Standardisiertes Glossar
Dieses Glossar soll eine umfassende, standardisierte Liste der Kubernetes-Terminologie darstellen. Es enthält technische Begriffe, die für K8 spezifisch sind, sowie allgemeinere Begriffe, die einen nützlichen Kontext bieten.
Begriffe nach ihren Tags filtern
Klicken Sie auf die [+] Indikatoren unten, um eine längere Erklärung für einen bestimmten Begriff zu erhalten.
Ressourcen, die die Funktionalität von Kubernetes erweitern.
[+]Add-Ons installieren erklärt mehr über die Verwendung von Add-Ons in Ihrem Cluster, und listet einige populäre Add-Ons auf.
In Kubernetes, ist Affinität ein Satz Regeln, die dem Scheduler Hinweise geben, wo er Pods platzieren soll.
[+]Es gibt zwei Arten Affinität:
Die Regeln werden mithilfe der in Pods angegebenen Label und Selektoren definiert, und sie können entweder erforderlich oder bevorzugt sein, je nachdem wie streng sie möchten, dass der Scheduler sie durchsetzen soll.
Die Aggregationsschicht erlaubt Ihnen die Installation zusätzlicher Kubernetes-artiger APIs in Ihrem Cluster.
[+]Wenn Sie den Kubernetes API Server konfiguriert haben um zusätzliche APIs zu unterstützen, können Sie
APIServiceObjekte hinzufügen, um einen URL Pfad in der Kubernetes API zu "belegen".Ein Key-Value Paar, dass verwendet wird um willkürliche, nicht-identifizierende Metadaten an Objekte zu binden.
[+]Die Metadaten in einer Annotation können klein oder groß sein, strukturiert oder unstrukturiert, und können Zeichen enthalten, die nicht in Label erlaubt sind. Clients wie Tools oder Libraries können diese Metadaten abfragen.
- Die Schicht, in der verschiedene containerisierte Anwendungen laufen. [+]
Die Schicht, in der verschiedene containerisierte Anwendungen laufen.
Eine Person, die verantwortlich ist für das Highlevel-Design einer Anwendung.
[+]Ein Architekt sorgt dafür, dass die Implementierung einer Anwendung eine skalierbare und verwaltbare Interaktion mit den umgebenden Komponenten ermöglicht. Umgebende Komponenten können Datenbanken, Logging-Infrastruktur und andere Microservices sein.
Eine Person, die eine Anwendung entwickelt, die in einem Kubernetes Cluster läuft.
[+]Ein Anwendungsentwickler fokussiert auf einen Teil der Anwendung. Die Größe des Fokus kann significant variieren.
Ein Satz zugehöriger Pfade in der Kubernetes API.
[+]Sie können jedeAPI Gruppe ein- oder ausschalten durch Änderung der Konfiguration Ihres API Servers. Sie können auch Pfade zu spezifischen Ressourcen ein- oder ausschalten. API Gruppe vereinfacht die Erweiterung der Kubernetes API. Die API Gruppe ist festgelegt durch einen REST Pfad und durch das
apiVersionFeld eines serialisierten Objekts.- Siehe API Gruppe für mehr Informationen.
API-initiierte Räumung ist der Prozess, durch den Sie die Räumungs API verwenden, um ein Räumungsobjekt zu erstellen, dass eine geordnete Beendung des Pods auslöst.
[+]Sie können Räumung anfragen, indem Sie direkt die Räumungs API verwenden, mithilfe eines Clients des kube-api-servers, wie der
kubectl drainBefehl. Wenn einRäumungsObjekt erstellt wird, beendet der API Server den Pod.API-initiierte Räumungen respektieren Ihre konfigurierte
PodDisruptionBudgetsundterminationGracePeriodSeconds.API-initiierte Räumung ist nicht das gleiche wie Knotendruck Räumung.
- Siehe API-initiierte Räumung für mehr Informationen.
Anwendungscontainer (oder App Container) sind die Container in einem Pod, die gestartet werden, nachdem jegliche Init Container abgeschlossen haben.
[+]Ein Init Container erlaubt es Ihnen Initialisierungsdetails, die wichtig sind für die gesamte Arbeitslast, und die nicht mehr weiter laufen müssen, sobald der Anwendungscontainer startet, sauber abzutrennen. Wenn ein Pod keine Init Container konfiguriert hat, sind alle Container in diesem Pod App Container.
Eine Person, die Kubernetes Code Beiträge überprüfen und zulassen kann.
[+]Während Code Review sich auf Qualität und Korrektheit des Codes konzentriert, ist das Genehmigen auf die holistische Akzeptanz eines Beitrags fokussiert. Holistische Akzeptanz achtet unter anderem auf Rückwärts- und Vorwärtskompatibilität, beachten der API und Flag Konventionen, subtile Performance- und Korrektheitsprobleme, und Interaktionen mit anderen Teilendes Systems. Approver Status ist begrenzt auf einen Teil des gesamten Codes (Codebase). Approver wurden früher Maintainer genannt.
cAdvisor (Container Advisor) ermöglicht Benutzer von Container ein besseres Verständnis des Ressourcenverbrauchs und der Performance Charakteristiken ihrer laufenden Container.
[+]Es ist ein laufender Daemon, der Informationen über laufende Container sammelt, aggregiert, verarbeitet, und exportiert. Genauer gesagt, speichert es für jeden Container die Ressourcenisolationsparameter, den historischen Ressourcenverbrauch, die Histogramme des kompletten historischen Ressourcenverbrauchs und die Netzwerkstatistiken. Diese Daten werden pro Container und maschinenweit exportiert.
Eine Gruppe Linux Prozesse mit optionaler Isolation, Erfassung und Begrenzung der Ressourcen.
[+]cgroup ist eine Funktion des Linux Kernels, dass die Ressourcennutzung (CPU, Speicher, Platten I/O, Netzwerk) begrenzt, erfasst und isoliert, für eine Sammling Prozesse.
CIDR (Classless Inter-Domain Routing) ist eine Notation, um Blöcke von IP Adressen zu beschreiben und wird viel verwendet in verschiedenen Netzwerkkonfigurationen.
[+]Im Kubernetes Kontext, erhält jeder Knoten eine Reihe von IP Adressen durch die Startadresse und eine Subnetzmaske unter Verwendung von CIDR. Dies erlaubt Knoten jedem Pod eine eigene IP Adresse zuzuweisen. Obwohl es ursprünglich ein Konzept für IPv4 ist, wurde CIDR erweitert um auch IPv6 einzubinden.
