jiebi/CodeConvo huggingface dataset:
Code change:
## {{% heading "whatsnext" %}} <ins> Learn more about the following: </ins> * Follow the [Connecting Applications with Services](/docs/tutorials/services/connect-applications-service/) tutorial <del> * Read about [Ingress](/docs/concepts/services-networking/ingress/) * Read about [EndpointSlices](/docs/concepts/services-networking/endpoint-slices/) </del> <ins> * [Ingress](/docs/concepts/services-networking/ingress/) exposes HTTP and HTTPS routes from outside the cluster to services within the cluster. * [EndpointSlices](/docs/concepts/services-networking/endpoint-slices/) </ins> For more context: <del> * Read [Virtual IPs and Service Proxies](/docs/reference/networking/virtual-ips/) * Read the [API reference](/docs/reference/kubernetes-api/service-resources/service-v1/) for the Service API * Read the [API reference](/docs/reference/kubernetes-api/service-resources/endpoints-v1/) for the Endpoints API * Read the [API reference](/docs/reference/kubernetes-api/service-resources/endpoint-slice-v1/) for the EndpointSlice API </del> <ins> * [Virtual IPs and Service Proxies](/docs/reference/networking/virtual-ips/) * [API reference](/docs/reference/kubernetes-api/service-resources/service-v1/) for the Service API * [API reference](/docs/reference/kubernetes-api/service-resources/endpoints-v1/) for the Endpoints API * [API reference](/docs/reference/kubernetes-api/service-resources/endpoint-slice-v1/) for the EndpointSlice API </ins>

Related discussion:
text: A link reference from to has the title text whereas the current title of that page is It will be a little less confusing if the link title was adjusted to be the same as the page title.
/sig docs /language en /assign
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : /kind suggestion I Agree on your point. If triage accepted, i will update this reference text from to that can avoid confusion. Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
I Agree on your point. If triage accepted, i will update this reference text from to that can avoid confusion.
This issue got resolved with PR .
/triage accepted
Code change:
You can directly configure CSI volumes within the Pod specification. Volumes specified in this way are ephemeral and do not persist across pod restarts. See [Ephemeral <del> Volumes](/docs/concepts/storage/ephemeral-volumes/#csi-ephemeral-volume) </del> <ins> Volumes](/docs/concepts/storage/ephemeral-volumes/#csi-ephemeral-volumes) </ins> for more information. For more information on how to develop a CSI driver, refer to the

Related discussion:
text: This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: Links to some ephemeral volume types are wrong. Proposed Solution: In , update links as follows: → → Page to Update: <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--/language en /assign
This issue is currently awaiting triage. SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the label. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Code change:
client-key: fake-key-file - name: experimenter user: <ins> # Documentation note (this comment is NOT part of the command output). # Storing passwords in Kubernetes client config is risky. # A better alternative would be to use a credential plugin # and store the credentials separately. # See https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins </ins> password: some-password username: exp ```

