From b15ccd6c4afb532c851187bea45be4ed6e9645d7 Mon Sep 17 00:00:00 2001
From: Rui Chen <rchen@meetup.com>
Date: Mon, 3 Dec 2018 09:43:05 -0500
Subject: [PATCH] zh-trans: add examples/{policy,service,windows}/ yaml files

---
 content/zh/examples/policy/example-psp.yaml   | 17 +++++++
 .../zh/examples/policy/privileged-psp.yaml    | 27 +++++++++++
 .../zh/examples/policy/restricted-psp.yaml    | 48 +++++++++++++++++++
 .../zh/examples/service/access/frontend.yaml  | 39 +++++++++++++++
 .../service/access/hello-service.yaml         | 12 +++++
 content/zh/examples/service/access/hello.yaml | 24 ++++++++++
 .../examples/service/networking/curlpod.yaml  | 28 +++++++++++
 .../service/networking/custom-dns.yaml        | 20 ++++++++
 .../service/networking/hostaliases-pod.yaml   | 22 +++++++++
 .../examples/service/networking/ingress.yaml  |  9 ++++
 .../service/networking/nginx-secure-app.yaml  | 46 ++++++++++++++++++
 .../service/networking/nginx-svc.yaml         | 12 +++++
 .../service/networking/run-my-nginx.yaml      | 20 ++++++++
 .../zh/examples/service/nginx-service.yaml    | 16 +++++++
 .../zh/examples/windows/configmap-pod.yaml    | 31 ++++++++++++
 content/zh/examples/windows/daemonset.yaml    | 21 ++++++++
 .../zh/examples/windows/deploy-hyperv.yaml    | 22 +++++++++
 .../zh/examples/windows/deploy-resource.yaml  | 24 ++++++++++
 content/zh/examples/windows/emptydir-pod.yaml | 20 ++++++++
 .../examples/windows/hostpath-volume-pod.yaml | 18 +++++++
 content/zh/examples/windows/secret-pod.yaml   | 32 +++++++++++++
 content/zh/examples/windows/simple-pod.yaml   | 14 ++++++
 22 files changed, 522 insertions(+)
 create mode 100644 content/zh/examples/policy/example-psp.yaml
 create mode 100644 content/zh/examples/policy/privileged-psp.yaml
 create mode 100644 content/zh/examples/policy/restricted-psp.yaml
 create mode 100644 content/zh/examples/service/access/frontend.yaml
 create mode 100644 content/zh/examples/service/access/hello-service.yaml
 create mode 100644 content/zh/examples/service/access/hello.yaml
 create mode 100644 content/zh/examples/service/networking/curlpod.yaml
 create mode 100644 content/zh/examples/service/networking/custom-dns.yaml
 create mode 100644 content/zh/examples/service/networking/hostaliases-pod.yaml
 create mode 100644 content/zh/examples/service/networking/ingress.yaml
 create mode 100644 content/zh/examples/service/networking/nginx-secure-app.yaml
 create mode 100644 content/zh/examples/service/networking/nginx-svc.yaml
 create mode 100644 content/zh/examples/service/networking/run-my-nginx.yaml
 create mode 100644 content/zh/examples/service/nginx-service.yaml
 create mode 100644 content/zh/examples/windows/configmap-pod.yaml
 create mode 100644 content/zh/examples/windows/daemonset.yaml
 create mode 100644 content/zh/examples/windows/deploy-hyperv.yaml
 create mode 100644 content/zh/examples/windows/deploy-resource.yaml
 create mode 100644 content/zh/examples/windows/emptydir-pod.yaml
 create mode 100644 content/zh/examples/windows/hostpath-volume-pod.yaml
 create mode 100644 content/zh/examples/windows/secret-pod.yaml
 create mode 100644 content/zh/examples/windows/simple-pod.yaml

diff --git a/content/zh/examples/policy/example-psp.yaml b/content/zh/examples/policy/example-psp.yaml
new file mode 100644
index 0000000000..7531949b65
--- /dev/null
+++ b/content/zh/examples/policy/example-psp.yaml
@@ -0,0 +1,17 @@
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: example
+spec:
+  privileged: false  # Don't allow privileged pods!
+  # The rest fills in some required fields.