Bedingungen unter denen ein Mitwirkender eine Lizenz an ein Open Source Projekt erteilt für seine Mitwirkungen.
[+]CLAs helfen dabei rechtliche Streitigkeiten rund um Mitwirkungen und geistigem Eigentum (IP) zu lösen.
Eine Kubernetes Control Plane Komponente, die Cloud spezifische Kontrolllogik einbettet. Der Cloud Controller Manager lässt Sie Ihr Cluster in die Cloud Provider API einbinden, und trennt die Komponenten die mit der Cloud Platform interagieren von Komponenten, die nur mit Ihrem Cluster interagieren.
[+]Durch Entkopplung der Interoperabilitätslogik zwischen Kubernetes und der darunterliegenden Cloud Infrastruktur, ermöglicht der Cloud Controller Manager den Cloud Providern das Freigeben neuer Features in einem anderen Tempo als das Kubernetes Projekt.
The Cloud Native Computing Foundation (CNCF) builds sustainable ecosystems and fosters a community around projects that orchestrate containers as part of a microservices architecture.
Kubernetes is a CNCF project.
[+]The CNCF is a sub-foundation of the Linux Foundation. Its mission is to make cloud native computing ubiquitous.
- Auch bekannt als: Cloud Service Provider
A business or other organization that offers a cloud computing platform.
[+]Cloud providers, sometimes called Cloud Service Providers (CSPs), offer cloud computing platforms or services.
Many cloud providers offer managed infrastructure (also called Infrastructure as a Service or IaaS). With managed infrastructure the cloud provider is responsible for servers, storage, and networking while you manage layers on top of that such as running a Kubernetes cluster.
You can also find Kubernetes as a managed service; sometimes called Platform as a Service, or PaaS. With managed Kubernetes, your cloud provider is responsible for the Kubernetes control plane as well as the nodes and the infrastructure they rely on: networking, storage, and possibly other elements such as load balancers.
Ein Satz Arbeitermaschinen, gennant Knoten, die containerisierte Anwendungen ausführen. Jedes Cluster hat mindestens einen Arbeiterknoten.
[+]Die Arbeiterknoten bringen die Pods unter, die die Komponenten der Applikationslast sind. Die Control Plane verwaltet die Arbeiterknoten und Pods im Cluster. In Produktionsumgebungen läuft die Control Plane meistens über mehrere Computer, und ein Cluster hat meistens mehrere Knoten, um Fehlertoleranz und Hochverfügbarkeit zu ermöglichen.
A person who designs infrastructure that involves one or more Kubernetes clusters.
[+]Cluster architects are concerned with best practices for distributed systems, for example: high availability and security.
- The infrastructure layer provides and maintains VMs, networking, security groups and others. [+]
The infrastructure layer provides and maintains VMs, networking, security groups and others.
The work involved in managing a Kubernetes cluster: managing day-to-day operations, and co-ordinating upgrades.
[+]Examples of cluster operations work include: deploying new Nodes to scale the cluster; performing software upgrades; implementing security controls; adding or removing storage; configuring cluster networking; managing cluster-wide observability; and responding to events.
A person who configures, controls, and monitors clusters.
[+]Their primary responsibility is keeping a cluster up and running, which may involve periodic maintenance activities or upgrades.
Note:
Cluster operators are different from the Operator pattern that extends the Kubernetes API.A person who develops and contributes code to the Kubernetes open source codebase.
[+]They are also an active community member who participates in one or more Special Interest Groups (SIGs).
An API object used to store non-confidential data in key-value pairs. Pods can consume ConfigMaps as environment variables, command-line arguments, or as configuration files in a volume.
[+]A ConfigMap allows you to decouple environment-specific configuration from your container images, so that your applications are easily portable.
Ein kleines und portierbares ausführbares Image, dass eine Software und all seine Abhängigkeiten enthält.
[+]Container entkuppeln Anwendungen von der darunterliegenden Rechner Infrastruktur, um den Einsatz in verschiedenen Cloud- oder Betriebssystemumgebungen zu vereinfachen. Die Anwendungen in Container nennt man Containerisierte Anwendungen. Der Prozess des Bündelns dieser Anwendungen und ihrer Abhängigkeiten in einem Container Image nennt man Containerisierung.
Container environment variables are name=value pairs that provide useful information into containers running in a pod
[+]Container environment variables provide information that is required by the running containerized applications along with information about important resources to the containers. For example, file system details, information about the container itself, and other cluster resources such as service endpoints.
The lifecycle hooks expose events in the Container management lifecycle and let the user run code when the events occur.
[+]Two hooks are exposed to Containers: PostStart which executes immediately after a container is created and PreStop which is blocking and is called immediately before a container is terminated.
Container network interface (CNI) plugins are a type of Network plugin that adheres to the appc/CNI specification.
[+]- For information on Kubernetes and CNI, see Network Plugins.
A fundamental component that empowers Kubernetes to run containers effectively. It is responsible for managing the execution and lifecycle of containers within the Kubernetes environment.
[+]Kubernetes supports container runtimes such as containerd, CRI-O, and any other implementation of the Kubernetes CRI (Container Runtime Interface).
The main protocol for the communication between the kubelet and Container Runtime.
[+]The Kubernetes Container Runtime Interface (CRI) defines the main gRPC protocol for the communication between the node components kubelet and container runtime.
The Container Storage Interface (CSI) defines a standard interface to expose storage systems to containers.
[+]CSI allows vendors to create custom storage plugins for Kubernetes without adding them to the Kubernetes repository (out-of-tree plugins). To use a CSI driver from a storage provider, you must first deploy it to your cluster. You will then be able to create a Storage Class that uses that CSI driver.
Someone who donates code, documentation, or their time to help the Kubernetes project or community.
[+]Contributions include pull requests (PRs), issues, feedback, special interest groups (SIG) participation, or organizing community events.
Die Container Orchestrierungsschicht, die die API und Schnittstellen exponiert, um den Lebenszyklus von Container zu definieren, bereitzustellen, und zu verwalten.
[+]Diese Schicht besteht aus vielen verschiedenen Komponenten, zum Beispiel (aber nicht begranzt auf):
Diese Komponenten können als traditionelle Betriebssystemdienste (daemons) oder als Container laufen. Die Hosts auf denen diese Komponenten laufen, hießen früher Master.