Related discussion:
text: This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Add a comment to the example Kubernetes client config in Why is this needed Storing a password in a Kubernetes client config is risky, and we have an opportunities to call out other options. Comments A good alternative is a and separate secret storage. /language en /sig security
once this issue is triaged, I'd expect that contributors look at the issue and decide whether they know how to resolve it. If you - or anyone else - aren't sure how to resolve a particular issue, that's OK. In that case, you have a few options: ask in Kubernetes Slack for advice for this issue specifically, WG API Expression or SIG Security might be able to offer advice around good practice with password storage look on the web using a web search engine. For example, has links to pages that might offer advice here look for a different issue to work on. With over 200 other English language issues open, you may find another issue that you do know how to work on. It's OK not to work on an issue that you don't understand how to fix. In general, asking the person who reported the issue isn't the best way to get help. Sometimes they may know exactly what is wrong but not have a clear idea about what to do to fix it.
If you decide that you don't know how to work on this then I recommend that you unassign yourself, so it's clear to other contributors that help is needed here.
/triage accepted
Code change:
kubectl delete pod fine-pod --wait --now ``` <del> ## Create Pod that uses the container runtime default seccomp profile Most container runtimes provide a sane set of default syscalls that are allowed or not. You can adopt these defaults for your workload by setting the seccomp type in the security context of a pod or container to `RuntimeDefault`. {{< note >}} If you have the `SeccompDefault` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) enabled, then Pods use the `RuntimeDefault` seccomp profile whenever no other seccomp profile is specified. Otherwise, the default is `Unconfined`. {{< /note >}} Here's a manifest for a Pod that requests the `RuntimeDefault` seccomp profile for all its containers: {{< codenew file="pods/security/seccomp/ga/default-pod.yaml" >}} Create that Pod: ```shell kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/default-pod.yaml ``` ```shell kubectl get pod default-pod ``` The Pod should be showing as having started successfully: ``` NAME        READY   STATUS    RESTARTS   AGE default-pod 1/1     Running   0          20s ``` Finally, now that you saw that work OK, clean up: ```shell kubectl delete pod default-pod --wait --now ``` </del> ## {{% heading "whatsnext" %}} You can learn more about Linux seccomp:

Related discussion:
text: This is a Feature Request Hi, I would like to request a change made in doc page: It would make more sense if the "Create Pod that uses the container runtime default seccomp profile" section was after "Enable the use of RuntimeDefault as the default seccomp profile for all workloads" section, and not the very last option of creating pods with seccomp profiles. I feel like it would improve the flow.
Page: /language en
I am new to the kubernetes website project, Can I work on this issue ?
/retitle Improve flow for Seccomp security tutorial
Anyone can work on this issue, providing that they follow our .
Hi Are you working on this issue?
/triage accepted
if no one is working on this then I'm up for it.
/assign
Hi will this seems valid to you?
yeah I think having a slightly different order of the sections would make understanding the topic better. I'm in favor of that! :)
thanks for your views on this. I will soon create the PR for it.
Fixed it here:
Code change:
Watch out when using this type of volume, because: <ins> * HostPaths can expose privileged system credentials (such as for the Kubelet) or privileged APIs (such as container runtime socket), which can be used for container escape or to attack other parts of the cluster. </ins> * Pods with identical configuration (such as created from a PodTemplate) may behave differently on different nodes due to different files on the nodes * The files or directories created on the underlying hosts are only writable by root. You

Related discussion:
text: This is a Feature Request The chapter that describes volume should mention field and recommend to use it when possible. What would you like to be should mention field Why is this needed This improves cluster security and should be always used when possible. Without a warning users might not know or just forget to specify this flag. Comments We might use a warning from as a draft and modify it accordingly. /sig auth /kind documentation
The label(s) cannot be applied, because the repository doesn't have them <detailsIn response to : This is a Feature Request The chapter that describes volume should mention field and recommend to use it when possible. should mention field This improves cluster security and should be always used when possible. Without a warning users might not know or just forget to specify this flag. We might use a warning from as a draft and modify it accordingly. Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
/assign
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or .
Code change:
Watch out when using this type of volume, because: <ins> * HostPaths can expose privileged system credentials (such as for the Kubelet) or privileged APIs (such as container runtime socket), which can be used for container escape or to attack other parts of the cluster. </ins> * Pods with identical configuration (such as created from a PodTemplate) may behave differently on different nodes due to different files on the nodes * The files or directories created on the underlying hosts are only writable by root. You

