From 2a42da0495a4d9a757c3cab8d5b5bd5f29aa8a58 Mon Sep 17 00:00:00 2001
From: AdamDang <adam.dang@daocloud.io>
Date: Wed, 21 Nov 2018 12:57:34 +0800
Subject: [PATCH] zh-trans: add storage-object-in-use-protection.md(recreation)
 (#11107)

* zh-trans: add storage-object-in-use-protection.md(recreation)

add storage-object-in-use-protection.md

* Update storage-object-in-use-protection.md
---
 .../storage-object-in-use-protection.md       | 442 ++++++++++++++++++
 1 file changed, 442 insertions(+)
 create mode 100644 content/zh/docs/tasks/administer-cluster/storage-object-in-use-protection.md

diff --git a/content/zh/docs/tasks/administer-cluster/storage-object-in-use-protection.md b/content/zh/docs/tasks/administer-cluster/storage-object-in-use-protection.md
new file mode 100644
index 0000000000..c173b854ab
--- /dev/null
+++ b/content/zh/docs/tasks/administer-cluster/storage-object-in-use-protection.md
@@ -0,0 +1,442 @@
+<!--
+---
+reviewers:
+- msau42
+- jsafrane
+title: Storage Object in Use Protection
+content_template: templates/task
+---
+-->
+
+---
+reviewers:
+- msau42
+- jsafrane
+
+title: 保护使用的存储对象
+content_template: templates/task
+---
+
+{{% capture overview %}}
+
+<!--
+Persistent volume claims (PVCs) that are in active use by a pod and persistent volumes (PVs) that are bound to PVCs can be protected from premature removal.
+-->
+
+Kubernetes 可以对被 Pod 持续使用的永久卷声明（PVCs）和绑定到 PVC 的永久卷（PVs）进行保护，以避免它们被用户不小心删除掉。
+
+{{% /capture %}}
+
+{{% capture prerequisites %}}
+
+<!--
+The Storage Object in Use Protection feature is enabled in one of the below Kubernetes versions:
+-->
+
+在下面列出的 Kubernetes 版本中，激活了在用存储对象的保护特性：
+
+{{< feature-state for_k8s_version="v1.10" state="beta" >}}
+
+
+{{< feature-state for_k8s_version="v1.11" state="stable" >}}
+
+{{% /capture %}}
+
+{{% capture steps %}}
+
+ <!--
+## Storage Object in Use Protection feature used for PVC Protection
+
+The example below uses a GCE PD `StorageClass`, however, similar steps can be performed for any volume type.
+
+Create a `StorageClass` for convenient storage provisioning:
+-->
+
+## 在用存储对象的保护功能用于 PVC 的保护
+
+下面的例子中使用了 GCE PD `StorageClass`, 但是类似的步骤可以在任意的卷类型上执行。
+
+创建 `StorageClass` 以便提供存储：
+
+```yaml
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: slow
+provisioner: kubernetes.io/gce-pd
+parameters:
+  type: pd-standard
+```
+
+<!--
+Verification scenarios follow below.
+-->
+
+下面列出了验证场景。
+
+<!--
+### Scenario 1: The PVC is not in active use by a pod
+-->
+
+### 场景1: PVC 没有被 Pod 使用
+
+<!--
+- Create a PVC:
+-->
+
+- 创建 PVC
+
+```yaml
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: slzc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: slow
+  resources:
+    requests:
+      storage: 3.7Gi
+```
+
+<!--
+- Check that the PVC has the finalizer `kubernetes.io/pvc-protection` set:
+-->
+
+- 检查 PVC 设置了终结器 `kubernetes.io/pvc-protection`：
+
+```shell
+kubectl describe pvc slzc
+Name:          slzc
+Namespace:     default
+StorageClass:  slow
+Status:        Bound
+Volume:        pvc-bee8c30a-d6a3-11e7-9af0-42010a800002
+Labels:        <none>
+Annotations:   pv.kubernetes.io/bind-completed=yes
+               pv.kubernetes.io/bound-by-controller=yes
+               volume.beta.kubernetes.io/storage-provisioner=kubernetes.io/gce-pd
+Finalizers:    [kubernetes.io/pvc-protection]
+Capacity:      4Gi
+Access Modes:  RWO
+Events:
+  Type    Reason                 Age   From                         Message
+  ----    ------                 ----  ----                         -------
+  Normal  ProvisioningSucceeded  2m    persistentvolume-controller  Successfully provisioned volume pvc-bee8c30a-d6a3-11e7-9af0-42010a800002 using kubernetes.io/gce-pd
+```
+
+<!--
+- Delete the PVC and check that the PVC (not in active use by a pod) was removed successfully.
+-->
+
+- 删除 PVC 并检查 PVC （当前未被某 Pod 使用）被成功删除。
+
+<!--
+### Scenario 2: The PVC is in active use by a pod
+
+- Again, create the same PVC.