In Kubernetes sind Controller Kontrollschleifen, die den Zustand des Clusters überwachen und bei Bedarf Änderungen ausführen oder anfordern. Jeder Controller versucht, den aktuellen Clusterzustand in Richtung des Wunschzustands zu bewegen.
[+]Controller beobachten den geteilten Zustand des Clusters durch den API Server (Teil der Control Plane).
Mache Controller, laufen auch im Control Plane, und stellen Kontrollschleifen zur Verfügung, die essentiell für die grundlegende Kubernetes Funktionalität sind. Zum Beispiel: der Deployment Controller, der Daemonset Controller, der Namespace Controller und der Persistent Volume Controller (unter anderem) laufen alle innerhalb des Kube Controller Managers.
A tool that lets you use OCI container runtimes with Kubernetes CRI.
[+]CRI-O is an implementation of the Container runtime interface (CRI) to enable using container runtimes that are compatible with the Open Container Initiative (OCI) runtime spec.
Deploying CRI-O allows Kubernetes to use any OCI-compliant runtime as the container runtime for running Pods, and to fetch OCI container images from remote registries.
Custom code that defines a resource to add to your Kubernetes API server without building a complete custom server.
[+]Custom Resource Definitions let you extend the Kubernetes API for your environment if the publicly supported API resources can't meet your needs.
- The layer that provides capacity such as CPU, memory, network, and storage so that the containers can run and connect to a network. [+]
The layer that provides capacity such as CPU, memory, network, and storage so that the containers can run and connect to a network.
Ein API Object, das eine replizierte Anwendung verwaltet, typischerweise durch laufende Pods ohne lokalem Zustand.
[+]Jedes Replikat wird durch ein Pod repräsentiert, und die Pods werden auf den Knoten eines Clusters verteilt. Für Arbeitslasten, die einen lokalen Zustand benötigen, sollten Sie einen StatefulSet verwenden.
May refer to: Application Developer, Code Contributor, or Platform Developer.
[+]This overloaded term may have different meanings depending on the context
Device plugins run on worker Nodes and provide Pods with access to resources, such as local hardware, that require vendor-specific initialization or setup steps.
[+]Device plugins advertise resources to the kubelet, so that workload Pods can access hardware features that relate to the Node where that Pod is running. You can deploy a device plugin as a DaemonSet, or install the device plugin software directly on each target Node.
See Device Plugins for more information.
Disruptions are events that lead to one or more Pods going out of service. A disruption has consequences for workload resources, such as Deployment, that rely on the affected Pods.
[+]If you, as cluster operator, destroy a Pod that belongs to an application, Kubernetes terms that a voluntary disruption. If a Pod goes offline because of a Node failure, or an outage affecting a wider failure zone, Kubernetes terms that an involuntary disruption.
See Disruptions for more information.
Docker (genauer gesagt, Docker Engine) ist eine Software Technologie, die Virtualisierung auf Betriebssystemebene (auch bekannt als Container) bereitstellt.
[+]Docker verwendet die Ressourcenisolierungsfunktionen des Linux Kernels, wie cgroups und Kernel Namespaces, und ein Unionsfähiges Dateisystem wie OverlayFS (unter anderem), um unabhängige Container auf einer einzigen Linux Instanz auszuführen. Dies vermeidet den Mehraufwand des Starten und Verwalten virtueller Maschinen (VMs).
The dockershim is a component of Kubernetes version 1.23 and earlier. It allows the kubelet to communicate with Docker Engine.
[+]Starting with version 1.24, dockershim has been removed from Kubernetes. For more information, see Dockershim FAQ.
May refer to: code in the Kubernetes ecosystem that depends upon the core Kubernetes codebase or a forked repo.
[+]- In the Kubernetes Community: Conversations often use downstream to mean the ecosystem, code, or third-party tools that rely on the core Kubernetes codebase. For example, a new feature in Kubernetes may be adopted by applications downstream to improve their functionality.
- In GitHub or git: The convention is to refer to a forked repo as downstream, whereas the source repo is considered upstream.
Kubernetes' mechanism to expose Pod and container field values to code running in a container.
[+]It is sometimes useful for a container to have information about itself, without needing to make changes to the container code that directly couple it to Kubernetes.
The Kubernetes downward API allows containers to consume information about themselves or their context in a Kubernetes cluster. Applications in containers can have access to that information, without the application needing to act as a client of the Kubernetes API.
There are two ways to expose Pod and container fields to a running container:
- using environment variables
- using a
downwardAPIvolume
Together, these two ways of exposing Pod and container fields are called the downward API.
- In Kubernetes APIs, a duration must be non-negative and is typically expressed with a suffix. For example, 5s for five seconds or 1m30s for one minute and thirty seconds. [+]
In Kubernetes APIs, a duration must be non-negative and is typically expressed with a suffix. For example,
5sfor five seconds or1m30sfor one minute and thirty seconds. Allows users to request automatic creation of storage Volumes.
[+]Dynamic provisioning eliminates the need for cluster administrators to pre-provision storage. Instead, it automatically provisions storage by user request. Dynamic volume provisioning is based on an API object, StorageClass, referring to a Volume Plugin that provisions a Volume and the set of parameters to pass to the Volume Plugin.
Endpoints track the IP addresses of Pods with matching selectors.
[+]Endpoints can be configured manually for Services without selectors specified. The EndpointSlice resource provides a scalable and extensible alternative to Endpoints.
A way to group network endpoints together with Kubernetes resources.
[+]A scalable and extensible way to group network endpoints together. These can be used by kube-proxy to establish network routes on each node.
A Container type that you can temporarily run inside a Pod.
[+]If you want to investigate a Pod that's running with problems, you can add an ephemeral container to that Pod and carry out diagnostics. Ephemeral containers have no resource or scheduling guarantees, and you should not use them to run any part of the workload itself.
Ephemeral containers are not supported by static pods.
Konsistenter und hochverfügbarer Key-Value Speicher, der als Backupspeicher von Kubernetes für alle Clusterdaten verwendet wird.
[+]Halten Sie immer einen Sicherungsplan für etcds Daten für Ihren Kubernetes-Cluster bereit. Ausführliche Informationen zu etcd finden Sie in der etcd Dokumentation.