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  fsGroup:
+    rule: RunAsAny
+  volumes:
+  - '*'
diff --git a/content/zh/examples/policy/privileged-psp.yaml b/content/zh/examples/policy/privileged-psp.yaml
new file mode 100644
index 0000000000..915c8d37b5
--- /dev/null
+++ b/content/zh/examples/policy/privileged-psp.yaml
@@ -0,0 +1,27 @@
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: privileged
+  annotations:
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+spec:
+  privileged: true
+  allowPrivilegeEscalation: true
+  allowedCapabilities:
+  - '*'
+  volumes:
+  - '*'
+  hostNetwork: true
+  hostPorts:
+  - min: 0
+    max: 65535
+  hostIPC: true
+  hostPID: true
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
diff --git a/content/zh/examples/policy/restricted-psp.yaml b/content/zh/examples/policy/restricted-psp.yaml
new file mode 100644
index 0000000000..e677ba8e22
--- /dev/null
+++ b/content/zh/examples/policy/restricted-psp.yaml
@@ -0,0 +1,48 @@
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: restricted
+  annotations:
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
+spec:
+  privileged: false
+  # Required to prevent escalations to root.
+  allowPrivilegeEscalation: false
+  # This is redundant with non-root + disallow privilege escalation,
+  # but we can provide it for defense in depth.
+  requiredDropCapabilities:
+    - ALL
+  # Allow core volume types.
+  volumes:
+    - 'configMap'
+    - 'emptyDir'
+    - 'projected'
+    - 'secret'
+    - 'downwardAPI'
+    # Assume that persistentVolumes set up by the cluster admin are safe to use.
+    - 'persistentVolumeClaim'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    # Require the container to run without root privileges.
+    rule: 'MustRunAsNonRoot'
+  seLinux:
+    # This policy assumes the nodes are using AppArmor rather than SELinux.
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
diff --git a/content/zh/examples/service/access/frontend.yaml b/content/zh/examples/service/access/frontend.yaml
new file mode 100644
index 0000000000..9f5b6b757f
--- /dev/null
+++ b/content/zh/examples/service/access/frontend.yaml
@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontend
+spec:
+  selector:
+    app: hello
+    tier: frontend
+  ports:
+  - protocol: "TCP"
+    port: 80
+    targetPort: 80
+  type: LoadBalancer
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+spec:
+  selector:
+    matchLabels:
+      app: hello
+      tier: frontend
+      track: stable
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: hello
+        tier: frontend
+        track: stable
+    spec:
+      containers:
+      - name: nginx
+        image: "gcr.io/google-samples/hello-frontend:1.0"
+        lifecycle:
+          preStop:
+            exec:
+              command: ["/usr/sbin/nginx","-s","quit"]
diff --git a/content/zh/examples/service/access/hello-service.yaml b/content/zh/examples/service/access/hello-service.yaml
new file mode 100644
index 0000000000..1e4c7a6c32
--- /dev/null
+++ b/content/zh/examples/service/access/hello-service.yaml
@@ -0,0 +1,12 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: hello
+spec:
+  selector:
+    app: hello
+    tier: backend
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: http
diff --git a/content/zh/examples/service/access/hello.yaml b/content/zh/examples/service/access/hello.yaml
new file mode 100644
index 0000000000..85dff18ee1
--- /dev/null
+++ b/content/zh/examples/service/access/hello.yaml
@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hello
+spec:
+  selector:
+    matchLabels:
+      app: hello
+      tier: backend
+      track: stable
+  replicas: 7
+  template:
+    metadata:
+      labels:
+        app: hello
+        tier: backend
+        track: stable
+    spec:
+      containers:
+        - name: hello
+          image: "gcr.io/google-samples/hello-go-gke:1.0"
+          ports:
+            - name: http
+              containerPort: 80
diff --git a/content/zh/examples/service/networking/curlpod.yaml b/content/zh/examples/service/networking/curlpod.yaml
new file mode 100644
index 0000000000..c15133641f
--- /dev/null
+++ b/content/zh/examples/service/networking/curlpod.yaml
@@ -0,0 +1,28 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: curl-deployment
+spec:
+  selector:
+    matchLabels:
+      app: curlpod
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: curlpod
+    spec:
+      volumes:
+      - name: secret-volume
+        secret:
+          secretName: nginxsecret
+      containers:
+      - name: curlpod
+        command:
+        - sh
+        - -c
+        - while true; do sleep 1; done
+        image: radial/busyboxplus:curl
+        volumeMounts:
+        - mountPath: /etc/nginx/ssl
+          name: secret-volume
diff --git a/content/zh/examples/service/networking/custom-dns.yaml b/content/zh/examples/service/networking/custom-dns.yaml
new file mode 100644
index 0000000000..3e5acd841a
--- /dev/null
+++ b/content/zh/examples/service/networking/custom-dns.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  namespace: default
+  name: dns-example
+spec:
+  containers:
+    - name: test
+      image: nginx
+  dnsPolicy: "None"
+  dnsConfig:
+    nameservers:
+      - 1.2.3.4
+    searches:
+      - ns1.svc.cluster.local
+      - my.dns.search.suffix
+    options:
+      - name: ndots
+        value: "2"
+      - name: edns0
diff --git a/content/zh/examples/service/networking/hostaliases-pod.yaml b/content/zh/examples/service/networking/hostaliases-pod.yaml
new file mode 100644
index 0000000000..643813b34a
--- /dev/null
+++ b/content/zh/examples/service/networking/hostaliases-pod.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostaliases-pod
+spec:
+  restartPolicy: Never
+  hostAliases:
+  - ip: "127.0.0.1"
+    hostnames:
+    - "foo.local"
+    - "bar.local"
+  - ip: "10.1.2.3"
+    hostnames:
+    - "foo.remote"
+    - "bar.remote"
+  containers:
+  - name: cat-hosts
+    image: busybox
+    command:
+    - cat
+    args:
+    - "/etc/hosts"
diff --git a/content/zh/examples/service/networking/ingress.yaml b/content/zh/examples/service/networking/ingress.yaml
new file mode 100644
index 0000000000..163c1d5b9d
--- /dev/null
+++ b/content/zh/examples/service/networking/ingress.yaml
@@ -0,0 +1,9 @@
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: test-ingress
+spec:
+  backend:
+    serviceName: testsvc
+    servicePort: 80
+
diff --git a/content/zh/examples/service/networking/nginx-secure-app.yaml b/content/zh/examples/service/networking/nginx-secure-app.yaml
new file mode 100644
index 0000000000..ec180a18df
--- /dev/null
+++ b/content/zh/examples/service/networking/nginx-secure-app.yaml
@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: my-nginx
+  labels:
+    run: my-nginx
+spec:
+  type: NodePort
+  ports:
+  - port: 8080
+    targetPort: 80
+    protocol: TCP
+    name: http
+  - port: 443
+    protocol: TCP
+    name: https
+  selector:
+    run: my-nginx
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-nginx
+spec:
+  selector:
+    matchLabels:
+      run: my-nginx
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        run: my-nginx
+    spec:
+      volumes:
+      - name: secret-volume
+        secret:
+          secretName: nginxsecret
+      containers:
+      - name: nginxhttps
+        image: bprashanth/nginxhttps:1.0
+        ports:
+        - containerPort: 443
+        - containerPort: 80
+        volumeMounts:
+        - mountPath: /etc/nginx/ssl
+          name: secret-volume
diff --git a/content/zh/examples/service/networking/nginx-svc.yaml b/content/zh/examples/service/networking/nginx-svc.yaml
new file mode 100644
index 0000000000..12fcd5d0bf
--- /dev/null
+++ b/content/zh/examples/service/networking/nginx-svc.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: my-nginx
+  labels:
+    run: my-nginx
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+  selector:
+    run: my-nginx
diff --git a/content/zh/examples/service/networking/run-my-nginx.yaml b/content/zh/examples/service/networking/run-my-nginx.yaml
new file mode 100644
index 0000000000..76a879f5c4
--- /dev/null
+++ b/content/zh/examples/service/networking/run-my-nginx.yaml
@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-nginx
+spec:
+  selector:
+    matchLabels:
+      run: my-nginx
+  replicas: 2
+  template:
+    metadata:
+      labels:
+        run: my-nginx
+    spec:
+      containers:
+      - name: my-nginx
+        image: nginx
+        ports:
+        - containerPort: 80
+
diff --git a/content/zh/examples/service/nginx-service.yaml b/content/zh/examples/service/nginx-service.yaml
new file mode 100644
index 0000000000..810f0ec7d8
--- /dev/null
+++ b/content/zh/examples/service/nginx-service.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx-service
+spec:
+  ports:
+  - port: 8000 # the port that this service should serve on
+    # the container on each pod to connect to, can be a name
+    # (e.g. 'www') or a number (e.g. 80)
+    targetPort: 80
+    protocol: TCP
+  # just like the selector in the deployment,
+  # but this time it identifies the set of pods to load balance
+  # traffic to.
