From 1120f6c4a110ae69fe0d9494aab3d4765645eb62 Mon Sep 17 00:00:00 2001
From: SataQiu <1527062125@qq.com>
Date: Wed, 14 Aug 2019 13:26:24 +0800
Subject: [PATCH] zh-trans: add docs/reference/access-authn-authz/abac.md
 (#15785)

* zh-trans: add docs/reference/access-authn-authz/abac.md

* Update content/zh/docs/reference/access-authn-authz/abac.md

Co-Authored-By: Qiming <tengqim@cn.ibm.com>

* Update content/zh/docs/reference/access-authn-authz/abac.md

Co-Authored-By: Qiming <tengqim@cn.ibm.com>

* Update content/zh/docs/reference/access-authn-authz/abac.md

Co-Authored-By: Qiming <tengqim@cn.ibm.com>

* Update content/zh/docs/reference/access-authn-authz/abac.md

Co-Authored-By: Qiming <tengqim@cn.ibm.com>

* Update content/zh/docs/reference/access-authn-authz/abac.md

Co-Authored-By: Qiming <tengqim@cn.ibm.com>

* Update content/zh/docs/reference/access-authn-authz/abac.md

Co-Authored-By: Qiming <tengqim@cn.ibm.com>

* Update content/zh/docs/reference/access-authn-authz/abac.md

Co-Authored-By: Qiming <tengqim@cn.ibm.com>

* Update content/zh/docs/reference/access-authn-authz/abac.md

Co-Authored-By: Qiming <tengqim@cn.ibm.com>

* Update content/zh/docs/reference/access-authn-authz/abac.md

Co-Authored-By: Qiming <tengqim@cn.ibm.com>

* Update content/zh/docs/reference/access-authn-authz/abac.md

Co-Authored-By: Qiming <tengqim@cn.ibm.com>
---
 .../docs/reference/access-authn-authz/abac.md | 293 ++++++++++++++++++
 1 file changed, 293 insertions(+)
 create mode 100644 content/zh/docs/reference/access-authn-authz/abac.md