Event is a Kubernetes object that describes state change/notable occurrences in the system.
[+]Events have a limited retention time and triggers and messages may evolve with time. Event consumers should not rely on the timing of an event with a given reason reflecting a consistent underlying trigger, or the continued existence of events with that reason.
Events should be treated as informative, best-effort, supplemental data.
In Kubernetes, auditing generates a different kind of Event record (API group
audit.k8s.io).Eviction is the process of terminating one or more Pods on Nodes.
[+]There are two kinds of eviction:
Extensions are software components that extend and deeply integrate with Kubernetes to support new types of hardware.
[+]Many cluster administrators use a hosted or distribution instance of Kubernetes. These clusters come with extensions pre-installed. As a result, most Kubernetes users will not need to install extensions and even fewer users will need to author new ones.
Feature gates are a set of keys (opaque string values) that you can use to control which Kubernetes features are enabled in your cluster.
[+]You can turn these features on or off using the
--feature-gatescommand line flag on each Kubernetes component. Each Kubernetes component lets you enable or disable a set of feature gates that are relevant to that component. The Kubernetes documentation lists all current feature gates and what they control.Finalizers are namespaced keys that tell Kubernetes to wait until specific conditions are met before it fully deletes resources marked for deletion. Finalizers alert controllers to clean up resources the deleted object owned.
[+]When you tell Kubernetes to delete an object that has finalizers specified for it, the Kubernetes API marks the object for deletion by populating
.metadata.deletionTimestamp, and returns a202status code (HTTP "Accepted"). The target object remains in a terminating state while the control plane, or other components, take the actions defined by the finalizers. After these actions are complete, the controller removes the relevant finalizers from the target object. When themetadata.finalizersfield is empty, Kubernetes considers the deletion complete and deletes the object.You can use finalizers to control garbage collection of resources. For example, you can define a finalizer to clean up related resources or infrastructure before the controller deletes the target resource.
FlexVolume is a deprecated interface for creating out-of-tree volume plugins. The Container Storage Interface is a newer interface that addresses several problems with FlexVolume.
[+]FlexVolumes enable users to write their own drivers and add support for their volumes in Kubernetes. FlexVolume driver binaries and dependencies must be installed on host machines. This requires root access. The Storage SIG suggests implementing a CSI driver if possible since it addresses the limitations with FlexVolumes.
Garbage collection is a collective term for the various mechanisms Kubernetes uses to clean up cluster resources.
[+]Kubernetes uses garbage collection to clean up resources like unused containers and images, failed Pods, objects owned by the targeted resource, completed Jobs, and resources that have expired or failed.
A family of API kinds for modeling service networking in Kubernetes.
[+]Gateway API provides a family of extensible, role-oriented, protocol-aware API kinds for modeling service networking in Kubernetes.
- Auch bekannt als: GVR
Means of representing unique Kubernetes API resource.
[+]Group Version Resources (GVRs) specify the API group, API version, and resource (name for the object kind as it appears in the URI) associated with accessing a particular id of object in Kubernetes. GVRs let you define and distinguish different Kubernetes objects, and to specify a way of accessing objects that is stable even as APIs change.
A package of pre-configured Kubernetes resources that can be managed with the Helm tool.
[+]Charts provide a reproducible way of creating and sharing Kubernetes applications. A single chart can be used to deploy something simple, like a memcached Pod, or something complex, like a full web app stack with HTTP servers, databases, caches, and so on.
- Auch bekannt als: HPA
An API resource that automatically scales the number of Pod replicas based on targeted CPU utilization or custom metric targets.
[+]HPA is typically used with ReplicationControllers, Deployments, or ReplicaSets. It cannot be applied to objects that cannot be scaled, for example DaemonSets.
A HostAliases is a mapping between the IP address and hostname to be injected into a Pod's hosts file.
[+]HostAliases is an optional list of hostnames and IP addresses that will be injected into the Pod's hosts file if specified. This is only valid for non-hostNetwork Pods.
Stored instance of a Container that holds a set of software needed to run an application.
[+]A way of packaging software that allows it to be stored in a container registry, pulled to a local system, and run as an application. Meta data is included in the image that can indicate what executable to run, who built it, and other information.
Immutable Infrastructure refers to computer infrastructure (virtual machines, containers, network appliances) that cannot be changed once deployed.
[+]Immutability can be enforced by an automated process that overwrites unauthorized changes or through a system that won’t allow changes in the first place. Containers are a good example of immutable infrastructure because persistent changes to containers can only be made by creating a new version of the container or recreating the existing container from its image.
By preventing or identifying unauthorized changes, immutable infrastructures make it easier to identify and mitigate security risks. Operating such a system becomes a lot more straightforward because administrators can make assumptions about it. After all, they know no one made mistakes or changes they forgot to communicate. Immutable infrastructure goes hand-in-hand with infrastructure as code where all automation needed to create infrastructure is stored in version control (such as Git). This combination of immutability and version control means that there is a durable audit log of every authorized change to a system.
An API object that manages external access to the services in a cluster, typically HTTP.
[+]Ingress may provide load balancing, SSL termination and name-based virtual hosting.
One or more initialization containers that must run to completion before any app containers run.
[+]Initialization (init) containers are like regular app containers, with one difference: init containers must run to completion before any app containers can start. Init containers run in series: each init container must run to completion before the next init container begins.
Unlike sidecar containers, init containers do not remain running after Pod startup.
For more information, read init containers.
An open platform (not Kubernetes-specific) that provides a uniform way to integrate microservices, manage traffic flow, enforce policies, and aggregate telemetry data.
[+]Adding Istio does not require changing application code. It is a layer of infrastructure between a service and the network, which when combined with service deployments, is commonly referred to as a service mesh. Istio's control plane abstracts away the underlying cluster management platform, which may be Kubernetes, Mesosphere, etc.
A means of representing claims to be transferred between two parties.
[+]JWTs can be digitally signed and encrypted. Kubernetes uses JWTs as authentication tokens to verify the identity of entities that want to perform actions in a cluster.
Ein Knoten ist eine Arbietermaschine in Kubernetes.
[+]Ein Arbeiterknoten kann eine virtuelle Maschine oder physische Maschine sein, abhängig vom Cluster. Es hat lokale Daemons und Dienste, die nötig sind um Pods auszuführen, und wird von der Control Plane administriert. Die Daemonen auf einem Knoten beinhalten auch das kubelet, kube-proxy, und eine Container Runtime, die ein CRI, wie zum Beispiel Docker. implementieren.