Related discussion:
text: /lifecycle rotten
/remove-lifecycle rotten Still working on this?
/sig security
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-contributor-experience at . /lifecycle stale
Adding the PSS as is the future as K8S 1.21 is deprecating PSP. All Documentation for mention Read Only should also be covered in this docf from now on.
/sig storage /remove-sig auth
does this mean that readonly for hostpath is allowed and working but just not documented ?
yes, exactly
that is ownsome I was just going to rule out this solution because of the security issue. Thanks for your answer I'll test it right away.
well, I am using this manifest but I get this error
the VolumeMount on the pod spec allows a readonly setup but not on the Volume definition.
You're right and that's what I meant. Perhaps, I explained it a little vague.
well in that case I think you should close this issue as it is not an issue? the hostpath volume type does not support readonly but the container volume mount supports it and is documented here :
My point was that we can promote best practices by adding a hint to the documentation. Most of the people, don't read API specifications, they google and find a page with documentation. In this case, an advise of other options might be useful.
/remove-lifecycle stale
Would very much have appreciated if suggestion had been implemented; would have saved me a bunch of time looking for a way to mount a hostPath readonly.
/assign I can add a note in
Code change:
If you don't specify a registry hostname, Kubernetes assumes that you mean the Docker public registry. <del> After the image name part you can add a _tag_ (as also using with commands such as `docker` and `podman`). </del> <ins> After the image name part you can add a _tag_ (in the same way you would when using with commands like `docker` or `podman`). </ins> Tags let you identify different versions of the same series of images. Image tags consist of lowercase and uppercase letters, digits, underscores (`_`),

Related discussion:
text: Ref: needs a rewrite. It mentions Docker (and Podman!) all over the place, which is a good indication that the docs are old enough to need a rewrite. At a minimum, remove mentions of Docker in these topics: /triage accepted /milestone 1.24
/assign
/assign
Reasked folks in Slack for correct disposition
Asked in the SIG Node slack channel:
To summarize the consensus from talking with folks about this issue, specifically the examples in Using a Private Registry section: The steps in the Using a Private Registry section are still valid. However, as written, it makes it sound like Docker is the only/recommended way to do this-which we dont want. We should be able to remove the docker examples and point folks to this page , which covers most of the same content with third party disclaimers already written into the examples. I plan to open a PR later this week with these changes!
Has anyone opened a PR for this issue? It seems to be referring to
Code change:
- annotation，注解 - anti-affinity，反亲和性 - attach，挂接 <ins> - authenticate，身份验证 - authorize，授权或鉴权 - 将权限授予某主体时，译为“授权” - 根据某些参数/条件来确定具有哪些权限时，译为“鉴权” - authorizer，鉴权器 </ins> - autoscale，自动扩缩容 - bearer token，持有者令牌 - capabilities

Related discussion:
text: When re-syncing , found that are being translated into "" and "" on the same page. I am confused about which word would be better when looking for documents. So I think it would be great if we reach a rough consensus and write into the in the Mandarin localization guide. Including "": 56 files / 229 lines / 243 words Including "": 68 files / 182 lines / 196 words Including both terms: 31 files It's hard to tell the correctness of files including both terms without reviewing them, it will cost a lot of time. So here is just the line count for occurrence of two terms. <pre<code 17 19 2357 <a href=""content/zh-cn/docs/reference/access-authn-</a5 6 558 <a href=""content/zh-cn/docs/concepts/extend-kubernetes/api-extension/custom-</a13 5 226 <a href=""content/zh-cn/docs/reference/access-authn-</a4 7 526 <a href=""content/zh-cn/docs/tasks/administer-cluster/securing-a-</a6 4 2410 <a href=""content/zh-cn/docs/reference/command-line-tools-reference/kube-</a3 25 1383 <a href=""content/zh-cn/docs/concepts/security/pod-security-</a3 4 903 <a href=""content/zh-cn/docs/reference/access-authn-authz/kubelet-tls-</a3 4 1003 <a href=""content/zh-cn/docs/reference/command-line-tools-reference/kube-</a7 3 1981 <a href=""content/zh-cn/docs/reference/command-line-tools-reference/kube-controller-</a10 3 2033 <a href=""content/zh-cn/docs/reference/access-authn-</a2 4 1630 <a href=""content/zh-cn/docs/reference/using-api/api-</a2 2 2513 <a href=""content/zh-cn/docs/reference/command-line-tools-</a2 2 1151 <a href=""content/zh-cn/docs/reference/setup-tools/kubeadm/implementation-</a2 2 1091 <a href=""content/zh-cn/docs/concepts/security/multi-</a3 2 1374 <a href=""content/zh-cn/docs/reference/access-authn-authz/admission-</a15 2 603 <a
Code change:
- annotation，注解 - anti-affinity，反亲和性 - attach，挂接 <ins> - authenticate，身份验证 - authorize，授权或鉴权 - 将权限授予某主体时，译为“授权” - 根据某些参数/条件来确定具有哪些权限时，译为“鉴权” - authorizer，鉴权器 </ins> - autoscale，自动扩缩容 - bearer token，持有者令牌 - capabilities