diff --git a/content/zh/docs/reference/access-authn-authz/abac.md b/content/zh/docs/reference/access-authn-authz/abac.md
new file mode 100644
index 0000000000..6be89483df
--- /dev/null
+++ b/content/zh/docs/reference/access-authn-authz/abac.md
@@ -0,0 +1,293 @@
+---
+reviewers:
+- erictune
+- lavalamp
+- deads2k
+- liggitt
+title: 使用 ABAC 授权
+content_template: templates/concept
+weight: 80
+---
+<!--
+---
+reviewers:
+- erictune
+- lavalamp
+- deads2k
+- liggitt
+title: Using ABAC Authorization
+content_template: templates/concept
+weight: 80
+---
+-->
+{{< note >}}
+{{< feature-state state="deprecated" for_k8s_version="1.6" >}}
+<!--
+The ABAC Authorization feature has been considered deprecated from the Kubernetes 1.6 release.
+-->
+从 Kubernetes 1.6 开始，ABAC 授权功能已被视为弃用。
+{{< /note >}}
+
+{{% capture overview %}}
+<!--
+Attribute-based access control (ABAC) defines an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together.
+-->
+基于属性的访问控制（ABAC）定义了一种访问控制范例，通过使用将属性组合在一起的策略，将访问权限授予用户。
+{{% /capture %}}
+
+{{% capture body %}}
+<!--
+## Policy File Format
+-->
+## 策略文件格式
+
+<!--
+To enable `ABAC` mode, specify `--authorization-policy-file=SOME_FILENAME` and `--authorization-mode=ABAC` on startup.
+-->
+要启用 `ABAC` 模式，请在启动时指定 `--authorization-policy-file=SOME_FILENAME` 和 `--authorization-mode=ABAC` 。
+
+<!--
+The file format is [one JSON object per line](http://jsonlines.org/).  There should be no enclosing list or map, just one map per line.
+-->
+文件格式是[每行一个 JSON 对象](http://jsonlines.org/)。不允许存在内嵌的 list 或 map，每一行只能有一个 map 。
+
+<!--
+Each line is a "policy object", where each such object is a map with the following properties:
+- Versioning properties:
+    - `apiVersion`, type string; valid values are "abac.authorization.kubernetes.io/v1beta1". Allows versioning and conversion of the policy format.
+    - `kind`, type string: valid values are "Policy". Allows versioning and conversion of the policy format.
+  - `spec` property set to a map with the following properties:
+    - Subject-matching properties:
+      - `user`, type string; the user-string from `--token-auth-file`. If you specify `user`, it must match the username of the authenticated user.
+      - `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `system:authenticated` matches all authenticated requests. `system:unauthenticated` matches all unauthenticated requests.
+    - Resource-matching properties:
+      - `apiGroup`, type string; an API group.
+        - Ex: `extensions`
+        - Wildcard: `*` matches all API groups.
+      - `namespace`, type string; a namespace.
+        - Ex: `kube-system`
+        - Wildcard: `*` matches all resource requests.
+      - `resource`, type string; a resource type
+        - Ex: `pods`
+        - Wildcard: `*` matches all resource requests.
+    - Non-resource-matching properties:
+      - `nonResourcePath`, type string; non-resource request paths.
+        - Ex: `/version` or `/apis`
+        - Wildcard: 
+          - `*` matches all non-resource requests.
+          - `/foo/*` matches all subpaths of `/foo/`.
+    - `readonly`, type boolean, when true, means that the Resource-matching policy only applies to get, list, and watch operations, Non-resource-matching policy only applies to get operation.
+
+-->
+每一行都是一个“策略对象”，其中每个这样的对象都是具有以下属性的 map：
+
+- 版本属性：
+    - `apiVersion`， 字符串类型，有效值是 "abac.authorization.kubernetes.io/v1beta1"。 用来支持策略格式的版本化和转换。
+    - `kind`，字符串类型，有效值是 "Policy"。 用来支持策略格式的版本化和转换。
+  - `spec` 属性设置为具有以下属性的 map：
+    - 主体匹配属性：
+      - `user`，字符串类型，来自 `--token-auth-file` 的用户字符串。 如果您指定 `user`，它必须与经过身份验证的用户的用户名匹配。
+      - `group`，字符串类型，如果您指定 `group`，它必须匹配经过身份验证的用户的一个组。 `system:authenticated` 匹配所有经过身份验证的请求。 `system:unauthenticated` 匹配所有未经身份验证的请求。
+    - 资源匹配属性：
+      - `apiGroup`，字符串类型，一个 API 组。
+        - 示例： `extensions`
+        - 通配符： `*` 匹配所有 API 组。
+      - `namespace`，字符串类型，一个命名空间。
+        - 示例： `kube-system`
+        - 通配符: `*` 匹配所有资源请求。
+      - `resource`，字符串类型，一种资源。
+        - 示例： `pods`
+        - 通配符： `*` 匹配所有资源请求。
+    - 非资源匹配属性：
+      - `nonResourcePath`，字符串类型，非资源请求路径。
+        - 示例： `/version` 或 `/apis`
+        - 通配符：
+          - `*` 匹配所有非资源请求。
+          - `/foo/*` 匹配 `/foo/` 的所有子路径。
+    - `readonly`，布尔类型， 表示资源匹配策略仅适用于 get，list 和 watch 操作，非资源匹配策略仅适用于 get 操作。
+
+{{< note >}}
+<!--
+An unset property is the same as a property set to the zero value for its type(e.g. empty string, 0, false). However, unset should be preferred for readability. In the future, policies may be expressed in a JSON format, and managed via aREST interface.
+-->
+未设置的属性与为属性设置为对应类型之零值（例如，空字符串，0，false）的效果相同。为了可读性，应尽量采用不设置的方式。将来，策略可能会用 JSON 格式表示，并通过 REST 接口管理。
+
+{{< /note >}}
+
+<!--
+## Authorization Algorithm
+-->
+## 授权算法
+
+<!--
+A request has attributes which correspond to the properties of a policy object.
+-->
+请求具有与策略对象的属性相对应的属性。
+
+<!--
+When a request is received, the attributes are determined.  Unknown attributesare set to the zero value of its type (e.g. empty string, 0, false).
+-->
+当 kubernetes 收到请求时，确定各属性的取值。未知属性会被设置为其对应类型的零值（例如空字符串，0，false）。
+
+<!--
+A property set to `"*"` will match any value of the corresponding attribute.