In älteren Kubernetes Versionen wurden Knoten "Minions" genannt.
[+]kOpswill not only help you create, destroy, upgrade and maintain production-grade, highly available, Kubernetes cluster, but it will also provision the necessary cloud infrastructure.Note:
AWS (Amazon Web Services) is currently officially supported, with DigitalOcean, GCE and OpenStack in beta support, and Azure in alpha.kOpsis an automated provisioning system:- Fully automated installation
- Uses DNS to identify clusters
- Self-healing: everything runs in Auto-Scaling Groups
- Multiple OS support (Amazon Linux, Debian, Flatcar, RHEL, Rocky and Ubuntu)
- High-Availability support
- Can directly provision, or generate terraform manifests
Komponente auf der Control Plane, die die Kubernetes-API verfügbar macht. Es ist das Frontend für die Kubernetes-Steuerebene.
[+]Es ist für die horizontale Skalierung konzipiert, d.h. es skaliert durch die Bereitstellung von mehr Instanzen. Mehr informationen finden Sie unter Cluster mit hoher Verfügbarkeit erstellen.
Komponente auf der Control Plane, auf der Controller ausgeführt werden.
[+]Logisch gesehen ist jeder Controller ein separater Prozess, aber zur Vereinfachung der Komplexität werden sie alle zu einer einzigen Binärdatei zusammengefasst und in einem einzigen Prozess ausgeführt.
kube-proxy is a network proxy that runs on each node in your cluster, implementing part of the Kubernetes Service concept.
[+]kube-proxy maintains network rules on nodes. These network rules allow network communication to your Pods from network sessions inside or outside of your cluster.
kube-proxy uses the operating system packet filtering layer if there is one and it's available. Otherwise, kube-proxy forwards the traffic itself.
Komponente auf der Control Plane, die neu erstellte Pods überwacht, denen kein Knoten zugewiesen ist. Sie wählt den Knoten aus, auf dem sie ausgeführt werden sollen.
[+]Zu den Faktoren, die bei Planungsentscheidungen berücksichtigt werden, zählen individuelle und kollektive Ressourcenanforderungen, Hardware- / Software- / Richtlinieneinschränkungen, Affinitäts- und Anti-Affinitätsspezifikationen, Datenlokalität, Interworkload-Interferenz und Deadlines.
Ein Werkzeug um schnell Kubernetes zu installieren und ein sicheres Cluster zu erstellen.
[+]Man kann kubeadm verwenden, um sowohl die Control Plane, als auch die Worker Node Komponenten zu installieren.
- Auch bekannt als: kubectl
Command line tool for communicating with a Kubernetes cluster's control plane, using the Kubernetes API.
[+]You can use
kubectlto create, inspect, update, and delete Kubernetes objects. Ein Agent, der auf jedem Knoten im Cluster ausgeführt wird. Er stellt sicher, dass Container in einem Pod ausgeführt werden.
[+]Das Kubelet verwendet eine Reihe von PodSpecs, die über verschiedene Mechanismen bereitgestellt werden, und stellt sicher, dass die in diesen PodSpecs beschriebenen Container ordnungsgemäß ausgeführt werden. Das kubelet verwaltet keine Container, die nicht von Kubernetes erstellt wurden.
The application that serves Kubernetes functionality through a RESTful interface and stores the state of the cluster.
[+]Kubernetes resources and "records of intent" are all stored as API objects, and modified via RESTful calls to the API. The API allows configuration to be managed in a declarative way. Users can interact with the Kubernetes API directly, or via tools like
kubectl. The core Kubernetes API is flexible and can also be extended to support custom resources.Provides constraints to limit resource consumption per Containers or Pods in a namespace.
[+]LimitRange limits the quantity of objects that can be created by type, as well as the amount of compute resources that may be requested/consumed by individual Containers or Pods in a namespace.
A software offering maintained by a third-party provider.
[+]Some examples of Managed Services are AWS EC2, Azure SQL Database, and GCP Pub/Sub, but they can be any software offering that can be used by an application.
Veralteter Begriff, verwendet als Synonym für die Knoten auf denen die Control Plane läuft.
[+]Dieser Begriff wird noch durch einige Provisionierungswerkzeuge verwendet, wie zum Beispiel kubeadm, und gemanagte Dienste, um Knoten mit dem
kubernetes.io/roleLabel zu kennzeichnen, und Pods auf der Control Plane zu platzieren.A continuously active contributor in the K8s community.
[+]Members can have issues and PRs assigned to them and participate in special interest groups (SIGs) through GitHub teams. Pre-submit tests are automatically run for members' PRs. A member is expected to remain an active contributor to the community.
A tool for running Kubernetes locally.
[+]Minikube runs a single-node cluster inside a VM on your computer. You can use Minikube to try Kubernetes in a learning environment.
A pod object that a kubelet uses to represent a static pod
[+]When the kubelet finds a static pod in its configuration, it automatically tries to create a Pod object on the Kubernetes API server for it. This means that the pod will be visible on the API server, but cannot be controlled from there.
(For example, removing a mirror pod will not stop the kubelet daemon from running it).
- Auch bekannt als: MVP
Feature to let a kube-apiserver proxy a resource request to a different peer API server.
[+]When a cluster has multiple API servers running different versions of Kubernetes, this feature enables resource requests to be served by the correct API server.
MVP is disabled by default and can be activated by enabling the feature gate named
UnknownVersionInteroperabilityProxywhen the API Server is started. A client-provided string that refers to an object in a resource URL, such as
[+]/api/v1/pods/some-name.Only one object of a given kind can have a given name at a time. However, if you delete the object, you can make a new object with the same name.
An abstraction used by Kubernetes to support isolation of groups of resources within a single cluster.
[+]Namespaces are used to organize objects in a cluster and provide a way to divide cluster resources. Names of resources need to be unique within a namespace, but not across namespaces. Namespace-based scoping is applicable only for namespaced objects (e.g. Deployments, Services, etc) and not for cluster-wide objects (e.g. StorageClass, Nodes, PersistentVolumes, etc).
A specification of how groups of Pods are allowed to communicate with each other and with other network endpoints.
[+]Network Policies help you declaratively configure which Pods are allowed to connect to each other, which namespaces are allowed to communicate, and more specifically which port numbers to enforce each policy on.