+- Create a pod that uses the PVC:
+-->
+
+### 场景 2: PVC 被 Pod 使用
+
+- 再来一次，创建相同的 PVC。
+- 创建一个 Pod ，并使用上面创建的 PVC：
+
+```yaml
+kind: Pod
+apiVersion: v1
+metadata:
+  name: app1
+spec:
+  containers:
+  - name: test-pod
+    image: k8s.gcr.io/busybox:1.24
+    command:
+      - "/bin/sh"
+    args:
+      - "-c"
+      - "date > /mnt/app1.txt; sleep 60 && exit 0 || exit 1"
+    volumeMounts:
+      - name: path-pvc
+        mountPath: "/mnt"
+  restartPolicy: "Never"
+  volumes:
+    - name: path-pvc
+      persistentVolumeClaim:
+        claimName: slzc
+```
+<!--
+- Wait until the pod status is `Running`, i.e. the PVC becomes in active use.
+- Delete the PVC that is now in active use by a pod and verify that the PVC is not removed but its status is `Terminating`:
+-->
+
+- 等到 Pod 的状态为 `Running`，即 PVC 变为在用状态。
+- 删除被 Pod 使用的 PVC 并确认其没有被删除成功，但它的状态为 `Terminating`:
+
+```shell
+Name:          slzc
+Namespace:     default
+StorageClass:  slow
+Status:        Terminating (since Fri, 01 Dec 2017 14:47:55 +0000)
+Volume:        pvc-803a1f4d-d6a6-11e7-9af0-42010a800002
+Labels:        <none>
+Annotations:   pv.kubernetes.io/bind-completed=yes
+               pv.kubernetes.io/bound-by-controller=yes
+               volume.beta.kubernetes.io/storage-provisioner=kubernetes.io/gce-pd
+Finalizers:    [kubernetes.io/pvc-protection]
+Capacity:      4Gi
+Access Modes:  RWO
+Events:
+  Type    Reason                 Age   From                         Message
+  ----    ------                 ----  ----                         -------
+  Normal  ProvisioningSucceeded  52s   persistentvolume-controller  Successfully provisioned volume pvc-803a1f4d-d6a6-11e7-9af0-42010a800002 using kubernetes.io/gce-pd
+```
+
+<!--
+-  Wait until the pod status is `Terminated` (either delete the pod or wait until it finishes). Afterwards, check that the PVC is removed.
+-->
+
+- 等到 Pod 的状态变为 `Terminated` （删除 Pod 或者等到它结束），紧接着确认 PVC 被删除掉了。
+
+<!--
+### Scenario 3: A pod starts using a PVC that is in Terminating state
+
+- Again, create the same PVC.
+- Create a first pod that uses the PVC:
+-->
+
+### 场景 3: Pod 开始使用正在停止状态（Terminating）的 PVC
+
+- 再次创建相同的 PVC。
+- 创建使用这个 PVC 的第一个 Pod：
+
+```yaml
+kind: Pod
+apiVersion: v1
+metadata:
+  name: app1
+spec:
+  containers:
+  - name: test-pod
+    image: k8s.gcr.io/busybox:1.24
+    command:
+      - "/bin/sh"
+    args:
+      - "-c"
+      - "date > /mnt/app1.txt; sleep 600 && exit 0 || exit 1"
+    volumeMounts:
+      - name: path-pvc
+        mountPath: "/mnt"
+  restartPolicy: "Never"
+  volumes:
+    - name: path-pvc
+      persistentVolumeClaim:
+        claimName: slzc
+```
+
+<!--
+- Wait until the pod status is `Running`, i.e. the PVC becomes in active use.
