Question:
This is a Feature Report Problem: misssing Chinese translation docs: content/en/blog/_posts/2022-04-28-Increasing-the-security-bar-in-Ingress-NGINX Proposed Solution: add Chinese translation docs in website Kubernetes Blog Comments /language zh /assign
English page:
/triage accepted

<ins> --- layout: blog title: '在 Ingress-NGINX v1.2.0 中提高安全标准' date: 2022-04-28 slug: ingress-nginx-1-2-0 --- <!-- layout: blog title: 'Increasing the security bar in Ingress-NGINX v1.2.0' date: 2022-04-28 slug: ingress-nginx-1-2-0 --> <!-- **Authors:** Ricardo Katz (VMware), James Strong (Chainguard) --> **作者：** Ricardo Katz (VMware), James Strong (Chainguard) <!-- The [Ingress](/docs/concepts/services-networking/ingress/) may be one of the most targeted components of Kubernetes. An Ingress typically defines an HTTP reverse proxy, exposed to the Internet, containing multiple websites, and with some privileged access to Kubernetes API (such as to read Secrets relating to TLS certificates and their private keys). --> [Ingress](/zh-cn/docs/concepts/services-networking/ingress/) 可能是 Kubernetes 最容易受攻击的组件之一。 Ingress 通常定义一个 HTTP 反向代理，暴露在互联网上，包含多个网站，并具有对 Kubernetes API 的一些特权访问（例如读取与 TLS 证书及其私钥相关的 Secret）。 <!-- While it is a risky component in your architecture, it is still the most popular way to properly expose your services. --> 虽然它是架构中的一个风险组件，但它仍然是正常公开服务的最流行方式。 <!-- Ingress-NGINX has been part of security assessments that figured out we have a big problem: we don't do all proper sanitization before turning the configuration into an `nginx.conf` file, which may lead to information disclosure risks. --> Ingress-NGINX 一直是安全评估的重头戏，这类评估会发现我们有着很大的问题： 在将配置转换为 `nginx.conf` 文件之前，我们没有进行所有适当的清理，这可能会导致信息泄露风险。 <!-- While we understand this risk and the real need to fix this, it's not an easy process to do, so we took another approach to reduce (but not remove!) this risk in the current (v1.2.0) release. --> 虽然我们了解此风险以及解决此问题的真正需求，但这并不是一个容易的过程， 因此我们在当前(v1.2.0)版本中采取了另一种方法来减少（但不是消除！）这种风险。 <!-- ## Meet Ingress NGINX v1.2.0 and the chrooted NGINX process --> ## 了解 Ingress NGINX v1.2.0 和 chrooted NGINX 进程 <!-- One of the main challenges is that Ingress-NGINX runs the web proxy server (NGINX) alongside the Ingress controller (the component that has access to Kubernetes API that and that creates the `nginx.conf` file). --> 主要挑战之一是 Ingress-NGINX 运行着 Web 代理服务器（NGINX），并与 Ingress 控制器一起运行 （后者是一个可以访问 Kubernetes API 并创建 `nginx.conf` 的组件）。 <!-- So, NGINX does have the same access to the filesystem of the controller (and Kubernetes service account token, and other configurations from the container). While splitting those components is our end goal, the project needed a fast response; that lead us to the idea of using `chroot()`. --> 因此，NGINX 对控制器的文件系统（和 Kubernetes 服务帐户令牌，以及容器中的其他配置）具有相同的访问权限。 虽然拆分这些组件是我们的最终目标，但该项目需要快速响应；这让我们想到了使用 `chroot()`。 <!-- Let's take a look into what an Ingress-NGINX container looked like before this change: --> 让我们看一下 Ingress-NGINX 容器在此更改之前的样子： ![Ingress NGINX pre chroot](ingress-pre-chroot.png) <!-- As we can see, the same container (not the Pod, the container!) that provides HTTP Proxy is the one that watches Ingress objects and writes the Container Volume --> 正如我们所见，用来提供 HTTP Proxy 的容器（不是 Pod，是容器！）也是是监视 Ingress 对象并将数据写入容器卷的容器。 <!-- Now, meet the new architecture: --> 现在，见识一下新架构： ![Ingress NGINX post chroot](ingress-post-chroot.png) <!-- What does all of this mean? A basic summary is: that we are isolating the NGINX service as a container inside the controller container. --> 这一切意味着什么？一个基本的总结是：我们将 NGINX 服务隔离为控制器容器内的容器。 <!-- While this is not strictly true, to understand what was done here, it's good to understand how Linux containers (and underlying mechanisms such as kernel namespaces) work. You can read about cgroups in the Kubernetes glossary: [`cgroup`](https://kubernetes.io/docs/reference/glossary/?fundamental=true#term-cgroup) and learn more about cgroups interact with namespaces in the NGINX project article [What Are Namespaces and cgroups, and How Do They Work?](https://www.nginx.com/blog/what-are-namespaces-cgroups-how-do-they-work/). (As you read that, bear in mind that Linux kernel namespaces are a different thing from [Kubernetes namespaces](/docs/concepts/overview/working-with-objects/namespaces/)). --> 虽然这并不完全正确，但要了解这里所做的事情，最好了解 Linux 容器（以及内核命名空间等底层机制）是如何工作的。 你可以在 Kubernetes 词汇表中阅读有关 cgroup 的信息：[`cgroup`](/zh-cn/docs/reference/glossary/?fundamental=true#term-cgroup)， 并在 NGINX 项目文章[什么是命名空间和 cgroup，以及它们如何工作？](https://www.nginx.com/blog/what-are-namespaces-cgroups-how-do-they-work/) 中了解有关 cgroup 与命名空间交互的更多信息。（当你阅读时，请记住 Linux 内核命名空间与 [Kubernetes 命名空间](/zh-cn/docs/concepts/overview/working-with-objects/namespaces/)不同）。 <!-- ## Skip the talk, what do I need to use this new approach? --> ## 跳过谈话，我需要什么才能使用这种新方法？ <!-- While this increases the security, we made this feature an opt-in in this release so you can have time to make the right adjustments in your environment(s). This new feature is only available from release v1.2.0 of the Ingress-NGINX controller. --> 虽然这增加了安全性，但我们在这个版本中把这个功能作为一个选项，这样你就可以有时间在你的环境中做出正确的调整。 此新功能仅在 Ingress-NGINX 控制器的 v1.2.0 版本中可用。 <!-- There are two required changes in your deployments to use this feature: * Append the suffix "-chroot" to the container image name. For example: `gcr.io/k8s-staging-ingress-nginx/controller-chroot:v1.2.0` * In your Pod template for the Ingress controller, find where you add the capability `NET_BIND_SERVICE` and add the capability `SYS_CHROOT`. After you edit the manifest, you'll see a snippet like: --> 要使用这个功能，在你的部署中有两个必要的改变： * 将后缀 "-chroot" 添加到容器镜像名称中。例如：`gcr.io/k8s-staging-ingress-nginx/controller-chroot:v1.2.0` * 在你的 Ingress 控制器的 Pod 模板中，找到添加 `NET_BIND_SERVICE` 权能的位置并添加 `SYS_CHROOT` 权能。 编辑清单后，你将看到如下代码段： ```yaml capabilities: drop: - ALL add: - NET_BIND_SERVICE - SYS_CHROOT ``` <!-- If you deploy the controller using the official Helm chart then change the following setting in `values.yaml`: --> 如果你使用官方 Helm Chart 部署控制器，则在 `values.yaml` 中更改以下设置： ```yaml controller: image: chroot: true ``` <!