From e7aa12e167773bc2c52f09294a13932d4ddca906 Mon Sep 17 00:00:00 2001 From: wojtekt Date: Thu, 23 Aug 2018 13:16:41 +0200 Subject: [PATCH 1/2] Fix secrets docs --- content/en/docs/concepts/configuration/secret.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/configuration/secret.md b/content/en/docs/concepts/configuration/secret.md index e2469c1c83fc6..5b31cbf89ce67 100644 --- a/content/en/docs/concepts/configuration/secret.md +++ b/content/en/docs/concepts/configuration/secret.md @@ -339,9 +339,15 @@ files. When a secret being already consumed in a volume is updated, projected keys are eventually updated as well. Kubelet is checking whether the mounted secret is fresh on every periodic sync. -However, it is using its local ttl-based cache for getting the current value of the secret. -As a result, the total delay from the moment when the secret is updated to the moment when new keys are -projected to the pod can be as long as kubelet sync period + ttl of secrets cache in kubelet. +However, it is using its local cache for getting the current value of the secret. +The type of the cache is configurable (`ConfigMapAndSecretChangeDetectionStrategy` field in +[KubeletConfiguration struct](https://github.com/kubernetes/kubernetes/blob/{{< param "docsbranch" >}}/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go)) +and can be either propagated via watch (default), ttl-based or simply redirecting +all requests to directly kube-apiserver. +As a result, the total delay from the moment when the secret is updated to the moment +when new keys are projected to the pod can be as long as kubelet sync period + cache +propagation delay, where cache propagation delay depends on the chosen cache type +(it equals to watch propagation delay, ttl of cache or zero corespondingly). {{< note >}} **Note:** A container using a Secret as a From 3d4849d6e2ad537198d926c3c89cea0904a39af3 Mon Sep 17 00:00:00 2001 From: Zach Arnold Date: Thu, 13 Sep 2018 11:00:46 -0700 Subject: [PATCH 2/2] Update secret.md --- content/en/docs/concepts/configuration/secret.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/en/docs/concepts/configuration/secret.md b/content/en/docs/concepts/configuration/secret.md index 5b31cbf89ce67..7b66862781cd7 100644 --- a/content/en/docs/concepts/configuration/secret.md +++ b/content/en/docs/concepts/configuration/secret.md @@ -339,15 +339,15 @@ files. When a secret being already consumed in a volume is updated, projected keys are eventually updated as well. Kubelet is checking whether the mounted secret is fresh on every periodic sync. -However, it is using its local cache for getting the current value of the secret. -The type of the cache is configurable (`ConfigMapAndSecretChangeDetectionStrategy` field in -[KubeletConfiguration struct](https://github.com/kubernetes/kubernetes/blob/{{< param "docsbranch" >}}/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go)) -and can be either propagated via watch (default), ttl-based or simply redirecting +However, it is using its local cache for getting the current value of the Secret. +The type of the cache is configurable using the (`ConfigMapAndSecretChangeDetectionStrategy` field in +[KubeletConfiguration struct](https://github.com/kubernetes/kubernetes/blob/{{< param "docsbranch" >}}/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go)). +It can be either propagated via watch (default), ttl-based, or simply redirecting all requests to directly kube-apiserver. -As a result, the total delay from the moment when the secret is updated to the moment -when new keys are projected to the pod can be as long as kubelet sync period + cache +As a result, the total delay from the moment when the Secret is updated to the moment +when new keys are projected to the Pod can be as long as kubelet sync period + cache propagation delay, where cache propagation delay depends on the chosen cache type -(it equals to watch propagation delay, ttl of cache or zero corespondingly). +(it equals to watch propagation delay, ttl of cache, or zero corespondingly). {{< note >}} **Note:** A container using a Secret as a