Related discussion:
text: href=""content/zh-cn/docs/tasks/extend-kubernetes/configure-aggregation-</a1 4 849 <a href=""content/zh-cn/docs/reference/access-authn-authz/certificate-signing-</a1 3 668 <a href=""content/zh-cn/docs/tasks/configure-pod-container/migrate-from-</a1 2 500 <a href=""content/zh-cn/docs/tasks/configure-pod-container/configure-</a1 2 147 <a href=""content/zh-cn/docs/concepts/cluster-</a1 1 1182 <a href=""content/zh-</a1 1 344 <a href=""content/zh-cn/docs/concepts/cluster-administration/system-</a1 1 373 <a href=""content/zh-cn/docs/concepts/security/rbac-good-</a1 1 1140 <a href=""content/zh-cn/docs/setup/production-environment/tools/kubeadm/create-cluster-</a1 1 370 <a href=""content/zh-cn/docs/tasks/administer-cluster/controller-manager-leader-</a1 1 431 <a href=""content/zh-cn/docs/tasks/administer-cluster/namespaces-</a1 1 519 <a href=""content/zh-cn/docs/tasks/administer-</a1 1 645 <a href=""content/zh-cn/docs/tasks/configure-pod-container/configure-service-</a2 1 2240 <a href=""content/zh-</a4 1 60 <a href=""content/zh-cn/docs/reference/access-authn-</a15 1 588 <a href=""content/zh-cn/docs/setup/production-</a</code</pre
Opinion: I found (Security Framework: identification, authorization, authentication, and permission control). As it said: mapping to authorization, and mapping to authentication.
According to the official bilingual vocabulary list of Taiwan (temporary unavailable for unknown reason): is recommended to be translated to / is recommended to be translated to / / / / (Just for the reference, it's not that suitable for translation.)
Hope we can get inputs from active translators. CC
/language zh
wow, in my understanding, current authentication is with less confusion. Authorizer is recommended to use , and is for authorize and authorization. For most people, authz (authorize, authorizer, authorization) is related to for their first impression.
Code change:
- annotation，注解 - anti-affinity，反亲和性 - attach，挂接 <ins> - authenticate，身份验证 - authorize，授权或鉴权 - 将权限授予某主体时，译为“授权” - 根据某些参数/条件来确定具有哪些权限时，译为“鉴权” - authorizer，鉴权器 </ins> - autoscale，自动扩缩容 - bearer token，持有者令牌 - capabilities

