiB。

常用指令

TODO;

配置示例

TODO;

数据结构

ConfigMap

// ConfigMap holds configuration data for pods to consume.
type ConfigMap struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Immutable, if set to true, ensures that data stored in the ConfigMap cannot
 // be updated (only object metadata can be modified).
 // If not set to true, the field can be modified at any time.
 // Defaulted to nil.
 // +optional
 Immutable *bool `json:"immutable,omitempty" protobuf:"varint,4,opt,name=immutable"`

 // Data contains the configuration data.
 // Each key must consist of alphanumeric characters, '-', '_' or '.'.
 // Values with non-UTF-8 byte sequences must use the BinaryData field.
 // The keys stored in Data must not overlap with the keys in
 // the BinaryData field, this is enforced during validation process.
 // +optional
 Data map[string]string `json:"data,omitempty" protobuf:"bytes,2,rep,name=data"`

 // BinaryData contains the binary data.
 // Each key must consist of alphanumeric characters, '-', '_' or '.'.
 // BinaryData can contain byte sequences that are not in the UTF-8 range.
 // The keys stored in BinaryData must not overlap with the ones in
 // the Data field, this is enforced during validation process.
 // Using this field will require 1.10+ apiserver and
 // kubelet.
 // +optional
 BinaryData map[string][]byte `json:"binaryData,omitempty" protobuf:"bytes,3,rep,name=binaryData"`
}

Docs: Pod

Mon, 05 Dec 2022 18:54:45 +0800

简要概述

staging/src/k8s.io/api/core/v1/types.go

查看官方介绍

其中数据结构主要由以下四部分组成：

存储卷 Pod Volume
容器组 Pod Container
容器安全 Pod Security
亲和性与污点 Pod Affinity

常用指令

TODO;

配置示例

通过 kubectl 创建

生成可运行的 yaml 内容

kubectl run busybox \
 --namespace=default \
 --image=registry.cn-hangzhou.aliyuncs.com/opsaid/busybox:1.35.0 \
 --dry-run=client \
 -o yaml \
 --command -- /bin/sh -c sleep 3600

通过 yaml 创建

apiVersion: v1
kind: Pod
metadata:
 labels:
 run: busybox
 name: busybox
 namespace: default
spec:
 containers:
 - command:
 - /bin/sh
 - -c
 - sleep
 - "3600"
 image: registry.cn-hangzhou.aliyuncs.com/opsaid/busybox:1.35.0
 name: busybox
 resources: {}
 dnsPolicy: ClusterFirst
 restartPolicy: Always

数据结构

Pod

// Pod is a collection of containers that can run on a host. This resource is created
// by clients and scheduled onto hosts.
type Pod struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Specification of the desired behavior of the pod.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Spec PodSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // Most recently observed status of the pod.
 // This data may not be up to date.
 // Populated by the system.
 // Read-only.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Status PodStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

PodSpec

// PodSpec is a description of a pod.
type PodSpec struct {
 // List of volumes that can be mounted by containers belonging to the pod.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes
 // +optional
 // +patchMergeKey=name
 // +patchStrategy=merge,retainKeys
 Volumes []Volume `json:"volumes,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,1,rep,name=volumes"`
 // List of initialization containers belonging to the pod.
 // Init containers are executed in order prior to containers being started. If any
 // init container fails, the pod is considered to have failed and is handled according
 // to its restartPolicy. The name for an init container or normal container must be
 // unique among all containers.
 // Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
 // The resourceRequirements of an init container are taken into account during scheduling
 // by finding the highest request/limit for each resource type, and then using the max of
 // of that value or the sum of the normal containers. Limits are applied to init containers
 // in a similar fashion.
 // Init containers cannot currently be added or removed.
 // Cannot be updated.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
 // +patchMergeKey=name
 // +patchStrategy=merge
 InitContainers []Container `json:"initContainers,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,20,rep,name=initContainers"`
 // List of containers belonging to the pod.
 // Containers cannot currently be added or removed.
 // There must be at least one container in a Pod.
 // Cannot be updated.
 // +patchMergeKey=name
 // +patchStrategy=merge
 Containers []Container `json:"containers" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=containers"`
 // List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing
 // pod to perform user-initiated actions such as debugging. This list cannot be specified when
 // creating a pod, and it cannot be modified by updating the pod spec. In order to add an
 // ephemeral container to an existing pod, use the pod's ephemeralcontainers subresource.
 // This field is alpha-level and is only honored by servers that enable the EphemeralContainers feature.
 // +optional
 // +patchMergeKey=name
 // +patchStrategy=merge
 EphemeralContainers []EphemeralContainer `json:"ephemeralContainers,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,34,rep,name=ephemeralContainers"`
 // Restart policy for all containers within the pod.
 // One of Always, OnFailure, Never.
 // Default to Always.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy
 // +optional
 RestartPolicy RestartPolicy `json:"restartPolicy,omitempty" protobuf:"bytes,3,opt,name=restartPolicy,casttype=RestartPolicy"`
 // Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request.
 // Value must be non-negative integer. The value zero indicates stop immediately via
 // the kill signal (no opportunity to shut down).
 // If this value is nil, the default grace period will be used instead.
 // The grace period is the duration in seconds after the processes running in the pod are sent
 // a termination signal and the time when the processes are forcibly halted with a kill signal.
 // Set this value longer than the expected cleanup time for your process.
 // Defaults to 30 seconds.
 // +optional
 TerminationGracePeriodSeconds *int64 `json:"terminationGracePeriodSeconds,omitempty" protobuf:"varint,4,opt,name=terminationGracePeriodSeconds"`
 // Optional duration in seconds the pod may be active on the node relative to
 // StartTime before the system will actively try to mark it failed and kill associated containers.
 // Value must be a positive integer.
 // +optional
 ActiveDeadlineSeconds *int64 `json:"activeDeadlineSeconds,omitempty" protobuf:"varint,5,opt,name=activeDeadlineSeconds"`
 // Set DNS policy for the pod.
 // Defaults to "ClusterFirst".
 // Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'.
 // DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy.
 // To have DNS options set along with hostNetwork, you have to specify DNS policy
 // explicitly to 'ClusterFirstWithHostNet'.
 // +optional
 DNSPolicy DNSPolicy `json:"dnsPolicy,omitempty" protobuf:"bytes,6,opt,name=dnsPolicy,casttype=DNSPolicy"`
 // NodeSelector is a selector which must be true for the pod to fit on a node.
 // Selector which must match a node's labels for the pod to be scheduled on that node.
 // More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
 // +optional
 // +mapType=atomic
 NodeSelector map[string]string `json:"nodeSelector,omitempty" protobuf:"bytes,7,rep,name=nodeSelector"`

 // ServiceAccountName is the name of the ServiceAccount to use to run this pod.
 // More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
 // +optional
 ServiceAccountName string `json:"serviceAccountName,omitempty" protobuf:"bytes,8,opt,name=serviceAccountName"`
 // DeprecatedServiceAccount is a depreciated alias for ServiceAccountName.
 // Deprecated: Use serviceAccountName instead.
 // +k8s:conversion-gen=false
 // +optional
 DeprecatedServiceAccount string `json:"serviceAccount,omitempty" protobuf:"bytes,9,opt,name=serviceAccount"`
 // AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
 // +optional
 AutomountServiceAccountToken *bool `json:"automountServiceAccountToken,omitempty" protobuf:"varint,21,opt,name=automountServiceAccountToken"`

 // NodeName is a request to schedule this pod onto a specific node. If it is non-empty,
 // the scheduler simply schedules this pod onto that node, assuming that it fits resource
 // requirements.
 // +optional
 NodeName string `json:"nodeName,omitempty" protobuf:"bytes,10,opt,name=nodeName"`
 // Host networking requested for this pod. Use the host's network namespace.
 // If this option is set, the ports that will be used must be specified.
 // Default to false.
 // +k8s:conversion-gen=false
 // +optional
 HostNetwork bool `json:"hostNetwork,omitempty" protobuf:"varint,11,opt,name=hostNetwork"`
 // Use the host's pid namespace.
 // Optional: Default to false.
 // +k8s:conversion-gen=false
 // +optional
 HostPID bool `json:"hostPID,omitempty" protobuf:"varint,12,opt,name=hostPID"`
 // Use the host's ipc namespace.
 // Optional: Default to false.
 // +k8s:conversion-gen=false
 // +optional
 HostIPC bool `json:"hostIPC,omitempty" protobuf:"varint,13,opt,name=hostIPC"`
 // Share a single process namespace between all of the containers in a pod.
 // When this is set containers will be able to view and signal processes from other containers
 // in the same pod, and the first process in each container will not be assigned PID 1.
 // HostPID and ShareProcessNamespace cannot both be set.
 // Optional: Default to false.
 // +k8s:conversion-gen=false
 // +optional
 ShareProcessNamespace *bool `json:"shareProcessNamespace,omitempty" protobuf:"varint,27,opt,name=shareProcessNamespace"`
 // SecurityContext holds pod-level security attributes and common container settings.
 // Optional: Defaults to empty. See type description for default values of each field.
 // +optional
 SecurityContext *PodSecurityContext `json:"securityContext,omitempty" protobuf:"bytes,14,opt,name=securityContext"`
 // ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
 // If specified, these secrets will be passed to individual puller implementations for them to use. For example,
 // in the case of docker, only DockerConfig type secrets are honored.
 // More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
 // +optional
 // +patchMergeKey=name
 // +patchStrategy=merge
 ImagePullSecrets []LocalObjectReference `json:"imagePullSecrets,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,15,rep,name=imagePullSecrets"`
 // Specifies the hostname of the Pod
 // If not specified, the pod's hostname will be set to a system-defined value.
 // +optional
 Hostname string `json:"hostname,omitempty" protobuf:"bytes,16,opt,name=hostname"`
 // If specified, the fully qualified Pod hostname will be "<hostname>.<subdomain>.<pod namespace>.svc.<cluster domain>".
 // If not specified, the pod will not have a domainname at all.
 // +optional
 Subdomain string `json:"subdomain,omitempty" protobuf:"bytes,17,opt,name=subdomain"`
 // If specified, the pod's scheduling constraints
 // +optional
 Affinity *Affinity `json:"affinity,omitempty" protobuf:"bytes,18,opt,name=affinity"`
 // If specified, the pod will be dispatched by specified scheduler.
 // If not specified, the pod will be dispatched by default scheduler.
 // +optional
 SchedulerName string `json:"schedulerName,omitempty" protobuf:"bytes,19,opt,name=schedulerName"`
 // If specified, the pod's tolerations.
 // +optional
 Tolerations []Toleration `json:"tolerations,omitempty" protobuf:"bytes,22,opt,name=tolerations"`
 // HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts
 // file if specified. This is only valid for non-hostNetwork pods.
 // +optional
 // +patchMergeKey=ip
 // +patchStrategy=merge
 HostAliases []HostAlias `json:"hostAliases,omitempty" patchStrategy:"merge" patchMergeKey:"ip" protobuf:"bytes,23,rep,name=hostAliases"`
 // If specified, indicates the pod's priority. "system-node-critical" and
 // "system-cluster-critical" are two special keywords which indicate the
 // highest priorities with the former being the highest priority. Any other
 // name must be defined by creating a PriorityClass object with that name.
 // If not specified, the pod priority will be default or zero if there is no
 // default.
 // +optional
 PriorityClassName string `json:"priorityClassName,omitempty" protobuf:"bytes,24,opt,name=priorityClassName"`
 // The priority value. Various system components use this field to find the
 // priority of the pod. When Priority Admission Controller is enabled, it
 // prevents users from setting this field. The admission controller populates
 // this field from PriorityClassName.
 // The higher the value, the higher the priority.
 // +optional
 Priority *int32 `json:"priority,omitempty" protobuf:"bytes,25,opt,name=priority"`
 // Specifies the DNS parameters of a pod.
 // Parameters specified here will be merged to the generated DNS
 // configuration based on DNSPolicy.
 // +optional
 DNSConfig *PodDNSConfig `json:"dnsConfig,omitempty" protobuf:"bytes,26,opt,name=dnsConfig"`
 // If specified, all readiness gates will be evaluated for pod readiness.
 // A pod is ready when all its containers are ready AND
 // all conditions specified in the readiness gates have status equal to "True"
 // More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates
 // +optional
 ReadinessGates []PodReadinessGate `json:"readinessGates,omitempty" protobuf:"bytes,28,opt,name=readinessGates"`
 // RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used
 // to run this pod. If no RuntimeClass resource matches the named class, the pod will not be run.
 // If unset or empty, the "legacy" RuntimeClass will be used, which is an implicit class with an
 // empty definition that uses the default runtime handler.
 // More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
 // This is a beta feature as of Kubernetes v1.14.
 // +optional
 RuntimeClassName *string `json:"runtimeClassName,omitempty" protobuf:"bytes,29,opt,name=runtimeClassName"`
 // EnableServiceLinks indicates whether information about services should be injected into pod's
 // environment variables, matching the syntax of Docker links.
 // Optional: Defaults to true.
 // +optional
 EnableServiceLinks *bool `json:"enableServiceLinks,omitempty" protobuf:"varint,30,opt,name=enableServiceLinks"`
 // PreemptionPolicy is the Policy for preempting pods with lower priority.
 // One of Never, PreemptLowerPriority.
 // Defaults to PreemptLowerPriority if unset.
 // This field is beta-level, gated by the NonPreemptingPriority feature-gate.
 // +optional
 PreemptionPolicy *PreemptionPolicy `json:"preemptionPolicy,omitempty" protobuf:"bytes,31,opt,name=preemptionPolicy"`
 // Overhead represents the resource overhead associated with running a pod for a given RuntimeClass.
 // This field will be autopopulated at admission time by the RuntimeClass admission controller. If
 // the RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests.
 // The RuntimeClass admission controller will reject Pod create requests which have the overhead already
 // set. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value
 // defined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero.
 // More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md
 // This field is beta-level as of Kubernetes v1.18, and is only honored by servers that enable the PodOverhead feature.
 // +optional
 Overhead ResourceList `json:"overhead,omitempty" protobuf:"bytes,32,opt,name=overhead"`
 // TopologySpreadConstraints describes how a group of pods ought to spread across topology
 // domains. Scheduler will schedule pods in a way which abides by the constraints.
 // All topologySpreadConstraints are ANDed.
 // +optional
 // +patchMergeKey=topologyKey
 // +patchStrategy=merge
 // +listType=map
 // +listMapKey=topologyKey
 // +listMapKey=whenUnsatisfiable
 TopologySpreadConstraints []TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty" patchStrategy:"merge" patchMergeKey:"topologyKey" protobuf:"bytes,33,opt,name=topologySpreadConstraints"`
 // If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default).
 // In Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname).
 // In Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters to FQDN.
 // If a pod does not have FQDN, this has no effect.
 // Default to false.
 // +optional
 SetHostnameAsFQDN *bool `json:"setHostnameAsFQDN,omitempty" protobuf:"varint,35,opt,name=setHostnameAsFQDN"`
}

Volume

参考 Pod Volume 数据结构。

Container

参考 Pod Container 数据结构。

EphemeralContainer

// An EphemeralContainer is a container that may be added temporarily to an existing pod for
// user-initiated activities such as debugging. Ephemeral containers have no resource or
// scheduling guarantees, and they will not be restarted when they exit or when a pod is
// removed or restarted. If an ephemeral container causes a pod to exceed its resource
// allocation, the pod may be evicted.
// Ephemeral containers may not be added by directly updating the pod spec. They must be added
// via the pod's ephemeralcontainers subresource, and they will appear in the pod spec
// once added.
// This is an alpha feature enabled by the EphemeralContainers feature flag.
type EphemeralContainer struct {
 // Ephemeral containers have all of the fields of Container, plus additional fields
 // specific to ephemeral containers. Fields in common with Container are in the
 // following inlined struct so than an EphemeralContainer may easily be converted
 // to a Container.
 EphemeralContainerCommon `json:",inline" protobuf:"bytes,1,req"`

 // If set, the name of the container from PodSpec that this ephemeral container targets.
 // The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.
 // If not set then the ephemeral container is run in whatever namespaces are shared
 // for the pod. Note that the container runtime must support this feature.
 // +optional
 TargetContainerName string `json:"targetContainerName,omitempty" protobuf:"bytes,2,opt,name=targetContainerName"`
}

RestartPolicy

// RestartPolicy describes how the container should be restarted.
// Only one of the following restart policies may be specified.
// If none of the following policies is specified, the default one
// is RestartPolicyAlways.
type RestartPolicy string

const (
 RestartPolicyAlways RestartPolicy = "Always"
 RestartPolicyOnFailure RestartPolicy = "OnFailure"
 RestartPolicyNever RestartPolicy = "Never"
)

DNSPolicy

// DNSPolicy defines how a pod's DNS will be configured.
type DNSPolicy string

const (
 // DNSClusterFirstWithHostNet indicates that the pod should use cluster DNS
 // first, if it is available, then fall back on the default
 // (as determined by kubelet) DNS settings.
 DNSClusterFirstWithHostNet DNSPolicy = "ClusterFirstWithHostNet"

 // DNSClusterFirst indicates that the pod should use cluster DNS
 // first unless hostNetwork is true, if it is available, then
 // fall back on the default (as determined by kubelet) DNS settings.
 DNSClusterFirst DNSPolicy = "ClusterFirst"

 // DNSDefault indicates that the pod should use the default (as
 // determined by kubelet) DNS settings.
 DNSDefault DNSPolicy = "Default"

 // DNSNone indicates that the pod should use empty DNS settings. DNS
 // parameters such as nameservers and search paths should be defined via
 // DNSConfig.
 DNSNone DNSPolicy = "None"
)

PodSecurityContext

参考 Pod Security 数据结构。

LocalObjectReference

// LocalObjectReference contains enough information to let you locate the
// referenced object inside the same namespace.
// +structType=atomic
type LocalObjectReference struct {
 // Name of the referent.
 // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 // TODO: Add other useful fields. apiVersion, kind, uid?
 // +optional
 Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`
}

Affinity

参考 Pod Affinity 数据结构。

Toleration

参考 Pod Affinity 数据结构。

HostAlias

// HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
// pod's hosts file.
type HostAlias struct {
 // IP address of the host file entry.
 IP string `json:"ip,omitempty" protobuf:"bytes,1,opt,name=ip"`
 // Hostnames for the above IP address.
 Hostnames []string `json:"hostnames,omitempty" protobuf:"bytes,2,rep,name=hostnames"`
}

PodDNSConfig

// PodDNSConfig defines the DNS parameters of a pod in addition to
// those generated from DNSPolicy.
type PodDNSConfig struct {
 // A list of DNS name server IP addresses.
 // This will be appended to the base nameservers generated from DNSPolicy.
 // Duplicated nameservers will be removed.
 // +optional
 Nameservers []string `json:"nameservers,omitempty" protobuf:"bytes,1,rep,name=nameservers"`
 // A list of DNS search domains for host-name lookup.
 // This will be appended to the base search paths generated from DNSPolicy.
 // Duplicated search paths will be removed.
 // +optional
 Searches []string `json:"searches,omitempty" protobuf:"bytes,2,rep,name=searches"`
 // A list of DNS resolver options.
 // This will be merged with the base options generated from DNSPolicy.
 // Duplicated entries will be removed. Resolution options given in Options
 // will override those that appear in the base DNSPolicy.
 // +optional
 Options []PodDNSConfigOption `json:"options,omitempty" protobuf:"bytes,3,rep,name=options"`
}

// PodDNSConfigOption defines DNS resolver options of a pod.
type PodDNSConfigOption struct {
 // Required.
 Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`
 // +optional
 Value *string `json:"value,omitempty" protobuf:"bytes,2,opt,name=value"`
}

PodConditionType

// PodConditionType is a valid value for PodCondition.Type
type PodConditionType string

// These are valid conditions of pod.
const (
 // ContainersReady indicates whether all containers in the pod are ready.
 ContainersReady PodConditionType = "ContainersReady"
 // PodInitialized means that all init containers in the pod have started successfully.
 PodInitialized PodConditionType = "Initialized"
 // PodReady means the pod is able to service requests and should be added to the
 // load balancing pools of all matching services.
 PodReady PodConditionType = "Ready"
 // PodScheduled represents status of the scheduling process for this pod.
 PodScheduled PodConditionType = "PodScheduled"
)

PodReadinessGate

// PodReadinessGate contains the reference to a pod condition
type PodReadinessGate struct {
 // ConditionType refers to a condition in the pod's condition list with matching type.
 ConditionType PodConditionType `json:"conditionType" protobuf:"bytes,1,opt,name=conditionType,casttype=PodConditionType"`
}

PreemptionPolicy

// PreemptionPolicy describes a policy for if/when to preempt a pod.
type PreemptionPolicy string

const (
 // PreemptLowerPriority means that pod can preempt other pods with lower priority.
 PreemptLowerPriority PreemptionPolicy = "PreemptLowerPriority"
 // PreemptNever means that pod never preempts other pods with lower priority.
 PreemptNever PreemptionPolicy = "Never"
)

ResourceList

// ResourceName is the name identifying various resources in a ResourceList.
type ResourceName string

// Resource names must be not more than 63 characters, consisting of upper- or lower-case alphanumeric characters,
// with the -, _, and . characters allowed anywhere, except the first or last character.
// The default convention, matching that for annotations, is to use lower-case names, with dashes, rather than
// camel case, separating compound words.
// Fully-qualified resource typenames are constructed from a DNS-style subdomain, followed by a slash `/` and a name.
const (
 // CPU, in cores. (500m = .5 cores)
 ResourceCPU ResourceName = "cpu"
 // Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
 ResourceMemory ResourceName = "memory"
 // Volume size, in bytes (e,g. 5Gi = 5GiB = 5 * 1024 * 1024 * 1024)
 ResourceStorage ResourceName = "storage"
 // Local ephemeral storage, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
 // The resource name for ResourceEphemeralStorage is alpha and it can change across releases.
 ResourceEphemeralStorage ResourceName = "ephemeral-storage"
)

const (
 // Default namespace prefix.
 ResourceDefaultNamespacePrefix = "kubernetes.io/"
 // Name prefix for huge page resources (alpha).
 ResourceHugePagesPrefix = "hugepages-"
 // Name prefix for storage resource limits
 ResourceAttachableVolumesPrefix = "attachable-volumes-"
)

// ResourceList is a set of (resource name, quantity) pairs.
type ResourceList map[ResourceName]resource.Quantity

TopologySpreadConstraint

type UnsatisfiableConstraintAction string

const (
 // DoNotSchedule instructs the scheduler not to schedule the pod
 // when constraints are not satisfied.
 DoNotSchedule UnsatisfiableConstraintAction = "DoNotSchedule"
 // ScheduleAnyway instructs the scheduler to schedule the pod
 // even if constraints are not satisfied.
 ScheduleAnyway UnsatisfiableConstraintAction = "ScheduleAnyway"
)

// TopologySpreadConstraint specifies how to spread matching pods among the given topology.
type TopologySpreadConstraint struct {
 // MaxSkew describes the degree to which pods may be unevenly distributed.
 // When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference
 // between the number of matching pods in the target topology and the global minimum.
 // For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
 // labelSelector spread as 1/1/0:
 // +-------+-------+-------+
 // | zone1 | zone2 | zone3 |
 // +-------+-------+-------+
 // | P | P | |
 // +-------+-------+-------+
 // - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 1/1/1;
 // scheduling it onto zone1(zone2) would make the ActualSkew(2-0) on zone1(zone2)
 // violate MaxSkew(1).
 // - if MaxSkew is 2, incoming pod can be scheduled onto any zone.
 // When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence
 // to topologies that satisfy it.
 // It's a required field. Default value is 1 and 0 is not allowed.
 MaxSkew int32 `json:"maxSkew" protobuf:"varint,1,opt,name=maxSkew"`
 // TopologyKey is the key of node labels. Nodes that have a label with this key
 // and identical values are considered to be in the same topology.
 // We consider each <key, value> as a "bucket", and try to put balanced number
 // of pods into each bucket.
 // It's a required field.
 TopologyKey string `json:"topologyKey" protobuf:"bytes,2,opt,name=topologyKey"`
 // WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy
 // the spread constraint.
 // - DoNotSchedule (default) tells the scheduler not to schedule it.
 // - ScheduleAnyway tells the scheduler to schedule the pod in any location,
 // but giving higher precedence to topologies that would help reduce the
 // skew.
 // A constraint is considered "Unsatisfiable" for an incoming pod
 // if and only if every possible node assigment for that pod would violate
 // "MaxSkew" on some topology.
 // For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
 // labelSelector spread as 3/1/1:
 // +-------+-------+-------+
 // | zone1 | zone2 | zone3 |
 // +-------+-------+-------+
 // | P P P | P | P |
 // +-------+-------+-------+
 // If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled
 // to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies
 // MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler
 // won't make it *more* imbalanced.
 // It's a required field.
 WhenUnsatisfiable UnsatisfiableConstraintAction `json:"whenUnsatisfiable" protobuf:"bytes,3,opt,name=whenUnsatisfiable,casttype=UnsatisfiableConstraintAction"`
 // LabelSelector is used to find matching pods.
 // Pods that match this label selector are counted to determine the number of pods
 // in their corresponding topology domain.
 // +optional
 LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty" protobuf:"bytes,4,opt,name=labelSelector"`
}

PodStatus

// PodStatus represents information about the status of a pod. Status may trail the actual
// state of a system, especially if the node that hosts the pod cannot contact the control
// plane.
type PodStatus struct {
 // The phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle.
 // The conditions array, the reason and message fields, and the individual container status
 // arrays contain more detail about the pod's status.
 // There are five possible phase values:
 //
 // Pending: The pod has been accepted by the Kubernetes system, but one or more of the
 // container images has not been created. This includes time before being scheduled as
 // well as time spent downloading images over the network, which could take a while.
 // Running: The pod has been bound to a node, and all of the containers have been created.
 // At least one container is still running, or is in the process of starting or restarting.
 // Succeeded: All containers in the pod have terminated in success, and will not be restarted.
 // Failed: All containers in the pod have terminated, and at least one container has
 // terminated in failure. The container either exited with non-zero status or was terminated
 // by the system.
 // Unknown: For some reason the state of the pod could not be obtained, typically due to an
 // error in communicating with the host of the pod.
 //
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-phase
 // +optional
 Phase PodPhase `json:"phase,omitempty" protobuf:"bytes,1,opt,name=phase,casttype=PodPhase"`
 // Current service state of pod.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions
 // +optional
 // +patchMergeKey=type
 // +patchStrategy=merge
 Conditions []PodCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,2,rep,name=conditions"`
 // A human readable message indicating details about why the pod is in this condition.
 // +optional
 Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
 // A brief CamelCase message indicating details about why the pod is in this state.
 // e.g. 'Evicted'
 // +optional
 Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 // nominatedNodeName is set only when this pod preempts other pods on the node, but it cannot be
 // scheduled right away as preemption victims receive their graceful termination periods.
 // This field does not guarantee that the pod will be scheduled on this node. Scheduler may decide
 // to place the pod elsewhere if other nodes become available sooner. Scheduler may also decide to
 // give the resources on this node to a higher priority pod that is created after preemption.
 // As a result, this field may be different than PodSpec.nodeName when the pod is
 // scheduled.
 // +optional
 NominatedNodeName string `json:"nominatedNodeName,omitempty" protobuf:"bytes,11,opt,name=nominatedNodeName"`