-- Ingress controllers are normally set up cluster-wide (the IngressClass API is cluster scoped). If you manage the Ingress-NGINX controller but you're not the overall cluster operator, then check with your cluster admin about whether you can use the `SYS_CHROOT` capability, **before** you enable it in your deployment. --> Ingress 控制器通常部署在集群作用域（IngressClass API 是集群作用域的）。 如果你管理 Ingress-NGINX 控制器但你不是整个集群的操作员， 请在部署中启用它**之前**与集群管理员确认你是否可以使用 `SYS_CHROOT` 功能。 <!-- ## OK, but how does this increase the security of my Ingress controller? Take the following configuration snippet and imagine, for some reason it was added to your `nginx.conf`: --> ## 好吧，但这如何能提高我的 Ingress 控制器的安全性呢？ 以下面的配置片段为例，想象一下，由于某种原因，它被添加到你的 `nginx.conf` 中： ``` location /randomthing/ { alias /; autoindex on; } ``` <!-- If you deploy this configuration, someone can call `http://website.example/randomthing` and get some listing (and access) to the whole filesystem of the Ingress controller. Now, can you spot the difference between chrooted and non chrooted Nginx on the listings below? --> 如果你部署了这种配置，有人可以调用 `http://website.example/randomthing` 并获取对 Ingress 控制器的整个文件系统的一些列表（和访问权限）。 现在，你能在下面的列表中发现 chroot 处理过和未经 chroot 处理过的 Nginx 之间的区别吗？ | 不额外调用 `chroot()`             | 额外调用 `chroot()` | |----------------------------|--------| | `bin`                      | `bin`  | | `dev`                      | `dev`  | | `etc`                      | `etc`  | | `home`                     |        | | `lib`                      | `lib`  | | `media`                    |        | | `mnt`                      |        | | `opt`                      | `opt`  | | `proc`                     | `proc` | | `root`                     |        | | `run`                      | `run`  | | `sbin`                     |        | | `srv`                      |        | | `sys`                      |        | | `tmp`                      | `tmp`  | | `usr`                      | `usr`  | | `var`                      | `var`  | | `dbg`                      |        | | `nginx-ingress-controller` |        | | `wait-shutdown`            |        | <!-- The one in left side is not chrooted. So NGINX has full access to the filesystem. The one in right side is chrooted, so a new filesystem with only the required files to make NGINX work is created. --> 左侧的那个没有 chroot 处理。所以 NGINX 可以完全访问文件系统。右侧的那个经过 chroot 处理， 因此创建了一个新文件系统，其中只有使 NGINX 工作所需的文件。 <!-- ## What about other security improvements in this release? --> ## 此版本中的其他安全改进如何？ <!-- We know that the new `chroot()` mechanism helps address some portion of the risk, but still, someone can try to inject commands to read, for example, the `nginx.conf` file and extract sensitive information. --> 我们知道新的 `chroot()` 机制有助于解决部分风险，但仍然有人可以尝试注入命令来读取，例如 `nginx.conf` 文件并提取敏感信息。 <!-- So, another change in this release (this is opt-out!) is the _deep inspector_. We know that some directives or regular expressions may be dangerous to NGINX, so the deep inspector checks all fields from an Ingress object (during its reconciliation, and also with a [validating admission webhook](/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook)) to verify if any fields contains these dangerous directives. --> 所以，这个版本的另一个变化（可选择取消）是 **深度探测（Deep Inspector）**。 我们知道某些指令或正则表达式可能对 NGINX 造成危险，因此深度探测器会检查 Ingress 对象中的所有字段 （在其协调期间，并且还使用[验证准入 webhook](/zh-cn/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook)) 验证是否有任何字段包含这些危险指令。 <!-- The ingress controller already does this for annotations, and our goal is to move this existing validation to happen inside deep inspection as part of a future release. --> Ingress 控制器已经通过注解做了这个工作，我们的目标是把现有的验证转移到深度探测中，作为未来版本的一部分。 <!-- You can take a look into the existing rules in [https://github.com/kubernetes/ingress-nginx/blob/main/internal/ingress/inspector/rules.go](https://github.com/kubernetes/ingress-nginx/blob/main/internal/ingress/inspector/rules.go). --> 你可以在 [https://github.com/kubernetes/ingress-nginx/blob/main/internal/ingress/inspector/rules.go](https://github.com/kubernetes/ingress-nginx/blob/main/internal/ingress/inspector/rules.go) 中查看现有规则。 <!-- Due to the nature of inspecting and matching all strings within relevant Ingress objects, this new feature may consume a bit more CPU. You can disable it by running the ingress controller with the command line argument `--deep-inspect=false`. --> 由于检查和匹配相关 Ingress 对象中的所有字符串的性质，此新功能可能会消耗更多 CPU。 你可以通过使用命令行参数 `--deep-inspect=false` 运行 Ingress 控制器来禁用它。 <!-- ## What's next? This is not our final goal. Our final goal is to split the control plane and the data plane processes. In fact, doing so will help us also achieve a [Gateway](https://gateway-api.sigs.k8s.io/) API implementation, as we may have a different controller as soon as it "knows" what to provide to the data plane (we need some help here!!) --> ## 下一步是什么? 这不是我们的最终目标。我们的最终目标是拆分控制平面和数据平面进程。 事实上，这样做也将帮助我们实现 [Gateway](https://gateway-api.sigs.k8s.io/) API 实现， 因为一旦它“知道”要提供什么，我们可能会有不同的控制器 数据平面（我们需要一些帮助！！） <!-- Some other projects in Kubernetes already take this approach (like [KPNG](https://github.com/kubernetes-sigs/kpng), the proposed replacement for `kube-proxy`), and we plan to align with them and get the same experience for Ingress-NGINX. --> Kubernetes 中的其他一些项目已经采用了这种方法（如 [KPNG](https://github.com/kubernetes-sigs/kpng)， 建议替换 `kube-proxy`），我们计划与他们保持一致，并为 Ingress-NGINX 获得相同的体验。 <!-- ## Further reading If you want to take a look into how chrooting was done in Ingress NGINX, take a look into [https://github.com/kubernetes/ingress-nginx/pull/8337](https://github.com/kubernetes/ingress-nginx/pull/8337) The release v1.2.0 containing all the changes can be found at [https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.2.0](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.2.0) --> ## 延伸阅读 如果你想了解如何在 Ingress NGINX 中完成 chrooting，请查看 [https://github.com/kubernetes/ingress-nginx/pull/8337](https://github.com/kubernetes/ingress-nginx/pull/8337)。 包含所有更改的版本 v1.2.0 可以在以下位置找到 [https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.2.0](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.2.0) </ins>