NetworkPolicyresources use labels to select Pods and define rules which specify what traffic is allowed to the selected Pods. Network Policies are implemented by a supported network plugin provided by a network provider. Be aware that creating a network resource without a controller to implement it will have no effect.- Auch bekannt als: kubelet eviction
Node-pressure eviction is the process by which the kubelet proactively terminates pods to reclaim resources on nodes.
[+]The kubelet monitors resources like CPU, memory, disk space, and filesystem inodes on your cluster's nodes. When one or more of these resources reach specific consumption levels, the kubelet can proactively fail one or more pods on the node to reclaim resources and prevent starvation.
Node-pressure eviction is not the same as API-initiated eviction.
Eine Einheit im Kubernetessystem. Die Kubernetes API verwendet diese Einheiten um den Zustand Ihres Clusters darzustellen.
[+]Ein Kubernetes Objekt ist typischerweise ein "Datenstatz der Absicht"—sobald Sie das Objekt erstellen, arbeitet die Kubernetes Control Plane ständig, um zu versichern, dass das Element, welches es darstellt, auch existiert. Durch erstellen eines Objekts, erzählen Sie grundsätzlich dem Kubernetessystem wie dieser Teil der Arbeitslast Ihres Clusters aussehen soll; das ist der Wunschzustand Ihres Clusters.
The operator pattern is a system design that links a Controller to one or more custom resources.
[+]You can extend Kubernetes by adding controllers to your cluster, beyond the built-in controllers that come as part of Kubernetes itself.
If a running application acts as a controller and has API access to carry out tasks against a custom resource that's defined in the control plane, that's an example of the Operator pattern.
An API object that represents a piece of storage in the cluster. Available as a general, pluggable resource that persists beyond the lifecycle of any individual Pod.
[+]PersistentVolumes (PVs) provide an API that abstracts details of how storage is provided from how it is consumed. PVs are used directly in scenarios where storage can be created ahead of time (static provisioning). For scenarios that require on-demand storage (dynamic provisioning), PersistentVolumeClaims (PVCs) are used instead.
Claims storage resources defined in a PersistentVolume so that it can be mounted as a volume in a container.
[+]Specifies the amount of storage, how the storage will be accessed (read-only, read-write and/or exclusive) and how it is reclaimed (retained, recycled or deleted). Details of the storage itself are described in the PersistentVolume object.
A person who customizes the Kubernetes platform to fit the needs of their project.
[+]A platform developer may, for example, use Custom Resources or Extend the Kubernetes API with the aggregation layer to add functionality to their instance of Kubernetes, specifically for their application. Some Platform Developers are also contributors and develop extensions which are contributed to the Kubernetes community. Others develop closed-source commercial or site-specific extensions.
Das kleinste und einfachste Kubernetesobjekt. Ein Pod stellt ein Satz laufender Container in Ihrem Cluster dar.
[+]Ein Pod wird typischerweise verwendet, um einen einzelnen primären Container laufen zu lassen. Es kann optional auch "sidecar" Container laufen lassen, die zusätzliche Features, wie logging, hinzufügen. Pods werden normalerweise durch ein Deployment verwaltet.
Pod disruption is the process by which Pods on Nodes are terminated either voluntarily or involuntarily.
[+]Voluntary disruptions are started intentionally by application owners or cluster administrators. Involuntary disruptions are unintentional and can be triggered by unavoidable issues like Nodes running out of resources, or by accidental deletions.
- Auch bekannt als: PDB
A Pod Disruption Budget allows an application owner to create an object for a replicated application, that ensures a certain number or percentage of Pods with an assigned label will not be voluntarily evicted at any point in time.
[+]Involuntary disruptions cannot be prevented by PDBs; however they do count against the budget.
The sequence of states through which a Pod passes during its lifetime.
[+]The Pod Lifecycle is defined by the states or phases of a Pod. There are five possible Pod phases: Pending, Running, Succeeded, Failed, and Unknown. A high-level description of the Pod state is summarized in the PodStatus
phasefield.Pod Priority indicates the importance of a Pod relative to other Pods.
[+]Pod Priority gives the ability to set scheduling priority of a Pod to be higher and lower than other Pods — an important feature for production clusters workload.
Enables fine-grained authorization of Pod creation and updates.
[+]A cluster-level resource that controls security sensitive aspects of the Pod specification. The
PodSecurityPolicyobjects define a set of conditions that a Pod must run with in order to be accepted into the system, as well as defaults for the related fields. Pod Security Policy control is implemented as an optional admission controller.PodSecurityPolicy was deprecated as of Kubernetes v1.21, and removed in v1.25. As an alternative, use Pod Security Admission or a 3rd party admission plugin.
- Auch bekannt als: pod template
An API object that defines a template for creating Pods. The PodTemplate API is also embedded in API definitions for workload management, such as Deployment or StatefulSets.
[+]Pod templates allow you to define common metadata (such as labels, or a template for the name of a new Pod) as well as to specify a pod's desired state. Workload management controllers use Pod templates (embedded into another object, such as a Deployment or StatefulSet) to define and manage one or more Pods. When there can be multiple Pods based on the same template, these are called replicas. Although you can create a PodTemplate object directly, you rarely need to do so.
A PriorityClass is a named class for the scheduling priority that should be assigned to a Pod in that class.
[+]A PriorityClass is a non-namespaced object mapping a name to an integer priority, used for a Pod. The name is specified in the
metadata.namefield, and the priority value in thevaluefield. Priorities range from -2147483648 to 1000000000 inclusive. Higher values indicate higher priority.A check that the kubelet periodically performs against a container that is running in a pod, that will define container's state and health and informing container's lifecycle.
[+]To learn more, read container probes.
In computing, a proxy is a server that acts as an intermediary for a remote service.
[+]A client interacts with the proxy; the proxy copies the client's data to the actual server; the actual server replies to the proxy; the proxy sends the actual server's reply to the client.
kube-proxy is a network proxy that runs on each node in your cluster, implementing part of the Kubernetes Service concept.
You can run kube-proxy as a plain userland proxy service. If your operating system supports it, you can instead run kube-proxy in a hybrid mode that achieves the same overall effect using less system resources.
QoS Class (Quality of Service Class) provides a way for Kubernetes to classify Pods within the cluster into several classes and make decisions about scheduling and eviction.