 // IP address of the host to which the pod is assigned. Empty if not yet scheduled.
 // +optional
 HostIP string `json:"hostIP,omitempty" protobuf:"bytes,5,opt,name=hostIP"`
 // IP address allocated to the pod. Routable at least within the cluster.
 // Empty if not yet allocated.
 // +optional
 PodIP string `json:"podIP,omitempty" protobuf:"bytes,6,opt,name=podIP"`

 // podIPs holds the IP addresses allocated to the pod. If this field is specified, the 0th entry must
 // match the podIP field. Pods may be allocated at most 1 value for each of IPv4 and IPv6. This list
 // is empty if no IPs have been allocated yet.
 // +optional
 // +patchStrategy=merge
 // +patchMergeKey=ip
 PodIPs []PodIP `json:"podIPs,omitempty" protobuf:"bytes,12,rep,name=podIPs" patchStrategy:"merge" patchMergeKey:"ip"`

 // RFC 3339 date and time at which the object was acknowledged by the Kubelet.
 // This is before the Kubelet pulled the container image(s) for the pod.
 // +optional
 StartTime *metav1.Time `json:"startTime,omitempty" protobuf:"bytes,7,opt,name=startTime"`

 // The list has one entry per init container in the manifest. The most recent successful
 // init container will have ready = true, the most recently started container will have
 // startTime set.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status
 InitContainerStatuses []ContainerStatus `json:"initContainerStatuses,omitempty" protobuf:"bytes,10,rep,name=initContainerStatuses"`

 // The list has one entry per container in the manifest. Each entry is currently the output
 // of `docker inspect`.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status
 // +optional
 ContainerStatuses []ContainerStatus `json:"containerStatuses,omitempty" protobuf:"bytes,8,rep,name=containerStatuses"`
 // The Quality of Service (QOS) classification assigned to the pod based on resource requirements
 // See PodQOSClass type for available QOS classes
 // More info: https://git.k8s.io/community/contributors/design-proposals/node/resource-qos.md
 // +optional
 QOSClass PodQOSClass `json:"qosClass,omitempty" protobuf:"bytes,9,rep,name=qosClass"`
 // Status for any ephemeral containers that have run in this pod.
 // This field is alpha-level and is only populated by servers that enable the EphemeralContainers feature.
 // +optional
 EphemeralContainerStatuses []ContainerStatus `json:"ephemeralContainerStatuses,omitempty" protobuf:"bytes,13,rep,name=ephemeralContainerStatuses"`
}

PodPhase

// PodPhase is a label for the condition of a pod at the current time.
type PodPhase string

// These are the valid statuses of pods.
const (
 // PodPending means the pod has been accepted by the system, but one or more of the containers
 // has not been started. This includes time before being bound to a node, as well as time spent
 // pulling images onto the host.
 PodPending PodPhase = "Pending"
 // PodRunning means the pod has been bound to a node and all of the containers have been started.
 // At least one container is still running or is in the process of being restarted.
 PodRunning PodPhase = "Running"
 // PodSucceeded means that all containers in the pod have voluntarily terminated
 // with a container exit code of 0, and the system is not going to restart any of these containers.
 PodSucceeded PodPhase = "Succeeded"
 // PodFailed means that all containers in the pod have terminated, and at least one container has
 // terminated in a failure (exited with a non-zero exit code or was stopped by the system).
 PodFailed PodPhase = "Failed"
 // PodUnknown means that for some reason the state of the pod could not be obtained, typically due
 // to an error in communicating with the host of the pod.
 // Deprecated: It isn't being set since 2015 (74da3b14b0c0f658b3bb8d2def5094686d0e9095)
 PodUnknown PodPhase = "Unknown"
)

PodCondition

// PodCondition contains details for the current condition of this pod.
type PodCondition struct {
 // Type is the type of the condition.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions
 Type PodConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=PodConditionType"`
 // Status is the status of the condition.
 // Can be True, False, Unknown.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions
 Status ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=ConditionStatus"`
 // Last time we probed the condition.
 // +optional
 LastProbeTime metav1.Time `json:"lastProbeTime,omitempty" protobuf:"bytes,3,opt,name=lastProbeTime"`
 // Last time the condition transitioned from one status to another.
 // +optional
 LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,4,opt,name=lastTransitionTime"`
 // Unique, one-word, CamelCase reason for the condition's last transition.
 // +optional
 Reason string `json:"reason,omitempty" protobuf:"bytes,5,opt,name=reason"`
 // Human-readable message indicating details about last transition.
 // +optional
 Message string `json:"message,omitempty" protobuf:"bytes,6,opt,name=message"`
}

PodIP

// IP address information for entries in the (plural) PodIPs field.
// Each entry includes:
// IP: An IP address allocated to the pod. Routable at least within the cluster.
type PodIP struct {
 // ip is an IP address (IPv4 or IPv6) assigned to the pod
 IP string `json:"ip,omitempty" protobuf:"bytes,1,opt,name=ip"`
}

ContainerStatus

// ContainerStatus contains details for the current status of this container.
type ContainerStatus struct {
 // This must be a DNS_LABEL. Each container in a pod must have a unique name.
 // Cannot be updated.
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 // Details about the container's current condition.
 // +optional
 State ContainerState `json:"state,omitempty" protobuf:"bytes,2,opt,name=state"`
 // Details about the container's last termination condition.
 // +optional
 LastTerminationState ContainerState `json:"lastState,omitempty" protobuf:"bytes,3,opt,name=lastState"`
 // Specifies whether the container has passed its readiness probe.
 Ready bool `json:"ready" protobuf:"varint,4,opt,name=ready"`
 // The number of times the container has been restarted, currently based on
 // the number of dead containers that have not yet been removed.
 // Note that this is calculated from dead containers. But those containers are subject to
 // garbage collection. This value will get capped at 5 by GC.
 RestartCount int32 `json:"restartCount" protobuf:"varint,5,opt,name=restartCount"`
 // The image the container is running.
 // More info: https://kubernetes.io/docs/concepts/containers/images
 // TODO(dchen1107): Which image the container is running with?
 Image string `json:"image" protobuf:"bytes,6,opt,name=image"`
 // ImageID of the container's image.
 ImageID string `json:"imageID" protobuf:"bytes,7,opt,name=imageID"`
 // Container's ID in the format 'docker://<container_id>'.
 // +optional
 ContainerID string `json:"containerID,omitempty" protobuf:"bytes,8,opt,name=containerID"`
 // Specifies whether the container has passed its startup probe.
 // Initialized as false, becomes true after startupProbe is considered successful.
 // Resets to false when the container is restarted, or if kubelet loses state temporarily.
 // Is always true when no startupProbe is defined.
 // +optional
 Started *bool `json:"started,omitempty" protobuf:"varint,9,opt,name=started"`
}

PodQOSClass

// PodQOSClass defines the supported qos classes of Pods.
type PodQOSClass string

const (
 // PodQOSGuaranteed is the Guaranteed qos class.
 PodQOSGuaranteed PodQOSClass = "Guaranteed"
 // PodQOSBurstable is the Burstable qos class.
 PodQOSBurstable PodQOSClass = "Burstable"
 // PodQOSBestEffort is the BestEffort qos class.
 PodQOSBestEffort PodQOSClass = "BestEffort"
)

ConditionStatus

type ConditionStatus string

// These are valid condition statuses. "ConditionTrue" means a resource is in the condition.
// "ConditionFalse" means a resource is not in the condition. "ConditionUnknown" means kubernetes
// can't decide if a resource is in the condition or not. In the future, we could add other
// intermediate conditions, e.g. ConditionDegraded.
const (
 ConditionTrue ConditionStatus = "True"
 ConditionFalse ConditionStatus = "False"
 ConditionUnknown ConditionStatus = "Unknown"
)

ContainerState

// ContainerState holds a possible state of container.
// Only one of its members may be specified.
// If none of them is specified, the default one is ContainerStateWaiting.
type ContainerState struct {
 // Details about a waiting container
 // +optional
 Waiting *ContainerStateWaiting `json:"waiting,omitempty" protobuf:"bytes,1,opt,name=waiting"`
 // Details about a running container
 // +optional
 Running *ContainerStateRunning `json:"running,omitempty" protobuf:"bytes,2,opt,name=running"`
 // Details about a terminated container
 // +optional
 Terminated *ContainerStateTerminated `json:"terminated,omitempty" protobuf:"bytes,3,opt,name=terminated"`
}

// ContainerStateWaiting is a waiting state of a container.
type ContainerStateWaiting struct {
 // (brief) reason the container is not yet running.
 // +optional
 Reason string `json:"reason,omitempty" protobuf:"bytes,1,opt,name=reason"`
 // Message regarding why the container is not yet running.
 // +optional
 Message string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"`
}

// ContainerStateRunning is a running state of a container.
type ContainerStateRunning struct {
 // Time at which the container was last (re-)started
 // +optional
 StartedAt metav1.Time `json:"startedAt,omitempty" protobuf:"bytes,1,opt,name=startedAt"`
}

// ContainerStateTerminated is a terminated state of a container.
type ContainerStateTerminated struct {
 // Exit status from the last termination of the container
 ExitCode int32 `json:"exitCode" protobuf:"varint,1,opt,name=exitCode"`
 // Signal from the last termination of the container
 // +optional
 Signal int32 `json:"signal,omitempty" protobuf:"varint,2,opt,name=signal"`
 // (brief) reason from the last termination of the container
 // +optional
 Reason string `json:"reason,omitempty" protobuf:"bytes,3,opt,name=reason"`
 // Message regarding the last termination of the container
 // +optional
 Message string `json:"message,omitempty" protobuf:"bytes,4,opt,name=message"`
 // Time at which previous execution of the container started
 // +optional
 StartedAt metav1.Time `json:"startedAt,omitempty" protobuf:"bytes,5,opt,name=startedAt"`
 // Time at which the container last terminated
 // +optional
 FinishedAt metav1.Time `json:"finishedAt,omitempty" protobuf:"bytes,6,opt,name=finishedAt"`
 // Container's ID in the format 'docker://<container_id>'
 // +optional
 ContainerID string `json:"containerID,omitempty" protobuf:"bytes,7,opt,name=containerID"`
}

PodTemplateSpec

// PodTemplateSpec describes the data a pod should have when created from a template
type PodTemplateSpec struct {
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Specification of the desired behavior of the pod.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Spec PodSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

Docs: Ingress

Thu, 17 Nov 2022 15:36:12 +0800

简要概述

Ingress 是对集群中服务的外部访问进行管理的 API 对象，典型的访问方式是 HTTP。

它不会公开任意端口或协议，一般只将 HTTP 和 HTTPS 以外的服务公开到网络时，如果是其他协议服务，使用 Service.Type=NodePort 或 Service.Type=LoadBalancer 类型的 Service

这里基于 k8s-1.22 版本，数据结构代码路径：

staging/src/k8s.io/api/extensions/v1beta1/types.go
staging/src/k8s.io/api/networking/v1/types.go
staging/src/k8s.io/api/networking/v1beta1/types.go

所以该版本 Ingress 资源可使用三种 apiVersion 风格：

接口版本1

apiVersion: extensions/v1beta1
kind: Ingress

接口版本2

apiVersion: networking.k8s.io/v1beta1
kind: Ingress

接口版本3

apiVersion: networking.k8s.io/v1
kind: Ingress

配置示例

接口版本1

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
 name: demo-test-v1
spec:
 rules:
 - host: "demo-test-v1.biz-dev-uptime.a-demo-web.site"
 http:
 paths:
 - backend:
 serviceName: demo-test-v1
 servicePort: 10080
 path: /
 pathType: Prefix

接口版本2

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
 name: demo-test-v1
spec:
 rules:
 - host: "demo-test-v1.biz-dev-uptime.a-demo-web.site"
 http:
 paths:
 - backend:
 serviceName: demo-test-v1
 servicePort: 10080
 path: /
 pathType: Prefix

接口版本3

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
 name: demo-test-v1
spec:
 rules:
 - host: "demo-test-v1.biz-dev-uptime.a-demo-web.site"
 http:
 paths:
 - backend:
 service:
 name: demo-test-v1
 port:
 number: 10080
 path: /
 pathType: Prefix

接口版本 networking.k8s.io/v1beta1 相比 extensions/v1beta1 新增以下类型：IngressClassSpec、IngressClassParametersReference、IngressClassNamespacedParams、IngressClassList；而 networking.k8s.io/v1 中的 IngressBackend 类型发生了变化。

数据结构

extensions/v1beta1

// Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services
// externally-reachable urls, load balance traffic, terminate SSL, offer name
// based virtual hosting etc.
// DEPRECATED - This group version of Ingress is deprecated by networking.k8s.io/v1beta1 Ingress. See the release notes for more information.
type Ingress struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Spec is the desired state of the Ingress.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Spec IngressSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // Status is the current state of the Ingress.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Status IngressStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

// IngressSpec describes the Ingress the user wishes to exist.
type IngressSpec struct {
 // IngressClassName is the name of the IngressClass cluster resource. The
 // associated IngressClass defines which controller will implement the
 // resource. This replaces the deprecated `kubernetes.io/ingress.class`
 // annotation. For backwards compatibility, when that annotation is set, it
 // must be given precedence over this field. The controller may emit a
 // warning if the field and annotation have different values.
 // Implementations of this API should ignore Ingresses without a class
 // specified. An IngressClass resource may be marked as default, which can
 // be used to set a default value for this field. For more information,
 // refer to the IngressClass documentation.
 // +optional
 IngressClassName *string `json:"ingressClassName,omitempty" protobuf:"bytes,4,opt,name=ingressClassName"`

 // A default backend capable of servicing requests that don't match any
 // rule. At least one of 'backend' or 'rules' must be specified. This field
 // is optional to allow the loadbalancer controller or defaulting logic to
 // specify a global default.
 // +optional
 Backend *IngressBackend `json:"backend,omitempty" protobuf:"bytes,1,opt,name=backend"`

 // TLS configuration. Currently the Ingress only supports a single TLS
 // port, 443. If multiple members of this list specify different hosts, they
 // will be multiplexed on the same port according to the hostname specified
 // through the SNI TLS extension, if the ingress controller fulfilling the
 // ingress supports SNI.
 // +optional
 TLS []IngressTLS `json:"tls,omitempty" protobuf:"bytes,2,rep,name=tls"`

 // A list of host rules used to configure the Ingress. If unspecified, or
 // no rule matches, all traffic is sent to the default backend.
 // +optional
 Rules []IngressRule `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`
 // TODO: Add the ability to specify load-balancer IP through claims
}

// IngressTLS describes the transport layer security associated with an Ingress.
type IngressTLS struct {
 // Hosts are a list of hosts included in the TLS certificate. The values in
 // this list must match the name/s used in the tlsSecret. Defaults to the
 // wildcard host setting for the loadbalancer controller fulfilling this
 // Ingress, if left unspecified.
 // +optional
 Hosts []string `json:"hosts,omitempty" protobuf:"bytes,1,rep,name=hosts"`
 // SecretName is the name of the secret used to terminate SSL traffic on 443.
 // Field is left optional to allow SSL routing based on SNI hostname alone.
 // If the SNI host in a listener conflicts with the "Host" header field used
 // by an IngressRule, the SNI host is used for termination and value of the
 // Host header is used for routing.
 // +optional
 SecretName string `json:"secretName,omitempty" protobuf:"bytes,2,opt,name=secretName"`
 // TODO: Consider specifying different modes of termination, protocols etc.
}

// IngressRule represents the rules mapping the paths under a specified host to
// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
type IngressRule struct {
 // Host is the fully qualified domain name of a network host, as defined by RFC 3986.
 // Note the following deviations from the "host" part of the
 // URI as defined in RFC 3986:
 // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to
 // the IP in the Spec of the parent Ingress.
 // 2. The `:` delimiter is not respected because ports are not allowed.
 // Currently the port of an Ingress is implicitly :80 for http and
 // :443 for https.
 // Both these may change in the future.
 // Incoming requests are matched against the host before the
 // IngressRuleValue. If the host is unspecified, the Ingress routes all
 // traffic based on the specified IngressRuleValue.
 //
 // Host can be "precise" which is a domain name without the terminating dot of
 // a network host (e.g. "foo.bar.com") or "wildcard", which is a domain name
 // prefixed with a single wildcard label (e.g. "*.foo.com").
 // The wildcard character '*' must appear by itself as the first DNS label and
 // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
 // Requests will be matched against the Host field in the following way:
 // 1. If Host is precise, the request matches this rule if the http host header is equal to Host.
 // 2. If Host is a wildcard, then the request matches this rule if the http host header
 // is to equal to the suffix (removing the first label) of the wildcard rule.
 // +optional
 Host string `json:"host,omitempty" protobuf:"bytes,1,opt,name=host"`
 // IngressRuleValue represents a rule to route requests for this IngressRule.
 // If unspecified, the rule defaults to a http catch-all. Whether that sends
 // just traffic matching the host to the default backend or all traffic to the
 // default backend, is left to the controller fulfilling the Ingress. Http is
 // currently the only supported IngressRuleValue.
 // +optional
 IngressRuleValue `json:",inline,omitempty" protobuf:"bytes,2,opt,name=ingressRuleValue"`
}

// IngressRuleValue represents a rule to apply against incoming requests. If the
// rule is satisfied, the request is routed to the specified backend. Currently
// mixing different types of rules in a single Ingress is disallowed, so exactly
// one of the following must be set.
type IngressRuleValue struct {
 //TODO:
 // 1. Consider renaming this resource and the associated rules so they
 // aren't tied to Ingress. They can be used to route intra-cluster traffic.
 // 2. Consider adding fields for ingress-type specific global options
 // usable by a loadbalancer, like http keep-alive.

 // http is a list of http selectors pointing to backends.
 // A path is matched against the path of an incoming request. Currently it can
 // contain characters disallowed from the conventional "path" part of a URL
 // as defined by RFC 3986. Paths must begin with a '/'.
 // A backend defines the referenced service endpoint to which the traffic
 // will be forwarded to.
 HTTP *HTTPIngressRuleValue `json:"http,omitempty" protobuf:"bytes,1,opt,name=http"`
}

// HTTPIngressRuleValue is a list of http selectors pointing to backends.
// In the example: http://<host>/<path>?<searchpart> -> backend where
// where parts of the url correspond to RFC 3986, this resource will be used
// to match against everything after the last '/' and before the first '?'
// or '#'.
type HTTPIngressRuleValue struct {
 // A collection of paths that map requests to backends.
 Paths []HTTPIngressPath `json:"paths" protobuf:"bytes,1,rep,name=paths"`
 // TODO: Consider adding fields for ingress-type specific global
 // options usable by a loadbalancer, like http keep-alive.
}

// PathType represents the type of path referred to by a HTTPIngressPath.
type PathType string

const (
 // PathTypeExact matches the URL path exactly and with case sensitivity.
 PathTypeExact = PathType("Exact")

 // PathTypePrefix matches based on a URL path prefix split by '/'. Matching
 // is case sensitive and done on a path element by element basis. A path
 // element refers to the list of labels in the path split by the '/'
 // separator. A request is a match for path p if every p is an element-wise
 // prefix of p of the request path. Note that if the last element of the
 // path is a substring of the last element in request path, it is not a
 // match (e.g. /foo/bar matches /foo/bar/baz, but does not match
 // /foo/barbaz). If multiple matching paths exist in an Ingress spec, the
 // longest matching path is given priority.
 // Examples:
 // - /foo/bar does not match requests to /foo/barbaz
 // - /foo/bar matches request to /foo/bar and /foo/bar/baz
 // - /foo and /foo/ both match requests to /foo and /foo/. If both paths are
 // present in an Ingress spec, the longest matching path (/foo/) is given
 // priority.
 PathTypePrefix = PathType("Prefix")

 // PathTypeImplementationSpecific matching is up to the IngressClass.
 // Implementations can treat this as a separate PathType or treat it
 // identically to Prefix or Exact path types.
 PathTypeImplementationSpecific = PathType("ImplementationSpecific")
)

// HTTPIngressPath associates a path with a backend. Incoming urls matching the
// path are forwarded to the backend.
type HTTPIngressPath struct {
 // Path is matched against the path of an incoming request. Currently it can
 // contain characters disallowed from the conventional "path" part of a URL
 // as defined by RFC 3986. Paths must begin with a '/'. When unspecified,
 // all paths from incoming requests are matched.
 // +optional
 Path string `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"`

 // PathType determines the interpretation of the Path matching. PathType can
 // be one of the following values:
 // * Exact: Matches the URL path exactly.
 // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
 // done on a path element by element basis. A path element refers is the
 // list of labels in the path split by the '/' separator. A request is a
 // match for path p if every p is an element-wise prefix of p of the
 // request path. Note that if the last element of the path is a substring
 // of the last element in request path, it is not a match (e.g. /foo/bar
 // matches /foo/bar/baz, but does not match /foo/barbaz).
 // * ImplementationSpecific: Interpretation of the Path matching is up to
 // the IngressClass. Implementations can treat this as a separate PathType
 // or treat it identically to Prefix or Exact path types.
 // Implementations are required to support all path types.
 // Defaults to ImplementationSpecific.
 PathType *PathType `json:"pathType,omitempty" protobuf:"bytes,3,opt,name=pathType"`

 // Backend defines the referenced service endpoint to which the traffic
 // will be forwarded to.
 Backend IngressBackend `json:"backend" protobuf:"bytes,2,opt,name=backend"`
}

// IngressStatus describe the current state of the Ingress.
type IngressStatus struct {
 // LoadBalancer contains the current status of the load-balancer.
 // +optional
 LoadBalancer v1.LoadBalancerStatus `json:"loadBalancer,omitempty" protobuf:"bytes,1,opt,name=loadBalancer"`
}

// IngressBackend describes all endpoints for a given service and port.
type IngressBackend struct {
 // Specifies the name of the referenced service.
 // +optional
 ServiceName string `json:"serviceName,omitempty" protobuf:"bytes,1,opt,name=serviceName"`

 // Specifies the port of the referenced service.
 // +optional
 ServicePort intstr.IntOrString `json:"servicePort,omitempty" protobuf:"bytes,2,opt,name=servicePort"`

 // Resource is an ObjectRef to another Kubernetes resource in the namespace
 // of the Ingress object. If resource is specified, serviceName and servicePort
 // must not be specified.
 // +optional
 Resource *v1.TypedLocalObjectReference `json:"resource,omitempty" protobuf:"bytes,3,opt,name=resource"`
}

networking.k8s.io/v1beta1

相比 extensions/v1beta1 新增以下类型

// IngressClass represents the class of the Ingress, referenced by the Ingress
// Spec. The `ingressclass.kubernetes.io/is-default-class` annotation can be
// used to indicate that an IngressClass should be considered default. When a
// single IngressClass resource has this annotation set to true, new Ingress
// resources without a class specified will be assigned this default class.
type IngressClass struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Spec is the desired state of the IngressClass.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Spec IngressClassSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

// IngressClassSpec provides information about the class of an Ingress.
type IngressClassSpec struct {
 // Controller refers to the name of the controller that should handle this
 // class. This allows for different "flavors" that are controlled by the
 // same controller. For example, you may have different Parameters for the
 // same implementing controller. This should be specified as a
 // domain-prefixed path no more than 250 characters in length, e.g.
 // "acme.io/ingress-controller". This field is immutable.
 Controller string `json:"controller,omitempty" protobuf:"bytes,1,opt,name=controller"`

 // Parameters is a link to a custom resource containing additional
 // configuration for the controller. This is optional if the controller does
 // not require extra parameters.
 // +optional
 Parameters *IngressClassParametersReference `json:"parameters,omitempty" protobuf:"bytes,2,opt,name=parameters"`
}

const (
 // IngressClassParametersReferenceScopeNamespace indicates that the
 // referenced Parameters resource is namespace-scoped.
 IngressClassParametersReferenceScopeNamespace = "Namespace"
 // IngressClassParametersReferenceScopeNamespace indicates that the
 // referenced Parameters resource is cluster-scoped.
 IngressClassParametersReferenceScopeCluster = "Cluster"
)

// IngressClassParametersReference identifies an API object. This can be used
// to specify a cluster or namespace-scoped resource.
type IngressClassParametersReference struct {
 // APIGroup is the group for the resource being referenced. If APIGroup is
 // not specified, the specified Kind must be in the core API group. For any
 // other third-party types, APIGroup is required.
 // +optional
 APIGroup *string `json:"apiGroup,omitempty" protobuf:"bytes,1,opt,name=aPIGroup"`
 // Kind is the type of resource being referenced.
 Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
 // Name is the name of resource being referenced.
 Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
 // Scope represents if this refers to a cluster or namespace scoped resource.
 // This may be set to "Cluster" (default) or "Namespace".
 // Field can be enabled with IngressClassNamespacedParams feature gate.
 // +optional
 // +featureGate=IngressClassNamespacedParams
 Scope *string `json:"scope" protobuf:"bytes,4,opt,name=scope"`
 // Namespace is the namespace of the resource being referenced. This field is
 // required when scope is set to "Namespace" and must be unset when scope is set to
 // "Cluster".
 // +optional
 // +featureGate=IngressClassNamespacedParams
 Namespace *string `json:"namespace,omitempty" protobuf:"bytes,5,opt,name=namespace"`
}

// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
// +k8s:prerelease-lifecycle-gen:introduced=1.18
// +k8s:prerelease-lifecycle-gen:deprecated=1.19
// +k8s:prerelease-lifecycle-gen:replacement=networking.k8s.io,v1,IngressClassList

// IngressClassList is a collection of IngressClasses.
type IngressClassList struct {
 metav1.TypeMeta `json:",inline"`
 // Standard list metadata.
 // +optional
 metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Items is the list of IngressClasses.
 Items []IngressClass `json:"items" protobuf:"bytes,2,rep,name=items"`
}

networking.k8s.io/v1

数据结构相比 networking.k8s.io/v1beta1 接口版本没有变化，但是其中 IngressBackend 类型与 extensions/v1beta1、networking.k8s.io/v1beta1 接口版本做了变更。

// IngressBackend describes all endpoints for a given service and port.
type IngressBackend struct {
 // Service references a Service as a Backend.
 // This is a mutually exclusive setting with "Resource".
 // +optional
 Service *IngressServiceBackend `json:"service,omitempty" protobuf:"bytes,4,opt,name=service"`

