[zh] Update CSR v1 API reference
The misplaced `<!--` and `-->` are disrupting the structure of the document page. This PR fixes the indentation of these marks.
This commit is contained in:
+11
-24
@@ -5,13 +5,11 @@ api_metadata:
|
||||
kind: "CertificateSigningRequest"
|
||||
content_type: "api_reference"
|
||||
description: "CertificateSigningRequest 对象提供了一种通过提交证书签名请求并异步批准和颁发 x509 证书的机制。"
|
||||
title: "证书签名请求"
|
||||
title: CertificateSigningRequest
|
||||
weight: 4
|
||||
auto_generated: true
|
||||
---
|
||||
|
||||
<!--
|
||||
---
|
||||
api_metadata:
|
||||
apiVersion: "certificates.k8s.io/v1"
|
||||
import: "k8s.io/api/certificates/v1"
|
||||
@@ -21,18 +19,6 @@ description: "CertificateSigningRequest objects provide a mechanism to obtain x5
|
||||
title: "CertificateSigningRequest"
|
||||
weight: 4
|
||||
auto_generated: true
|
||||
---
|
||||
-->
|
||||
|
||||
<!--
|
||||
The file is auto-generated from the Go source code of the component using a generic
|
||||
[generator](https://github.com/kubernetes-sigs/reference-docs/). To learn how
|
||||
to generate the reference documentation, please read
|
||||
[Contributing to the reference documentation](/docs/contribute/generate-ref-docs/).
|
||||
To update the reference content, please follow the
|
||||
[Contributing upstream](/docs/contribute/generate-ref-docs/contribute-upstream/)
|
||||
guide. You can file document formatting bugs against the
|
||||
[reference-docs](https://github.com/kubernetes-sigs/reference-docs/) project.
|
||||
-->
|
||||
|
||||
<!--
|
||||
@@ -59,6 +45,7 @@ Kubelets use this API to obtain:
|
||||
CertificateSigningRequest 对象提供了一种通过提交证书签名请求并异步批准和颁发 x509 证书的机制。
|
||||
|
||||
Kubelets 使用 CertificateSigningRequest API 来获取:
|
||||
|
||||
1. 向 kube-apiserver 进行身份认证的客户端证书(使用 “kubernetes.io/kube-apiserver-client-kubelet” signerName)。
|
||||
2. kube-apiserver 可以安全连接到 TLS 端点的服务证书(使用 “kubernetes.io/kubelet-serving” signerName)。
|
||||
|
||||
@@ -117,13 +104,12 @@ or to obtain certificates from custom non-Kubernetes signers.
|
||||
|
||||
CertificateSigningRequestSpec contains the certificate request.
|
||||
-->
|
||||
## 证书签名请求规范 CertificateSigningRequestSpec {#CertificateSigningRequestSpec}
|
||||
## CertificateSigningRequestSpec {#CertificateSigningRequestSpec}
|
||||
|
||||
CertificateSigningRequestSpec 包含证书请求。
|
||||
|
||||
<!--
|
||||
<hr>
|
||||
|
||||
<!--
|
||||
- **request** ([]byte), required
|
||||
|
||||
*Atomic: will be replaced during a merge*
|
||||
@@ -131,7 +117,6 @@ CertificateSigningRequestSpec 包含证书请求。
|
||||
request contains an x509 certificate signing request encoded in a "CERTIFICATE REQUEST" PEM block.
|
||||
When serialized as JSON or YAML, the data is additionally base64-encoded.
|
||||
-->
|
||||
<hr>
|
||||
|
||||
- **request** ([]byte),必需
|
||||
|
||||
@@ -168,6 +153,7 @@ CertificateSigningRequestSpec 包含证书请求。
|
||||
More details are available at https://k8s.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers
|
||||
-->
|
||||
众所周知的 Kubernetes 签名者有:
|
||||
|
||||
1. “kubernetes.io/kube-apiserver-client”:颁发客户端证书,用于向 kube-apiserver 进行身份验证。
|
||||
对此签名者的请求永远不会被 kube-controller-manager 自动批准,
|
||||
可以由 kube-controller-manager 中的 “csrsigning” 控制器颁发。
|
||||
@@ -192,6 +178,7 @@ CertificateSigningRequestSpec 包含证书请求。
|
||||
6. Whether or not requests for CA certificates are allowed.
|
||||
-->
|
||||
也可以指定自定义 signerName。签名者定义如下:
|
||||
|
||||
1. 信任分发:信任(CA 证书包)是如何分发的。
|
||||
2. 许可的主体:当请求不允许的主体时的行为。
|
||||
3. 请求中必需、许可或禁止的 x509 扩展(包括是否允许 subjectAltNames、哪些类型、对允许值的限制)
|
||||
@@ -337,7 +324,7 @@ and the issued certificate.
|
||||
|
||||
<hr>
|
||||
-->
|
||||
## 证书签名请求状态 CertificateSigningRequestStatus {#CertificateSigningRequestStatus}
|
||||
## CertificateSigningRequestStatus {#CertificateSigningRequestStatus}
|
||||
|
||||
CertificateSigningRequestStatus 包含用于指示请求的批准/拒绝/失败状态和颁发证书的状况。
|
||||
|
||||
@@ -372,6 +359,7 @@ CertificateSigningRequestStatus 包含用于指示请求的批准/拒绝/失败
|
||||
to allow for explanatory text as described in section 5.2 of RFC7468.
|
||||
-->
|
||||
验证要求:
|
||||
|
||||
1. 证书必须包含一个或多个 PEM 块。
|
||||
2. 所有的 PEM 块必须有 “CERTIFICATE” 标签,不包含头和编码的数据,
|
||||
必须是由 BER 编码的 ASN.1 证书结构,如 RFC5280 第 4 节所述。
|
||||
@@ -400,6 +388,7 @@ CertificateSigningRequestStatus 包含用于指示请求的批准/拒绝/失败
|
||||
证书编码为 PEM 格式。
|
||||
|
||||
当序列化为 JSON 或 YAML 时,数据额外采用 base64 编码,它包括:
|
||||
|
||||
```
|
||||
base64(
|
||||
-----BEGIN CERTIFICATE-----
|
||||
@@ -407,6 +396,7 @@ CertificateSigningRequestStatus 包含用于指示请求的批准/拒绝/失败
|
||||
-----END CERTIFICATE-----
|
||||
)
|
||||
```
|
||||
|
||||
<!--
|
||||
- **conditions** ([]CertificateSigningRequestCondition)
|
||||
*Map: unique values on key type will be kept during a merge*
|
||||
@@ -523,7 +513,7 @@ CertificateSigningRequestList is a collection of CertificateSigningRequest objec
|
||||
|
||||
<hr>
|
||||
-->
|
||||
## 证书签名请求列表 CertificateSigningRequestList {#CertificateSigningRequestList}
|
||||
## CertificateSigningRequestList {#CertificateSigningRequestList}
|
||||
|
||||
CertificateSigningRequestList 是 CertificateSigningRequest 对象的集合。
|
||||
|
||||
@@ -550,11 +540,8 @@ CertificateSigningRequestList 是 CertificateSigningRequest 对象的集合。
|
||||
|
||||
items 是 CertificateSigningRequest 对象的集合。
|
||||
|
||||
|
||||
<!--
|
||||
## Operations {#Operations}
|
||||
|
||||
<hr>
|
||||
-->
|
||||
## 操作 {#Operations}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user