Merge pull request #25001 from tengqm/zh-sync-3

[zh] Sync changes from English site (3)

content/zh/docs/concepts/security/overview.md

@@ -204,7 +204,7 @@ Disallow privileged users | When constructing containers, consult your documenta
 
 容器安全性不在本指南的探讨范围内。下面是一些探索此主题的建议和连接：
 
-容器关注领域 | 建议 |
+容器关注领域                   | 建议           |
 ------------------------------ | -------------- |
 容器漏洞扫描和操作系统依赖安全性 | 作为镜像构建的一部分，您应该扫描您的容器里的已知漏洞。
 镜像签名和执行 | 对容器镜像进行签名，以维护对容器内容的信任。
@@ -257,8 +257,8 @@ Learn about related Kubernetes security topics:
 
 * [Pod security standards](/docs/concepts/security/pod-security-standards/)
 * [Network policies for Pods](/docs/concepts/services-networking/network-policies/)
+* [Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access)
 * [Securing your cluster](/docs/tasks/administer-cluster/securing-a-cluster/)
-* [API access control](/docs/reference/access-authn-authz/controlling-access/)
 * [Data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/) for the control plane
 * [Data encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)
 * [Secrets in Kubernetes](/docs/concepts/configuration/secret/)
@@ -267,8 +267,9 @@ Learn about related Kubernetes security topics:
 
 * [Pod 安全标准](/zh/docs/concepts/security/pod-security-standards/)
 * [Pod 的网络策略](/zh/docs/concepts/services-networking/network-policies/)
+* [控制对 Kubernetes API 的访问](/zh/docs/concepts/security/controlling-access/)
 * [保护您的集群](/zh/docs/tasks/administer-cluster/securing-a-cluster/)
-* [API 访问控制](/zh/docs/reference/access-authn-authz/controlling-access/)
-* [加密通信中的数据](/zh/docs/tasks/tls/managing-tls-in-a-cluster/) for the control plane
+* 为控制面[加密通信中的数据](/zh/docs/tasks/tls/managing-tls-in-a-cluster/)
 * [加密静止状态的数据](/zh/docs/tasks/administer-cluster/encrypt-data/)
-* [Kubernetes 的 Secret](/zh/docs/concepts/configuration/secret/)
+* [Kubernetes 中的 Secret](/zh/docs/concepts/configuration/secret/)
+

content/zh/docs/concepts/security/pod-security-standards.md

@@ -278,7 +278,7 @@ Baseline/Default 策略的目标是便于常见的容器化应用采用，同时
 				net.ipv4.ip_local_port_range<br>
 				net.ipv4.tcp_syncookies<br>
 				net.ipv4.ping_group_range<br>
-				undefined/empty<br>
+				未定义/空值<br>
 			</td>
 		</tr>
 	</tbody>
@@ -385,14 +385,15 @@ Restricted 策略旨在实施当前保护 Pod 的最佳实践，尽管这样作
 		<tr>
 			<td>Seccomp</td>
 			<td>
-				<!-- The 'runtime/default' seccomp profile must be required, or allow specific additional profiles. -->
-				必须要求使用 'runtime/default' seccomp profile 或者允许使用特定的 profiles。<br>
+				<!-- The RuntimeDefault seccomp profile must be required, or allow specific additional profiles. -->
+				必须要求使用 RuntimeDefault seccomp profile 或者允许使用特定的 profiles。<br>
 				<br><b>限制的字段：</b><br>
-				metadata.annotations['seccomp.security.alpha.kubernetes.io/pod']<br>
-				metadata.annotations['container.seccomp.security.alpha.kubernetes.io/*']<br>
+				spec.securityContext.seccompProfile.type<br>
+				spec.containers[*].securityContext.seccompProfile<br>
+				spec.initContainers[*].securityContext.seccompProfile<br>
 				<br><b>允许的值：</b><br>
 				'runtime/default'<br>
-				未定义（容器注解）<br>
+				未定义/nil<br>
 			</td>
 		</tr>
 	</tbody>
@@ -462,7 +463,7 @@ in the Pod manifest, and represent parameters to the container runtime.
 
 <!--
 Security policies are control plane mechanisms to enforce specific settings in the Security Context,
-as well as other parameters outside the Security Contex. As of February 2020, the current native
+as well as other parameters outside the Security Context. As of February 2020, the current native
 solution for enforcing these security policies is [Pod Security
 Policy](/docs/concepts/policy/pod-security-policy/) - a mechanism for centrally enforcing security
 policy on Pods across a cluster. Other alternatives for enforcing security policy are being
@@ -503,7 +504,7 @@ restrict privileged permissions is lessened when the workload is isolated from t
 kernel. This allows for workloads requiring heightened permissions to still be isolated.
 
 Additionally, the protection of sandboxed workloads is highly dependent on the method of
-sandboxing. As such, no single ‘recommended’ policy is recommended for all sandboxed workloads.
+sandboxing. As such, no single recommended policy is recommended for all sandboxed workloads.
 -->
 ### 沙箱（Sandboxed） Pod 怎么处理？
 
@@ -515,5 +516,5 @@ sandboxing. As such, no single ‘recommended’ policy is recommended for all s
 限制特权化操作的许可就不那么重要。这使得那些需要更多许可权限的负载仍能被有效隔离。
 
 此外，沙箱化负载的保护高度依赖于沙箱化的实现方法。
-因此，现在还没有针对所有沙箱化负载的“建议”策略。
+因此，现在还没有针对所有沙箱化负载的建议策略。