 // Resource is an ObjectRef to another Kubernetes resource in the namespace
 // of the Ingress object. If resource is specified, a service.Name and
 // service.Port must not be specified.
 // This is a mutually exclusive setting with "Service".
 // +optional
 Resource *v1.TypedLocalObjectReference `json:"resource,omitempty" protobuf:"bytes,3,opt,name=resource"`
}

// IngressServiceBackend references a Kubernetes Service as a Backend.
type IngressServiceBackend struct {
 // Name is the referenced service. The service must exist in
 // the same namespace as the Ingress object.
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`

 // Port of the referenced service. A port name or port number
 // is required for a IngressServiceBackend.
 Port ServiceBackendPort `json:"port,omitempty" protobuf:"bytes,2,opt,name=port"`
}

// ServiceBackendPort is the service port being referenced.
type ServiceBackendPort struct {
 // Name is the name of the port on the Service.
 // This is a mutually exclusive setting with "Number".
 // +optional
 Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`

 // Number is the numerical port number (e.g. 80) on the Service.
 // This is a mutually exclusive setting with "Name".
 // +optional
 Number int32 `json:"number,omitempty" protobuf:"bytes,2,opt,name=number"`
}

Docs: Pod Volume

Mon, 08 May 2023 16:56:42 +0800

简要概述

TODO;

关键站点：

https://kubernetes-csi.github.io/docs/

数据结构

Volume

// Volume represents a named volume in a pod that may be accessed by any container in the pod.
type Volume struct {
 // Volume's name.
 // Must be a DNS_LABEL and unique within the pod.
 // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 // VolumeSource represents the location and type of the mounted volume.
 // If not specified, the Volume is implied to be an EmptyDir.
 // This implied behavior is deprecated and will be removed in a future version.
 VolumeSource `json:",inline" protobuf:"bytes,2,opt,name=volumeSource"`
}

VolumeSource

// Represents the source of a volume to mount.
// Only one of its members may be specified.
type VolumeSource struct {
 // HostPath represents a pre-existing file or directory on the host
 // machine that is directly exposed to the container. This is generally
 // used for system agents or other privileged things that are allowed
 // to see the host machine. Most containers will NOT need this.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
 // ---
 // TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not
 // mount host directories as read/write.
 // +optional
 HostPath *HostPathVolumeSource `json:"hostPath,omitempty" protobuf:"bytes,1,opt,name=hostPath"`

 // EmptyDir represents a temporary directory that shares a pod's lifetime.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
 // +optional
 EmptyDir *EmptyDirVolumeSource `json:"emptyDir,omitempty" protobuf:"bytes,2,opt,name=emptyDir"`

 // Secret represents a secret that should populate this volume.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
 // +optional
 Secret *SecretVolumeSource `json:"secret,omitempty" protobuf:"bytes,6,opt,name=secret"`

 // NFS represents an NFS mount on the host that shares a pod's lifetime
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
 // +optional
 NFS *NFSVolumeSource `json:"nfs,omitempty" protobuf:"bytes,7,opt,name=nfs"`

 // ISCSI represents an ISCSI Disk resource that is attached to a
 // kubelet's host machine and then exposed to the pod.
 // More info: https://examples.k8s.io/volumes/iscsi/README.md
 // +optional
 ISCSI *ISCSIVolumeSource `json:"iscsi,omitempty" protobuf:"bytes,8,opt,name=iscsi"`

 // PersistentVolumeClaimVolumeSource represents a reference to a
 // PersistentVolumeClaim in the same namespace.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
 // +optional
 PersistentVolumeClaim *PersistentVolumeClaimVolumeSource `json:"persistentVolumeClaim,omitempty" protobuf:"bytes,10,opt,name=persistentVolumeClaim"`

 // DownwardAPI represents downward API about the pod that should populate this volume
 // +optional
 DownwardAPI *DownwardAPIVolumeSource `json:"downwardAPI,omitempty" protobuf:"bytes,16,opt,name=downwardAPI"`

 // FC represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.
 // +optional
 FC *FCVolumeSource `json:"fc,omitempty" protobuf:"bytes,17,opt,name=fc"`

 // ConfigMap represents a configMap that should populate this volume
 // +optional
 ConfigMap *ConfigMapVolumeSource `json:"configMap,omitempty" protobuf:"bytes,19,opt,name=configMap"`

 // Items for all in one resources secrets, configmaps, and downward API
 Projected *ProjectedVolumeSource `json:"projected,omitempty" protobuf:"bytes,26,opt,name=projected"`

 // Local represents directly-attached storage with node affinity
 // +optional
 Local *LocalVolumeSource `json:"local,omitempty" protobuf:"bytes,20,opt,name=local"`

 // CSI (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers (Beta feature).
 // +optional
 CSI *CSIVolumeSource `json:"csi,omitempty" protobuf:"bytes,28,opt,name=csi"`

 // Ephemeral represents a volume that is handled by a cluster storage driver.
 // The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts,
 // and deleted when the pod is removed.
 //
 // Use this if:
 // a) the volume is only needed while the pod runs,
 // b) features of normal volumes like restoring from snapshot or capacity
 // tracking are needed,
 // c) the storage driver is specified through a storage class, and
 // d) the storage driver supports dynamic volume provisioning through
 // a PersistentVolumeClaim (see EphemeralVolumeSource for more
 // information on the connection between this volume type
 // and PersistentVolumeClaim).
 //
 // Use PersistentVolumeClaim or one of the vendor-specific
 // APIs for volumes that persist for longer than the lifecycle
 // of an individual pod.
 //
 // Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to
 // be used that way - see the documentation of the driver for
 // more information.
 //
 // A pod can use both types of ephemeral volumes and
 // persistent volumes at the same time.
 //
 // This is a beta feature and only available when the GenericEphemeralVolume
 // feature gate is enabled.
 //
 // +optional
 Ephemeral *EphemeralVolumeSource `json:"ephemeral,omitempty" protobuf:"bytes,29,opt,name=ephemeral"`

 // 以下类型建议使用对应的 csi 插件实现
 GCEPersistentDisk *GCEPersistentDiskVolumeSource `json:"gcePersistentDisk,omitempty" protobuf:"bytes,3,opt,name=gcePersistentDisk"`
 AWSElasticBlockStore *AWSElasticBlockStoreVolumeSource `json:"awsElasticBlockStore,omitempty" protobuf:"bytes,4,opt,name=awsElasticBlockStore"`
 GitRepo *GitRepoVolumeSource `json:"gitRepo,omitempty" protobuf:"bytes,5,opt,name=gitRepo"`
 Glusterfs *GlusterfsVolumeSource `json:"glusterfs,omitempty" protobuf:"bytes,9,opt,name=glusterfs"`
 RBD *RBDVolumeSource `json:"rbd,omitempty" protobuf:"bytes,11,opt,name=rbd"`
 Cinder *CinderVolumeSource `json:"cinder,omitempty" protobuf:"bytes,13,opt,name=cinder"`
 CephFS *CephFSVolumeSource `json:"cephfs,omitempty" protobuf:"bytes,14,opt,name=cephfs"`
 AzureFile *AzureFileVolumeSource `json:"azureFile,omitempty" protobuf:"bytes,18,opt,name=azureFile"`
 VsphereVolume *VsphereVirtualDiskVolumeSource `json:"vsphereVolume,omitempty" protobuf:"bytes,20,opt,name=vsphereVolume"`
 AzureDisk *AzureDiskVolumeSource `json:"azureDisk,omitempty" protobuf:"bytes,22,opt,name=azureDisk"`
 PortworxVolume *PortworxVolumeSource `json:"portworxVolume,omitempty" protobuf:"bytes,24,opt,name=portworxVolume"`
 Quobyte *QuobyteVolumeSource `json:"quobyte,omitempty" protobuf:"bytes,21,opt,name=quobyte"`
 ScaleIO *ScaleIOVolumeSource `json:"scaleIO,omitempty" protobuf:"bytes,25,opt,name=scaleIO"`
 StorageOS *StorageOSVolumeSource `json:"storageos,omitempty" protobuf:"bytes,27,opt,name=storageos"`
 PhotonPersistentDisk *PhotonPersistentDiskVolumeSource `json:"photonPersistentDisk,omitempty" protobuf:"bytes,23,opt,name=photonPersistentDisk"`

 // 旧版外部存储插件，建议使用 csi 插件实现
 FlexVolume *FlexVolumeSource `json:"flexVolume,omitempty" protobuf:"bytes,12,opt,name=flexVolume"`

 // 已终止的开源项目
 // https://github.com/ClusterHQ/flocker/issues/3017
 Flocker *FlockerVolumeSource `json:"flocker,omitempty" protobuf:"bytes,15,opt,name=flocker"`
}

常见存储卷

HostPathVolumeSource

// Represents a host path mapped into a pod.
// Host path volumes do not support ownership management or SELinux relabeling.
type HostPathVolumeSource struct {
 // Path of the directory on the host.
 // If the path is a symlink, it will follow the link to the real path.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
 Path string `json:"path" protobuf:"bytes,1,opt,name=path"`
 // Type for HostPath Volume
 // Defaults to ""
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
 // +optional
 Type *HostPathType `json:"type,omitempty" protobuf:"bytes,2,opt,name=type"`
}

EmptyDirVolumeSource

// Represents an empty directory for a pod.
// Empty directory volumes support ownership management and SELinux relabeling.
type EmptyDirVolumeSource struct {
 // What type of storage medium should back this directory.
 // The default is "" which means to use the node's default medium.
 // Must be an empty string (default) or Memory.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
 // +optional
 Medium StorageMedium `json:"medium,omitempty" protobuf:"bytes,1,opt,name=medium,casttype=StorageMedium"`
 // Total amount of local storage required for this EmptyDir volume.
 // The size limit is also applicable for memory medium.
 // The maximum usage on memory medium EmptyDir would be the minimum value between
 // the SizeLimit specified here and the sum of memory limits of all containers in a pod.
 // The default is nil which means that the limit is undefined.
 // More info: http://kubernetes.io/docs/user-guide/volumes#emptydir
 // +optional
 SizeLimit *resource.Quantity `json:"sizeLimit,omitempty" protobuf:"bytes,2,opt,name=sizeLimit"`
}

SecretVolumeSource

// Adapts a Secret into a volume.
//
// The contents of the target Secret's Data field will be presented in a volume
// as files using the keys in the Data field as the file names.
// Secret volumes support ownership management and SELinux relabeling.
type SecretVolumeSource struct {
 // Name of the secret in the pod's namespace to use.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
 // +optional
 SecretName string `json:"secretName,omitempty" protobuf:"bytes,1,opt,name=secretName"`
 // If unspecified, each key-value pair in the Data field of the referenced
 // Secret will be projected into the volume as a file whose name is the
 // key and content is the value. If specified, the listed keys will be
 // projected into the specified paths, and unlisted keys will not be
 // present. If a key is specified which is not present in the Secret,
 // the volume setup will error unless it is marked optional. Paths must be
 // relative and may not contain the '..' path or start with '..'.
 // +optional
 Items []KeyToPath `json:"items,omitempty" protobuf:"bytes,2,rep,name=items"`
 // Optional: mode bits used to set permissions on created files by default.
 // Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
 // YAML accepts both octal and decimal values, JSON requires decimal values
 // for mode bits. Defaults to 0644.
 // Directories within the path are not affected by this setting.
 // This might be in conflict with other options that affect the file
 // mode, like fsGroup, and the result can be other mode bits set.
 // +optional
 DefaultMode *int32 `json:"defaultMode,omitempty" protobuf:"bytes,3,opt,name=defaultMode"`
 // Specify whether the Secret or its keys must be defined
 // +optional
 Optional *bool `json:"optional,omitempty" protobuf:"varint,4,opt,name=optional"`
}

NFSVolumeSource

// Represents an NFS mount that lasts the lifetime of a pod.
// NFS volumes do not support ownership management or SELinux relabeling.
type NFSVolumeSource struct {
 // Server is the hostname or IP address of the NFS server.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
 Server string `json:"server" protobuf:"bytes,1,opt,name=server"`

 // Path that is exported by the NFS server.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
 Path string `json:"path" protobuf:"bytes,2,opt,name=path"`

 // ReadOnly here will force
 // the NFS export to be mounted with read-only permissions.
 // Defaults to false.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
 // +optional
 ReadOnly bool `json:"readOnly,omitempty" protobuf:"varint,3,opt,name=readOnly"`
}

ISCSIVolumeSource

// Represents an ISCSI disk.
// ISCSI volumes can only be mounted as read/write once.
// ISCSI volumes support ownership management and SELinux relabeling.
type ISCSIVolumeSource struct {
 // iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port
 // is other than default (typically TCP ports 860 and 3260).
 TargetPortal string `json:"targetPortal" protobuf:"bytes,1,opt,name=targetPortal"`
 // Target iSCSI Qualified Name.
 IQN string `json:"iqn" protobuf:"bytes,2,opt,name=iqn"`
 // iSCSI Target Lun number.
 Lun int32 `json:"lun" protobuf:"varint,3,opt,name=lun"`
 // iSCSI Interface Name that uses an iSCSI transport.
 // Defaults to 'default' (tcp).
 // +optional
 ISCSIInterface string `json:"iscsiInterface,omitempty" protobuf:"bytes,4,opt,name=iscsiInterface"`
 // Filesystem type of the volume that you want to mount.
 // Tip: Ensure that the filesystem type is supported by the host operating system.
 // Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
 // More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi
 // TODO: how do we prevent errors in the filesystem from compromising the machine
 // +optional
 FSType string `json:"fsType,omitempty" protobuf:"bytes,5,opt,name=fsType"`
 // ReadOnly here will force the ReadOnly setting in VolumeMounts.
 // Defaults to false.
 // +optional
 ReadOnly bool `json:"readOnly,omitempty" protobuf:"varint,6,opt,name=readOnly"`
 // iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port
 // is other than default (typically TCP ports 860 and 3260).
 // +optional
 Portals []string `json:"portals,omitempty" protobuf:"bytes,7,opt,name=portals"`
 // whether support iSCSI Discovery CHAP authentication
 // +optional
 DiscoveryCHAPAuth bool `json:"chapAuthDiscovery,omitempty" protobuf:"varint,8,opt,name=chapAuthDiscovery"`
 // whether support iSCSI Session CHAP authentication
 // +optional
 SessionCHAPAuth bool `json:"chapAuthSession,omitempty" protobuf:"varint,11,opt,name=chapAuthSession"`
 // CHAP Secret for iSCSI target and initiator authentication
 // +optional
 SecretRef *LocalObjectReference `json:"secretRef,omitempty" protobuf:"bytes,10,opt,name=secretRef"`
 // Custom iSCSI Initiator Name.
 // If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface
 // <target portal>:<volume name> will be created for the connection.
 // +optional
 InitiatorName *string `json:"initiatorName,omitempty" protobuf:"bytes,12,opt,name=initiatorName"`
}

PersistentVolumeClaimVolumeSource

// PersistentVolumeClaimVolumeSource references the user's PVC in the same namespace.
// This volume finds the bound PV and mounts that volume for the pod. A
// PersistentVolumeClaimVolumeSource is, essentially, a wrapper around another
// type of volume that is owned by someone else (the system).
type PersistentVolumeClaimVolumeSource struct {
 // ClaimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
 ClaimName string `json:"claimName" protobuf:"bytes,1,opt,name=claimName"`
 // Will force the ReadOnly setting in VolumeMounts.
 // Default false.
 // +optional
 ReadOnly bool `json:"readOnly,omitempty" protobuf:"varint,2,opt,name=readOnly"`
}

DownwardAPIVolumeSource

// DownwardAPIVolumeSource represents a volume containing downward API info.
// Downward API volumes support ownership management and SELinux relabeling.
type DownwardAPIVolumeSource struct {
 // Items is a list of downward API volume file
 // +optional
 Items []DownwardAPIVolumeFile `json:"items,omitempty" protobuf:"bytes,1,rep,name=items"`
 // Optional: mode bits to use on created files by default. Must be a
 // Optional: mode bits used to set permissions on created files by default.
 // Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
 // YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
 // Defaults to 0644.
 // Directories within the path are not affected by this setting.
 // This might be in conflict with other options that affect the file
 // mode, like fsGroup, and the result can be other mode bits set.
 // +optional
 DefaultMode *int32 `json:"defaultMode,omitempty" protobuf:"varint,2,opt,name=defaultMode"`
}

FCVolumeSource

// Represents a Fibre Channel volume.
// Fibre Channel volumes can only be mounted as read/write once.
// Fibre Channel volumes support ownership management and SELinux relabeling.
type FCVolumeSource struct {
 // Optional: FC target worldwide names (WWNs)
 // +optional
 TargetWWNs []string `json:"targetWWNs,omitempty" protobuf:"bytes,1,rep,name=targetWWNs"`
 // Optional: FC target lun number
 // +optional
 Lun *int32 `json:"lun,omitempty" protobuf:"varint,2,opt,name=lun"`
 // Filesystem type to mount.
 // Must be a filesystem type supported by the host operating system.
 // Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
 // TODO: how do we prevent errors in the filesystem from compromising the machine
 // +optional
 FSType string `json:"fsType,omitempty" protobuf:"bytes,3,opt,name=fsType"`
 // Optional: Defaults to false (read/write). ReadOnly here will force
 // the ReadOnly setting in VolumeMounts.
 // +optional
 ReadOnly bool `json:"readOnly,omitempty" protobuf:"varint,4,opt,name=readOnly"`
 // Optional: FC volume world wide identifiers (wwids)
 // Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously.
 // +optional
 WWIDs []string `json:"wwids,omitempty" protobuf:"bytes,5,rep,name=wwids"`
}

ConfigMapVolumeSource

// Adapts a ConfigMap into a volume.
//
// The contents of the target ConfigMap's Data field will be presented in a
// volume as files using the keys in the Data field as the file names, unless
// the items element is populated with specific mappings of keys to paths.
// ConfigMap volumes support ownership management and SELinux relabeling.
type ConfigMapVolumeSource struct {
 LocalObjectReference `json:",inline" protobuf:"bytes,1,opt,name=localObjectReference"`
 // If unspecified, each key-value pair in the Data field of the referenced
 // ConfigMap will be projected into the volume as a file whose name is the
 // key and content is the value. If specified, the listed keys will be
 // projected into the specified paths, and unlisted keys will not be
 // present. If a key is specified which is not present in the ConfigMap,
 // the volume setup will error unless it is marked optional. Paths must be
 // relative and may not contain the '..' path or start with '..'.
 // +optional
 Items []KeyToPath `json:"items,omitempty" protobuf:"bytes,2,rep,name=items"`
 // Optional: mode bits used to set permissions on created files by default.
 // Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
 // YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
 // Defaults to 0644.
 // Directories within the path are not affected by this setting.
 // This might be in conflict with other options that affect the file
 // mode, like fsGroup, and the result can be other mode bits set.
 // +optional
 DefaultMode *int32 `json:"defaultMode,omitempty" protobuf:"varint,3,opt,name=defaultMode"`
 // Specify whether the ConfigMap or its keys must be defined
 // +optional
 Optional *bool `json:"optional,omitempty" protobuf:"varint,4,opt,name=optional"`
}

ProjectedVolumeSource

// Represents a projected volume source
type ProjectedVolumeSource struct {
 // list of volume projections
 // +optional
 Sources []VolumeProjection `json:"sources" protobuf:"bytes,1,rep,name=sources"`
 // Mode bits used to set permissions on created files by default.
 // Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
 // YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
 // Directories within the path are not affected by this setting.
 // This might be in conflict with other options that affect the file
 // mode, like fsGroup, and the result can be other mode bits set.
 // +optional
 DefaultMode *int32 `json:"defaultMode,omitempty" protobuf:"varint,2,opt,name=defaultMode"`
}

LocalVolumeSource

// Local represents directly-attached storage with node affinity (Beta feature)
type LocalVolumeSource struct {
 // The full path to the volume on the node.
 // It can be either a directory or block device (disk, partition, ...).
 Path string `json:"path" protobuf:"bytes,1,opt,name=path"`

 // Filesystem type to mount.
 // It applies only when the Path is a block device.
 // Must be a filesystem type supported by the host operating system.
 // Ex. "ext4", "xfs", "ntfs". The default value is to auto-select a fileystem if unspecified.
 // +optional
 FSType *string `json:"fsType,omitempty" protobuf:"bytes,2,opt,name=fsType"`
}

CSIVolumeSource

// Represents a source location of a volume to mount, managed by an external CSI driver
type CSIVolumeSource struct {
 // Driver is the name of the CSI driver that handles this volume.
 // Consult with your admin for the correct name as registered in the cluster.
 Driver string `json:"driver" protobuf:"bytes,1,opt,name=driver"`

 // Specifies a read-only configuration for the volume.
 // Defaults to false (read/write).
 // +optional
 ReadOnly *bool `json:"readOnly,omitempty" protobuf:"varint,2,opt,name=readOnly"`

 // Filesystem type to mount. Ex. "ext4", "xfs", "ntfs".
 // If not provided, the empty value is passed to the associated CSI driver
 // which will determine the default filesystem to apply.
 // +optional
 FSType *string `json:"fsType,omitempty" protobuf:"bytes,3,opt,name=fsType"`

 // VolumeAttributes stores driver-specific properties that are passed to the CSI
 // driver. Consult your driver's documentation for supported values.
 // +optional
 VolumeAttributes map[string]string `json:"volumeAttributes,omitempty" protobuf:"bytes,4,rep,name=volumeAttributes"`

 // NodePublishSecretRef is a reference to the secret object containing
 // sensitive information to pass to the CSI driver to complete the CSI
 // NodePublishVolume and NodeUnpublishVolume calls.
 // This field is optional, and may be empty if no secret is required. If the
 // secret object contains more than one secret, all secret references are passed.
 // +optional
 NodePublishSecretRef *LocalObjectReference `json:"nodePublishSecretRef,omitempty" protobuf:"bytes,5,opt,name=nodePublishSecretRef"`
}

EphemeralVolumeSource

// Represents an ephemeral volume that is handled by a normal storage driver.
type EphemeralVolumeSource struct {
 // Will be used to create a stand-alone PVC to provision the volume.
 // The pod in which this EphemeralVolumeSource is embedded will be the
 // owner of the PVC, i.e. the PVC will be deleted together with the
 // pod. The name of the PVC will be `<pod name>-<volume name>` where
 // `<volume name>` is the name from the `PodSpec.Volumes` array
 // entry. Pod validation will reject the pod if the concatenated name
 // is not valid for a PVC (for example, too long).
 //
 // An existing PVC with that name that is not owned by the pod
 // will *not* be used for the pod to avoid using an unrelated
 // volume by mistake. Starting the pod is then blocked until
 // the unrelated PVC is removed. If such a pre-created PVC is
 // meant to be used by the pod, the PVC has to updated with an
 // owner reference to the pod once the pod exists. Normally
 // this should not be necessary, but it may be useful when
 // manually reconstructing a broken cluster.
 //
 // This field is read-only and no changes will be made by Kubernetes
 // to the PVC after it has been created.
 //
 // Required, must not be nil.
 VolumeClaimTemplate *PersistentVolumeClaimTemplate `json:"volumeClaimTemplate,omitempty" protobuf:"bytes,1,opt,name=volumeClaimTemplate"`

 // ReadOnly is tombstoned to show why 2 is a reserved protobuf tag.
 // ReadOnly bool `json:"readOnly,omitempty" protobuf:"varint,2,opt,name=readOnly"`
}

存储卷属性

HostPathType

type HostPathType string

const (
 // For backwards compatible, leave it empty if unset
 HostPathUnset HostPathType = ""
 // If nothing exists at the given path, an empty directory will be created there
 // as needed with file mode 0755, having the same group and ownership with Kubelet.
 HostPathDirectoryOrCreate HostPathType = "DirectoryOrCreate"
 // A directory must exist at the given path
 HostPathDirectory HostPathType = "Directory"
 // If nothing exists at the given path, an empty file will be created there
 // as needed with file mode 0644, having the same group and ownership with Kubelet.
 HostPathFileOrCreate HostPathType = "FileOrCreate"
 // A file must exist at the given path
 HostPathFile HostPathType = "File"
 // A UNIX socket must exist at the given path
 HostPathSocket HostPathType = "Socket"
 // A character device must exist at the given path
 HostPathCharDev HostPathType = "CharDevice"
 // A block device must exist at the given path
 HostPathBlockDev HostPathType = "BlockDevice"
)

StorageMedium

// StorageMedium defines ways that storage can be allocated to a volume.
type StorageMedium string

const (
 StorageMediumDefault StorageMedium = "" // use whatever the default is for the node, assume anything we don't explicitly handle is this
 StorageMediumMemory StorageMedium = "Memory" // use memory (e.g. tmpfs on linux)
 StorageMediumHugePages StorageMedium = "HugePages" // use hugepages
 StorageMediumHugePagesPrefix StorageMedium = "HugePages-" // prefix for full medium notation HugePages-<size>
)

resource.Quantity

TODO;

PersistentVolumeClaimTemplate

// PersistentVolumeClaimTemplate is used to produce
// PersistentVolumeClaim objects as part of an EphemeralVolumeSource.
type PersistentVolumeClaimTemplate struct {
 // May contain labels and annotations that will be copied into the PVC
 // when creating it. No other fields are allowed and will be rejected during
 // validation.
 //
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // The specification for the PersistentVolumeClaim. The entire content is
 // copied unchanged into the PVC that gets created from this
 // template. The same fields as in a PersistentVolumeClaim
 // are also valid here.
 Spec PersistentVolumeClaimSpec `json:"spec" protobuf:"bytes,2,name=spec"`
}