Related discussion:
text: This may cause some review efforts.
I agree.
+1
+1 I refer to the localized content of AKS and EKS, and hold the same opinion. /triage accepted
I think we all agree to the translation provided in . Hey may I ask you to add it into the glossary of terms? ‍
Ok, let me have a try to add this glossary.
Code change:
`JobTrackingWithFinalizers`機能が無効になっている時に作成されたJobについては、コントロールプレーンを1.26にアップグレードしても、ファイナライザーを使用してJobを追跡しません。 {{< /note >}} <del> コントロールプレーンは任意のJobに属するPodを追跡し、そのPodがAPIサーバーから削除されたかどうか認識します。そのためJobコントローラはファイナライザー`batch.kubernetes.io/job-tracking`を持つPodを作成します。コントローラーがファイナライザーを削除するのは、PodがJobステータスに反映された後なので、他のコントローラーやユーザがPodを削除することができます。 </del> <ins> コントロールプレーンは任意のJobに属するPodを追跡し、そのPodがAPIサーバーから削除されたかどうか認識します。そのためJobコントローラーはファイナライザー`batch.kubernetes.io/job-tracking`を持つPodを作成します。コントローラーがファイナライザーを削除するのは、PodがJobステータスに反映された後なので、他のコントローラーやユーザがPodを削除することができます。 </ins> Kubernetes 1.26にアップグレードする前、またはフィーチャーゲート`JobTrackingWithFinalizers`が有効になる前に作成されたJobは、Podファイナライザーを使用せずに追跡されます。Job{{< glossary_tooltip term_id="controller" text="コントローラー" >}}は、クラスタに存在するPodのみに基づいて、`succeeded`Podと`failed`Podのステータスカウンタを更新します。クラスタからPodが削除されると、コントロールプレーンはJobの進捗を見失う可能性があります。

Related discussion:
text: This is a Bug Report Problem: In the Japanese localization of k/website, it is necessary to express "controller" as "" (not ""). In , it is expressed as "". ref. ref. Proposed Solution: fix "" to "" Page to Update:
/assign /area localization /language ja
ref.
/triage accepted
Code change:
对象的定义中包含了更多的细节信息。 * 博客 [分布式系统工具箱：复合容器模式](/blog/2015/06/the-distributed-system-toolkit-patterns/) 中解释了在同一 Pod 中包含多个容器时的几种常见布局。 <del> * 了解 [Pod 拓扑分布约束](/zh-cn/docs/concepts/workloads/pods/pod-topology-spread-constraints/)。 </del> <ins> * 了解 [Pod 拓扑分布约束](/zh-cn/docs/concepts/scheduling-eviction/topology-spread-constraints//)。 </ins> <!-- To understand the context for why Kubernetes wraps a common Pod API in other resources (such as {{< glossary_tooltip text="StatefulSets" term_id="statefulset" >}} or {{< glossary_tooltip text="Deployments" term_id="deployment" >}}), you can read about the prior art, including:

Related discussion:
text: This is a Feature Request Will relocate this file from to in which may involve some text updates and link fix.
/triage accepted
/language zh
/assign
/assign I handle the language/zh-cn
Regarding assignee issue I share the following comment in the releated PR. :)
Yes, this is not a simple relocation, which involves with much localization of new paras and text.
Code change:
} ``` <del> Note that the `resourceVersion` of the list remains constant across each request, indicating the server is showing us a consistent snapshot of the pods. Pods that are created, updated, or deleted after version `10245` would not be shown unless the user makes a list request without the `continue` token.  This allows clients to break large requests into smaller chunks and then perform a watch operation on the full set without missing any updates. </del> <ins> Note that the `resourceVersion` of the list remains constant across each request, indicating the server is showing us a consistent snapshot of the pods. Pods that are created, updated, or deleted after version `10245` would not be shown unless the user makes a list request without the `continue` token.  This allows clients to break large requests into smaller chunks and then perform a watch operation on the full set without missing any updates. `remainingItemCount` is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the API server does not include a `remainingItemCount` field in its response. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and the API server does not include a `remainingItemCount` field in its response. The intended use of the `remainingItemCount` is estimating the size of a collection. </ins> ## Receiving resources as Tables

Related discussion:
text: lists RemainingItemCount as alpha but shows it went beta. /kind bug /language en /sig api-machinery
/triage accepted
What was the version when it was promoted to beta? (The PR seems quite old). Was it if I am not wrong? /assign