+  selector:
+    app: nginx
diff --git a/content/zh/examples/windows/configmap-pod.yaml b/content/zh/examples/windows/configmap-pod.yaml
new file mode 100644
index 0000000000..e30939b367
--- /dev/null
+++ b/content/zh/examples/windows/configmap-pod.yaml
@@ -0,0 +1,31 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: example-config
+data:
+  example.property.1: hello
+  example.property.2: world
+
+---
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: configmap-pod
+spec:
+  containers:
+  - name: configmap-redis
+    image: redis:3.0-nanoserver
+    env:
+      - name: EXAMPLE_PROPERTY_1
+        valueFrom:
+          configMapKeyRef:
+            name: example-config
+            key: example.property.1
+      - name: EXAMPLE_PROPERTY_2
+        valueFrom:
+          configMapKeyRef:
+            name: example-config
+            key: example.property.2
+  nodeSelector:
+    beta.kubernetes.io/os: windows
\ No newline at end of file
diff --git a/content/zh/examples/windows/daemonset.yaml b/content/zh/examples/windows/daemonset.yaml
new file mode 100644
index 0000000000..d3a7bb6636
--- /dev/null
+++ b/content/zh/examples/windows/daemonset.yaml
@@ -0,0 +1,21 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: my-daemonset
+  labels:
+    app: foo
+spec:
+  selector:
+    matchLabels:
+      app: foo
+  template:
+    metadata:
+      labels:
+        app: foo
+    spec:
+      containers:
+      - name: foo
+        image: microsoft/windowsservercore:1709
+      nodeSelector:
+        beta.kubernetes.io/os: windows
+
diff --git a/content/zh/examples/windows/deploy-hyperv.yaml b/content/zh/examples/windows/deploy-hyperv.yaml
new file mode 100644
index 0000000000..c8b71ce8cb
--- /dev/null
+++ b/content/zh/examples/windows/deploy-hyperv.yaml
@@ -0,0 +1,22 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: iis
+spec:
+  selector:
+    matchLabels:
+      app: iis
+  replicas: 3
+  template:
+    metadata:
+      labels:
+        app: iis
+      annotations:
+        experimental.windows.kubernetes.io/isolation-type: hyperv
+    spec:
+      containers:
+      - name: iis
+        image: microsoft/iis
+        ports:
+        - containerPort: 80
+
diff --git a/content/zh/examples/windows/deploy-resource.yaml b/content/zh/examples/windows/deploy-resource.yaml
new file mode 100644
index 0000000000..81207a3804
--- /dev/null
+++ b/content/zh/examples/windows/deploy-resource.yaml
@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: iis
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: iis
+  template:
+    metadata:
+      labels:
+        app: iis
+    spec:
+      containers:
+      - name: iis
+        image: microsoft/iis
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: 2
+        ports:
+        - containerPort: 80
+
diff --git a/content/zh/examples/windows/emptydir-pod.yaml b/content/zh/examples/windows/emptydir-pod.yaml
new file mode 100644
index 0000000000..3210576a59
--- /dev/null
+++ b/content/zh/examples/windows/emptydir-pod.yaml
@@ -0,0 +1,20 @@
+ apiVersion: v1
+ kind: Pod
+ metadata:
+   name: my-empty-dir-pod
+ spec:
+   containers:
+   - image: microsoft/windowsservercore:1709
+     name: my-empty-dir-pod
+     volumeMounts:
+     - mountPath: /cache
+       name: cache-volume
+     - mountPath: C:/scratch
+       name: scratch-volume
+   volumes:
+   - name: cache-volume
+     emptyDir: {}
+   - name: scratch-volume
+     emptyDir: {}
+   nodeSelector:
+     beta.kubernetes.io/os: windows
diff --git a/content/zh/examples/windows/hostpath-volume-pod.yaml b/content/zh/examples/windows/hostpath-volume-pod.yaml
new file mode 100644
index 0000000000..843250c80c
--- /dev/null
+++ b/content/zh/examples/windows/hostpath-volume-pod.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostpath-volume-pod
+spec:
+  containers:
+  - name: my-hostpath-volume-pod
+    image: microsoft/windowsservercore:1709
+    volumeMounts:
+    - name: foo
+      mountPath: "C:\\etc\\foo"
+      readOnly: true
+  nodeSelector:
+    beta.kubernetes.io/os: windows
+  volumes:
+  - name: foo
+    hostPath:
+     path: "C:\\etc\\foo"
diff --git a/content/zh/examples/windows/secret-pod.yaml b/content/zh/examples/windows/secret-pod.yaml
new file mode 100644
index 0000000000..f4a8122c0a
--- /dev/null
+++ b/content/zh/examples/windows/secret-pod.yaml
@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mysecret
+type: Opaque
+data:
+  username: YWRtaW4=
+  password: MWYyZDFlMmU2N2Rm
+
+---
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: my-secret-pod
+spec:
+  containers:
+  - name: my-secret-pod
+    image: microsoft/windowsservercore:1709
+    env:
+      - name: USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: mysecret
+            key: username
+      - name: PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: mysecret
+            key: password
+  nodeSelector:
+    beta.kubernetes.io/os: windows
diff --git a/content/zh/examples/windows/simple-pod.yaml b/content/zh/examples/windows/simple-pod.yaml
new file mode 100644
index 0000000000..f056f3cf0a
--- /dev/null
+++ b/content/zh/examples/windows/simple-pod.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: iis
+  labels:
+    name: iis
+spec:
+  containers:
+    - name: iis
+      image: microsoft/iis:windowsservercore-1709
+      ports:
+        - containerPort: 80
+  nodeSelector:
+    "beta.kubernetes.io/os": windows