PersistentVolumeClaimSpec

// PersistentVolumeClaimSpec describes the common attributes of storage devices
// and allows a Source for provider-specific attributes
type PersistentVolumeClaimSpec struct {
 // AccessModes contains the desired access modes the volume should have.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
 // +optional
 AccessModes []PersistentVolumeAccessMode `json:"accessModes,omitempty" protobuf:"bytes,1,rep,name=accessModes,casttype=PersistentVolumeAccessMode"`
 // A label query over volumes to consider for binding.
 // +optional
 Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,4,opt,name=selector"`
 // Resources represents the minimum resources the volume should have.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
 // +optional
 Resources ResourceRequirements `json:"resources,omitempty" protobuf:"bytes,2,opt,name=resources"`
 // VolumeName is the binding reference to the PersistentVolume backing this claim.
 // +optional
 VolumeName string `json:"volumeName,omitempty" protobuf:"bytes,3,opt,name=volumeName"`
 // Name of the StorageClass required by the claim.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
 // +optional
 StorageClassName *string `json:"storageClassName,omitempty" protobuf:"bytes,5,opt,name=storageClassName"`
 // volumeMode defines what type of volume is required by the claim.
 // Value of Filesystem is implied when not included in claim spec.
 // +optional
 VolumeMode *PersistentVolumeMode `json:"volumeMode,omitempty" protobuf:"bytes,6,opt,name=volumeMode,casttype=PersistentVolumeMode"`
 // This field can be used to specify either:
 // * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
 // * An existing PVC (PersistentVolumeClaim)
 // If the provisioner or an external controller can support the specified data source,
 // it will create a new volume based on the contents of the specified data source.
 // If the AnyVolumeDataSource feature gate is enabled, this field will always have
 // the same contents as the DataSourceRef field.
 // +optional
 DataSource *TypedLocalObjectReference `json:"dataSource,omitempty" protobuf:"bytes,7,opt,name=dataSource"`
 // Specifies the object from which to populate the volume with data, if a non-empty
 // volume is desired. This may be any local object from a non-empty API group (non
 // core object) or a PersistentVolumeClaim object.
 // When this field is specified, volume binding will only succeed if the type of
 // the specified object matches some installed volume populator or dynamic
 // provisioner.
 // This field will replace the functionality of the DataSource field and as such
 // if both fields are non-empty, they must have the same value. For backwards
 // compatibility, both fields (DataSource and DataSourceRef) will be set to the same
 // value automatically if one of them is empty and the other is non-empty.
 // There are two important differences between DataSource and DataSourceRef:
 // * While DataSource only allows two specific types of objects, DataSourceRef
 // allows any non-core object, as well as PersistentVolumeClaim objects.
 // * While DataSource ignores disallowed values (dropping them), DataSourceRef
 // preserves all values, and generates an error if a disallowed value is
 // specified.
 // (Alpha) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
 // +optional
 DataSourceRef *TypedLocalObjectReference `json:"dataSourceRef,omitempty" protobuf:"bytes,8,opt,name=dataSourceRef"`
}

Docs: Pod Container

Mon, 08 May 2023 16:56:48 +0800

简要概述

TODO;

数据结构

Container

// A single application container that you want to run within a pod.
type Container struct {
 // Name of the container specified as a DNS_LABEL.
 // Each container in a pod must have a unique name (DNS_LABEL).
 // Cannot be updated.
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 // Docker image name.
 // More info: https://kubernetes.io/docs/concepts/containers/images
 // This field is optional to allow higher level config management to default or override
 // container images in workload controllers like Deployments and StatefulSets.
 // +optional
 Image string `json:"image,omitempty" protobuf:"bytes,2,opt,name=image"`
 // Entrypoint array. Not executed within a shell.
 // The docker image's ENTRYPOINT is used if this is not provided.
 // Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
 // cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
 // to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
 // produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
 // of whether the variable exists or not. Cannot be updated.
 // More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
 // +optional
 Command []string `json:"command,omitempty" protobuf:"bytes,3,rep,name=command"`
 // Arguments to the entrypoint.
 // The docker image's CMD is used if this is not provided.
 // Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
 // cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
 // to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
 // produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
 // of whether the variable exists or not. Cannot be updated.
 // More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
 // +optional
 Args []string `json:"args,omitempty" protobuf:"bytes,4,rep,name=args"`
 // Container's working directory.
 // If not specified, the container runtime's default will be used, which
 // might be configured in the container image.
 // Cannot be updated.
 // +optional
 WorkingDir string `json:"workingDir,omitempty" protobuf:"bytes,5,opt,name=workingDir"`
 // List of ports to expose from the container. Exposing a port here gives
 // the system additional information about the network connections a
 // container uses, but is primarily informational. Not specifying a port here
 // DOES NOT prevent that port from being exposed. Any port which is
 // listening on the default "0.0.0.0" address inside a container will be
 // accessible from the network.
 // Cannot be updated.
 // +optional
 // +patchMergeKey=containerPort
 // +patchStrategy=merge
 // +listType=map
 // +listMapKey=containerPort
 // +listMapKey=protocol
 Ports []ContainerPort `json:"ports,omitempty" patchStrategy:"merge" patchMergeKey:"containerPort" protobuf:"bytes,6,rep,name=ports"`
 // List of sources to populate environment variables in the container.
 // The keys defined within a source must be a C_IDENTIFIER. All invalid keys
 // will be reported as an event when the container is starting. When a key exists in multiple
 // sources, the value associated with the last source will take precedence.
 // Values defined by an Env with a duplicate key will take precedence.
 // Cannot be updated.
 // +optional
 EnvFrom []EnvFromSource `json:"envFrom,omitempty" protobuf:"bytes,19,rep,name=envFrom"`
 // List of environment variables to set in the container.
 // Cannot be updated.
 // +optional
 // +patchMergeKey=name
 // +patchStrategy=merge
 Env []EnvVar `json:"env,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,7,rep,name=env"`
 // Compute Resources required by this container.
 // Cannot be updated.
 // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
 // +optional
 Resources ResourceRequirements `json:"resources,omitempty" protobuf:"bytes,8,opt,name=resources"`
 // Pod volumes to mount into the container's filesystem.
 // Cannot be updated.
 // +optional
 // +patchMergeKey=mountPath
 // +patchStrategy=merge
 VolumeMounts []VolumeMount `json:"volumeMounts,omitempty" patchStrategy:"merge" patchMergeKey:"mountPath" protobuf:"bytes,9,rep,name=volumeMounts"`
 // volumeDevices is the list of block devices to be used by the container.
 // +patchMergeKey=devicePath
 // +patchStrategy=merge
 // +optional
 VolumeDevices []VolumeDevice `json:"volumeDevices,omitempty" patchStrategy:"merge" patchMergeKey:"devicePath" protobuf:"bytes,21,rep,name=volumeDevices"`

 // Periodic probe of container liveness.
 // Container will be restarted if the probe fails.
 // Cannot be updated.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 // +optional
 // 存活探测，如果探测失败，则容器会被重启
 LivenessProbe *Probe `json:"livenessProbe,omitempty" protobuf:"bytes,10,opt,name=livenessProbe"`

 // Periodic probe of container service readiness.
 // Container will be removed from service endpoints if the probe fails.
 // Cannot be updated.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 // +optional
 // 可用探测，如果探测失败，则会把地址从 ipvs 移除
 ReadinessProbe *Probe `json:"readinessProbe,omitempty" protobuf:"bytes,11,opt,name=readinessProbe"`

 // StartupProbe indicates that the Pod has successfully initialized.
 // If specified, no other probes are executed until this completes successfully.
 // If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
 // This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
 // when it might take a long time to load data or warm a cache, than during steady-state operation.
 // This cannot be updated.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 // +optional
 // 启动探测，成功之后才会继续执行 LivenessProbe 与 ReadinessProbe 探测
 StartupProbe *Probe `json:"startupProbe,omitempty" protobuf:"bytes,22,opt,name=startupProbe"`

 // Actions that the management system should take in response to container lifecycle events.
 // Cannot be updated.
 // +optional
 Lifecycle *Lifecycle `json:"lifecycle,omitempty" protobuf:"bytes,12,opt,name=lifecycle"`
 // Optional: Path at which the file to which the container's termination message
 // will be written is mounted into the container's filesystem.
 // Message written is intended to be brief final status, such as an assertion failure message.
 // Will be truncated by the node if greater than 4096 bytes. The total message length across
 // all containers will be limited to 12kb.
 // Defaults to /dev/termination-log.
 // Cannot be updated.
 // +optional
 TerminationMessagePath string `json:"terminationMessagePath,omitempty" protobuf:"bytes,13,opt,name=terminationMessagePath"`
 // Indicate how the termination message should be populated. File will use the contents of
 // terminationMessagePath to populate the container status message on both success and failure.
 // FallbackToLogsOnError will use the last chunk of container log output if the termination
 // message file is empty and the container exited with an error.
 // The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
 // Defaults to File.
 // Cannot be updated.
 // +optional
 TerminationMessagePolicy TerminationMessagePolicy `json:"terminationMessagePolicy,omitempty" protobuf:"bytes,20,opt,name=terminationMessagePolicy,casttype=TerminationMessagePolicy"`
 // Image pull policy.
 // One of Always, Never, IfNotPresent.
 // Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
 // Cannot be updated.
 // More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
 // +optional
 ImagePullPolicy PullPolicy `json:"imagePullPolicy,omitempty" protobuf:"bytes,14,opt,name=imagePullPolicy,casttype=PullPolicy"`
 // SecurityContext defines the security options the container should be run with.
 // If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
 // More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
 // +optional
 SecurityContext *SecurityContext `json:"securityContext,omitempty" protobuf:"bytes,15,opt,name=securityContext"`
 // Variables for interactive containers, these have very specialized use-cases (e.g. debugging)
 // and shouldn't be used for general purpose containers.
 // Whether this container should allocate a buffer for stdin in the container runtime. If this
 // is not set, reads from stdin in the container will always result in EOF.
 // Default is false.
 // +optional
 Stdin bool `json:"stdin,omitempty" protobuf:"varint,16,opt,name=stdin"`
 // Whether the container runtime should close the stdin channel after it has been opened by
 // a single attach. When stdin is true the stdin stream will remain open across multiple attach
 // sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
 // first client attaches to stdin, and then remains open and accepts data until the client disconnects,
 // at which time stdin is closed and remains closed until the container is restarted. If this
 // flag is false, a container processes that reads from stdin will never receive an EOF.
 // Default is false
 // +optional
 StdinOnce bool `json:"stdinOnce,omitempty" protobuf:"varint,17,opt,name=stdinOnce"`
 // Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.
 // Default is false.
 // +optional
 TTY bool `json:"tty,omitempty" protobuf:"varint,18,opt,name=tty"`
}

ContainerPort

// ContainerPort represents a network port in a single container.
type ContainerPort struct {
 // If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
 // named port in a pod must have a unique name. Name for the port that can be
 // referred to by services.
 // +optional
 Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`
 // Number of port to expose on the host.
 // If specified, this must be a valid port number, 0 < x < 65536.
 // If HostNetwork is specified, this must match ContainerPort.
 // Most containers do not need this.
 // +optional
 HostPort int32 `json:"hostPort,omitempty" protobuf:"varint,2,opt,name=hostPort"`
 // Number of port to expose on the pod's IP address.
 // This must be a valid port number, 0 < x < 65536.
 ContainerPort int32 `json:"containerPort" protobuf:"varint,3,opt,name=containerPort"`
 // Protocol for port. Must be UDP, TCP, or SCTP.
 // Defaults to "TCP".
 // +optional
 // +default="TCP"
 Protocol Protocol `json:"protocol,omitempty" protobuf:"bytes,4,opt,name=protocol,casttype=Protocol"`
 // What host IP to bind the external port to.
 // +optional
 HostIP string `json:"hostIP,omitempty" protobuf:"bytes,5,opt,name=hostIP"`
}

EnvFromSource

// EnvFromSource represents the source of a set of ConfigMaps
type EnvFromSource struct {
 // An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
 // +optional
 Prefix string `json:"prefix,omitempty" protobuf:"bytes,1,opt,name=prefix"`
 // The ConfigMap to select from
 // +optional
 ConfigMapRef *ConfigMapEnvSource `json:"configMapRef,omitempty" protobuf:"bytes,2,opt,name=configMapRef"`
 // The Secret to select from
 // +optional
 SecretRef *SecretEnvSource `json:"secretRef,omitempty" protobuf:"bytes,3,opt,name=secretRef"`
}

EnvVar

// EnvVar represents an environment variable present in a Container.
type EnvVar struct {
 // Name of the environment variable. Must be a C_IDENTIFIER.
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`

 // Optional: no more than one of the following may be specified.

 // Variable references $(VAR_NAME) are expanded
 // using the previously defined environment variables in the container and
 // any service environment variables. If a variable cannot be resolved,
 // the reference in the input string will be unchanged. Double $$ are reduced
 // to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
 // "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
 // Escaped references will never be expanded, regardless of whether the variable
 // exists or not.
 // Defaults to "".
 // +optional
 Value string `json:"value,omitempty" protobuf:"bytes,2,opt,name=value"`
 // Source for the environment variable's value. Cannot be used if value is not empty.
 // +optional
 ValueFrom *EnvVarSource `json:"valueFrom,omitempty" protobuf:"bytes,3,opt,name=valueFrom"`
}

ResourceRequirements

// ResourceRequirements describes the compute resource requirements.
type ResourceRequirements struct {
 // Limits describes the maximum amount of compute resources allowed.
 // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
 // +optional
 Limits ResourceList `json:"limits,omitempty" protobuf:"bytes,1,rep,name=limits,casttype=ResourceList,castkey=ResourceName"`
 // Requests describes the minimum amount of compute resources required.
 // If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
 // otherwise to an implementation-defined value.
 // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
 // +optional
 Requests ResourceList `json:"requests,omitempty" protobuf:"bytes,2,rep,name=requests,casttype=ResourceList,castkey=ResourceName"`
}

VolumeMount

// VolumeMount describes a mounting of a Volume within a container.
type VolumeMount struct {
 // This must match the Name of a Volume.
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 // Mounted read-only if true, read-write otherwise (false or unspecified).
 // Defaults to false.
 // +optional
 ReadOnly bool `json:"readOnly,omitempty" protobuf:"varint,2,opt,name=readOnly"`
 // Path within the container at which the volume should be mounted. Must
 // not contain ':'.
 MountPath string `json:"mountPath" protobuf:"bytes,3,opt,name=mountPath"`
 // Path within the volume from which the container's volume should be mounted.
 // Defaults to "" (volume's root).
 // +optional
 SubPath string `json:"subPath,omitempty" protobuf:"bytes,4,opt,name=subPath"`
 // mountPropagation determines how mounts are propagated from the host
 // to container and the other way around.
 // When not set, MountPropagationNone is used.
 // This field is beta in 1.10.
 // +optional
 MountPropagation *MountPropagationMode `json:"mountPropagation,omitempty" protobuf:"bytes,5,opt,name=mountPropagation,casttype=MountPropagationMode"`
 // Expanded path within the volume from which the container's volume should be mounted.
 // Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
 // Defaults to "" (volume's root).
 // SubPathExpr and SubPath are mutually exclusive.
 // +optional
 SubPathExpr string `json:"subPathExpr,omitempty" protobuf:"bytes,6,opt,name=subPathExpr"`
}

VolumeDevice

// volumeDevice describes a mapping of a raw block device within a container.
type VolumeDevice struct {
 // name must match the name of a persistentVolumeClaim in the pod
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 // devicePath is the path inside of the container that the device will be mapped to.
 DevicePath string `json:"devicePath" protobuf:"bytes,2,opt,name=devicePath"`
}

Probe

// Probe describes a health check to be performed against a container to determine whether it is
// alive or ready to receive traffic.
type Probe struct {
 // The action taken to determine the health of a container
 Handler `json:",inline" protobuf:"bytes,1,opt,name=handler"`
 // Number of seconds after the container has started before liveness probes are initiated.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 // +optional
 InitialDelaySeconds int32 `json:"initialDelaySeconds,omitempty" protobuf:"varint,2,opt,name=initialDelaySeconds"`
 // Number of seconds after which the probe times out.
 // Defaults to 1 second. Minimum value is 1.
 // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 // +optional
 TimeoutSeconds int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,3,opt,name=timeoutSeconds"`
 // How often (in seconds) to perform the probe.
 // Default to 10 seconds. Minimum value is 1.
 // +optional
 PeriodSeconds int32 `json:"periodSeconds,omitempty" protobuf:"varint,4,opt,name=periodSeconds"`
 // Minimum consecutive successes for the probe to be considered successful after having failed.
 // Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
 // +optional
 SuccessThreshold int32 `json:"successThreshold,omitempty" protobuf:"varint,5,opt,name=successThreshold"`
 // Minimum consecutive failures for the probe to be considered failed after having succeeded.
 // Defaults to 3. Minimum value is 1.
 // +optional
 FailureThreshold int32 `json:"failureThreshold,omitempty" protobuf:"varint,6,opt,name=failureThreshold"`
 // Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
 // The grace period is the duration in seconds after the processes running in the pod are sent
 // a termination signal and the time when the processes are forcibly halted with a kill signal.
 // Set this value longer than the expected cleanup time for your process.
 // If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
 // value overrides the value provided by the pod spec.
 // Value must be non-negative integer. The value zero indicates stop immediately via
 // the kill signal (no opportunity to shut down).
 // This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
 // Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
 // +optional
 TerminationGracePeriodSeconds *int64 `json:"terminationGracePeriodSeconds,omitempty" protobuf:"varint,7,opt,name=terminationGracePeriodSeconds"`
}

// Handler defines a specific action that should be taken
// TODO: pass structured data to these actions, and document that data here.
type Handler struct {
 // One and only one of the following should be specified.
 // Exec specifies the action to take.
 // +optional
 Exec *ExecAction `json:"exec,omitempty" protobuf:"bytes,1,opt,name=exec"`
 // HTTPGet specifies the http request to perform.
 // +optional
 HTTPGet *HTTPGetAction `json:"httpGet,omitempty" protobuf:"bytes,2,opt,name=httpGet"`
 // TCPSocket specifies an action involving a TCP port.
 // TCP hooks not yet supported
 // TODO: implement a realistic TCP lifecycle hook
 // +optional
 TCPSocket *TCPSocketAction `json:"tcpSocket,omitempty" protobuf:"bytes,3,opt,name=tcpSocket"`
}

// TCPSocketAction describes an action based on opening a socket
type TCPSocketAction struct {
 // Number or name of the port to access on the container.
 // Number must be in the range 1 to 65535.
 // Name must be an IANA_SVC_NAME.
 Port intstr.IntOrString `json:"port" protobuf:"bytes,1,opt,name=port"`
 // Optional: Host name to connect to, defaults to the pod IP.
 // +optional
 Host string `json:"host,omitempty" protobuf:"bytes,2,opt,name=host"`
}

// ExecAction describes a "run in container" action.
type ExecAction struct {
 // Command is the command line to execute inside the container, the working directory for the
 // command is root ('/') in the container's filesystem. The command is simply exec'd, it is
 // not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
 // a shell, you need to explicitly call out to that shell.
 // Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
 // +optional
 Command []string `json:"command,omitempty" protobuf:"bytes,1,rep,name=command"`
}

// HTTPHeader describes a custom header to be used in HTTP probes
type HTTPHeader struct {
 // The header field name
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 // The header field value
 Value string `json:"value" protobuf:"bytes,2,opt,name=value"`
}

// URIScheme identifies the scheme used for connection to a host for Get actions
type URIScheme string

const (
 // URISchemeHTTP means that the scheme used will be http://
 URISchemeHTTP URIScheme = "HTTP"
 // URISchemeHTTPS means that the scheme used will be https://
 URISchemeHTTPS URIScheme = "HTTPS"
)

// HTTPGetAction describes an action based on HTTP Get requests.
type HTTPGetAction struct {
 // Path to access on the HTTP server.
 // +optional
 Path string `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"`
 // Name or number of the port to access on the container.
 // Number must be in the range 1 to 65535.
 // Name must be an IANA_SVC_NAME.
 Port intstr.IntOrString `json:"port" protobuf:"bytes,2,opt,name=port"`
 // Host name to connect to, defaults to the pod IP. You probably want to set
 // "Host" in httpHeaders instead.
 // +optional
 Host string `json:"host,omitempty" protobuf:"bytes,3,opt,name=host"`
 // Scheme to use for connecting to the host.
 // Defaults to HTTP.
 // +optional
 Scheme URIScheme `json:"scheme,omitempty" protobuf:"bytes,4,opt,name=scheme,casttype=URIScheme"`
 // Custom headers to set in the request. HTTP allows repeated headers.
 // +optional
 HTTPHeaders []HTTPHeader `json:"httpHeaders,omitempty" protobuf:"bytes,5,rep,name=httpHeaders"`
}

Lifecycle

// Lifecycle describes actions that the management system should take in response to container lifecycle
// events. For the PostStart and PreStop lifecycle handlers, management of the container blocks
// until the action is complete, unless the container process fails, in which case the handler is aborted.
type Lifecycle struct {
 // PostStart is called immediately after a container is created. If the handler fails,
 // the container is terminated and restarted according to its restart policy.
 // Other management of the container blocks until the hook completes.
 // More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
 // +optional
 PostStart *Handler `json:"postStart,omitempty" protobuf:"bytes,1,opt,name=postStart"`
 // PreStop is called immediately before a container is terminated due to an
 // API request or management event such as liveness/startup probe failure,
 // preemption, resource contention, etc. The handler is not called if the
 // container crashes or exits. The reason for termination is passed to the
 // handler. The Pod's termination grace period countdown begins before the
 // PreStop hooked is executed. Regardless of the outcome of the handler, the
 // container will eventually terminate within the Pod's termination grace
 // period. Other management of the container blocks until the hook completes
 // or until the termination grace period is reached.
 // More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
 // +optional
 PreStop *Handler `json:"preStop,omitempty" protobuf:"bytes,2,opt,name=preStop"`
}

TerminationMessagePolicy

// TerminationMessagePolicy describes how termination messages are retrieved from a container.
type TerminationMessagePolicy string

const (
 // TerminationMessageReadFile is the default behavior and will set the container status message to
 // the contents of the container's terminationMessagePath when the container exits.
 TerminationMessageReadFile TerminationMessagePolicy = "File"
 // TerminationMessageFallbackToLogsOnError will read the most recent contents of the container logs
 // for the container status message when the container exits with an error and the
 // terminationMessagePath has no contents.
 TerminationMessageFallbackToLogsOnError TerminationMessagePolicy = "FallbackToLogsOnError"
)

PullPolicy

// PullPolicy describes a policy for if/when to pull a container image
type PullPolicy string

const (
 // PullAlways means that kubelet always attempts to pull the latest image. Container will fail If the pull fails.
 PullAlways PullPolicy = "Always"
 // PullNever means that kubelet never pulls an image, but only uses a local image. Container will fail if the image isn't present
 PullNever PullPolicy = "Never"
 // PullIfNotPresent means that kubelet pulls if the image isn't present on disk. Container will fail if the image isn't present and the pull fails.
 PullIfNotPresent PullPolicy = "IfNotPresent"
)

SecurityContext

// SecurityContext holds security configuration that will be applied to a container.
// Some fields are present in both SecurityContext and PodSecurityContext. When both
// are set, the values in SecurityContext take precedence.
type SecurityContext struct {
 // The capabilities to add/drop when running containers.
 // Defaults to the default set of capabilities granted by the container runtime.
 // +optional
 Capabilities *Capabilities `json:"capabilities,omitempty" protobuf:"bytes,1,opt,name=capabilities"`
 // Run container in privileged mode.
 // Processes in privileged containers are essentially equivalent to root on the host.
 // Defaults to false.
 // +optional
 Privileged *bool `json:"privileged,omitempty" protobuf:"varint,2,opt,name=privileged"`
 // The SELinux context to be applied to the container.
 // If unspecified, the container runtime will allocate a random SELinux context for each
 // container. May also be set in PodSecurityContext. If set in both SecurityContext and
 // PodSecurityContext, the value specified in SecurityContext takes precedence.
 // +optional
 SELinuxOptions *SELinuxOptions `json:"seLinuxOptions,omitempty" protobuf:"bytes,3,opt,name=seLinuxOptions"`
 // The Windows specific settings applied to all containers.
 // If unspecified, the options from the PodSecurityContext will be used.
 // If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
 // +optional
 WindowsOptions *WindowsSecurityContextOptions `json:"windowsOptions,omitempty" protobuf:"bytes,10,opt,name=windowsOptions"`
 // The UID to run the entrypoint of the container process.
 // Defaults to user specified in image metadata if unspecified.
 // May also be set in PodSecurityContext. If set in both SecurityContext and
 // PodSecurityContext, the value specified in SecurityContext takes precedence.
 // +optional
 RunAsUser *int64 `json:"runAsUser,omitempty" protobuf:"varint,4,opt,name=runAsUser"`
 // The GID to run the entrypoint of the container process.
 // Uses runtime default if unset.
 // May also be set in PodSecurityContext. If set in both SecurityContext and
 // PodSecurityContext, the value specified in SecurityContext takes precedence.
 // +optional
 RunAsGroup *int64 `json:"runAsGroup,omitempty" protobuf:"varint,8,opt,name=runAsGroup"`
 // Indicates that the container must run as a non-root user.
 // If true, the Kubelet will validate the image at runtime to ensure that it
 // does not run as UID 0 (root) and fail to start the container if it does.
 // If unset or false, no such validation will be performed.
 // May also be set in PodSecurityContext. If set in both SecurityContext and
 // PodSecurityContext, the value specified in SecurityContext takes precedence.
 // +optional
 RunAsNonRoot *bool `json:"runAsNonRoot,omitempty" protobuf:"varint,5,opt,name=runAsNonRoot"`
 // Whether this container has a read-only root filesystem.
 // Default is false.
 // +optional
 ReadOnlyRootFilesystem *bool `json:"readOnlyRootFilesystem,omitempty" protobuf:"varint,6,opt,name=readOnlyRootFilesystem"`
 // AllowPrivilegeEscalation controls whether a process can gain more
 // privileges than its parent process. This bool directly controls if
 // the no_new_privs flag will be set on the container process.
 // AllowPrivilegeEscalation is true always when the container is:
 // 1) run as Privileged
 // 2) has CAP_SYS_ADMIN
 // +optional
 AllowPrivilegeEscalation *bool `json:"allowPrivilegeEscalation,omitempty" protobuf:"varint,7,opt,name=allowPrivilegeEscalation"`
 // procMount denotes the type of proc mount to use for the containers.
 // The default is DefaultProcMount which uses the container runtime defaults for
 // readonly paths and masked paths.
 // This requires the ProcMountType feature flag to be enabled.
 // +optional
 ProcMount *ProcMountType `json:"procMount,omitempty" protobuf:"bytes,9,opt,name=procMount"`
 // The seccomp options to use by this container. If seccomp options are
 // provided at both the pod & container level, the container options
 // override the pod options.
 // +optional
 SeccompProfile *SeccompProfile `json:"seccompProfile,omitempty" protobuf:"bytes,11,opt,name=seccompProfile"`
}

ResourceList

TODO;

Docs: Pod Security

Mon, 08 May 2023 18:19:18 +0800

简要概述

TODO;