Question:
This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Update the to only ignore the directories and at the top level of the repository. Why is this needed If somebody wants to create a content directory named , that ignore will conflict. We should tidy it so it wouldn't. Comments /kind cleanup Docs for : https://git-
Can you assign it to me..??
/assign
/triage accepted
/priority backlog

nohup.out # Hugo output <del> public/ resources/ </del> <ins> /public/ /resources/ </ins> .hugo_build.lock # Netlify Functions build output package-lock.json <del> functions/ node_modules/ </del> <ins> /functions/ /node_modules/ </ins> # Generated files when building with make container-build .config/


Question:
web
/retitle [zh-cn] Fix table formatting errors on the kubectl page
/triage accepted

`annotate`    | kubectl annotate (-f FILENAME | TYPE NAME | TYPE/NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--overwrite] [--all] [--resource-version=version] [flags] | Add or update the annotations of one or more resources. `api-resources`    | `kubectl api-resources [flags]` | List the API resources that are available. `api-versions`    | `kubectl api-versions [flags]` | List the API versions that are available.  --> 操作             | 语法      |       描述 -------------------- | -------------------- | -------------------- `alpha`    | `kubectl alpha SUBCOMMAND [flags]` | 列出与 alpha 特性对应的可用命令，这些特性在 Kubernetes 集群中默认情况下是不启用的。 `annotate`    | kubectl annotate (-f FILENAME | TYPE NAME | TYPE/NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--overwrite] [--all] [--resource-version=version] [flags] | 添加或更新一个或多个资源的注解。 `api-resources`    | `kubectl api-resources [flags]` | 列出可用的 API 资源。 `api-versions`    | `kubectl api-versions [flags]` | 列出可用的 API 版本。


Question:
web
/retitle [zh-cn] Fix table formatting errors on the kubectl page
/triage accepted

`cluster-info`    | `kubectl cluster-info [flags]` | Display endpoint information about the master and services in the cluster. `completion`    | `kubectl completion SHELL [options]` | Output shell completion code for the specified shell (bash or zsh). `config`        | `kubectl config SUBCOMMAND [flags]` | Modifies kubeconfig files. See the individual subcommands for details.  --> `apply`            | `kubectl apply -f FILENAME [flags]`| 从文件或 stdin 对资源应用配置更改。 `attach`        | `kubectl attach POD -c CONTAINER [-i] [-t] [flags]` | 挂接到正在运行的容器，查看输出流或与容器（stdin）交互。 `auth`    | `kubectl auth [flags] [options]` | 检查授权。 `autoscale`    | kubectl autoscale (-f FILENAME | TYPE NAME | TYPE/NAME) [--min=MINPODS] --max=MAXPODS [--cpu-percent=CPU] [flags] | 自动扩缩由副本控制器管理的一组 pod。 `certificate`    | `kubectl certificate SUBCOMMAND [options]` | 修改证书资源。 `cluster-info`    | `kubectl cluster-info [flags]` | 显示有关集群中主服务器和服务的端口信息。 `completion`    | `kubectl completion SHELL [options]` | 为指定的 Shell（Bash 或 Zsh）输出 Shell 补齐代码。 `config`        | `kubectl config SUBCOMMAND [flags]` | 修改 kubeconfig 文件。有关详细信息，请参阅各个子命令。