+- Delete the PVC that is now in active use by a pod and verify that the PVC is not removed but its status is `Terminating`:
+-->
+
+- 等到 Pod 状态为 `Running`，即 PVC 变为使用状态。
+- 删除被 Pod 使用的 PVC 并确认其没有被删除成功，但它的状态为 `Terminating`:
+
+```shell
+Name:          slzc
+Namespace:     default
+StorageClass:  slow
+Status:        Terminating (since Fri, 01 Dec 2017 14:47:55 +0000)
+Volume:        pvc-803a1f4d-d6a6-11e7-9af0-42010a800002
+Labels:        <none>
+Annotations:   pv.kubernetes.io/bind-completed=yes
+               pv.kubernetes.io/bound-by-controller=yes
+               volume.beta.kubernetes.io/storage-provisioner=kubernetes.io/gce-pd
+Finalizers:    [kubernetes.io/pvc-protection]
+Capacity:      4Gi
+Access Modes:  RWO
+Events:
+  Type    Reason                 Age   From                         Message
+  ----    ------                 ----  ----                         -------
+  Normal  ProvisioningSucceeded  52s   persistentvolume-controller  Successfully provisioned volume pvc-803a1f4d-d6a6-11e7-9af0-42010a800002 using kubernetes.io/gce-pd
+```
+
+<!--
+- Create a second pod that uses the same PVC:
+-->
+
+- 创建使用这个 PVC 的第二个 Pod：
+
+```yaml
+kind: Pod
+apiVersion: v1
+metadata:
+  name: app2
+spec:
+  containers:
+  - name: test-pod
+    image: gcr.io/google_containers/busybox:1.24
+    command:
+      - "/bin/sh"
+    args:
+      - "-c"
+      - "date > /mnt/app1.txt; sleep 600 && exit 0 || exit 1"
+    volumeMounts:
+      - name: path-pvc
+        mountPath: "/mnt"
+  restartPolicy: "Never"
+  volumes:
+    - name: path-pvc
+      persistentVolumeClaim:
+        claimName: slzc
+```
+
+<!--
+- Verify that the scheduling of the second pod fails with the below warning:
+-->
+
+- 检查第二个 Pod 因为下面的警告而导致调度失败：
+
+```shell
+Warning  FailedScheduling  18s (x4 over 21s)  default-scheduler persistentvolumeclaim "slzc" is being deleted
+```
+
+<!--
+- Wait until the pod status of both pods is `Terminated` or `Completed` (either delete the pods or wait until they finish). Afterwards, check that the PVC is removed.
+-->
+
+- 等到两个 Pod 的状态为 `Terminated` 或者 `Completed`（删除 Pod 或者等待它们结束），紧接着检查 PVC 被删除掉了。
+
+<!--
+## Storage Object in Use Protection feature used for PV Protection
+
+The example below uses a `HostPath` PV.
+
+Verification scenarios follow below.
+
+### Scenario 1: The PV is not bound to a PVC
+
+- Create a PV:
+-->
+
+## 使用在用存储对象保护的功能来保护 PV
+
+下面的示例使用了 `HostPath` PV。
+
+下面列出了验证场景。
+
+### 场景 1: PV 没有绑定到 PVC
+
+- 创建 PV:
+
+```yaml
+kind: PersistentVolume
+apiVersion: v1
+metadata:
+  name: task-pv-volume
+  labels:
+    type: local
+spec:
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Delete
+  storageClassName: standard
+  hostPath:
+    path: "/tmp/data"
+```
+
+<!--
+- Check that the PV has the finalizer `kubernetes.io/pv-protection` set:
+-->
+
+- 检查 PV 设置了终结器 `kubernetes.io/pv-protection`：
+
+```shell
+Name:            task-pv-volume
+Labels:          type=local
+Annotations:     pv.kubernetes.io/bound-by-controller=yes
+Finalizers:      [kubernetes.io/pv-protection]
+StorageClass:    standard
+Status:          Terminating (lasts 1m)
+Claim:           default/task-pv-claim
+Reclaim Policy:  Delete
+Access Modes:    RWO
+Capacity:        1Gi
+Message:         
+Source:
+    Type:          HostPath (bare host directory volume)
+    Path:          /tmp/data
+    HostPathType:  
+Events:            <none>
+```
+
+<!--
+- Delete the PV and check that the PV (not bound to a PVC) is removed successfully.
+
+### Scenario 2: The PV is bound to a PVC
+
+- Again, create the same PV.
+
+- Create a PVC
+-->
+
+- 删除 PV 并检查该 PV（没有绑定到 PVC ）被成功删除。
+
+### 场景 2: PV 绑定了 PVC。
+
+- 再次创建相同的 PV。
+
+- 创建一个 PVC：
+
+```yaml
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: task-pv-claim
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+```
+
+<!--
+- Wait until the PV and PVC are bound to each other.
+- Delete the PV and verify that the PV is not removed but its status is `Terminating`:
+-->
+
+- 等到 PV 和 PVC 相互绑定。
+- 删除 PV 并确认该 PV 没有被删除掉，但它的状态是 `Terminating`：
+
+```shell
+NAME             CAPACITY     ACCESS MODES   RECLAIM POLICY   STATUS        CLAIM                   STORAGECLASS   REASON    AGE
+task-pv-volume   1Gi          RWO            Delete           Terminating   default/task-pv-claim   standard                 59s
+
+```
+
+<!--
+-  Delete the PVC and verify that the PV is removed too.
+-->
+
+- 删除 PVC 并确认 PV 也一同被删除了。
+
+```shell
+kubectl delete pvc task-pv-claim
+persistentvolumeclaim "task-pv-claim" deleted
+$ kubectl get pvc
+No resources found.
+$ kubectl get pv
+No resources found.
+```
+
+{{% /capture %}}
+
+{{% capture discussion %}}
+
+
+{{% /capture %}}