数据结构

PodSecurityContext

// PodSecurityContext holds pod-level security attributes and common container settings.
// Some fields are also present in container.securityContext. Field values of
// container.securityContext take precedence over field values of PodSecurityContext.
type PodSecurityContext struct {
 // The SELinux context to be applied to all containers.
 // If unspecified, the container runtime will allocate a random SELinux context for each
 // container. May also be set in SecurityContext. If set in
 // both SecurityContext and PodSecurityContext, the value specified in SecurityContext
 // takes precedence for that container.
 // +optional
 SELinuxOptions *SELinuxOptions `json:"seLinuxOptions,omitempty" protobuf:"bytes,1,opt,name=seLinuxOptions"`
 // The Windows specific settings applied to all containers.
 // If unspecified, the options within a container's SecurityContext will be used.
 // If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
 // +optional
 WindowsOptions *WindowsSecurityContextOptions `json:"windowsOptions,omitempty" protobuf:"bytes,8,opt,name=windowsOptions"`
 // The UID to run the entrypoint of the container process.
 // Defaults to user specified in image metadata if unspecified.
 // May also be set in SecurityContext. If set in both SecurityContext and
 // PodSecurityContext, the value specified in SecurityContext takes precedence
 // for that container.
 // +optional
 RunAsUser *int64 `json:"runAsUser,omitempty" protobuf:"varint,2,opt,name=runAsUser"`
 // The GID to run the entrypoint of the container process.
 // Uses runtime default if unset.
 // May also be set in SecurityContext. If set in both SecurityContext and
 // PodSecurityContext, the value specified in SecurityContext takes precedence
 // for that container.
 // +optional
 RunAsGroup *int64 `json:"runAsGroup,omitempty" protobuf:"varint,6,opt,name=runAsGroup"`
 // Indicates that the container must run as a non-root user.
 // If true, the Kubelet will validate the image at runtime to ensure that it
 // does not run as UID 0 (root) and fail to start the container if it does.
 // If unset or false, no such validation will be performed.
 // May also be set in SecurityContext. If set in both SecurityContext and
 // PodSecurityContext, the value specified in SecurityContext takes precedence.
 // +optional
 RunAsNonRoot *bool `json:"runAsNonRoot,omitempty" protobuf:"varint,3,opt,name=runAsNonRoot"`
 // A list of groups applied to the first process run in each container, in addition
 // to the container's primary GID. If unspecified, no groups will be added to
 // any container.
 // +optional
 SupplementalGroups []int64 `json:"supplementalGroups,omitempty" protobuf:"varint,4,rep,name=supplementalGroups"`
 // A special supplemental group that applies to all containers in a pod.
 // Some volume types allow the Kubelet to change the ownership of that volume
 // to be owned by the pod:
 //
 // 1. The owning GID will be the FSGroup
 // 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
 // 3. The permission bits are OR'd with rw-rw----
 //
 // If unset, the Kubelet will not modify the ownership and permissions of any volume.
 // +optional
 FSGroup *int64 `json:"fsGroup,omitempty" protobuf:"varint,5,opt,name=fsGroup"`
 // Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
 // sysctls (by the container runtime) might fail to launch.
 // +optional
 Sysctls []Sysctl `json:"sysctls,omitempty" protobuf:"bytes,7,rep,name=sysctls"`
 // fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
 // before being exposed inside Pod. This field will only apply to
 // volume types which support fsGroup based ownership(and permissions).
 // It will have no effect on ephemeral volume types such as: secret, configmaps
 // and emptydir.
 // Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
 // +optional
 FSGroupChangePolicy *PodFSGroupChangePolicy `json:"fsGroupChangePolicy,omitempty" protobuf:"bytes,9,opt,name=fsGroupChangePolicy"`
 // The seccomp options to use by the containers in this pod.
 // +optional
 SeccompProfile *SeccompProfile `json:"seccompProfile,omitempty" protobuf:"bytes,10,opt,name=seccompProfile"`
}

SELinuxOptions

// SELinuxOptions are the labels to be applied to the container
type SELinuxOptions struct {
 // User is a SELinux user label that applies to the container.
 // +optional
 User string `json:"user,omitempty" protobuf:"bytes,1,opt,name=user"`
 // Role is a SELinux role label that applies to the container.
 // +optional
 Role string `json:"role,omitempty" protobuf:"bytes,2,opt,name=role"`
 // Type is a SELinux type label that applies to the container.
 // +optional
 Type string `json:"type,omitempty" protobuf:"bytes,3,opt,name=type"`
 // Level is SELinux level label that applies to the container.
 // +optional
 Level string `json:"level,omitempty" protobuf:"bytes,4,opt,name=level"`
}

WindowsSecurityContextOptions

// WindowsSecurityContextOptions contain Windows-specific options and credentials.
type WindowsSecurityContextOptions struct {
 // GMSACredentialSpecName is the name of the GMSA credential spec to use.
 // +optional
 GMSACredentialSpecName *string `json:"gmsaCredentialSpecName,omitempty" protobuf:"bytes,1,opt,name=gmsaCredentialSpecName"`

 // GMSACredentialSpec is where the GMSA admission webhook
 // (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
 // GMSA credential spec named by the GMSACredentialSpecName field.
 // +optional
 GMSACredentialSpec *string `json:"gmsaCredentialSpec,omitempty" protobuf:"bytes,2,opt,name=gmsaCredentialSpec"`

 // The UserName in Windows to run the entrypoint of the container process.
 // Defaults to the user specified in image metadata if unspecified.
 // May also be set in PodSecurityContext. If set in both SecurityContext and
 // PodSecurityContext, the value specified in SecurityContext takes precedence.
 // +optional
 RunAsUserName *string `json:"runAsUserName,omitempty" protobuf:"bytes,3,opt,name=runAsUserName"`

 // HostProcess determines if a container should be run as a 'Host Process' container.
 // This field is alpha-level and will only be honored by components that enable the
 // WindowsHostProcessContainers feature flag. Setting this field without the feature
 // flag will result in errors when validating the Pod. All of a Pod's containers must
 // have the same effective HostProcess value (it is not allowed to have a mix of HostProcess
 // containers and non-HostProcess containers). In addition, if HostProcess is true
 // then HostNetwork must also be set to true.
 // +optional
 HostProcess *bool `json:"hostProcess,omitempty" protobuf:"bytes,4,opt,name=hostProcess"`
}

Sysctl

// Sysctl defines a kernel parameter to be set
type Sysctl struct {
 // Name of a property to set
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 // Value of a property to set
 Value string `json:"value" protobuf:"bytes,2,opt,name=value"`
}

PodFSGroupChangePolicy

// PodFSGroupChangePolicy holds policies that will be used for applying fsGroup to a volume
// when volume is mounted.
type PodFSGroupChangePolicy string

const (
 // FSGroupChangeOnRootMismatch indicates that volume's ownership and permissions will be changed
 // only when permission and ownership of root directory does not match with expected
 // permissions on the volume. This can help shorten the time it takes to change
 // ownership and permissions of a volume.
 FSGroupChangeOnRootMismatch PodFSGroupChangePolicy = "OnRootMismatch"
 // FSGroupChangeAlways indicates that volume's ownership and permissions
 // should always be changed whenever volume is mounted inside a Pod. This the default
 // behavior.
 FSGroupChangeAlways PodFSGroupChangePolicy = "Always"
)

SeccompProfile

// SeccompProfile defines a pod/container's seccomp profile settings.
// Only one profile source may be set.
// +union
type SeccompProfile struct {
 // type indicates which kind of seccomp profile will be applied.
 // Valid options are:
 //
 // Localhost - a profile defined in a file on the node should be used.
 // RuntimeDefault - the container runtime default profile should be used.
 // Unconfined - no profile should be applied.
 // +unionDiscriminator
 Type SeccompProfileType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=SeccompProfileType"`
 // localhostProfile indicates a profile defined in a file on the node should be used.
 // The profile must be preconfigured on the node to work.
 // Must be a descending path, relative to the kubelet's configured seccomp profile location.
 // Must only be set if type is "Localhost".
 // +optional
 LocalhostProfile *string `json:"localhostProfile,omitempty" protobuf:"bytes,2,opt,name=localhostProfile"`
}

// SeccompProfileType defines the supported seccomp profile types.
type SeccompProfileType string

const (
 // SeccompProfileTypeUnconfined indicates no seccomp profile is applied (A.K.A. unconfined).
 SeccompProfileTypeUnconfined SeccompProfileType = "Unconfined"
 // SeccompProfileTypeRuntimeDefault represents the default container runtime seccomp profile.
 SeccompProfileTypeRuntimeDefault SeccompProfileType = "RuntimeDefault"
 // SeccompProfileTypeLocalhost indicates a profile defined in a file on the node should be used.
 // The file's location is based off the kubelet's deprecated flag --seccomp-profile-root.
 // Once the flag support is removed the location will be <kubelet-root-dir>/seccomp.
 SeccompProfileTypeLocalhost SeccompProfileType = "Localhost"
)

Docs: Pod Affinity

Mon, 08 May 2023 18:19:26 +0800

简要概述

TODO;

数据结构

Affinity

// Affinity is a group of affinity scheduling rules.
type Affinity struct {
 // Describes node affinity scheduling rules for the pod.
 // +optional
 NodeAffinity *NodeAffinity `json:"nodeAffinity,omitempty" protobuf:"bytes,1,opt,name=nodeAffinity"`
 // Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
 // +optional
 PodAffinity *PodAffinity `json:"podAffinity,omitempty" protobuf:"bytes,2,opt,name=podAffinity"`
 // Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
 // +optional
 PodAntiAffinity *PodAntiAffinity `json:"podAntiAffinity,omitempty" protobuf:"bytes,3,opt,name=podAntiAffinity"`
}

NodeAffinity

// Node affinity is a group of node affinity scheduling rules.
type NodeAffinity struct {
 // NOT YET IMPLEMENTED. TODO: Uncomment field once it is implemented.
 // If the affinity requirements specified by this field are not met at
 // scheduling time, the pod will not be scheduled onto the node.
 // If the affinity requirements specified by this field cease to be met
 // at some point during pod execution (e.g. due to an update), the system
 // will try to eventually evict the pod from its node.
 // +optional
 // RequiredDuringSchedulingRequiredDuringExecution *NodeSelector `json:"requiredDuringSchedulingRequiredDuringExecution,omitempty"`

 // If the affinity requirements specified by this field are not met at
 // scheduling time, the pod will not be scheduled onto the node.
 // If the affinity requirements specified by this field cease to be met
 // at some point during pod execution (e.g. due to an update), the system
 // may or may not try to eventually evict the pod from its node.
 // +optional
 RequiredDuringSchedulingIgnoredDuringExecution *NodeSelector `json:"requiredDuringSchedulingIgnoredDuringExecution,omitempty" protobuf:"bytes,1,opt,name=requiredDuringSchedulingIgnoredDuringExecution"`
 // The scheduler will prefer to schedule pods to nodes that satisfy
 // the affinity expressions specified by this field, but it may choose
 // a node that violates one or more of the expressions. The node that is
 // most preferred is the one with the greatest sum of weights, i.e.
 // for each node that meets all of the scheduling requirements (resource
 // request, requiredDuringScheduling affinity expressions, etc.),
 // compute a sum by iterating through the elements of this field and adding
 // "weight" to the sum if the node matches the corresponding matchExpressions; the
 // node(s) with the highest sum are the most preferred.
 // +optional
 PreferredDuringSchedulingIgnoredDuringExecution []PreferredSchedulingTerm `json:"preferredDuringSchedulingIgnoredDuringExecution,omitempty" protobuf:"bytes,2,rep,name=preferredDuringSchedulingIgnoredDuringExecution"`
}

PodAffinity

// Pod affinity is a group of inter pod affinity scheduling rules.
type PodAffinity struct {
 // NOT YET IMPLEMENTED. TODO: Uncomment field once it is implemented.
 // If the affinity requirements specified by this field are not met at
 // scheduling time, the pod will not be scheduled onto the node.
 // If the affinity requirements specified by this field cease to be met
 // at some point during pod execution (e.g. due to a pod label update), the
 // system will try to eventually evict the pod from its node.
 // When there are multiple elements, the lists of nodes corresponding to each
 // podAffinityTerm are intersected, i.e. all terms must be satisfied.
 // +optional
 // RequiredDuringSchedulingRequiredDuringExecution []PodAffinityTerm `json:"requiredDuringSchedulingRequiredDuringExecution,omitempty"`

 // If the affinity requirements specified by this field are not met at
 // scheduling time, the pod will not be scheduled onto the node.
 // If the affinity requirements specified by this field cease to be met
 // at some point during pod execution (e.g. due to a pod label update), the
 // system may or may not try to eventually evict the pod from its node.
 // When there are multiple elements, the lists of nodes corresponding to each
 // podAffinityTerm are intersected, i.e. all terms must be satisfied.
 // +optional
 RequiredDuringSchedulingIgnoredDuringExecution []PodAffinityTerm `json:"requiredDuringSchedulingIgnoredDuringExecution,omitempty" protobuf:"bytes,1,rep,name=requiredDuringSchedulingIgnoredDuringExecution"`
 // The scheduler will prefer to schedule pods to nodes that satisfy
 // the affinity expressions specified by this field, but it may choose
 // a node that violates one or more of the expressions. The node that is
 // most preferred is the one with the greatest sum of weights, i.e.
 // for each node that meets all of the scheduling requirements (resource
 // request, requiredDuringScheduling affinity expressions, etc.),
 // compute a sum by iterating through the elements of this field and adding
 // "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
 // node(s) with the highest sum are the most preferred.
 // +optional
 PreferredDuringSchedulingIgnoredDuringExecution []WeightedPodAffinityTerm `json:"preferredDuringSchedulingIgnoredDuringExecution,omitempty" protobuf:"bytes,2,rep,name=preferredDuringSchedulingIgnoredDuringExecution"`
}

PodAntiAffinity

// Pod anti affinity is a group of inter pod anti affinity scheduling rules.
type PodAntiAffinity struct {
 // NOT YET IMPLEMENTED. TODO: Uncomment field once it is implemented.
 // If the anti-affinity requirements specified by this field are not met at
 // scheduling time, the pod will not be scheduled onto the node.
 // If the anti-affinity requirements specified by this field cease to be met
 // at some point during pod execution (e.g. due to a pod label update), the
 // system will try to eventually evict the pod from its node.
 // When there are multiple elements, the lists of nodes corresponding to each
 // podAffinityTerm are intersected, i.e. all terms must be satisfied.
 // +optional
 // RequiredDuringSchedulingRequiredDuringExecution []PodAffinityTerm `json:"requiredDuringSchedulingRequiredDuringExecution,omitempty"`

 // If the anti-affinity requirements specified by this field are not met at
 // scheduling time, the pod will not be scheduled onto the node.
 // If the anti-affinity requirements specified by this field cease to be met
 // at some point during pod execution (e.g. due to a pod label update), the
 // system may or may not try to eventually evict the pod from its node.
 // When there are multiple elements, the lists of nodes corresponding to each
 // podAffinityTerm are intersected, i.e. all terms must be satisfied.
 // +optional
 RequiredDuringSchedulingIgnoredDuringExecution []PodAffinityTerm `json:"requiredDuringSchedulingIgnoredDuringExecution,omitempty" protobuf:"bytes,1,rep,name=requiredDuringSchedulingIgnoredDuringExecution"`
 // The scheduler will prefer to schedule pods to nodes that satisfy
 // the anti-affinity expressions specified by this field, but it may choose
 // a node that violates one or more of the expressions. The node that is
 // most preferred is the one with the greatest sum of weights, i.e.
 // for each node that meets all of the scheduling requirements (resource
 // request, requiredDuringScheduling anti-affinity expressions, etc.),
 // compute a sum by iterating through the elements of this field and adding
 // "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
 // node(s) with the highest sum are the most preferred.
 // +optional
 PreferredDuringSchedulingIgnoredDuringExecution []WeightedPodAffinityTerm `json:"preferredDuringSchedulingIgnoredDuringExecution,omitempty" protobuf:"bytes,2,rep,name=preferredDuringSchedulingIgnoredDuringExecution"`
}

Toleration

// The pod this Toleration is attached to tolerates any taint that matches
// the triple <key,value,effect> using the matching operator <operator>.
type Toleration struct {
 // Key is the taint key that the toleration applies to. Empty means match all taint keys.
 // If the key is empty, operator must be Exists; this combination means to match all values and all keys.
 // +optional
 Key string `json:"key,omitempty" protobuf:"bytes,1,opt,name=key"`
 // Operator represents a key's relationship to the value.
 // Valid operators are Exists and Equal. Defaults to Equal.
 // Exists is equivalent to wildcard for value, so that a pod can
 // tolerate all taints of a particular category.
 // +optional
 Operator TolerationOperator `json:"operator,omitempty" protobuf:"bytes,2,opt,name=operator,casttype=TolerationOperator"`
 // Value is the taint value the toleration matches to.
 // If the operator is Exists, the value should be empty, otherwise just a regular string.
 // +optional
 Value string `json:"value,omitempty" protobuf:"bytes,3,opt,name=value"`
 // Effect indicates the taint effect to match. Empty means match all taint effects.
 // When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
 // +optional
 Effect TaintEffect `json:"effect,omitempty" protobuf:"bytes,4,opt,name=effect,casttype=TaintEffect"`
 // TolerationSeconds represents the period of time the toleration (which must be
 // of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
 // it is not set, which means tolerate the taint forever (do not evict). Zero and
 // negative values will be treated as 0 (evict immediately) by the system.
 // +optional
 TolerationSeconds *int64 `json:"tolerationSeconds,omitempty" protobuf:"varint,5,opt,name=tolerationSeconds"`
}

// A toleration operator is the set of operators that can be used in a toleration.
type TolerationOperator string

const (
 TolerationOpExists TolerationOperator = "Exists"
 TolerationOpEqual TolerationOperator = "Equal"
)

Docs: Secret

Fri, 12 May 2023 10:11:24 +0800

简要概述

属于组：“corev1”

{Group: corev1.GroupName, Kind: "Secret"}

staging/src/k8s.io/kubectl/pkg/describe/describe.go

代码路径：

staging/src/k8s.io/api/core/v1/types.go

常用指令

TODO;

配置示例

TODO;

数据结构

Secret

// Secret holds secret data of a certain type. The total bytes of the values in
// the Data field must be less than MaxSecretSize bytes.
type Secret struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Immutable, if set to true, ensures that data stored in the Secret cannot
 // be updated (only object metadata can be modified).
 // If not set to true, the field can be modified at any time.
 // Defaulted to nil.
 // +optional
 Immutable *bool `json:"immutable,omitempty" protobuf:"varint,5,opt,name=immutable"`

 // Data contains the secret data. Each key must consist of alphanumeric
 // characters, '-', '_' or '.'. The serialized form of the secret data is a
 // base64 encoded string, representing the arbitrary (possibly non-string)
 // data value here. Described in https://tools.ietf.org/html/rfc4648#section-4
 // +optional
 Data map[string][]byte `json:"data,omitempty" protobuf:"bytes,2,rep,name=data"`

 // stringData allows specifying non-binary secret data in string form.
 // It is provided as a write-only input field for convenience.
 // All keys and values are merged into the data field on write, overwriting any existing values.
 // The stringData field is never output when reading from the API.
 // +k8s:conversion-gen=false
 // +optional
 StringData map[string]string `json:"stringData,omitempty" protobuf:"bytes,4,rep,name=stringData"`

 // Used to facilitate programmatic handling of secret data.
 // +optional
 Type SecretType `json:"type,omitempty" protobuf:"bytes,3,opt,name=type,casttype=SecretType"`
}

SecretType

type SecretType string

const (
 // SecretTypeOpaque is the default. Arbitrary user-defined data
 SecretTypeOpaque SecretType = "Opaque"

 // SecretTypeServiceAccountToken contains a token that identifies a service account to the API
 //
 // Required fields:
 // - Secret.Annotations["kubernetes.io/service-account.name"] - the name of the ServiceAccount the token identifies
 // - Secret.Annotations["kubernetes.io/service-account.uid"] - the UID of the ServiceAccount the token identifies
 // - Secret.Data["token"] - a token that identifies the service account to the API
 SecretTypeServiceAccountToken SecretType = "kubernetes.io/service-account-token"

 // ServiceAccountNameKey is the key of the required annotation for SecretTypeServiceAccountToken secrets
 ServiceAccountNameKey = "kubernetes.io/service-account.name"
 // ServiceAccountUIDKey is the key of the required annotation for SecretTypeServiceAccountToken secrets
 ServiceAccountUIDKey = "kubernetes.io/service-account.uid"
 // ServiceAccountTokenKey is the key of the required data for SecretTypeServiceAccountToken secrets
 ServiceAccountTokenKey = "token"
 // ServiceAccountKubeconfigKey is the key of the optional kubeconfig data for SecretTypeServiceAccountToken secrets
 ServiceAccountKubeconfigKey = "kubernetes.kubeconfig"
 // ServiceAccountRootCAKey is the key of the optional root certificate authority for SecretTypeServiceAccountToken secrets
 ServiceAccountRootCAKey = "ca.crt"
 // ServiceAccountNamespaceKey is the key of the optional namespace to use as the default for namespaced API calls
 ServiceAccountNamespaceKey = "namespace"

 // SecretTypeDockercfg contains a dockercfg file that follows the same format rules as ~/.dockercfg
 //
 // Required fields:
 // - Secret.Data[".dockercfg"] - a serialized ~/.dockercfg file
 SecretTypeDockercfg SecretType = "kubernetes.io/dockercfg"

 // DockerConfigKey is the key of the required data for SecretTypeDockercfg secrets
 DockerConfigKey = ".dockercfg"

 // SecretTypeDockerConfigJson contains a dockercfg file that follows the same format rules as ~/.docker/config.json
 //
 // Required fields:
 // - Secret.Data[".dockerconfigjson"] - a serialized ~/.docker/config.json file
 SecretTypeDockerConfigJson SecretType = "kubernetes.io/dockerconfigjson"

 // DockerConfigJsonKey is the key of the required data for SecretTypeDockerConfigJson secrets
 DockerConfigJsonKey = ".dockerconfigjson"

 // SecretTypeBasicAuth contains data needed for basic authentication.
 //
 // Required at least one of fields:
 // - Secret.Data["username"] - username used for authentication
 // - Secret.Data["password"] - password or token needed for authentication
 SecretTypeBasicAuth SecretType = "kubernetes.io/basic-auth"

 // BasicAuthUsernameKey is the key of the username for SecretTypeBasicAuth secrets
 BasicAuthUsernameKey = "username"
 // BasicAuthPasswordKey is the key of the password or token for SecretTypeBasicAuth secrets
 BasicAuthPasswordKey = "password"

 // SecretTypeSSHAuth contains data needed for SSH authetication.
 //
 // Required field:
 // - Secret.Data["ssh-privatekey"] - private SSH key needed for authentication
 SecretTypeSSHAuth SecretType = "kubernetes.io/ssh-auth"

 // SSHAuthPrivateKey is the key of the required SSH private key for SecretTypeSSHAuth secrets
 SSHAuthPrivateKey = "ssh-privatekey"
 // SecretTypeTLS contains information about a TLS client or server secret. It
 // is primarily used with TLS termination of the Ingress resource, but may be
 // used in other types.
 //
 // Required fields:
 // - Secret.Data["tls.key"] - TLS private key.
 // Secret.Data["tls.crt"] - TLS certificate.
 // TODO: Consider supporting different formats, specifying CA/destinationCA.
 SecretTypeTLS SecretType = "kubernetes.io/tls"

 // TLSCertKey is the key for tls certificates in a TLS secret.
 TLSCertKey = "tls.crt"
 // TLSPrivateKeyKey is the key for the private key field in a TLS secret.
 TLSPrivateKeyKey = "tls.key"
 // SecretTypeBootstrapToken is used during the automated bootstrap process (first
 // implemented by kubeadm). It stores tokens that are used to sign well known
 // ConfigMaps. They are used for authn.
 SecretTypeBootstrapToken SecretType = "bootstrap.kubernetes.io/token"
)

Docs: Service

Fri, 18 Nov 2022 17:46:05 +0800

简要概述

staging/src/k8s.io/api/core/v1/types.go

配置示例

数据结构

Service

// 一个抽象的服务组，配合coredns做服务发现，提供负载均衡与VIP，当仅可在集群内通讯
type Service struct {
 // 公共基础结构
 metav1.TypeMeta `json:",inline"`
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // 服务规范定义
 Spec ServiceSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // 服务实际配置
 Status ServiceStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

ServiceSpec

// 用户声明期望的服务配置
type ServiceSpec struct {
 // 服务对外暴露的端口
 Ports []ServicePort `json:"ports,omitempty" patchStrategy:"merge" patchMergeKey:"port" protobuf:"bytes,1,rep,name=ports"`

 // 根据这里配置的标签来决定具体路由流量至后端POD
 // 如果类型是：ExternalName 则会被忽略，仅为：ClusterIP, NodePort, and LoadBalancer 类型有效；
 Selector map[string]string `json:"selector,omitempty" protobuf:"bytes,2,rep,name=selector"`

 // 一个虚拟IP地址，如果未手工配置则自动生成，手工配置必须未被使用且在有效范围内
 // 如果设置为 "None" 则不分配IP，也就是 "headless service"，一般配合有状态应用使用
 // 如果 type="ExternalName" 则不生效
 // 仅当 type 为 ClusterIP, NodePort, and LoadBalancer 生效
 ClusterIP string `json:"clusterIP,omitempty" protobuf:"bytes,3,opt,name=clusterIP"`

 // 功能同 ClusterIP，支持多个虚拟IP，如果同时配置了 ClusterIP，则必须与 ClusterIPs[0] 值相同
 ClusterIPs []string `json:"clusterIPs,omitempty" protobuf:"bytes,18,opt,name=clusterIPs"`

 // 默认类型为：ClusterIP，支持类型：ExternalName, ClusterIP, NodePort, and LoadBalancer
 Type ServiceType `json:"type,omitempty" protobuf:"bytes,4,opt,name=type,casttype=ServiceType"`

 // TODO; 具体实现待验证
 // 非K8S管理的外部IP，但用于接收这个服务的流量
 ExternalIPs []string `json:"externalIPs,omitempty" protobuf:"bytes,5,rep,name=externalIPs"`

 // 会话的亲和性，支持："ClientIP" and "None"，默认为 "None"
 SessionAffinity ServiceAffinity `json:"sessionAffinity,omitempty" protobuf:"bytes,7,opt,name=sessionAffinity,casttype=ServiceAffinity"`

 // 仅当服务类型为 "LoadBalancer" 生效，不支持双栈网络，依赖云服务提供商
 LoadBalancerIP string `json:"loadBalancerIP,omitempty" protobuf:"bytes,8,opt,name=loadBalancerIP"`

 // TODO; https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/
 LoadBalancerSourceRanges []string `json:"loadBalancerSourceRanges,omitempty" protobuf:"bytes,9,opt,name=loadBalancerSourceRanges"`

 // 设置为一个DNS地址，用于作为该服务的别名，同时 "type" 必须设置为 "ExternalName"
 ExternalName string `json:"externalName,omitempty" protobuf:"bytes,10,opt,name=externalName"`

 // 用于控制外部流量进入集群后如何路由到后端 Pod，影响 "NodePort" 或 "LoadBalancer" 类型服务
 // 如果设置为 "Local"，当该节点上没有匹配的 Pod，则流量不会被转发到集群中的其他节点，这样则会保留源客户端源 IP
 // 如果设置为 "Cluster"，将采用集群内部的负载均衡机制，无论外部流量来自哪个节点，都可被路由到对应 Pod
 ExternalTrafficPolicy ServiceExternalTrafficPolicyType `json:"externalTrafficPolicy,omitempty" protobuf:"bytes,11,opt,name=externalTrafficPolicy"`