Question:
web
/retitle [zh-cn] Fix table formatting errors on the kubectl page
/triage accepted

`delete`        | kubectl delete (-f FILENAME | TYPE [NAME | /NAME | -l label | --all]) [flags] | Delete resources either from a file, stdin, or specifying label selectors, names, resource selectors, or resources. `describe`    | kubectl describe (-f FILENAME | TYPE [NAME_PREFIX | /NAME | -l label]) [flags] | Display the detailed state of one or more resources. `diff`        | `kubectl diff -f FILENAME [flags]`| Diff file or stdin against live configuration.  --> `convert`    | `kubectl convert -f FILENAME [options]` | 在不同的 API 版本之间转换配置文件。配置文件可以是 YAML 或 JSON 格式。注意 - 需要安装 `kubectl-convert` 插件。 `cordon`    | `kubectl cordon NODE [options]` | 将节点标记为不可调度。 `cp`    | `kubectl cp <file-spec-src> <file-spec-dest> [options]` | 从容器复制文件、目录或将文件、目录复制到容器。 `create`        | `kubectl create -f FILENAME [flags]` | 从文件或 stdin 创建一个或多个资源。 `delete`        |  kubectl delete (-f FILENAME | TYPE [NAME | /NAME | -l label | --all]) [flags] |  基于文件、标准输入或通过指定标签选择器、名称、资源选择器或资源本身，删除资源。 `describe`    | kubectl describe (-f FILENAME | TYPE [NAME_PREFIX | /NAME | -l label]) [flags] | 显示一个或多个资源的详细状态。 `diff`        | `kubectl diff -f FILENAME [flags]`| 在当前起作用的配置和文件或标准输之间作对比 (**BETA**)


Question:
web
/retitle [zh-cn] Fix table formatting errors on the kubectl page
/triage accepted

`expose`        | kubectl expose (-f FILENAME | TYPE NAME | TYPE/NAME) [--port=port] [--protocol=TCP|UDP] [--target-port=number-or-name] [--name=name] [--external-ip=external-ip-of-service] [--type=type] [flags] | Expose a replication controller, service, or pod as a new Kubernetes service. `get`        | kubectl get (-f FILENAME | TYPE [NAME | /NAME | -l label]) [--watch] [--sort-by=FIELD] [[-o | --output]=OUTPUT_FORMAT] [flags] | List one or more resources. `kustomize`    | `kubectl kustomize <dir> [flags] [options]` | List a set of API resources generated from instructions in a kustomization.yaml file. The argument must be the path to the directory containing the file, or a git repository URL with a path suffix specifying same with respect to the repository root.  --> `drain`    | `kubectl drain NODE [options]` | 腾空节点以准备维护。 `edit`        | kubectl edit (-f FILENAME | TYPE NAME | TYPE/NAME) [flags] | 使用默认编辑器编辑和更新服务器上一个或多个资源的定义。 `exec`        | `kubectl exec POD [-c CONTAINER] [-i] [-t] [flags] [-- COMMAND [args...]]` | 对 Pod 中的容器执行命令。 `explain`    | `kubectl explain  [--recursive=false] [flags]` | 获取多种资源的文档。例如 Pod、Node、Service 等。 `expose`        | kubectl expose (-f FILENAME | TYPE NAME | TYPE/NAME) [--port=port] [--protocol=TCP|UDP] [--target-port=number-or-name] [--name=name] [--external-ip=external-ip-of-service] [--type=type] [flags] | 将副本控制器、服务或 Pod 作为新的 Kubernetes 服务暴露。 `get`        | kubectl get (-f FILENAME | TYPE [NAME | /NAME | -l label]) [--watch] [--sort-by=FIELD] [[-o | --output]=OUTPUT_FORMAT] [flags] | 列出一个或多个资源。 `kustomize`    | kubectl kustomize <dir> [flags] [options]` </code> | 列出从 kustomization.yaml 文件中的指令生成的一组 API 资源。参数必须是包含文件的目录的路径，或者是 git 存储库 URL，其路径后缀相对于存储库根目录指定了相同的路径。 <!-- </del> `label`        | kubectl label (-f FILENAME | TYPE NAME | TYPE/NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--overwrite] [--all] [--resource-version=version] [flags] | Add or update the labels of one or more resources. `logs`        | `kubectl logs POD [-c CONTAINER] [--follow] [flags]` | Print the logs for a container in a pod. `options`    | `kubectl options` | List of global command-line options, which apply to all commands.