[+]QoS Class of a Pod is set at creation time based on its compute resources requests and limits settings. QoS classes are used to make decisions about Pods scheduling and eviction. Kubernetes can assign one of the following QoS classes to a Pod:
Guaranteed,BurstableorBestEffort.A whole-number representation of small or large numbers using SI suffixes.
[+]Quantities are representations of small or large numbers using a compact, whole-number notation with SI suffixes. Fractional numbers are represented using milli units, while large numbers can be represented using kilo, mega, or giga units.
For instance, the number
1.5is represented as1500m, while the number1000can be represented as1k, and1000000as1M. You can also specify binary-notation suffixes; the number 2048 can be written as2Ki.The accepted decimal (power-of-10) units are
m(milli),k(kilo, intentionally lowercase),M(mega),G(giga),T(tera),P(peta),E(exa).The accepted binary (power-of-2) units are
Ki(kibi),Mi(mebi),Gi(gibi),Ti(tebi),Pi(pebi),Ei(exbi).Manages authorization decisions, allowing admins to dynamically configure access policies through the Kubernetes API.
[+]RBAC utilizes roles, which contain permission rules, and role bindings, which grant the permissions defined in a role to a set of users.
A copy or duplicate of a Pod or a set of pods. Replicas ensure high availability, scalability, and fault tolerance by maintaining multiple identical instances of a pod.
[+]Replicas are commonly used in Kubernetes to achieve the desired application state and reliability. They enable workload scaling and distribution across multiple nodes in a cluster.
By defining the number of replicas in a Deployment or ReplicaSet, Kubernetes ensures that the specified number of instances are running, automatically adjusting the count as needed.
Replica management allows for efficient load balancing, rolling updates, and self-healing capabilities in a Kubernetes cluster.
A ReplicaSet (aims to) maintain a set of replica Pods running at any given time.
[+]Workload objects such as Deployment make use of ReplicaSets to ensure that the configured number of Pods are running in your cluster, based on the spec of that ReplicaSet.
A workload resource that manages a replicated application, ensuring that a specific number of instances of a Pod are running.
[+]The control plane ensures that the defined number of Pods are running, even if some Pods fail, if you delete Pods manually, or if too many are started by mistake.
Note:
ReplicationController is deprecated. See Deployment, which is similar.A person who reviews code for quality and correctness on some part of the project.
[+]Reviewers are knowledgeable about both the codebase and software engineering principles. Reviewer status is scoped to a part of the codebase.
Stores sensitive information, such as passwords, OAuth tokens, and SSH keys.
[+]Secrets give you more control over how sensitive information is used and reduces the risk of accidental exposure. Secret values are encoded as base64 strings and are stored unencrypted by default, but can be configured to be encrypted at rest.
A Pod can reference the Secret in a variety of ways, such as in a volume mount or as an environment variable. Secrets are designed for confidential data and ConfigMaps are designed for non-confidential data.
The
[+]securityContextfield defines privilege and access control settings for a Pod or container.In a
securityContext, you can define: the user that processes run as, the group that processes run as, and privilege settings. You can also configure security policies (for example: SELinux, AppArmor or seccomp).The
PodSpec.securityContextsetting applies to all containers in a Pod.Eine Methode um Netwzwerkanwendungen freizugeben, die als einen oder mehrere Pods in Ihrem Cluster laufen.
[+]Der Satz Pods, der von einem Servie anvisiert ist, wird durch einen Selector bestimmt. Wenn mehrere Pods hinzugefügt oder entfernt werden, ändert sich der Satz Pods die zum Selector passen. Der Service versichert, dass Netzwerkverkehr an den aktuellen Satz Pods für die Arbeitslast gelenkt werden kann.
Kubernetes Services verwenden entweder IP Netzwerke (IPv4, IPv6, oder beide), oder referenzieren einen externen Namen im Domain Name System (DNS).
Die Service Abstraktion ermöglicht andere Mechanismen, wie Ingress und Gateway.
A former extension API that enabled applications running in Kubernetes clusters to easily use external managed software offerings, such as a datastore service offered by a cloud provider.
[+]It provided a way to list, provision, and bind with external Managed Services without needing detailed knowledge about how those services would be created or managed.
Provides an identity for processes that run in a Pod.
[+]When processes inside Pods access the cluster, they are authenticated by the API server as a particular service account, for example,
default. When you create a Pod, if you do not specify a service account, it is automatically assigned the default service account in the same Namespace.A technique for assigning requests to queues that provides better isolation than hashing modulo the number of queues.
[+]We are often concerned with insulating different flows of requests from each other, so that a high-intensity flow does not crowd out low-intensity flows. A simple way to put requests into queues is to hash some characteristics of the request, modulo the number of queues, to get the index of the queue to use. The hash function uses as input characteristics of the request that align with flows. For example, in the Internet this is often the 5-tuple of source and destination address, protocol, and source and destination port.
That simple hash-based scheme has the property that any high-intensity flow will crowd out all the low-intensity flows that hash to the same queue. Providing good insulation for a large number of flows requires a large number of queues, which is problematic. Shuffle-sharding is a more nimble technique that can do a better job of insulating the low-intensity flows from the high-intensity flows. The terminology of shuffle-sharding uses the metaphor of dealing a hand from a deck of cards; each queue is a metaphorical card. The shuffle-sharding technique starts with hashing the flow-identifying characteristics of the request, to produce a hash value with dozens or more of bits. Then the hash value is used as a source of entropy to shuffle the deck and deal a hand of cards (queues). All the dealt queues are examined, and the request is put into one of the examined queues with the shortest length. With a modest hand size, it does not cost much to examine all the dealt cards and a given low-intensity flow has a good chance to dodge the effects of a given high-intensity flow. With a large hand size it is expensive to examine the dealt queues and more difficult for the low-intensity flows to dodge the collective effects of a set of high-intensity flows. Thus, the hand size should be chosen judiciously.
One or more containers that are typically started before any app containers run.
[+]Sidecar containers are like regular app containers, but with a different purpose: the sidecar provides a Pod-local service to the main app container. Unlike init containers, sidecar containers continue running after Pod startup.
Read Sidecar containers for more information.
Community members who collectively manage an ongoing piece or aspect of the larger Kubernetes open source project.
[+]Members within a SIG have a shared interest in advancing a specific area, such as architecture, API machinery, or documentation. SIGs must follow the SIG governance guidelines, but can have their own contribution policy and channels of communication.