 // 用于健康检测，仅当类型为 "LoadBalancer" 且 "externalTrafficPolicy=Local" 时有效；
 HealthCheckNodePort int32 `json:"healthCheckNodePort,omitempty" protobuf:"bytes,12,opt,name=healthCheckNodePort"`

 // TODO; 用途未知
 PublishNotReadyAddresses bool `json:"publishNotReadyAddresses,omitempty" protobuf:"varint,13,opt,name=publishNotReadyAddresses"`

 // 用于配置会话亲和性
 SessionAffinityConfig *SessionAffinityConfig `json:"sessionAffinityConfig,omitempty" protobuf:"bytes,14,opt,name=sessionAffinityConfig"`

 // 服务IP版本，可取：IPv4, IPv6，仅当类型为："ClusterIP"、"NodePort"、"LoadBalancer"
 IPFamilies []IPFamily `json:"ipFamilies,omitempty" protobuf:"bytes,19,opt,name=ipFamilies,casttype=IPFamily"`

 // 服务IP策略，是否支持双栈，可取值 "SingleStack"、"PreferDualStack"、"RequireDualStack"
 IPFamilyPolicy *IPFamilyPolicyType `json:"ipFamilyPolicy,omitempty" protobuf:"bytes,17,opt,name=ipFamilyPolicy,casttype=IPFamilyPolicyType"`

 // 当类型为 "LoadBalancer" 是否自动分配 "NodePorts" 端口，默认为 "true"
 AllocateLoadBalancerNodePorts *bool `json:"allocateLoadBalancerNodePorts,omitempty" protobuf:"bytes,20,opt,name=allocateLoadBalancerNodePorts"`

 // 当类型为 "LoadBalancer" 才有效
 LoadBalancerClass *string `json:"loadBalancerClass,omitempty" protobuf:"bytes,21,opt,name=loadBalancerClass"`

 // InternalTrafficPolicy specifies if the cluster internal traffic
 // should be routed to all endpoints or node-local endpoints only.
 // "Cluster" routes internal traffic to a Service to all endpoints.
 // "Local" routes traffic to node-local endpoints only, traffic is
 // dropped if no node-local endpoints are ready.
 // The default value is "Cluster".
 // +featureGate=ServiceInternalTrafficPolicy
 // +optional
 // 类似 externalTrafficPolicy 用于控制内部流量在集群内如何路由到后端 Pod
 InternalTrafficPolicy *ServiceInternalTrafficPolicyType `json:"internalTrafficPolicy,omitempty" protobuf:"bytes,22,opt,name=internalTrafficPolicy"`
}

ServiceStatus

// ServiceStatus represents the current status of a service.
type ServiceStatus struct {
 // LoadBalancer contains the current status of the load-balancer,
 // if one is present.
 // +optional
 LoadBalancer LoadBalancerStatus `json:"loadBalancer,omitempty" protobuf:"bytes,1,opt,name=loadBalancer"`
 // Current service state
 // +optional
 // +patchMergeKey=type
 // +patchStrategy=merge
 // +listType=map
 // +listMapKey=type
 Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,2,rep,name=conditions"`
}

ServicePort

type ServicePort struct {
 // 各服务名称必须是唯一的
 Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`

 // 该端口协议，支持："TCP", "UDP", and "SCTP"，默认为："TCP"
 Protocol Protocol `json:"protocol,omitempty" protobuf:"bytes,2,opt,name=protocol,casttype=Protocol"`

 // TODO; 待确认
 AppProtocol *string `json:"appProtocol,omitempty" protobuf:"bytes,6,opt,name=appProtocol"`

 // 提供外部连接使用的服务端口
 Port int32 `json:"port" protobuf:"varint,3,opt,name=port"`

 // 后端容器端口或者端口关联的唯一名字，这个字段比较特殊，同时支持字符串与数字格式
 // 如果数字格式，说明为端口，必须在 1 至 65535 范围内
 // 如果是字符串格式，则说明为对应容器端口的名称
 TargetPort intstr.IntOrString `json:"targetPort,omitempty" protobuf:"bytes,4,opt,name=targetPort"`

 // 当类型为 "NodePort" 或 "LoadBalancer" 用于在工作节点额外开启提供外部服务的端口
 NodePort int32 `json:"nodePort,omitempty" protobuf:"varint,5,opt,name=nodePort"`
}

ServiceType

// Service Type string describes ingress methods for a service
type ServiceType string

const (
 // ServiceTypeClusterIP means a service will only be accessible inside the
 // cluster, via the cluster IP.
 ServiceTypeClusterIP ServiceType = "ClusterIP"

 // ServiceTypeNodePort means a service will be exposed on one port of
 // every node, in addition to 'ClusterIP' type.
 ServiceTypeNodePort ServiceType = "NodePort"

 // ServiceTypeLoadBalancer means a service will be exposed via an
 // external load balancer (if the cloud provider supports it), in addition
 // to 'NodePort' type.
 ServiceTypeLoadBalancer ServiceType = "LoadBalancer"

 // ServiceTypeExternalName means a service consists of only a reference to
 // an external name that kubedns or equivalent will return as a CNAME
 // record, with no exposing or proxying of any pods involved.
 ServiceTypeExternalName ServiceType = "ExternalName"
)

ServiceAffinity

// Session Affinity Type string
type ServiceAffinity string

const (
 // ServiceAffinityClientIP is the Client IP based.
 ServiceAffinityClientIP ServiceAffinity = "ClientIP"

 // ServiceAffinityNone - no session affinity.
 ServiceAffinityNone ServiceAffinity = "None"
)

ServiceExternalTrafficPolicyType

// Service External Traffic Policy Type string
type ServiceExternalTrafficPolicyType string

const (
 // ServiceExternalTrafficPolicyTypeLocal specifies node-local endpoints behavior.
 ServiceExternalTrafficPolicyTypeLocal ServiceExternalTrafficPolicyType = "Local"
 // ServiceExternalTrafficPolicyTypeCluster specifies node-global (legacy) behavior.
 ServiceExternalTrafficPolicyTypeCluster ServiceExternalTrafficPolicyType = "Cluster"
)

SessionAffinityConfig

// SessionAffinityConfig represents the configurations of session affinity.
type SessionAffinityConfig struct {
 // clientIP contains the configurations of Client IP based session affinity.
 // +optional
 ClientIP *ClientIPConfig `json:"clientIP,omitempty" protobuf:"bytes,1,opt,name=clientIP"`
}

// ClientIPConfig represents the configurations of Client IP based session affinity.
type ClientIPConfig struct {
 // timeoutSeconds specifies the seconds of ClientIP type session sticky time.
 // The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP".
 // Default value is 10800(for 3 hours).
 // +optional
 TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,1,opt,name=timeoutSeconds"`
}

IPFamilyPolicyType

// IPFamilyPolicyType represents the dual-stack-ness requested or required by a Service
type IPFamilyPolicyType string

const (
 // IPFamilyPolicySingleStack indicates that this service is required to have a single IPFamily.
 // The IPFamily assigned is based on the default IPFamily used by the cluster
 // or as identified by service.spec.ipFamilies field
 IPFamilyPolicySingleStack IPFamilyPolicyType = "SingleStack"
 // IPFamilyPolicyPreferDualStack indicates that this service prefers dual-stack when
 // the cluster is configured for dual-stack. If the cluster is not configured
 // for dual-stack the service will be assigned a single IPFamily. If the IPFamily is not
 // set in service.spec.ipFamilies then the service will be assigned the default IPFamily
 // configured on the cluster
 IPFamilyPolicyPreferDualStack IPFamilyPolicyType = "PreferDualStack"
 // IPFamilyPolicyRequireDualStack indicates that this service requires dual-stack. Using
 // IPFamilyPolicyRequireDualStack on a single stack cluster will result in validation errors. The
 // IPFamilies (and their order) assigned to this service is based on service.spec.ipFamilies. If
 // service.spec.ipFamilies was not provided then it will be assigned according to how they are
 // configured on the cluster. If service.spec.ipFamilies has only one entry then the alternative
 // IPFamily will be added by apiserver
 IPFamilyPolicyRequireDualStack IPFamilyPolicyType = "RequireDualStack"
)

ServiceInternalTrafficPolicyType

// ServiceInternalTrafficPolicyType describes the type of traffic routing for
// internal traffic
type ServiceInternalTrafficPolicyType string

const (
 // ServiceInternalTrafficPolicyCluster routes traffic to all endpoints
 ServiceInternalTrafficPolicyCluster ServiceInternalTrafficPolicyType = "Cluster"

 // ServiceInternalTrafficPolicyLocal only routes to node-local
 // endpoints, otherwise drops the traffic
 ServiceInternalTrafficPolicyLocal ServiceInternalTrafficPolicyType = "Local"
)

// Service External Traffic Policy Type string
type ServiceExternalTrafficPolicyType string

const (
 // ServiceExternalTrafficPolicyTypeLocal specifies node-local endpoints behavior.
 ServiceExternalTrafficPolicyTypeLocal ServiceExternalTrafficPolicyType = "Local"
 // ServiceExternalTrafficPolicyTypeCluster specifies node-global (legacy) behavior.
 ServiceExternalTrafficPolicyTypeCluster ServiceExternalTrafficPolicyType = "Cluster"
)

LoadBalancerStatus

// LoadBalancerStatus represents the status of a load-balancer.
type LoadBalancerStatus struct {
 // Ingress is a list containing ingress points for the load-balancer.
 // Traffic intended for the service should be sent to these ingress points.
 // +optional
 Ingress []LoadBalancerIngress `json:"ingress,omitempty" protobuf:"bytes,1,rep,name=ingress"`
}

LoadBalancerIngress

// LoadBalancerIngress represents the status of a load-balancer ingress point:
// traffic intended for the service should be sent to an ingress point.
type LoadBalancerIngress struct {
 // IP is set for load-balancer ingress points that are IP based
 // (typically GCE or OpenStack load-balancers)
 // +optional
 IP string `json:"ip,omitempty" protobuf:"bytes,1,opt,name=ip"`

 // Hostname is set for load-balancer ingress points that are DNS based
 // (typically AWS load-balancers)
 // +optional
 Hostname string `json:"hostname,omitempty" protobuf:"bytes,2,opt,name=hostname"`

 // Ports is a list of records of service ports
 // If used, every port defined in the service should have an entry in it
 // +listType=atomic
 // +optional
 Ports []PortStatus `json:"ports,omitempty" protobuf:"bytes,4,rep,name=ports"`
}

Docs: Deployment

Wed, 15 Feb 2023 11:26:30 +0800

简要概述

staging/src/k8s.io/api/apps/v1/types.go

查看官方介绍

常用指令

调整副本数

对空间下 kube-system 资源 deployment/l7-lb-controller 的副本数调整为 0

kubectl scale --replicas=0 deployment/l7-lb-controller -n kube-system

配置示例

通过 kubectl 创建

生成可运行的 yaml 内容

kubectl create deployment busybox \
 --replicas=3 \
 --image=registry.cn-hangzhou.aliyuncs.com/opsaid/busybox:1.35.0 \
 --dry-run=client \
 -o yaml \
 -- /bin/sh -c "sleep 3600"

通过 yaml 创建

apiVersion: apps/v1
kind: Deployment
metadata:
 creationTimestamp: null
 labels:
 app: busybox
 name: busybox
spec:
 replicas: 3
 selector:
 matchLabels:
 app: busybox
 strategy: {}
 template:
 metadata:
 creationTimestamp: null
 labels:
 app: busybox
 spec:
 containers:
 - command:
 - /bin/sh
 - -c
 - sleep 3600
 image: registry.cn-hangzhou.aliyuncs.com/opsaid/busybox:1.35.0
 name: busybox
 resources: {}

数据结构

Deployment

// Deployment enables declarative updates for Pods and ReplicaSets.
type Deployment struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Specification of the desired behavior of the Deployment.
 // +optional
 Spec DeploymentSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // Most recently observed status of the Deployment.
 // +optional
 Status DeploymentStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

DeploymentSpec

// DeploymentSpec is the specification of the desired behavior of the Deployment.
type DeploymentSpec struct {
 // Number of desired pods. This is a pointer to distinguish between explicit
 // zero and not specified. Defaults to 1.
 // +optional
 Replicas *int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`

 // Label selector for pods. Existing ReplicaSets whose pods are
 // selected by this will be the ones affected by this deployment.
 // It must match the pod template's labels.
 Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,2,opt,name=selector"`

 // Template describes the pods that will be created.
 Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,3,opt,name=template"`

 // The deployment strategy to use to replace existing pods with new ones.
 // +optional
 // +patchStrategy=retainKeys
 Strategy DeploymentStrategy `json:"strategy,omitempty" patchStrategy:"retainKeys" protobuf:"bytes,4,opt,name=strategy"`

 // Minimum number of seconds for which a newly created pod should be ready
 // without any of its container crashing, for it to be considered available.
 // Defaults to 0 (pod will be considered available as soon as it is ready)
 // +optional
 MinReadySeconds int32 `json:"minReadySeconds,omitempty" protobuf:"varint,5,opt,name=minReadySeconds"`

 // The number of old ReplicaSets to retain to allow rollback.
 // This is a pointer to distinguish between explicit zero and not specified.
 // Defaults to 10.
 // +optional
 RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty" protobuf:"varint,6,opt,name=revisionHistoryLimit"`

 // Indicates that the deployment is paused.
 // +optional
 Paused bool `json:"paused,omitempty" protobuf:"varint,7,opt,name=paused"`

 // The maximum time in seconds for a deployment to make progress before it
 // is considered to be failed. The deployment controller will continue to
 // process failed deployments and a condition with a ProgressDeadlineExceeded
 // reason will be surfaced in the deployment status. Note that progress will
 // not be estimated during the time a deployment is paused. Defaults to 600s.
 // 通过使用 "kubectl rollout status deployment test" 超过这个时间未完成部署，则会出现以下错误信息：
 // error: deployment "test" exceeded its progress deadline
 ProgressDeadlineSeconds *int32 `json:"progressDeadlineSeconds,omitempty" protobuf:"varint,9,opt,name=progressDeadlineSeconds"`
}

metav1.LabelSelector

TODO;

v1.PodTemplateSpec

参考 Pods 资源。

DeploymentStrategy

// DeploymentStrategy describes how to replace existing pods with new ones.
type DeploymentStrategy struct {
 // Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate.
 // +optional
 Type DeploymentStrategyType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type,casttype=DeploymentStrategyType"`

 // Rolling update config params. Present only if DeploymentStrategyType =
 // RollingUpdate.
 //---
 // TODO: Update this to follow our convention for oneOf, whatever we decide it
 // to be.
 // +optional
 RollingUpdate *RollingUpdateDeployment `json:"rollingUpdate,omitempty" protobuf:"bytes,2,opt,name=rollingUpdate"`
}

type DeploymentStrategyType string

const (
 // Kill all existing pods before creating new ones.
 RecreateDeploymentStrategyType DeploymentStrategyType = "Recreate"

 // Replace the old ReplicaSets by new one using rolling update i.e gradually scale down the old ReplicaSets and scale up the new one.
 RollingUpdateDeploymentStrategyType DeploymentStrategyType = "RollingUpdate"
)

RollingUpdateDeployment

// Spec to control the desired behavior of rolling update.
type RollingUpdateDeployment struct {
 // The maximum number of pods that can be unavailable during the update.
 // Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
 // Absolute number is calculated from percentage by rounding down.
 // This can not be 0 if MaxSurge is 0.
 // Defaults to 25%.
 // Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods
 // immediately when the rolling update starts. Once new pods are ready, old ReplicaSet
 // can be scaled down further, followed by scaling up the new ReplicaSet, ensuring
 // that the total number of pods available at all times during the update is at
 // least 70% of desired pods.
 // +optional
 MaxUnavailable *intstr.IntOrString `json:"maxUnavailable,omitempty" protobuf:"bytes,1,opt,name=maxUnavailable"`

 // The maximum number of pods that can be scheduled above the desired number of
 // pods.
 // Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
 // This can not be 0 if MaxUnavailable is 0.
 // Absolute number is calculated from percentage by rounding up.
 // Defaults to 25%.
 // Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when
 // the rolling update starts, such that the total number of old and new pods do not exceed
 // 130% of desired pods. Once old pods have been killed,
 // new ReplicaSet can be scaled up further, ensuring that total number of pods running
 // at any time during the update is at most 130% of desired pods.
 // +optional
 MaxSurge *intstr.IntOrString `json:"maxSurge,omitempty" protobuf:"bytes,2,opt,name=maxSurge"`
}

intstr.IntOrString

TODO;

DeploymentStatus

// DeploymentStatus is the most recently observed status of the Deployment.
type DeploymentStatus struct {
 // The generation observed by the deployment controller.
 // +optional
 ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,1,opt,name=observedGeneration"`

 // Total number of non-terminated pods targeted by this deployment (their labels match the selector).
 // +optional
 Replicas int32 `json:"replicas,omitempty" protobuf:"varint,2,opt,name=replicas"`

 // Total number of non-terminated pods targeted by this deployment that have the desired template spec.
 // +optional
 UpdatedReplicas int32 `json:"updatedReplicas,omitempty" protobuf:"varint,3,opt,name=updatedReplicas"`

 // Total number of ready pods targeted by this deployment.
 // +optional
 ReadyReplicas int32 `json:"readyReplicas,omitempty" protobuf:"varint,7,opt,name=readyReplicas"`

 // Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.
 // +optional
 AvailableReplicas int32 `json:"availableReplicas,omitempty" protobuf:"varint,4,opt,name=availableReplicas"`

 // Total number of unavailable pods targeted by this deployment. This is the total number of
 // pods that are still required for the deployment to have 100% available capacity. They may
 // either be pods that are running but not yet available or pods that still have not been created.
 // +optional
 UnavailableReplicas int32 `json:"unavailableReplicas,omitempty" protobuf:"varint,5,opt,name=unavailableReplicas"`

 // Represents the latest available observations of a deployment's current state.
 // +patchMergeKey=type
 // +patchStrategy=merge
 Conditions []DeploymentCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,6,rep,name=conditions"`

 // Count of hash collisions for the Deployment. The Deployment controller uses this
 // field as a collision avoidance mechanism when it needs to create the name for the
 // newest ReplicaSet.
 // +optional
 CollisionCount *int32 `json:"collisionCount,omitempty" protobuf:"varint,8,opt,name=collisionCount"`
}

DeploymentCondition

type DeploymentConditionType string

// These are valid conditions of a deployment.
const (
 // Available means the deployment is available, ie. at least the minimum available
 // replicas required are up and running for at least minReadySeconds.
 DeploymentAvailable DeploymentConditionType = "Available"
 // Progressing means the deployment is progressing. Progress for a deployment is
 // considered when a new replica set is created or adopted, and when new pods scale
 // up or old pods scale down. Progress is not estimated for paused deployments or
 // when progressDeadlineSeconds is not specified.
 DeploymentProgressing DeploymentConditionType = "Progressing"
 // ReplicaFailure is added in a deployment when one of its pods fails to be created
 // or deleted.
 DeploymentReplicaFailure DeploymentConditionType = "ReplicaFailure"
)

// DeploymentCondition describes the state of a deployment at a certain point.
type DeploymentCondition struct {
 // Type of deployment condition.
 Type DeploymentConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=DeploymentConditionType"`
 // Status of the condition, one of True, False, Unknown.
 Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 // The last time this condition was updated.
 LastUpdateTime metav1.Time `json:"lastUpdateTime,omitempty" protobuf:"bytes,6,opt,name=lastUpdateTime"`
 // Last time the condition transitioned from one status to another.
 LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,7,opt,name=lastTransitionTime"`
 // The reason for the condition's last transition.
 Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 // A human readable message indicating details about the transition.
 Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
}

v1.ConditionStatus

参考 Pods 资源。

metav1.Time

TODO;

Docs: Endpoints

Mon, 09 Jan 2023 16:50:49 +0800

简要概述

属于组：“corev1”

{Group: corev1.GroupName, Kind: "Endpoints"}

代码路径：

staging/src/k8s.io/api/core/v1/types.go

当一个 POD 发生重启时，如果是 Endpoint 资源，它在 etcd 中的结构是一整块数据，则需全量更新，如果是 EndpointSlice 资源，则仅更新其中一小块，因为它在 etcd 中是分成几块内容。

配置示例

apiVersion: v1
kind: Endpoints
metadata:
 name: platform-mysql
 namespace: biz-prod-qe2bu3
subsets:
- addresses:
 - ip: 172.27.2.78
 - ip: 172.27.2.79
 - ip: 172.27.2.80
 ports:
 - port: 6033

数据结构

Endpoints

staging/src/k8s.io/api/core/v1/types.go

// Endpoints is a collection of endpoints that implement the actual service. Example:
// Name: "mysvc",
// Subsets: [
// {
// Addresses: [{"ip": "10.10.1.1"}, {"ip": "10.10.2.2"}],
// Ports: [{"name": "a", "port": 8675}, {"name": "b", "port": 309}]
// },
// {
// Addresses: [{"ip": "10.10.3.3"}],
// Ports: [{"name": "a", "port": 93}, {"name": "b", "port": 76}]
// },
// ]
type Endpoints struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // The set of all endpoints is the union of all subsets. Addresses are placed into
 // subsets according to the IPs they share. A single address with multiple ports,
 // some of which are ready and some of which are not (because they come from
 // different containers) will result in the address being displayed in different
 // subsets for the different ports. No address will appear in both Addresses and
 // NotReadyAddresses in the same subset.
 // Sets of addresses and ports that comprise a service.
 // +optional
 Subsets []EndpointSubset `json:"subsets,omitempty" protobuf:"bytes,2,rep,name=subsets"`
}

EndpointSubset

staging/src/k8s.io/api/core/v1/types.go

// EndpointSubset is a group of addresses with a common set of ports. The
// expanded set of endpoints is the Cartesian product of Addresses x Ports.
// For example, given:
// {
// Addresses: [{"ip": "10.10.1.1"}, {"ip": "10.10.2.2"}],
// Ports: [{"name": "a", "port": 8675}, {"name": "b", "port": 309}]
// }
// The resulting set of endpoints can be viewed as:
// a: [ 10.10.1.1:8675, 10.10.2.2:8675 ],
// b: [ 10.10.1.1:309, 10.10.2.2:309 ]
type EndpointSubset struct {
 // IP addresses which offer the related ports that are marked as ready. These endpoints
 // should be considered safe for load balancers and clients to utilize.
 // +optional
 Addresses []EndpointAddress `json:"addresses,omitempty" protobuf:"bytes,1,rep,name=addresses"`
 // IP addresses which offer the related ports but are not currently marked as ready
 // because they have not yet finished starting, have recently failed a readiness check,
 // or have recently failed a liveness check.
 // +optional
 NotReadyAddresses []EndpointAddress `json:"notReadyAddresses,omitempty" protobuf:"bytes,2,rep,name=notReadyAddresses"`
 // Port numbers available on the related IP addresses.
 // +optional
 Ports []EndpointPort `json:"ports,omitempty" protobuf:"bytes,3,rep,name=ports"`
}

EndpointAddress

staging/src/k8s.io/api/core/v1/types.go

// EndpointAddress is a tuple that describes single IP address.
// +structType=atomic
type EndpointAddress struct {
 // The IP of this endpoint.
 // May not be loopback (127.0.0.0/8), link-local (169.254.0.0/16),
 // or link-local multicast ((224.0.0.0/24).
 // IPv6 is also accepted but not fully supported on all platforms. Also, certain
 // kubernetes components, like kube-proxy, are not IPv6 ready.
 // TODO: This should allow hostname or IP, See #4447.
 IP string `json:"ip" protobuf:"bytes,1,opt,name=ip"`
 // The Hostname of this endpoint
 // +optional
 Hostname string `json:"hostname,omitempty" protobuf:"bytes,3,opt,name=hostname"`
 // Optional: Node hosting this endpoint. This can be used to determine endpoints local to a node.
 // +optional
 NodeName *string `json:"nodeName,omitempty" protobuf:"bytes,4,opt,name=nodeName"`
 // Reference to object providing the endpoint.
 // +optional
 TargetRef *ObjectReference `json:"targetRef,omitempty" protobuf:"bytes,2,opt,name=targetRef"`
}

EndpointPort

staging/src/k8s.io/api/core/v1/types.go

// EndpointPort is a tuple that describes a single port.
// +structType=atomic
type EndpointPort struct {
 // The name of this port. This must match the 'name' field in the
 // corresponding ServicePort.
 // Must be a DNS_LABEL.
 // Optional only if one port is defined.
 // +optional
 Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`

 // The port number of the endpoint.
 Port int32 `json:"port" protobuf:"varint,2,opt,name=port"`

 // The IP protocol for this port.
 // Must be UDP, TCP, or SCTP.
 // Default is TCP.
 // +optional
 Protocol Protocol `json:"protocol,omitempty" protobuf:"bytes,3,opt,name=protocol,casttype=Protocol"`

 // The application protocol for this port.
 // This field follows standard Kubernetes label syntax.
 // Un-prefixed names are reserved for IANA standard service names (as per
 // RFC-6335 and http://www.iana.org/assignments/service-names).
 // Non-standard protocols should use prefixed names such as
 // mycompany.com/my-custom-protocol.
 // +optional
 AppProtocol *string `json:"appProtocol,omitempty" protobuf:"bytes,4,opt,name=appProtocol"`
}

Protocol

// Protocol defines network protocols supported for things like container ports.
type Protocol string

const (
 // ProtocolTCP is the TCP protocol.
 ProtocolTCP Protocol = "TCP"
 // ProtocolUDP is the UDP protocol.
 ProtocolUDP Protocol = "UDP"
 // ProtocolSCTP is the SCTP protocol.
 ProtocolSCTP Protocol = "SCTP"
)

ObjectReference

// ObjectReference contains enough information to let you inspect or modify the referred object.
// ---
// New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
// 1. Ignored fields. It includes many fields which are not generally honored. For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
// 2. Invalid usage help. It is impossible to add specific help for individual usage. In most embedded usages, there are particular
// restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
// Those cannot be well described when embedded.
// 3. Inconsistent validation. Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
// 4. The fields are both imprecise and overly precise. Kind is not a precise mapping to a URL. This can produce ambiguity
// during interpretation and require a REST mapping. In most cases, the dependency is on the group,resource tuple
// and the version of the actual struct is irrelevant.
// 5. We cannot easily change it. Because this type is embedded in many locations, updates to this type
// will affect numerous schemas. Don't make new APIs embed an underspecified API type they do not control.
// Instead of using this type, create a locally provided and used type that is well-focused on your reference.
// For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
// +structType=atomic
type ObjectReference struct {
 // Kind of the referent.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 // +optional
 Kind string `json:"kind,omitempty" protobuf:"bytes,1,opt,name=kind"`
 // Namespace of the referent.
 // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
 // +optional
 Namespace string `json:"namespace,omitempty" protobuf:"bytes,2,opt,name=namespace"`
 // Name of the referent.
 // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 // +optional
 Name string `json:"name,omitempty" protobuf:"bytes,3,opt,name=name"`
 // UID of the referent.
 // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
 // +optional
 UID types.UID `json:"uid,omitempty" protobuf:"bytes,4,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
 // API version of the referent.
 // +optional
 APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,5,opt,name=apiVersion"`
 // Specific resourceVersion to which this reference is made, if any.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
 // +optional
 ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,6,opt,name=resourceVersion"`