Question:
web
/retitle [zh-cn] Fix table formatting errors on the kubectl page
/triage accepted

`replace`        | `kubectl replace -f FILENAME` | Replace a resource from a file or stdin. `rollout`    | `kubectl rollout SUBCOMMAND [options]` | Manage the rollout of a resource. Valid resource types include: deployments, daemonsets and statefulsets. `run`        | kubectl run NAME --image=image [--env="key=value"] [--port=port] [--dry-run=server|client|none] [--overrides=inline-json] [flags] | Run a specified image on the cluster.  `scale`        | kubectl scale (-f FILENAME | TYPE NAME | TYPE/NAME) --replicas=COUNT [--resource-version=version] [--current-replicas=count] [flags] | Update the size of the specified replication controller. `set`    | `kubectl set SUBCOMMAND [options]` | Configure application resources. `taint`    | `kubectl taint NODE NAME KEY_1=VAL_1:TAINT_EFFECT_1 ... KEY_N=VAL_N:TAINT_EFFECT_N [options]` | Update the taints on one or more nodes. `top`    | `kubectl top [flags] [options]` | Display Resource (CPU/Memory/Storage) usage. `uncordon`    | `kubectl uncordon NODE [options]` | Mark node as schedulable. `version`        | `kubectl version [--client] [flags]` | Display the Kubernetes version running on the client and server. `wait`    | kubectl wait ([-f FILENAME] | resource.group/resource.name | resource.group [(-l label | --all)]) [--for=delete|--for condition=available] [options] | Experimental: Wait for a specific condition on one or many resources.  -->  操作             | 语法      |       描述 -------------------- | -------------------- | -------------------- `alpha`    | `kubectl alpha SUBCOMMAND [flags]` | 列出与 alpha 特性对应的可用命令，这些特性在 Kubernetes 集群中默认情况下是不启用的。 `annotate`    | kubectl annotate (-f FILENAME | TYPE NAME | TYPE/NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--overwrite] [--all] [--resource-version=version] [flags] | 添加或更新一个或多个资源的注解。 `api-resources`    | `kubectl api-resources [flags]` | 列出可用的 API 资源。 `api-versions`    | `kubectl api-versions [flags]` | 列出可用的 API 版本。 `apply`            | `kubectl apply -f FILENAME [flags]`| 从文件或 stdin 对资源应用配置更改。 `attach`        | `kubectl attach POD -c CONTAINER [-i] [-t] [flags]` | 挂接到正在运行的容器，查看输出流或与容器（stdin）交互。 `auth`    | `kubectl auth [flags] [options]` | 检查授权。 `autoscale`    | kubectl autoscale (-f FILENAME | TYPE NAME | TYPE/NAME) [--min=MINPODS] --max=MAXPODS [--cpu-percent=CPU] [flags] | 自动扩缩由副本控制器管理的一组 pod。 `certificate`    | `kubectl certificate SUBCOMMAND [options]` | 修改证书资源。 `cluster-info`    | `kubectl cluster-info [flags]` | 显示有关集群中主服务器和服务的端口信息。 `completion`    | `kubectl completion SHELL [options]` | 为指定的 Shell（Bash 或 Zsh）输出 Shell 补齐代码。 `config`        | `kubectl config SUBCOMMAND [flags]` | 修改 kubeconfig 文件。有关详细信息，请参阅各个子命令。 `convert`    | `kubectl convert -f FILENAME [options]` | 在不同的 API 版本之间转换配置文件。配置文件可以是 YAML 或 JSON 格式。注意 - 需要安装 `kubectl-convert` 插件。 `cordon`    | `kubectl cordon NODE [options]` | 将节点标记为不可调度。 `cp`    | `kubectl cp <file-spec-src> <file-spec-dest> [options]` | 从容器复制文件、目录或将文件、目录复制到容器。 `create`        | `kubectl create -f FILENAME [flags]` | 从文件或 stdin 创建一个或多个资源。 `delete`        |  kubectl delete (-f FILENAME | TYPE [NAME | /NAME | -l label | --all]) [flags] |  基于文件、标准输入或通过指定标签选择器、名称、资源选择器或资源本身，删除资源。 `describe`    | kubectl describe (-f FILENAME | TYPE [NAME_PREFIX | /NAME | -l label]) [flags] | 显示一个或多个资源的详细状态。 `diff`        | `kubectl diff -f FILENAME [flags]`| 在当前起作用的配置和文件或标准输之间作对比 (**BETA**) `drain`    | `kubectl drain NODE [options]` | 腾空节点以准备维护。 `edit`        | kubectl edit (-f FILENAME | TYPE NAME | TYPE/NAME) [flags] | 使用默认编辑器编辑和更新服务器上一个或多个资源的定义。 `exec`        | `kubectl exec POD [-c CONTAINER] [-i] [-t] [flags] [-- COMMAND [args...]]` | 对 Pod 中的容器执行命令。 `explain`    | `kubectl explain  [--recursive=false] [flags]` | 获取多种资源的文档。例如 Pod、Node、Service 等。 `expose`        | kubectl expose (-f FILENAME | TYPE NAME | TYPE/NAME) [--port=port] [--protocol=TCP|UDP] [--target-port=number-or-name] [--name=name] [--external-ip=external-ip-of-service] [--type=type] [flags] | 将副本控制器、服务或 Pod 作为新的 Kubernetes 服务暴露。 `get`        | kubectl get (-f FILENAME | TYPE [NAME | /NAME | -l label]) [--watch] [--sort-by=FIELD] [[-o | --output]=OUTPUT_FORMAT] [flags] | 列出一个或多个资源。 `kustomize`    | kubectl kustomize <dir> [flags] [options]` </code> | 列出从 kustomization.yaml 文件中的指令生成的一组 API 资源。参数必须是包含文件的目录的路径，或者是 git 存储库 URL，其路径后缀相对于存储库根目录指定了相同的路径。 </ins> `label`        | <code>kubectl label (-f FILENAME | TYPE NAME | TYPE/NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--overwrite] [--all] [--resource-version=version] [flags]</code> | 添加或更新一个或多个资源的标签。 `logs`        | `kubectl logs POD [-c CONTAINER] [--follow] [flags]` |  打印 Pod 中容器的日志。 `options`    | `kubectl options` | 全局命令行选项列表，这些选项适用于所有命令。