+-->
+设置为 `"*"` 的属性将匹配相应属性的任何值。
+
+<!--
+The tuple of attributes is checked for a match against every policy in thepolicy file. If at least one line matches the request attributes, then the request is authorized (but may fail later validation).
+-->
+属性元组与策略文件中的各个策略逐一比较，以寻找匹配项。如果至少有一行匹配请求属性，则请求被授权（但稍后可能会验证失败）。
+
+<!--
+To permit any authenticated user to do something, write a policy with the group property set to `"system:authenticated"`.
+-->
+要允许任何经过身份验证的用户执行某些操作，请编写将 group 属性设置为 `"system:authenticated"` 的策略。
+
+<!--
+To permit any unauthenticated user to do something, write a policy with the group property set to `"system:unauthenticated"`.
+-->
+要允许任何未经身份验证的用户执行某些操作，请编写将 group 属性设置为 `"system:unauthenticated"` 的策略。
+
+<!--
+To permit a user to do anything, write a policy with the apiGroup, namespace,resource, and nonResourcePath properties set to `"*"`.
+-->
+要允许用户执行任何操作，请编写将 apiGroup，namespace，resource 和 nonResourcePath 属性设置为 `"*"` 的策略。
+
+<!--
+## Kubectl
+-->
+## Kubectl
+
+<!--
+Kubectl uses the `/api` and `/apis` endpoints of api-server to discover served resource types, and validates objects sent to the API by create/update operations using schema information located at `/openapi/v2`.
+-->
+Kubectl 使用 api-server 的 `/api` 和 `/apis` 端点来发现资源类型，并使用位于 `/openapi/v2` 的 schema 信息验证通过创建/更新操作发送到 API 的对象。
+
+<!--
+When using ABAC authorization, those special resources have to be explicitly exposed via the `nonResourcePath` property in a policy (see [examples](#examples) below):
+-->
+当使用 ABAC 授权时，必须通过策略中的 `nonResourcePath` 属性显式地公开这些特殊资源（参见下面的[示例](#examples)）：
+
+* `/api`， `/api/*`， `/apis`， 和 `/apis/*` 用于 API 版本协商。
+* `/version` 用于通过 `kubectl version` 获取服务端版本。
+* `/swaggerapi/*` 用于创建/更新操作。
+
+<!--
+To inspect the HTTP calls involved in a specific kubectl operation you can turnup the verbosity:
+-->
+要检查特定 kubectl 操作中涉及的 HTTP 调用，您可以调整日志输出的详细程度：
+
+<!--
+    kubectl --v=8 version
+-->
+kubectl --v=8 version
+
+<!--
+## Examples
+-->
+## 示例 {#examples}
+
+<!--
+1. Alice can do anything to all resources:
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "alice", "namespace": "*", "resource": "*", "apiGroup": "*"}}
+    ```
+ 1. The Kubelet can read any pods:
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "pods", "readonly": true}}
+    ```
+ 2. The Kubelet can read and write events:
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "events"}}
+    ```
+ 3. Bob can just read pods in namespace "projectCaribou":
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "bob", "namespace": "projectCaribou", "resource": "pods", "readonly": true}}
+    ```
+ 5. Anyone can make read-only requests to all non-resource paths:
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:authenticated", "readonly": true, "nonResourcePath": "*"}}
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:unauthenticated", "readonly": true, "nonResourcePath": "*"}}
+    ```
+-->
+1. Alice 可以对所有资源做任何事情：
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "alice", "namespace": "*", "resource": "*", "apiGroup": "*"}}
+    ```
+
+2. Kubelet 可以读取任何 Pod：
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "pods", "readonly": true}}
+    ```
+
+3. Kubelet 可以读写事件：
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "events"}}
+    ```
+
+4. Bob 可以在命名空间 “projectCaribou” 中读取 Pod：
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "bob", "namespace": "projectCaribou", "resource": "pods", "readonly": true}}
+    ```
+
+5. 任何人都可以对所有非资源路径发出只读请求：
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:authenticated", "readonly": true, "nonResourcePath": "*"}}
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:unauthenticated", "readonly": true, "nonResourcePath": "*"}}
+    ```
+
+<!--
+[Complete file example](http://releases.k8s.io/{{< param "githubbranch" >}}/pkg/auth/authorizer/abac/example_policy_file.jsonl)
+-->
+[完整文件示例](http://releases.k8s.io/{{< param "githubbranch" >}}/pkg/auth/authorizer/abac/example_policy_file.jsonl)
+
+<!--
+## A quick note on service accounts
+-->
+## 关于服务帐户的快速说明
+
+<!--
+Every service account has a corresponding ABAC username, and that service account's user name is generated according to the naming convention:
+-->
+每个服务帐户都有一个相应的 ABAC 用户名，该服务帐户的用户名是根据下面的命名规则生成的：
+
+```shell
+system:serviceaccount:<namespace>:<serviceaccountname>
+```
+
+<!--
+Creating a new namespace leads to the creation of a new service account in the following format:
+-->
+创建新的命名空间会导致以下列格式创建新的服务帐户：
+
+```shell
+system:serviceaccount:<namespace>:default
+```
+
+<!--
+For example, if you wanted to grant the default service account (in the `kube-system` namespace) full privilege to the API using ABAC, you would add this line to your policy file:
+-->
+例如，如果您想使用 ABAC 将默认服务帐户（在 `kube-system` 命名空间中）进行 API 完全授权，您可以将此行添加到您的策略文件中：
+
+```json
+{"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"system:serviceaccount:kube-system:default","namespace":"*","resource":"*","apiGroup":"*"}}
+```
+
+<!--
+The apiserver will need to be restarted to pickup the new policy lines.
+-->
+需要重新启动 apiserver 以使新的策略行生效。
+
+{{% /capture %}}
+