 // If referring to a piece of an object instead of an entire object, this string
 // should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
 // For example, if the object reference is to a container within a pod, this would take on a value like:
 // "spec.containers{name}" (where "name" refers to the name of the container that triggered
 // the event) or if no container name is specified "spec.containers[2]" (container with
 // index 2 in this pod). This syntax is chosen only to have some well-defined way of
 // referencing a part of an object.
 // TODO: this design is not final and this field is subject to change in the future.
 // +optional
 FieldPath string `json:"fieldPath,omitempty" protobuf:"bytes,7,opt,name=fieldPath"`
}

Docs: StatefulSet

Fri, 05 May 2023 18:07:28 +0800

简要概述

staging/src/k8s.io/api/apps/v1/types.go

查看官方介绍

常用指令

TODO;

配置示例

通过 kubectl 创建

无法通过 kubectl 命令行直接创建该资源，可先创建 Deployment 资源然后在更改 yaml 文件。

kubectl create deployment nginx \
 --image=registry.cn-hangzhou.aliyuncs.com/kube-image-repo/nginx:1.23.2 \
 --dry-run=client \
 -o yaml

更改 kind 为 StatefulSet 同时移除生成 yaml 中 strategy、status，在添加 serviceName 属性。

通过 yaml 创建

apiVersion: apps/v1
kind: StatefulSet
metadata:
 creationTimestamp: null
 labels:
 app: nginx
 name: nginx 
spec:
 replicas: 1
 serviceName: nginx
 selector:
 matchLabels:
 app: nginx
 #strategy: {}
 template:
 metadata:
 creationTimestamp: null
 labels:
 app: nginx
 spec:
 containers:
 - image: registry.cn-hangzhou.aliyuncs.com/kube-image-repo/nginx:1.23.2
 name: nginx
 resources: {}

一般均配合不分配 VIP 的 Service 类型（无头服务）使用：

apiVersion: v1
kind: Service
metadata:
 name: nginx
 labels:
 app: nginx
spec:
 ports:
 - port: 80
 name: web
 clusterIP: None
 selector:
 app: nginx

此时可以使用 DNS 格式解析各个 POD：

{POD_NAME}.{serviceName}.{namespace}.svc.{cluster_domain}

既以上一个 POD 域名为：

nginx-0.nginx.default.svc.cluster.local

数据结构

StatefulSet

// StatefulSet represents a set of pods with consistent identities.
// Identities are defined as:
// - Network: A single stable DNS and hostname.
// - Storage: As many VolumeClaims as requested.
// The StatefulSet guarantees that a given network identity will always
// map to the same storage identity.
type StatefulSet struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Spec defines the desired identities of pods in this set.
 // +optional
 Spec StatefulSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // Status is the current status of Pods in this StatefulSet. This data
 // may be out of date by some window of time.
 // +optional
 Status StatefulSetStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

StatefulSetSpec

// A StatefulSetSpec is the specification of a StatefulSet.
type StatefulSetSpec struct {
 // replicas is the desired number of replicas of the given Template.
 // These are replicas in the sense that they are instantiations of the
 // same Template, but individual replicas also have a consistent identity.
 // If unspecified, defaults to 1.
 // TODO: Consider a rename of this field.
 // +optional
 Replicas *int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`

 // selector is a label query over pods that should match the replica count.
 // It must match the pod template's labels.
 // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
 Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,2,opt,name=selector"`

 // template is the object that describes the pod that will be created if
 // insufficient replicas are detected. Each pod stamped out by the StatefulSet
 // will fulfill this Template, but have a unique identity from the rest
 // of the StatefulSet.
 Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,3,opt,name=template"`

 // volumeClaimTemplates is a list of claims that pods are allowed to reference.
 // The StatefulSet controller is responsible for mapping network identities to
 // claims in a way that maintains the identity of a pod. Every claim in
 // this list must have at least one matching (by name) volumeMount in one
 // container in the template. A claim in this list takes precedence over
 // any volumes in the template, with the same name.
 // TODO: Define the behavior if a claim already exists with the same name.
 // +optional
 VolumeClaimTemplates []v1.PersistentVolumeClaim `json:"volumeClaimTemplates,omitempty" protobuf:"bytes,4,rep,name=volumeClaimTemplates"`

 // serviceName is the name of the service that governs this StatefulSet.
 // This service must exist before the StatefulSet, and is responsible for
 // the network identity of the set. Pods get DNS/hostnames that follow the
 // pattern: pod-specific-string.serviceName.default.svc.cluster.local
 // where "pod-specific-string" is managed by the StatefulSet controller.
 ServiceName string `json:"serviceName" protobuf:"bytes,5,opt,name=serviceName"`

 // podManagementPolicy controls how pods are created during initial scale up,
 // when replacing pods on nodes, or when scaling down. The default policy is
 // `OrderedReady`, where pods are created in increasing order (pod-0, then
 // pod-1, etc) and the controller will wait until each pod is ready before
 // continuing. When scaling down, the pods are removed in the opposite order.
 // The alternative policy is `Parallel` which will create pods in parallel
 // to match the desired scale without waiting, and on scale down will delete
 // all pods at once.
 // +optional
 PodManagementPolicy PodManagementPolicyType `json:"podManagementPolicy,omitempty" protobuf:"bytes,6,opt,name=podManagementPolicy,casttype=PodManagementPolicyType"`

 // updateStrategy indicates the StatefulSetUpdateStrategy that will be
 // employed to update Pods in the StatefulSet when a revision is made to
 // Template.
 UpdateStrategy StatefulSetUpdateStrategy `json:"updateStrategy,omitempty" protobuf:"bytes,7,opt,name=updateStrategy"`

 // revisionHistoryLimit is the maximum number of revisions that will
 // be maintained in the StatefulSet's revision history. The revision history
 // consists of all revisions not represented by a currently applied
 // StatefulSetSpec version. The default value is 10.
 RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty" protobuf:"varint,8,opt,name=revisionHistoryLimit"`

 // Minimum number of seconds for which a newly created pod should be ready
 // without any of its container crashing for it to be considered available.
 // Defaults to 0 (pod will be considered available as soon as it is ready)
 // This is an alpha field and requires enabling StatefulSetMinReadySeconds feature gate.
 // +optional
 MinReadySeconds int32 `json:"minReadySeconds,omitempty" protobuf:"varint,9,opt,name=minReadySeconds"`
}

metav1.LabelSelector

TODO;

v1.PodTemplateSpec

参考 Pods 资源。

v1.PersistentVolumeClaim

TODO;

PodManagementPolicyType

// PodManagementPolicyType defines the policy for creating pods under a stateful set.
type PodManagementPolicyType string

const (
 // OrderedReadyPodManagement will create pods in strictly increasing order on
 // scale up and strictly decreasing order on scale down, progressing only when
 // the previous pod is ready or terminated. At most one pod will be changed
 // at any time.
 OrderedReadyPodManagement PodManagementPolicyType = "OrderedReady"
 // ParallelPodManagement will create and delete pods as soon as the stateful set
 // replica count is changed, and will not wait for pods to be ready or complete
 // termination.
 ParallelPodManagement PodManagementPolicyType = "Parallel"
)

StatefulSetUpdateStrategy

// StatefulSetUpdateStrategy indicates the strategy that the StatefulSet
// controller will use to perform updates. It includes any additional parameters
// necessary to perform the update for the indicated strategy.
type StatefulSetUpdateStrategy struct {
 // Type indicates the type of the StatefulSetUpdateStrategy.
 // Default is RollingUpdate.
 // +optional
 Type StatefulSetUpdateStrategyType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type,casttype=StatefulSetStrategyType"`
 // RollingUpdate is used to communicate parameters when Type is RollingUpdateStatefulSetStrategyType.
 // +optional
 RollingUpdate *RollingUpdateStatefulSetStrategy `json:"rollingUpdate,omitempty" protobuf:"bytes,2,opt,name=rollingUpdate"`
}

// StatefulSetUpdateStrategyType is a string enumeration type that enumerates
// all possible update strategies for the StatefulSet controller.
type StatefulSetUpdateStrategyType string

const (
 // RollingUpdateStatefulSetStrategyType indicates that update will be
 // applied to all Pods in the StatefulSet with respect to the StatefulSet
 // ordering constraints. When a scale operation is performed with this
 // strategy, new Pods will be created from the specification version indicated
 // by the StatefulSet's updateRevision.
 RollingUpdateStatefulSetStrategyType StatefulSetUpdateStrategyType = "RollingUpdate"
 // OnDeleteStatefulSetStrategyType triggers the legacy behavior. Version
 // tracking and ordered rolling restarts are disabled. Pods are recreated
 // from the StatefulSetSpec when they are manually deleted. When a scale
 // operation is performed with this strategy,specification version indicated
 // by the StatefulSet's currentRevision.
 OnDeleteStatefulSetStrategyType StatefulSetUpdateStrategyType = "OnDelete"
)

// RollingUpdateStatefulSetStrategy is used to communicate parameter for RollingUpdateStatefulSetStrategyType.
type RollingUpdateStatefulSetStrategy struct {
 // Partition indicates the ordinal at which the StatefulSet should be
 // partitioned.
 // Default value is 0.
 // +optional
 Partition *int32 `json:"partition,omitempty" protobuf:"varint,1,opt,name=partition"`
}

StatefulSetStatus

// StatefulSetStatus represents the current state of a StatefulSet.
type StatefulSetStatus struct {
 // observedGeneration is the most recent generation observed for this StatefulSet. It corresponds to the
 // StatefulSet's generation, which is updated on mutation by the API Server.
 // +optional
 ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,1,opt,name=observedGeneration"`

 // replicas is the number of Pods created by the StatefulSet controller.
 Replicas int32 `json:"replicas" protobuf:"varint,2,opt,name=replicas"`

 // readyReplicas is the number of Pods created by the StatefulSet controller that have a Ready Condition.
 ReadyReplicas int32 `json:"readyReplicas,omitempty" protobuf:"varint,3,opt,name=readyReplicas"`

 // currentReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version
 // indicated by currentRevision.
 CurrentReplicas int32 `json:"currentReplicas,omitempty" protobuf:"varint,4,opt,name=currentReplicas"`

 // updatedReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version
 // indicated by updateRevision.
 UpdatedReplicas int32 `json:"updatedReplicas,omitempty" protobuf:"varint,5,opt,name=updatedReplicas"`

 // currentRevision, if not empty, indicates the version of the StatefulSet used to generate Pods in the
 // sequence [0,currentReplicas).
 CurrentRevision string `json:"currentRevision,omitempty" protobuf:"bytes,6,opt,name=currentRevision"`

 // updateRevision, if not empty, indicates the version of the StatefulSet used to generate Pods in the sequence
 // [replicas-updatedReplicas,replicas)
 UpdateRevision string `json:"updateRevision,omitempty" protobuf:"bytes,7,opt,name=updateRevision"`

 // collisionCount is the count of hash collisions for the StatefulSet. The StatefulSet controller
 // uses this field as a collision avoidance mechanism when it needs to create the name for the
 // newest ControllerRevision.
 // +optional
 CollisionCount *int32 `json:"collisionCount,omitempty" protobuf:"varint,9,opt,name=collisionCount"`

 // Represents the latest available observations of a statefulset's current state.
 // +optional
 // +patchMergeKey=type
 // +patchStrategy=merge
 Conditions []StatefulSetCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,10,rep,name=conditions"`

 // Total number of available pods (ready for at least minReadySeconds) targeted by this statefulset.
 // This is an alpha field and requires enabling StatefulSetMinReadySeconds feature gate.
 // Remove omitempty when graduating to beta
 // +optional
 AvailableReplicas int32 `json:"availableReplicas,omitempty" protobuf:"varint,11,opt,name=availableReplicas"`
}

StatefulSetCondition

type StatefulSetConditionType string

// StatefulSetCondition describes the state of a statefulset at a certain point.
type StatefulSetCondition struct {
 // Type of statefulset condition.
 Type StatefulSetConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=StatefulSetConditionType"`
 // Status of the condition, one of True, False, Unknown.
 Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 // Last time the condition transitioned from one status to another.
 // +optional
 LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 // The reason for the condition's last transition.
 // +optional
 Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 // A human readable message indicating details about the transition.
 // +optional
 Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
}

v1.ConditionStatus

参考 Pods 资源。

Docs: EndpointSlice

Wed, 01 Feb 2023 22:35:51 +0800

简要概述

属于组：“discovery.k8s.io”

{Group: discoveryv1.GroupName, Kind: "EndpointSlice"}

代码路径：

staging/src/k8s.io/api/discovery/v1/types.go

配置示例

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 labels:
 kubernetes.io/service-name: tidb-proxy
 name: tidb-proxy-ljzbz
 namespace: default
 ownerReferences:
addressType: IPv4
endpoints:
- addresses:
 - 192.168.31.201
 conditions:
 ready: true
- addresses:
 - 192.168.31.202
 conditions:
 ready: true
- addresses:
 - 192.168.31.203
 conditions:
 ready: true
ports:
- name: ""
 port: 6443
 protocol: TCP

数据结构

EndpointSlice

staging/src/k8s.io/api/discovery/v1/types.go

// EndpointSlice represents a subset of the endpoints that implement a service.
// For a given service there may be multiple EndpointSlice objects, selected by
// labels, which must be joined to produce the full set of endpoints.
type EndpointSlice struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 // addressType specifies the type of address carried by this EndpointSlice.
 // All addresses in this slice must be the same type. This field is
 // immutable after creation. The following address types are currently
 // supported:
 // * IPv4: Represents an IPv4 Address.
 // * IPv6: Represents an IPv6 Address.
 // * FQDN: Represents a Fully Qualified Domain Name.
 AddressType AddressType `json:"addressType" protobuf:"bytes,4,rep,name=addressType"`
 // endpoints is a list of unique endpoints in this slice. Each slice may
 // include a maximum of 1000 endpoints.
 // +listType=atomic
 Endpoints []Endpoint `json:"endpoints" protobuf:"bytes,2,rep,name=endpoints"`
 // ports specifies the list of network ports exposed by each endpoint in
 // this slice. Each port must have a unique name. When ports is empty, it
 // indicates that there are no defined ports. When a port is defined with a
 // nil port value, it indicates "all ports". Each slice may include a
 // maximum of 100 ports.
 // +optional
 // +listType=atomic
 Ports []EndpointPort `json:"ports" protobuf:"bytes,3,rep,name=ports"`
}

AddressType

// AddressType represents the type of address referred to by an endpoint.
type AddressType string

const (
 // AddressTypeIPv4 represents an IPv4 Address.
 AddressTypeIPv4 = AddressType(v1.IPv4Protocol)
 // AddressTypeIPv6 represents an IPv6 Address.
 AddressTypeIPv6 = AddressType(v1.IPv6Protocol)
 // AddressTypeFQDN represents a FQDN.
 AddressTypeFQDN = AddressType("FQDN")
)

Endpoint

// Endpoint represents a single logical "backend" implementing a service.
type Endpoint struct {
 // addresses of this endpoint. The contents of this field are interpreted
 // according to the corresponding EndpointSlice addressType field. Consumers
 // must handle different types of addresses in the context of their own
 // capabilities. This must contain at least one address but no more than
 // 100.
 // +listType=set
 Addresses []string `json:"addresses" protobuf:"bytes,1,rep,name=addresses"`
 // conditions contains information about the current status of the endpoint.
 Conditions EndpointConditions `json:"conditions,omitempty" protobuf:"bytes,2,opt,name=conditions"`
 // hostname of this endpoint. This field may be used by consumers of
 // endpoints to distinguish endpoints from each other (e.g. in DNS names).
 // Multiple endpoints which use the same hostname should be considered
 // fungible (e.g. multiple A values in DNS). Must be lowercase and pass DNS
 // Label (RFC 1123) validation.
 // +optional
 Hostname *string `json:"hostname,omitempty" protobuf:"bytes,3,opt,name=hostname"`
 // targetRef is a reference to a Kubernetes object that represents this
 // endpoint.
 // +optional
 TargetRef *v1.ObjectReference `json:"targetRef,omitempty" protobuf:"bytes,4,opt,name=targetRef"`

 // deprecatedTopology contains topology information part of the v1beta1
 // API. This field is deprecated, and will be removed when the v1beta1
 // API is removed (no sooner than kubernetes v1.24). While this field can
 // hold values, it is not writable through the v1 API, and any attempts to
 // write to it will be silently ignored. Topology information can be found
 // in the zone and nodeName fields instead.
 // +optional
 DeprecatedTopology map[string]string `json:"deprecatedTopology,omitempty" protobuf:"bytes,5,opt,name=deprecatedTopology"`

 // nodeName represents the name of the Node hosting this endpoint. This can
 // be used to determine endpoints local to a Node. This field can be enabled
 // with the EndpointSliceNodeName feature gate.
 // +optional
 NodeName *string `json:"nodeName,omitempty" protobuf:"bytes,6,opt,name=nodeName"`
 // zone is the name of the Zone this endpoint exists in.
 // +optional
 Zone *string `json:"zone,omitempty" protobuf:"bytes,7,opt,name=zone"`
 // hints contains information associated with how an endpoint should be
 // consumed.
 // +optional
 Hints *EndpointHints `json:"hints,omitempty" protobuf:"bytes,8,opt,name=hints"`
}

EndpointConditions

// EndpointConditions represents the current condition of an endpoint.
type EndpointConditions struct {
 // ready indicates that this endpoint is prepared to receive traffic,
 // according to whatever system is managing the endpoint. A nil value
 // indicates an unknown state. In most cases consumers should interpret this
 // unknown state as ready. For compatibility reasons, ready should never be
 // "true" for terminating endpoints.
 // +optional
 Ready *bool `json:"ready,omitempty" protobuf:"bytes,1,name=ready"`

 // serving is identical to ready except that it is set regardless of the
 // terminating state of endpoints. This condition should be set to true for
 // a ready endpoint that is terminating. If nil, consumers should defer to
 // the ready condition. This field can be enabled with the
 // EndpointSliceTerminatingCondition feature gate.
 // +optional
 Serving *bool `json:"serving,omitempty" protobuf:"bytes,2,name=serving"`

 // terminating indicates that this endpoint is terminating. A nil value
 // indicates an unknown state. Consumers should interpret this unknown state
 // to mean that the endpoint is not terminating. This field can be enabled
 // with the EndpointSliceTerminatingCondition feature gate.
 // +optional
 Terminating *bool `json:"terminating,omitempty" protobuf:"bytes,3,name=terminating"`
}

EndpointPort

由 EndpointSlice.Endpoint 数据结构，区别

// EndpointPort represents a Port used by an EndpointSlice
// +structType=atomic
type EndpointPort struct {
 // The name of this port. All ports in an EndpointSlice must have a unique
 // name. If the EndpointSlice is dervied from a Kubernetes service, this
 // corresponds to the Service.ports[].name.
 // Name must either be an empty string or pass DNS_LABEL validation:
 // * must be no more than 63 characters long.
 // * must consist of lower case alphanumeric characters or '-'.
 // * must start and end with an alphanumeric character.
 // Default is empty string.
 Name *string `json:"name,omitempty" protobuf:"bytes,1,name=name"`
 // The IP protocol for this port.
 // Must be UDP, TCP, or SCTP.
 // Default is TCP.
 Protocol *v1.Protocol `json:"protocol,omitempty" protobuf:"bytes,2,name=protocol"`
 // The port number of the endpoint.
 // If this is not specified, ports are not restricted and must be
 // interpreted in the context of the specific consumer.
 Port *int32 `json:"port,omitempty" protobuf:"bytes,3,opt,name=port"`
 // The application protocol for this port.
 // This field follows standard Kubernetes label syntax.
 // Un-prefixed names are reserved for IANA standard service names (as per
 // RFC-6335 and http://www.iana.org/assignments/service-names).
 // Non-standard protocols should use prefixed names such as
 // mycompany.com/my-custom-protocol.
 // +optional
 AppProtocol *string `json:"appProtocol,omitempty" protobuf:"bytes,4,name=appProtocol"`
}

EndpointHints

// EndpointHints provides hints describing how an endpoint should be consumed.
type EndpointHints struct {
 // forZones indicates the zone(s) this endpoint should be consumed by to
 // enable topology aware routing.
 // +listType=atomic
 ForZones []ForZone `json:"forZones,omitempty" protobuf:"bytes,1,name=forZones"`
}

// ForZone provides information about which zones should consume this endpoint.
type ForZone struct {
 // name represents the name of the zone.
 Name string `json:"name" protobuf:"bytes,1,name=name"`
}

v1.ObjectReference

见 ObjectReference

v1.Protocol

见 Protocol

Docs: DaemonSet

Fri, 05 May 2023 18:07:28 +0800

简要概述

staging/src/k8s.io/api/apps/v1/types.go

查看官方介绍

常用指令

TODO;

配置示例

通过 kubectl 创建

无法直接通过命令行创建该资源，可先创建 Deployment 然后以此为模版更改 yaml 内容。

kubectl create deployment busybox \
 --image=registry.cn-hangzhou.aliyuncs.com/opsaid/busybox:1.35.0 \
 --dry-run=client \
 -o yaml \
 -- /bin/sh -c sleep 3600

更改 kind 为 DaemonSet 同时移除生成 yaml 中 replicas、strategy、status 三个属性。

通过 yaml 创建

apiVersion: apps/v1
kind: DaemonSet
metadata:
 creationTimestamp: null
 labels:
 app: busybox
 name: busybox
spec:
 #replicas: 3
 selector:
 matchLabels:
 app: busybox
 #strategy: {}
 template:
 metadata:
 creationTimestamp: null
 labels:
 app: busybox
 spec:
 containers:
 - command:
 - /bin/sh
 - -c
 - sleep 3600
 image: registry.cn-hangzhou.aliyuncs.com/opsaid/busybox:1.35.0
 name: busybox
 resources: {}

数据结构

DaemonSet

// DaemonSet represents the configuration of a daemon set.
type DaemonSet struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // The desired behavior of this daemon set.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Spec DaemonSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // The current status of this daemon set. This data may be
 // out of date by some window of time.
 // Populated by the system.
 // Read-only.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Status DaemonSetStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

DaemonSetSpec

// DaemonSetSpec is the specification of a daemon set.
type DaemonSetSpec struct {
 // A label query over pods that are managed by the daemon set.
 // Must match in order to be controlled.
 // It must match the pod template's labels.
 // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
 Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,1,opt,name=selector"`

 // An object that describes the pod that will be created.
 // The DaemonSet will create exactly one copy of this pod on every node
 // that matches the template's node selector (or on every node if no node
 // selector is specified).
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
 Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,2,opt,name=template"`

 // An update strategy to replace existing DaemonSet pods with new pods.
 // +optional
 UpdateStrategy DaemonSetUpdateStrategy `json:"updateStrategy,omitempty" protobuf:"bytes,3,opt,name=updateStrategy"`

 // The minimum number of seconds for which a newly created DaemonSet pod should
 // be ready without any of its container crashing, for it to be considered
 // available. Defaults to 0 (pod will be considered available as soon as it
 // is ready).
 // +optional
 MinReadySeconds int32 `json:"minReadySeconds,omitempty" protobuf:"varint,4,opt,name=minReadySeconds"`

 // The number of old history to retain to allow rollback.
 // This is a pointer to distinguish between explicit zero and not specified.
 // Defaults to 10.
 // +optional
 RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty" protobuf:"varint,6,opt,name=revisionHistoryLimit"`
}

metav1.LabelSelector

TODO;

v1.PodTemplateSpec

参考 Pods 资源。

DaemonSetUpdateStrategy

// DaemonSetUpdateStrategy is a struct used to control the update strategy for a DaemonSet.
type DaemonSetUpdateStrategy struct {
 // Type of daemon set update. Can be "RollingUpdate" or "OnDelete". Default is RollingUpdate.
 // +optional
 Type DaemonSetUpdateStrategyType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type"`

 // Rolling update config params. Present only if type = "RollingUpdate".
 //---
 // TODO: Update this to follow our convention for oneOf, whatever we decide it
 // to be. Same as Deployment `strategy.rollingUpdate`.
 // See https://github.com/kubernetes/kubernetes/issues/35345
 // +optional
 RollingUpdate *RollingUpdateDaemonSet `json:"rollingUpdate,omitempty" protobuf:"bytes,2,opt,name=rollingUpdate"`
}

type DaemonSetUpdateStrategyType string

const (
 // Replace the old daemons by new ones using rolling update i.e replace them on each node one after the other.
 RollingUpdateDaemonSetStrategyType DaemonSetUpdateStrategyType = "RollingUpdate"

 // Replace the old daemons only when it's killed
 OnDeleteDaemonSetStrategyType DaemonSetUpdateStrategyType = "OnDelete"
)

RollingUpdateDaemonSet

// Spec to control the desired behavior of daemon set rolling update.
type RollingUpdateDaemonSet struct {
 // The maximum number of DaemonSet pods that can be unavailable during the
 // update. Value can be an absolute number (ex: 5) or a percentage of total
 // number of DaemonSet pods at the start of the update (ex: 10%). Absolute
 // number is calculated from percentage by rounding up.
 // This cannot be 0 if MaxSurge is 0
 // Default value is 1.
 // Example: when this is set to 30%, at most 30% of the total number of nodes
 // that should be running the daemon pod (i.e. status.desiredNumberScheduled)
 // can have their pods stopped for an update at any given time. The update
 // starts by stopping at most 30% of those DaemonSet pods and then brings
 // up new DaemonSet pods in their place. Once the new pods are available,
 // it then proceeds onto other DaemonSet pods, thus ensuring that at least
 // 70% of original number of DaemonSet pods are available at all times during
 // the update.
 // +optional
 MaxUnavailable *intstr.IntOrString `json:"maxUnavailable,omitempty" protobuf:"bytes,1,opt,name=maxUnavailable"`

 // The maximum number of nodes with an existing available DaemonSet pod that
 // can have an updated DaemonSet pod during during an update.
 // Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
 // This can not be 0 if MaxUnavailable is 0.
 // Absolute number is calculated from percentage by rounding up to a minimum of 1.
 // Default value is 0.
 // Example: when this is set to 30%, at most 30% of the total number of nodes
 // that should be running the daemon pod (i.e. status.desiredNumberScheduled)
 // can have their a new pod created before the old pod is marked as deleted.
 // The update starts by launching new pods on 30% of nodes. Once an updated
 // pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
 // on that node is marked deleted. If the old pod becomes unavailable for any
 // reason (Ready transitions to false, is evicted, or is drained) an updated
 // pod is immediatedly created on that node without considering surge limits.
 // Allowing surge implies the possibility that the resources consumed by the
 // daemonset on any given node can double if the readiness check fails, and
 // so resource intensive daemonsets should take into account that they may
 // cause evictions during disruption.
 // This is beta field and enabled/disabled by DaemonSetUpdateSurge feature gate.
 // +optional
 MaxSurge *intstr.IntOrString `json:"maxSurge,omitempty" protobuf:"bytes,2,opt,name=maxSurge"`
}

DaemonSetStatus

// DaemonSetStatus represents the current status of a daemon set.
type DaemonSetStatus struct {
 // The number of nodes that are running at least 1
 // daemon pod and are supposed to run the daemon pod.
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
 CurrentNumberScheduled int32 `json:"currentNumberScheduled" protobuf:"varint,1,opt,name=currentNumberScheduled"`

 // The number of nodes that are running the daemon pod, but are
 // not supposed to run the daemon pod.
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
 NumberMisscheduled int32 `json:"numberMisscheduled" protobuf:"varint,2,opt,name=numberMisscheduled"`

 // The total number of nodes that should be running the daemon
 // pod (including nodes correctly running the daemon pod).
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
 DesiredNumberScheduled int32 `json:"desiredNumberScheduled" protobuf:"varint,3,opt,name=desiredNumberScheduled"`

 // The number of nodes that should be running the daemon pod and have one
 // or more of the daemon pod running and ready.
 NumberReady int32 `json:"numberReady" protobuf:"varint,4,opt,name=numberReady"`

 // The most recent generation observed by the daemon set controller.
 // +optional
 ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,5,opt,name=observedGeneration"`

 // The total number of nodes that are running updated daemon pod
 // +optional
 UpdatedNumberScheduled int32 `json:"updatedNumberScheduled,omitempty" protobuf:"varint,6,opt,name=updatedNumberScheduled"`

 // The number of nodes that should be running the
 // daemon pod and have one or more of the daemon pod running and
 // available (ready for at least spec.minReadySeconds)
 // +optional
 NumberAvailable int32 `json:"numberAvailable,omitempty" protobuf:"varint,7,opt,name=numberAvailable"`

 // The number of nodes that should be running the
 // daemon pod and have none of the daemon pod running and available
 // (ready for at least spec.minReadySeconds)
 // +optional
 NumberUnavailable int32 `json:"numberUnavailable,omitempty" protobuf:"varint,8,opt,name=numberUnavailable"`

 // Count of hash collisions for the DaemonSet. The DaemonSet controller
 // uses this field as a collision avoidance mechanism when it needs to
 // create the name for the newest ControllerRevision.
 // +optional
 CollisionCount *int32 `json:"collisionCount,omitempty" protobuf:"varint,9,opt,name=collisionCount"`

 // Represents the latest available observations of a DaemonSet's current state.
 // +optional
 // +patchMergeKey=type
 // +patchStrategy=merge
 Conditions []DaemonSetCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,10,rep,name=conditions"`
}

DaemonSetCondition

type DaemonSetConditionType string

// TODO: Add valid condition types of a DaemonSet.