Question:
web
/retitle [zh-cn] Fix table formatting errors on the kubectl page
/triage accepted

`replace`        | `kubectl replace -f FILENAME` |  基于文件或标准输入替换资源。 `rollout`    | `kubectl rollout SUBCOMMAND [options]` | 管理资源的上线。有效的资源类型包括：Deployment、 DaemonSet 和 StatefulSet。 `run`        | kubectl run NAME --image=image [--env="key=value"] [--port=port] [--dry-run=server | client | none] [--overrides=inline-json] [flags] | 在集群上运行指定的镜像。    `scale`        | kubectl scale (-f FILENAME | TYPE NAME | TYPE/NAME) --replicas=COUNT [--resource-version=version] [--current-replicas=count] [flags] | 更新指定副本控制器的大小。 `set`    | `kubectl set SUBCOMMAND [options]` | 配置应用资源。 `taint`    | `kubectl taint NODE NAME KEY_1=VAL_1:TAINT_EFFECT_1 ... KEY_N=VAL_N:TAINT_EFFECT_N [options]` | 更新一个或多个节点上的污点。


Question:
This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: wrong command for strategic merge patch: "kubectl patch deployment retainkeys-demo --type merge --patch-file patch-file-" Proposed Solution: correct command: kubectl patch deployment retainkeys-demo --type strategic--patch-file patch-file- Page to Update:
/wg api-expression /language en
/assign
/triage accepted /good-first-issue
This request has been marked as suitable for new contributors. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met. If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /triage accepted /good-first-issue Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Patch your Deployment again with this new patch: ```shell <del> kubectl patch deployment retainkeys-demo --type merge --patch-file patch-file-retainkeys.yaml </del> <ins> kubectl patch deployment retainkeys-demo --type strategic --patch-file patch-file-retainkeys.yaml </ins> ``` Examine the content of the Deployment:


Question:
This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Kubernetes can use an annotation, , but this is not registered or documented. Proposed Solution: Document the annotation in . Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /sig auth
mentions this annotation, so it has been used in the past (and, I suspect, it is still used).
/assign
/triage accepted
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle rotten [1]:
/lifecycle frozen /priority backlog
Thanks SIG Auth folks!

See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. <ins> ### rbac.authorization.kubernetes.io/autoupdate Example: `rbac.authorization.kubernetes.io/autoupdate: "false"` Used on: ClusterRole, ClusterRoleBinding, Role, RoleBinding When this annotation is set to `"true"` on default RBAC objects created by the kube-apiserver, they are automatically updated at server start to add missing permissions and subjects (extra permissions and subjects are left in place). To prevent autoupdating a particular role or rolebinding, set this annotation to `"false"`. If you create your own RBAC objects and set this annotation to `"false"`, `kubectl auth reconcile` (which allows reconciling arbitrary RBAC objects in a {{< glossary_tooltip text="manifest" term_id="manifest" >}}) respects this annotation and does not automatically add missing permissions and subjects. </ins> ### kubernetes.io/psp (deprecated) {#kubernetes-io-psp} Example: `kubernetes.io/psp: restricted`


Question:
Problem: The text . on is redirecting to , it should point to these Check the github repository page for the problem. Page to Update: Proposed Solution: It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text these instructions to create a documentation pull request against the repository to and not to this . /kind document /assign /language en
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : Problem: The text . on is redirecting to , it should point to these Check the github repository page for the problem. It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text these instructions to create a documentation pull request against the repository to and not to this . /assign /language en Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

### Submitting Documentation Pull Requests <del> If you're fixing an issue in the existing documentation, you should submit a PR against the main branch.  Follow [these instructions to create a documentation pull request against the kubernetes.io repository](http://kubernetes.io/docs/home/contribute/create-pull-request/). </del> <ins> If you're fixing an issue in the existing documentation, you should submit a PR against the main branch.  Follow [these instructions to create a documentation pull request against the kubernetes.io repository](https://kubernetes.io/docs/contribute/new-content/open-a-pr/). </ins> For more information, see [contributing to Kubernetes docs](https://kubernetes.io/docs/contribute/).


Question:
Problem: The text on is not working, it should point to this Check the page for the problem. Page to Update: Proposed Solution: It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text FlexVolume plugins to and not to this . /kind document /assign /language en
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : Problem: The text on is not working, it should point to this Check the page for the problem. It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text FlexVolume plugins to and not to this . /assign /language en Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/triage accepted

[plugin](/docs/concepts/storage/volumes/#types-of-volumes). The following broad classes of Kubernetes volume plugins are supported on Windows: <del> * [`FlexVolume plugins`](/docs/concepts/storage/volumes/#flexVolume) </del> <ins> * [`FlexVolume plugins`](/docs/concepts/storage/volumes/#flexvolume-deprecated) </ins> * Please note that FlexVolumes have been deprecated as of 1.23 * [`CSI Plugins`](/docs/concepts/storage/volumes/#csi)


Question:
This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: implies that Kubernetes has Docker Engine support. In fact, Docker Engine only works with Kubernetes if you either: connect Kubernetes to the containerd that makes Docker Engine work use an adapter such as Proposed Solution: Pick an option: the sentence: a bigger revision to the concept page (check if there is already work under way) Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /language en
Hi is this work fine or if you like to add something
/triage accepted
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules: After 90d of inactivity, is applied After 30d of inactivity since was applied, is applied After 30d of inactivity since was applied, the issue is closed You can: Mark this issue or PR as fresh with Mark this issue or PR as rotten with Close this issue or PR with Offer to help out with [Issue Triage][1] Please send feedback to sig-contributor-experience at . /lifecycle stale [1]:
/remove-lifecycle stale