For more information, see the kubernetes/community repo and the current list of SIGs and Working Groups.
Defines how each object, like Pods or Services, should be configured and its desired state.
[+]Almost every Kubernetes object includes two nested object fields that govern the object's configuration: the object spec and the object status. For objects that have a spec, you have to set this when you create the object, providing a description of the characteristics you want the resource to have: its desired state.
It varies for different objects like Pods, StatefulSets, and Services, detailing settings such as containers, volumes, replicas, ports,
and other specifications unique to each object type. This field encapsulates what state Kubernetes should maintain for the defined
object.Verwaltet die Bereitstellung und Skalierung eines Satzes Pods, und stellt Garantieen zur Reihenfolge und Einzigartigkeit bereit für diese Pods.
[+]Wie ein Deployment, verwaltet ein StatefulSet Pods basierend auf eine identische Container Spezifikation. Anders als ein Deployment, verwaltet ein StatefulSet eine persistente Identität für jeden seiner Pods. Diese Pods werden anhand der gleichen Spezifikation erstellt, sind aber nicht austauschbar: Jeder hat eine persistente Identifizierung, die über jede Verschiebung erhalten bleibt.
Wenn Sie Speichervolumen verwenden wollen, um Persistenz der Arbeitslast zu ermöglichen, können Sie einen StatefulSet as Teil der Lösung verwenden. Obwohl einzelne Pods in einem StatefulSet anfälling für Fehler sind, machen die persistente Podidentifizierungen es einfacher, existierende Volumen mit neuen Pods, die die fehlerhaften ersetzen, zu verbinden.
A pod managed directly by the kubelet daemon on a specific node,
[+]without the API server observing it.
Static Pods do not support ephemeral containers.
A StorageClass provides a way for administrators to describe different available storage types.
[+]StorageClasses can map to quality-of-service levels, backup policies, or to arbitrary policies determined by cluster administrators. Each StorageClass contains the fields
provisioner,parameters, andreclaimPolicy, which are used when a Persistent Volume belonging to the class needs to be dynamically provisioned. Users can request a particular class using the name of a StorageClass object.
[+]sysctlis a semi-standardized interface for reading or changing the attributes of the running Unix kernel.On Unix-like systems,
sysctlis both the name of the tool that administrators use to view and modify these settings, and also the system call that the tool uses.Container runtimes and network plugins may rely on
sysctlvalues being set a certain way.A core object consisting of three required properties: key, value, and effect. Taints prevent the scheduling of Pods on nodes or node groups.
[+]Taints and tolerations work together to ensure that pods are not scheduled onto inappropriate nodes. One or more taints are applied to a node. A node should only schedule a Pod with the matching tolerations for the configured taints.
A Kubernetes systems-generated string to uniquely identify objects.
[+]Every object created over the whole lifetime of a Kubernetes cluster has a distinct UID. It is intended to distinguish between historical occurrences of similar entities.
May refer to: core Kubernetes or the source repo from which a repo was forked.
[+]- In the Kubernetes Community: Conversations often use upstream to mean the core Kubernetes codebase, which the general ecosystem, other code, or third-party tools rely upon. For example, community members may suggest that a feature is moved upstream so that it is in the core codebase instead of in a plugin or third-party tool.
- In GitHub or git: The convention is to refer to a source repo as upstream, whereas the forked repo is considered downstream.
A kernel feature to emulate root. Used for "rootless containers".
[+]User namespaces are a Linux kernel feature that allows a non-root user to emulate superuser ("root") privileges, for example in order to run containers without being a superuser outside the container.
User namespace is effective for mitigating damage of potential container break-out attacks.
In the context of user namespaces, the namespace is a Linux kernel feature, and not a namespace in the Kubernetes sense of the term.
A directory containing data, accessible to the containers in a Pod.
[+]A Kubernetes volume lives as long as the Pod that encloses it. Consequently, a volume outlives any containers that run within the Pod, and data in the volume is preserved across container restarts.
See storage for more information.
A Volume Plugin enables integration of storage within a Pod.
[+]A Volume Plugin lets you attach and mount storage volumes for use by a Pod. Volume plugins can be in tree or out of tree. In tree plugins are part of the Kubernetes code repository and follow its release cycle. Out of tree plugins are developed independently.
A verb that is used to track changes to an object in Kubernetes as a stream. It is used for the efficient detection of changes.
[+]A verb that is used to track changes to an object in Kubernetes as a stream. Watches allow efficient detection of changes; for example, a controller that needs to know whenever a ConfigMap has changed can use a watch rather than polling.
See Efficient Detection of Changes in API Concepts for more information.
Facilitates the discussion and/or implementation of a short-lived, narrow, or decoupled project for a committee, SIG, or cross-SIG effort.
[+]Working groups are a way of organizing people to accomplish a discrete task.
For more information, see the kubernetes/community repo and the current list of SIGs and working groups.
A workload is an application running on Kubernetes.
[+]Various core objects that represent different types or parts of a workload include the DaemonSet, Deployment, Job, ReplicaSet, and StatefulSet objects.
For example, a workload that has a web server and a database might run the database in one StatefulSet and the web server in a Deployment.
Eine kryptographisch sichere Datei, die verwendet wird um den Zugriff auf das Kubernetes Cluster zu bestätigen.
[+]Zertfikate ermöglichen es Anwendungen in einem Kubernetes Cluster sicher auf die Kubernetes API zuzugreifen. Zertfikate bestätigen, dass Clients die Erlaubnis haben auf die API zuzugreifen.
Ein Teil Code, das Anfragen an den Kubernetes API Server abfängt, vor der Persistenz eines Objekts.
[+]Zugangscontroller für den Kubernetes API Server sind konfigurierbar, und können "validierend", "verändernd", oder beides sein. Jeder Zugangscontroller kann die Anfrage ablehnen. Verändernde Controller können die Objekte ändern, die sie zulassen; validierende Controller dürfen das nicht.
Feedback
War diese Seite hilfreich?
Danke für die Rückmeldung. Wenn Sie eine spezifische, beantwortbare Frage zur Verwendung von Kubernetes haben, stellen Sie diese unter Stack Overflow. Öffnen Sie ein Problem im GitHub-Repo, wenn Sie möchten Ein Problem melden oder Eine Verbesserung vorschlagen.