// DaemonSetCondition describes the state of a DaemonSet at a certain point.
type DaemonSetCondition struct {
 // Type of DaemonSet condition.
 Type DaemonSetConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=DaemonSetConditionType"`
 // Status of the condition, one of True, False, Unknown.
 Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 // Last time the condition transitioned from one status to another.
 // +optional
 LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 // The reason for the condition's last transition.
 // +optional
 Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 // A human readable message indicating details about the transition.
 // +optional
 Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
}

v1.ConditionStatus

参考 Pod 资源。

Docs: Job

Sun, 07 May 2023 21:33:09 +0800

简要概述

staging/src/k8s.io/api/batch/v1/types.go

查看官方介绍

常用指令

TODO;

配置示例

通过 kubectl 创建

kubectl create job pi \
 --image=registry.cn-hangzhou.aliyuncs.com/kube-image-repo/busybox:1.35.0 \
 --dry-run=client \
 -o yaml \
 -- /bin/sh -c "echo helllo; sleep 5; echo world"

通过 yaml 创建

apiVersion: batch/v1
kind: Job
metadata:
 creationTimestamp: null
 name: pi
spec:
 template:
 metadata:
 creationTimestamp: null
 spec:
 containers:
 - command:
 - /bin/sh
 - -c
 - echo helllo; sleep 5; echo world
 image: registry.cn-hangzhou.aliyuncs.com/kube-image-repo/busybox:1.35.0
 name: pi
 resources: {}
 restartPolicy: Never
status: {}

数据结构

Job

// Job represents the configuration of a single job.
type Job struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Specification of the desired behavior of a job.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Spec JobSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // Current status of a job.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Status JobStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

JobSpec

// JobSpec describes how the job execution will look like.
type JobSpec struct {

 // Specifies the maximum desired number of pods the job should
 // run at any given time. The actual number of pods running in steady state will
 // be less than this number when ((.spec.completions - .status.successful) < .spec.parallelism),
 // i.e. when the work left to do is less than max parallelism.
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
 // +optional
 Parallelism *int32 `json:"parallelism,omitempty" protobuf:"varint,1,opt,name=parallelism"`

 // Specifies the desired number of successfully finished pods the
 // job should be run with. Setting to nil means that the success of any
 // pod signals the success of all pods, and allows parallelism to have any positive
 // value. Setting to 1 means that parallelism is limited to 1 and the success of that
 // pod signals the success of the job.
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
 // +optional
 Completions *int32 `json:"completions,omitempty" protobuf:"varint,2,opt,name=completions"`

 // Specifies the duration in seconds relative to the startTime that the job
 // may be continuously active before the system tries to terminate it; value
 // must be positive integer. If a Job is suspended (at creation or through an
 // update), this timer will effectively be stopped and reset when the Job is
 // resumed again.
 // +optional
 ActiveDeadlineSeconds *int64 `json:"activeDeadlineSeconds,omitempty" protobuf:"varint,3,opt,name=activeDeadlineSeconds"`

 // Specifies the number of retries before marking this job failed.
 // Defaults to 6
 // +optional
 BackoffLimit *int32 `json:"backoffLimit,omitempty" protobuf:"varint,7,opt,name=backoffLimit"`

 // TODO enabled it when https://github.com/kubernetes/kubernetes/issues/28486 has been fixed
 // Optional number of failed pods to retain.
 // +optional
 // FailedPodsLimit *int32 `json:"failedPodsLimit,omitempty" protobuf:"varint,9,opt,name=failedPodsLimit"`

 // A label query over pods that should match the pod count.
 // Normally, the system sets this field for you.
 // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
 // +optional
 Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,4,opt,name=selector"`

 // manualSelector controls generation of pod labels and pod selectors.
 // Leave `manualSelector` unset unless you are certain what you are doing.
 // When false or unset, the system pick labels unique to this job
 // and appends those labels to the pod template. When true,
 // the user is responsible for picking unique labels and specifying
 // the selector. Failure to pick a unique label may cause this
 // and other jobs to not function correctly. However, You may see
 // `manualSelector=true` in jobs that were created with the old `extensions/v1beta1`
 // API.
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/#specifying-your-own-pod-selector
 // +optional
 ManualSelector *bool `json:"manualSelector,omitempty" protobuf:"varint,5,opt,name=manualSelector"`

 // Describes the pod that will be created when executing a job.
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
 Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,6,opt,name=template"`

 // ttlSecondsAfterFinished limits the lifetime of a Job that has finished
 // execution (either Complete or Failed). If this field is set,
 // ttlSecondsAfterFinished after the Job finishes, it is eligible to be
 // automatically deleted. When the Job is being deleted, its lifecycle
 // guarantees (e.g. finalizers) will be honored. If this field is unset,
 // the Job won't be automatically deleted. If this field is set to zero,
 // the Job becomes eligible to be deleted immediately after it finishes.
 // This field is alpha-level and is only honored by servers that enable the
 // TTLAfterFinished feature.
 // +optional
 TTLSecondsAfterFinished *int32 `json:"ttlSecondsAfterFinished,omitempty" protobuf:"varint,8,opt,name=ttlSecondsAfterFinished"`

 // CompletionMode specifies how Pod completions are tracked. It can be
 // `NonIndexed` (default) or `Indexed`.
 //
 // `NonIndexed` means that the Job is considered complete when there have
 // been .spec.completions successfully completed Pods. Each Pod completion is
 // homologous to each other.
 //
 // `Indexed` means that the Pods of a
 // Job get an associated completion index from 0 to (.spec.completions - 1),
 // available in the annotation batch.kubernetes.io/job-completion-index.
 // The Job is considered complete when there is one successfully completed Pod
 // for each index.
 // When value is `Indexed`, .spec.completions must be specified and
 // `.spec.parallelism` must be less than or equal to 10^5.
 // In addition, The Pod name takes the form
 // `$(job-name)-$(index)-$(random-string)`,
 // the Pod hostname takes the form `$(job-name)-$(index)`.
 //
 // This field is beta-level. More completion modes can be added in the future.
 // If the Job controller observes a mode that it doesn't recognize, the
 // controller skips updates for the Job.
 // +optional
 CompletionMode *CompletionMode `json:"completionMode,omitempty" protobuf:"bytes,9,opt,name=completionMode,casttype=CompletionMode"`

 // Suspend specifies whether the Job controller should create Pods or not. If
 // a Job is created with suspend set to true, no Pods are created by the Job
 // controller. If a Job is suspended after creation (i.e. the flag goes from
 // false to true), the Job controller will delete all active Pods associated
 // with this Job. Users must design their workload to gracefully handle this.
 // Suspending a Job will reset the StartTime field of the Job, effectively
 // resetting the ActiveDeadlineSeconds timer too. Defaults to false.
 //
 // This field is beta-level, gated by SuspendJob feature flag (enabled by
 // default).
 //
 // +optional
 Suspend *bool `json:"suspend,omitempty" protobuf:"varint,10,opt,name=suspend"`
}

metav1.LabelSelector

TODO;

v1.PodTemplateSpec

参考 Pods 资源。

CompletionMode

// CompletionMode specifies how Pod completions of a Job are tracked.
type CompletionMode string

const (
 // NonIndexedCompletion is a Job completion mode. In this mode, the Job is
 // considered complete when there have been .spec.completions
 // successfully completed Pods. Pod completions are homologous to each other.
 NonIndexedCompletion CompletionMode = "NonIndexed"

 // IndexedCompletion is a Job completion mode. In this mode, the Pods of a
 // Job get an associated completion index from 0 to (.spec.completions - 1).
 // The Job is considered complete when a Pod completes for each completion
 // index.
 IndexedCompletion CompletionMode = "Indexed"
)

JobStatus

// JobStatus represents the current state of a Job.
type JobStatus struct {
 // The latest available observations of an object's current state. When a Job
 // fails, one of the conditions will have type "Failed" and status true. When
 // a Job is suspended, one of the conditions will have type "Suspended" and
 // status true; when the Job is resumed, the status of this condition will
 // become false. When a Job is completed, one of the conditions will have
 // type "Complete" and status true.
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
 // +optional
 // +patchMergeKey=type
 // +patchStrategy=merge
 // +listType=atomic
 Conditions []JobCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

 // Represents time when the job controller started processing a job. When a
 // Job is created in the suspended state, this field is not set until the
 // first time it is resumed. This field is reset every time a Job is resumed
 // from suspension. It is represented in RFC3339 form and is in UTC.
 // +optional
 StartTime *metav1.Time `json:"startTime,omitempty" protobuf:"bytes,2,opt,name=startTime"`

 // Represents time when the job was completed. It is not guaranteed to
 // be set in happens-before order across separate operations.
 // It is represented in RFC3339 form and is in UTC.
 // The completion time is only set when the job finishes successfully.
 // +optional
 CompletionTime *metav1.Time `json:"completionTime,omitempty" protobuf:"bytes,3,opt,name=completionTime"`

 // The number of actively running pods.
 // +optional
 Active int32 `json:"active,omitempty" protobuf:"varint,4,opt,name=active"`

 // The number of pods which reached phase Succeeded.
 // +optional
 Succeeded int32 `json:"succeeded,omitempty" protobuf:"varint,5,opt,name=succeeded"`

 // The number of pods which reached phase Failed.
 // +optional
 Failed int32 `json:"failed,omitempty" protobuf:"varint,6,opt,name=failed"`

 // CompletedIndexes holds the completed indexes when .spec.completionMode =
 // "Indexed" in a text format. The indexes are represented as decimal integers
 // separated by commas. The numbers are listed in increasing order. Three or
 // more consecutive numbers are compressed and represented by the first and
 // last element of the series, separated by a hyphen.
 // For example, if the completed indexes are 1, 3, 4, 5 and 7, they are
 // represented as "1,3-5,7".
 // +optional
 CompletedIndexes string `json:"completedIndexes,omitempty" protobuf:"bytes,7,opt,name=completedIndexes"`

 // UncountedTerminatedPods holds the UIDs of Pods that have terminated but
 // the job controller hasn't yet accounted for in the status counters.
 //
 // The job controller creates pods with a finalizer. When a pod terminates
 // (succeeded or failed), the controller does three steps to account for it
 // in the job status:
 // (1) Add the pod UID to the arrays in this field.
 // (2) Remove the pod finalizer.
 // (3) Remove the pod UID from the arrays while increasing the corresponding
 // counter.
 //
 // This field is alpha-level. The job controller only makes use of this field
 // when the feature gate PodTrackingWithFinalizers is enabled.
 // Old jobs might not be tracked using this field, in which case the field
 // remains null.
 // +optional
 UncountedTerminatedPods *UncountedTerminatedPods `json:"uncountedTerminatedPods,omitempty" protobuf:"bytes,8,opt,name=uncountedTerminatedPods"`
}

JobCondition

type JobConditionType string

// These are valid conditions of a job.
const (
 // JobSuspended means the job has been suspended.
 JobSuspended JobConditionType = "Suspended"
 // JobComplete means the job has completed its execution.
 JobComplete JobConditionType = "Complete"
 // JobFailed means the job has failed its execution.
 JobFailed JobConditionType = "Failed"
)

// JobCondition describes current state of a job.
type JobCondition struct {
 // Type of job condition, Complete or Failed.
 Type JobConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=JobConditionType"`
 // Status of the condition, one of True, False, Unknown.
 Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 // Last time the condition was checked.
 // +optional
 LastProbeTime metav1.Time `json:"lastProbeTime,omitempty" protobuf:"bytes,3,opt,name=lastProbeTime"`
 // Last time the condition transit from one status to another.
 // +optional
 LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,4,opt,name=lastTransitionTime"`
 // (brief) reason for the condition's last transition.
 // +optional
 Reason string `json:"reason,omitempty" protobuf:"bytes,5,opt,name=reason"`
 // Human readable message indicating details about last transition.
 // +optional
 Message string `json:"message,omitempty" protobuf:"bytes,6,opt,name=message"`
}

v1.ConditionStatus

参考 Pods 资源。

UncountedTerminatedPods

// UncountedTerminatedPods holds UIDs of Pods that have terminated but haven't
// been accounted in Job status counters.
type UncountedTerminatedPods struct {
 // Succeeded holds UIDs of succeeded Pods.
 // +listType=set
 // +optional
 Succeeded []types.UID `json:"succeeded,omitempty" protobuf:"bytes,1,rep,name=succeeded,casttype=k8s.io/apimachinery/pkg/types.UID"`

 // Failed holds UIDs of failed Pods.
 // +listType=set
 // +optional
 Failed []types.UID `json:"failed,omitempty" protobuf:"bytes,2,rep,name=failed,casttype=k8s.io/apimachinery/pkg/types.UID"`
}

Docs: CronJob

Sun, 07 May 2023 22:13:37 +0800

简要概述

staging/src/k8s.io/api/batch/v1/types.go

查看官方介绍

常用指令

TODO;

配置示例

通过 kubectl 创建

kubectl create cronjob pi \
 --image=registry.cn-hangzhou.aliyuncs.com/kube-image-repo/busybox:1.35.0 \
 --schedule='0/5 * * * ?' \
 --dry-run=client \
 -o yaml \
 -- /bin/sh -c "echo helllo; sleep 5; echo world"

通过 yaml 创建

apiVersion: batch/v1
kind: CronJob
metadata:
 creationTimestamp: null
 name: pi
spec:
 jobTemplate:
 metadata:
 creationTimestamp: null
 name: pi
 spec:
 template:
 metadata:
 creationTimestamp: null
 spec:
 containers:
 - command:
 - /bin/sh
 - -c
 - echo helllo; sleep 5; echo world
 image: registry.cn-hangzhou.aliyuncs.com/kube-image-repo/busybox:1.35.0
 name: pi
 resources: {}
 restartPolicy: OnFailure
 schedule: 0/5 * * * ?
status: {}

数据结构

CronJob

// CronJob represents the configuration of a single cron job.
type CronJob struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Specification of the desired behavior of a cron job, including the schedule.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Spec CronJobSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // Current status of a cron job.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Status CronJobStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

CronJobSpec

// CronJobSpec describes how the job execution will look like and when it will actually run.
type CronJobSpec struct {

 // The schedule in Cron format, see https://en.wikipedia.org/wiki/Cron.
 Schedule string `json:"schedule" protobuf:"bytes,1,opt,name=schedule"`

 // Optional deadline in seconds for starting the job if it misses scheduled
 // time for any reason. Missed jobs executions will be counted as failed ones.
 // +optional
 StartingDeadlineSeconds *int64 `json:"startingDeadlineSeconds,omitempty" protobuf:"varint,2,opt,name=startingDeadlineSeconds"`

 // Specifies how to treat concurrent executions of a Job.
 // Valid values are:
 // - "Allow" (default): allows CronJobs to run concurrently;
 // - "Forbid": forbids concurrent runs, skipping next run if previous run hasn't finished yet;
 // - "Replace": cancels currently running job and replaces it with a new one
 // +optional
 ConcurrencyPolicy ConcurrencyPolicy `json:"concurrencyPolicy,omitempty" protobuf:"bytes,3,opt,name=concurrencyPolicy,casttype=ConcurrencyPolicy"`

 // This flag tells the controller to suspend subsequent executions, it does
 // not apply to already started executions. Defaults to false.
 // +optional
 Suspend *bool `json:"suspend,omitempty" protobuf:"varint,4,opt,name=suspend"`

 // Specifies the job that will be created when executing a CronJob.
 JobTemplate JobTemplateSpec `json:"jobTemplate" protobuf:"bytes,5,opt,name=jobTemplate"`

 // The number of successful finished jobs to retain. Value must be non-negative integer.
 // Defaults to 3.
 // +optional
 SuccessfulJobsHistoryLimit *int32 `json:"successfulJobsHistoryLimit,omitempty" protobuf:"varint,6,opt,name=successfulJobsHistoryLimit"`

 // The number of failed finished jobs to retain. Value must be non-negative integer.
 // Defaults to 1.
 // +optional
 FailedJobsHistoryLimit *int32 `json:"failedJobsHistoryLimit,omitempty" protobuf:"varint,7,opt,name=failedJobsHistoryLimit"`
}

ConcurrencyPolicy

// ConcurrencyPolicy describes how the job will be handled.
// Only one of the following concurrent policies may be specified.
// If none of the following policies is specified, the default one
// is AllowConcurrent.
type ConcurrencyPolicy string

const (
 // AllowConcurrent allows CronJobs to run concurrently.
 AllowConcurrent ConcurrencyPolicy = "Allow"

 // ForbidConcurrent forbids concurrent runs, skipping next run if previous
 // hasn't finished yet.
 ForbidConcurrent ConcurrencyPolicy = "Forbid"

 // ReplaceConcurrent cancels currently running job and replaces it with a new one.
 ReplaceConcurrent ConcurrencyPolicy = "Replace"
)

JobTemplateSpec

// JobTemplateSpec describes the data a Job should have when created from a template
type JobTemplateSpec struct {
 // Standard object's metadata of the jobs created from this template.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Specification of the desired behavior of the job.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Spec JobSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

JobSpec

参考 Job 资源。

CronJobStatus

// CronJobStatus represents the current state of a cron job.
type CronJobStatus struct {
 // A list of pointers to currently running jobs.
 // +optional
 // +listType=atomic
 Active []v1.ObjectReference `json:"active,omitempty" protobuf:"bytes,1,rep,name=active"`

 // Information when was the last time the job was successfully scheduled.
 // +optional
 LastScheduleTime *metav1.Time `json:"lastScheduleTime,omitempty" protobuf:"bytes,4,opt,name=lastScheduleTime"`

 // Information when was the last time the job successfully completed.
 // +optional
 LastSuccessfulTime *metav1.Time `json:"lastSuccessfulTime,omitempty" protobuf:"bytes,5,opt,name=lastSuccessfulTime"`
}

v1.ObjectReference

TODO;

Docs: ReplicationController

Mon, 08 May 2023 11:44:47 +0800

简要概述

staging/src/k8s.io/api/core/v1/types.go

查看官方介绍

该资源已废弃，被 ReplicaSet 替代。

常用指令

TODO;

配置示例

通过 kubectl 创建

无法直接通过命令行创建该资源，可先创建 Deployment 然后以此为模版更改 yaml 内容。

kubectl create deployment busybox \
 --replicas=3 \
 --image=registry.cn-hangzhou.aliyuncs.com/opsaid/busybox:1.35.0 \
 --dry-run=client \
 -o yaml \
 -- /bin/sh -c "sleep 3600"

更改 apiVersion 为 v1， kind 为 ReplicationController 同时移除生成 yaml 中 matchLabels、strategy、status 三个属性。

通过 yaml 创建

apiVersion: v1
kind: ReplicationController
metadata:
 creationTimestamp: null
 labels:
 app: busybox
 name: busybox
spec:
 replicas: 3
 selector:
 app: busybox
 #matchLabels:
 # app: busybox
 #strategy: {}
 template:
 metadata:
 creationTimestamp: null
 labels:
 app: busybox
 spec:
 containers:
 - command:
 - /bin/sh
 - -c
 - sleep 3600
 image: registry.cn-hangzhou.aliyuncs.com/opsaid/busybox:1.35.0
 name: busybox
 resources: {}
#status: {}

数据结构

ReplicationController

// ReplicationController represents the configuration of a replication controller.
type ReplicationController struct {
 metav1.TypeMeta `json:",inline"`

 // If the Labels of a ReplicationController are empty, they are defaulted to
 // be the same as the Pod(s) that the replication controller manages.
 // Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Spec defines the specification of the desired behavior of the replication controller.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Spec ReplicationControllerSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // Status is the most recently observed status of the replication controller.
 // This data may be out of date by some window of time.
 // Populated by the system.
 // Read-only.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Status ReplicationControllerStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

ReplicationControllerSpec

// ReplicationControllerSpec is the specification of a replication controller.
type ReplicationControllerSpec struct {
 // Replicas is the number of desired replicas.
 // This is a pointer to distinguish between explicit zero and unspecified.
 // Defaults to 1.
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#what-is-a-replicationcontroller
 // +optional
 Replicas *int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`

 // Minimum number of seconds for which a newly created pod should be ready
 // without any of its container crashing, for it to be considered available.
 // Defaults to 0 (pod will be considered available as soon as it is ready)
 // +optional
 MinReadySeconds int32 `json:"minReadySeconds,omitempty" protobuf:"varint,4,opt,name=minReadySeconds"`

 // Selector is a label query over pods that should match the Replicas count.
 // If Selector is empty, it is defaulted to the labels present on the Pod template.
 // Label keys and values that must match in order to be controlled by this replication
 // controller, if empty defaulted to labels on Pod template.
 // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
 // +optional
 // +mapType=atomic
 Selector map[string]string `json:"selector,omitempty" protobuf:"bytes,2,rep,name=selector"`

 // TemplateRef is a reference to an object that describes the pod that will be created if
 // insufficient replicas are detected.
 // Reference to an object that describes the pod that will be created if insufficient replicas are detected.
 // +optional
 // TemplateRef *ObjectReference `json:"templateRef,omitempty"`

 // Template is the object that describes the pod that will be created if
 // insufficient replicas are detected. This takes precedence over a TemplateRef.
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
 // +optional
 Template *PodTemplateSpec `json:"template,omitempty" protobuf:"bytes,3,opt,name=template"`
}

PodTemplateSpec

参考 Pod 资源。

ReplicationControllerStatus

// ReplicationControllerStatus represents the current status of a replication
// controller.
type ReplicationControllerStatus struct {
 // Replicas is the most recently oberved number of replicas.
 // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#what-is-a-replicationcontroller
 Replicas int32 `json:"replicas" protobuf:"varint,1,opt,name=replicas"`

 // The number of pods that have labels matching the labels of the pod template of the replication controller.
 // +optional
 FullyLabeledReplicas int32 `json:"fullyLabeledReplicas,omitempty" protobuf:"varint,2,opt,name=fullyLabeledReplicas"`

 // The number of ready replicas for this replication controller.
 // +optional
 ReadyReplicas int32 `json:"readyReplicas,omitempty" protobuf:"varint,4,opt,name=readyReplicas"`

 // The number of available replicas (ready for at least minReadySeconds) for this replication controller.
 // +optional
 AvailableReplicas int32 `json:"availableReplicas,omitempty" protobuf:"varint,5,opt,name=availableReplicas"`

 // ObservedGeneration reflects the generation of the most recently observed replication controller.
 // +optional
 ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,3,opt,name=observedGeneration"`

 // Represents the latest available observations of a replication controller's current state.
 // +optional
 // +patchMergeKey=type
 // +patchStrategy=merge
 Conditions []ReplicationControllerCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,6,rep,name=conditions"`
}

ReplicationControllerCondition

type ReplicationControllerConditionType string

// These are valid conditions of a replication controller.
const (
 // ReplicationControllerReplicaFailure is added in a replication controller when one of its pods
 // fails to be created due to insufficient quota, limit ranges, pod security policy, node selectors,
 // etc. or deleted due to kubelet being down or finalizers are failing.
 ReplicationControllerReplicaFailure ReplicationControllerConditionType = "ReplicaFailure"
)

// ReplicationControllerCondition describes the state of a replication controller at a certain point.
type ReplicationControllerCondition struct {
 // Type of replication controller condition.
 Type ReplicationControllerConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=ReplicationControllerConditionType"`
 // Status of the condition, one of True, False, Unknown.
 Status ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=ConditionStatus"`
 // The last time the condition transitioned from one status to another.
 // +optional
 LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 // The reason for the condition's last transition.
 // +optional
 Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 // A human readable message indicating details about the transition.
 // +optional
 Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
}

ConditionStatus

参考 Pod 资源。