## What is a Pod? {{< note >}} <del> While Kubernetes supports more {{< glossary_tooltip text="container runtimes" term_id="container-runtime" >}} than just Docker, [Docker](https://www.docker.com/) is the most commonly known runtime, and it helps to describe Pods using some terminology from Docker. </del> <ins> You need to install a [container runtime](/docs/setup/production-environment/container-runtimes/) into each node in the cluster so that Pods can run there. </ins> {{< /note >}} The shared context of a Pod is a set of Linux namespaces, cgroups, and


Question:
But the document doesn't say what to do in this kind of case. Creating a secret using --from-file in this case won't work; instead have to create the secret by passing the --docker-server etc arguments.
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign

{{< note >}} If you use a Docker credentials store, you won't see that `auth` entry but a `credsStore` entry with the name of the store as value. <ins> In that case, you can create a secret directly. See [Create a Secret by providing credentials on the command line](#create-a-secret-by-providing-credentials-on-the-command-line). </ins> {{< /note >}} ## Create a Secret based on existing credentials {#registry-secret-existing-credentials}


Question:
If this is your first contribution, visit for information on how to get started. Review a few to see which content you have to change and which you leave unchanged. Make sure your base, target branch is and create a working branch called . Create a file called content/hi/docs/reference/glossary/replica- Copy the content of to the file you created Localize the content. Push your change and create a pull request. Completing this feature issue fixes part of /language hi /triage accepted
/assign Thank you

<ins> --- title: रेप्लिकासेट (ReplicaSet) id: replica-set date: 2018-04-12 full_link: /docs/concepts/workloads/controllers/replicaset/ short_description: > रेप्लिकासेट यह सुनिश्चित करता है कि किसी एक अवसर पर निर्दिष्ट संख्या में पॉड प्रतिकृतियां चल रही हैं। aka: tags: - fundamental - core-object - workload --- एक रेप्लिकासेट (का उद्देश्य) किसी भी समय चल रहे रेप्लिका पॉड्स का एक समूह बनाए रखना है। <!--more--> वर्कलोड ऑब्जेक्ट्स, जैसे {{< glossary_tooltip text="डिप्लॉयमेंट" term_id="deployment" >}}, रेप्लिकासेट्स के विनिर्देश के आधार पर आपके क्लस्टर पर कॉन्फ़िगर की गई संख्या में {{< glossary_tooltip term_id="pod" text="पॉड्स" >}} चल रहे है ये सुनिश्चित करते हैं। </ins>


Question:
Problem: The text on is not working, it should point to these Check the page for the problem. Page to Update: Proposed Solution: It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text FlexVolume to and not to this . /kind document /assign /language en
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : Problem: The text on is not working, it should point to these Check the page for the problem. It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text FlexVolume to and not to this . /assign /language en Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/triage accepted

durable external storage, or provide ephemeral storage, or they might offer a read-only interface to information using a filesystem paradigm. <del> Kubernetes also includes support for [FlexVolume](/docs/concepts/storage/volumes/#flexvolume) plugins, </del> <ins> Kubernetes also includes support for [FlexVolume](/docs/concepts/storage/volumes/#flexvolume-deprecated) plugins, </ins> which are deprecated since Kubernetes v1.23 (in favour of CSI). FlexVolume plugins allow users to mount volume types that aren't natively supported by Kubernetes. When


Question:
Problem: The text on is not working, it should point to these Check the page for the problem. Page to Update: Proposed Solution: It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text FlexVolume to and not to this . /kind document /assign /language en
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : Problem: The text on is not working, it should point to these Check the page for the problem. It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text FlexVolume to and not to this . /assign /language en Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/triage accepted

* [`gcePersistentDisk`](#gcepersistentdisk) * [`vsphereVolume`](#vspherevolume) <del> ### flexVolume (deprecated) </del> <ins> ### flexVolume (deprecated)   {#flexvolume} </ins> {{< feature-state for_k8s_version="v1.23" state="deprecated" >}}


Question:
Problem: The text on is not working, it should point to these Check the page for the problem. Page to Update: Proposed Solution: It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text FlexVolume to and not to this . /kind document /assign /language en
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : Problem: The text on is not working, it should point to these Check the page for the problem. It should resolve this issue by adding a simple link and enhancing the document line. Update the link on the text FlexVolume to and not to this . /assign /language en Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/triage accepted

[plugin](/docs/concepts/storage/volumes/#types-of-volumes). The following broad classes of Kubernetes volume plugins are supported on Windows: <del> * [`FlexVolume plugins`](/docs/concepts/storage/volumes/#flexvolume-deprecated) </del> <ins> * [`FlexVolume plugins`](/docs/concepts/storage/volumes/#flexvolume) </ins> * Please note that FlexVolumes have been deprecated as of 1.23 * [`CSI Plugins`](/docs/concepts/storage/volumes/#csi)


Question:
This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: documents metrics for Kubernetes v1.26 but that's incorrect because at the time I'm filing this the live documentation is for Kubernetes v1.25 Proposed Solution: Revert whichever PR bumped the document too early or do a careful partial revert that only omits the v1.26 changes Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /sig instrumentation /language en If v1.26 gets released before we fix this, it's OK to close the issue. Consider a backport to the v1.25 docs, though.
/assign
/triage accepted
/assign

Details of the metric data that Kubernetes components export. --- <del> ## Metrics (v1.26) <!-- (auto-generated 2022 Nov 09) --> <!-- (auto-generated v1.26) --> </del> <ins> ## Metrics (auto-generated 2022 Nov 01) </ins> This page details the metrics that different Kubernetes components export. You can query the metrics endpoint for these components using an HTTP scrape, and fetch the current metrics data in Prometheus format.


Question:
This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: documents metrics for Kubernetes v1.26 but that's incorrect because at the time I'm filing this the live documentation is for Kubernetes v1.25 Proposed Solution: Revert whichever PR bumped the document too early or do a careful partial revert that only omits the v1.26 changes Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /sig instrumentation /language en If v1.26 gets released before we fix this, it's OK to close the issue. Consider a backport to the v1.25 docs, though.
/assign
/triage accepted
/assign

Histogram	 Admission controller latency histogram in seconds, identified by name and broken out for each operation and API resource and type (validate or admit).
name

operation

rejected

type

   None

apiserver_admission_step_admission_duration_seconds	 STABLE	 Histogram	 Admission sub-step latency histogram in seconds, broken out for each operation and API resource and step type (validate or admit).
operation

rejected

type

   None

apiserver_admission_webhook_admission_duration_seconds	 STABLE	 Histogram	 Admission webhook latency histogram in seconds, identified by name and broken out for each operation and API resource and type (validate or admit).
name

operation

rejected

type

   None

apiserver_current_inflight_requests	 STABLE	 Gauge	 Maximal number of currently used inflight request limit of this apiserver per request kind in last second.
request_kind

   None

apiserver_longrunning_requests	 STABLE	 Gauge	 Gauge of all active long-running apiserver requests broken out by verb, group, version, resource, scope and component. Not all requests are tracked this way.
component

group

resource

scope

subresource

verb

version

   None

apiserver_request_duration_seconds	 STABLE	 Histogram	 Response latency distribution in seconds for each verb, dry run value, group, version, resource, subresource, scope and component.
component

dry_run

group

resource

scope

subresource

verb

version

   None

apiserver_request_total	 STABLE	 Counter	 Counter of apiserver requests broken out for each verb, dry run value, group, version, resource, scope, component, and HTTP response code.
code

component

dry_run

group

resource

scope

subresource

verb

version

   None

apiserver_requested_deprecated_apis	 STABLE	 Gauge	 Gauge of deprecated APIs that have been requested, broken out by API group, version, resource, subresource, and removed_release.
group

removed_release

resource

subresource

version

   None

apiserver_response_sizes	 STABLE	 Histogram	 Response size distribution in bytes for each group, version, verb, resource, subresource, scope and component.
component

group

resource

scope

subresource

verb

version

   None

apiserver_storage_objects	 STABLE	 Gauge	 Number of stored objects at the time of last check split by kind.
resource

cronjob_controller_job_creation_skew_duration_seconds	 STABLE	 Histogram	 Time between when a cronjob is scheduled to be run, and when the corresponding job is created

job_controller_job_pods_finished_total	 STABLE	 Counter	 The number of finished Pods that are fully tracked
completion_mode

result

job_controller_job_sync_duration_seconds	 STABLE	 Histogram	 The time it took to sync a job
action

completion_mode

result

job_controller_job_syncs_total	 STABLE	 Counter	 The number of job syncs
action

completion_mode

result

job_controller_jobs_finished_total	 STABLE	 Counter	 The number of finished jobs
completion_mode

reason

result

   None

node_collector_evictions_total	 STABLE	 Counter	 Number of Node evictions that happened since current instance of NodeController started.
zone

   None

scheduler_framework_extension_point_duration_seconds	 STABLE	 Histogram	 Latency for running all plugins of a specific extension point.
extension_point

profile

status

   None

scheduler_pending_pods	 STABLE	 Gauge	  Number of pending pods, by the queue type. 'active' means number of pods in activeQ; 'backoff' means number of pods in backoffQ; 'unschedulable' means number of pods in unschedulablePods that the scheduler attempted to schedule and failed; 'gated' is the number of unschedulable pods that the scheduler never attempted to schedule because they are gated.	   Number of pending pods, by the queue type. 'active' means number of pods in activeQ; 'backoff' means number of pods in backoffQ; 'unschedulable' means number of pods in unschedulablePods.
queue

   None

scheduler_pod_scheduling_attempts	 STABLE	 Histogram	 Number of attempts to successfully schedule a pod.
   None	 None

scheduler_pod_scheduling_duration_seconds	 STABLE	 Histogram	 E2e latency for a pod being scheduled which may include multiple scheduling attempts.
attempts

   None

scheduler_preemption_attempts_total	 STABLE	 Counter	 Total preemption attempts in the cluster till now
   None	 None

scheduler_preemption_victims	 STABLE	 Histogram	 Number of selected preemption victims
   None	 None

scheduler_queue_incoming_pods_total	 STABLE	 Counter	 Number of pods added to scheduling queues by event and queue type.
event

queue

   None

scheduler_schedule_attempts_total	 STABLE	 Counter	 Number of attempts to schedule pods, by the result. 'unschedulable' means a pod could not be scheduled, while 'error' means an internal scheduler problem.
profile

result

   None

scheduler_scheduling_attempt_duration_seconds	 STABLE	 Histogram	 Scheduling attempt latency in seconds (scheduling algorithm + binding)
profile

result

   None


Question:
This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: documents metrics for Kubernetes v1.26 but that's incorrect because at the time I'm filing this the live documentation is for Kubernetes v1.25 Proposed Solution: Revert whichever PR bumped the document too early or do a careful partial revert that only omits the v1.26 changes Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--Additional Information: /sig instrumentation /language en If v1.26 gets released before we fix this, it's OK to close the issue. Consider a backport to the v1.25 docs, though.
/assign
/triage accepted
/assign

Help	 Labels	 Const Labels	  Deprecated Version