Merge release 1.12 into release 1.13 (#14171)
* ZH-trans: Update coarse-parallel-processing-work-queue.md (#11862) * ZH-trans: Update coarse-parallel-processing-work-queue.md * Update coarse-parallel-processing-work-queue.md * zh-trans: add /docs/concepts/architecture/cloud-controller.md (#11799) * docs/concepts/architecture/cloud-controller.md * docs/concepts/architecture/cloud-controller.md * docs/concepts/architecture/cloud-controller.md * fix * fix * fix * zh-trans: /docs/contribute/style/kubernetes-components.md (#11838) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/generate-ref-docs/kubernetes-components.md; update Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * Update weave-network-policy.md (#11858) * ZH-trans: add Update define-environment-variable-container.md (#11859) * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update fine-parallel-processing-work-queue.md (#11863) * Update fine-parallel-processing-work-queue.md * Update fine-parallel-processing-work-queue.md * Update setup-extension-api-server.md (#11864) * zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md (#11798) * zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md * Update kubeadm-join.md * Create kubeadm_join.md * zh-trans: update docs/concepts/containers/images.md (#11877) * zh-trans: update docs/concepts/containers/images.md * zh-trans: update docs/concepts/containers/images.md * Update kubeadm_alpha_phase_controlplane.md (#11878) * 更新第 115 行翻译 * zh_trans: kubeadm_token_generate.md (#11884) * zh_trans: kubeadm_token_generate.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_token_generate.md * Better translation Better translation * zh-trans: add /docs/tasks/configure-pod-container/configure-pod-initialization.md (#11886) zh-trans: add /docs/tasks/configure-pod-container/configure-pod-initialization.md * zh-trans:add content/zh/docs/reference/issues-security (#11890) * zh-trans: add content/zh/docs/tutorials/online-training/overview.md (#11892) * zh_trans: kubeadm_token_delete.md (#11883) * zh_trans: kubeadm_token_delete.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_token_create.md * fix tpye error fix tpye error * Better translation Better translation * zh_trans: independent/create-cluster-kubeadm.md (#11882) * zh_trans: independent/create-cluster-kubeadm.md zh_trans: docs/setup/independent/create-cluster-kubeadm.md * fix word style error * fix type error * better zhtran better zhtran * fix "Create" -> "create" fix "Create" -> "create" * zh-trans: add docs/concepts/storage/storage-classes.md (#11788) * ZH-trans: fixing formatting errors (#11661) * ZH-trans: fixing formatting errors * Update ZH-trans: fixing formatting errors storage-classes zh part 1 * storage-classes zh trans * fix typo update trans for provisioner & fix typo * fix typo * 根据校对更新翻译 * zh_trans: kubeadm-token.md (#11898) zh_trans: /docs/reference/setup-tools/kubeadm/kubeadm-token.md * zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md (#11900) * zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md * Update quality-service-pod.md * zh_trans: kubeadm_alpha_phase_bootstrap-token_node.md (#11897) zh_trans: Path：/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node.md * zh-trans: add /docs/concepts/storage/volumes.md (#11767) * zh-trans: add /docs/concepts/storage/volumes.md zh-trans: add /docs/concepts/storage/volumes.md * Update volumes.md * Update volumes.md * self-review * Update volumes.md * fix docs format error (#11934) fix docs format error of https://v1-12.docs.kubernetes.io/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/ * Update cloud-controller.md (#11922) * zh-trans: /docs/reference/glossary/approver.md (#11924) zh-trans: /docs/reference/glossary/approver.md * zh-trans: add docs/setup/on-premises-vm/dcos.md (#11891) * zh-trans: add docs/setup/on-premises-vm/dcos.md * Update content/zh/docs/setup/on-premises-vm/dcos.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: /docs/tasks/configure-pod-container/configure-persistent-vo… (#11915) * zh-trans: /docs/tasks/configure-pod-container/configure-persistent-volume-storage.md zh-trans: /docs/tasks/configure-pod-container/configure-persistent-volume-storage.md * Update configure-persistent-volume-storage.md * zh_trans: kubeadm_alpha.md (#11902) * zh_trans: kubeadm_alpha.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha.md * Better translation Better translation * zh-trans: /docs/reference/glossary/downstream.md (#11931) * zh-trans: /docs/reference/glossary/downstream.md zh-trans: /docs/reference/glossary/downstream.md * Update downstream.md * Update downstream.md * ZH-trans: Update install-kubeadm.md (#11955) * fix typo of install-kubeadm.md fix typo of install-kubeadm.md * Update install-kubeadm.md * zh-trans: add kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md (#11952) * zh-trans: add /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md zh-trans: add /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md * Update kubeadm_alpha_phase_certs_renew_all.md * renew 的翻译更新为续期 * zh-trans:kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md (#11953) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md * Update kubeadm_alpha_phase_certs_renew_etcd-peer.md * zh-trans: /docs/contribute/generate-ref-docs/kubectl.md (#11941) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * fix docs format error (#11936) fix docs format error of https://v1-12.docs.kubernetes.io/zh/docs/reference/setup-tools/kubeadm/kubeadm-config/ * Update pull request (#11921) * Update pull request (#11960) * ZH-trans: add kubefed-options.md (#11956) * Update ZH-trans: add kubefed-options.md * Update kubefed-options.md * ZH-trans: add generated/... (#11880) * Update pull request * Update kubeadm_alpha_phase_certs_renew.md * Update pull request (#11881) * ZH-trans: add generated/... (#11879) * Update pull request * Resolving file conflicts * zh-trans: add zh/ docs/tasks/configure-pod-container/configure-servic… (#11889) * zh-trans: add zh/ docs/tasks/configure-pod-container/configure-service-account.md zh-trans: add zh/ docs/tasks/configure-pod-container/configure-service-account.md * Update configure-service-account.md * Update configure-service-account.md * zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md (#11875) * zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md * zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md * zh-trans:update kubelet-garbage-collection.md * zh_trans: kubeadm_alpha_phase_kubeconfig_user.md (#11901) * zh_trans: kubeadm_alpha_phase_kubeconfig_user.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_user.md * Better translation * zh-trans:add docs/reference/using-api/client-libraries.md (#11958) * zh-trans:add docs/reference/using-api/client-libraries.md * Update content/zh/docs/reference/using-api/client-libraries.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: add pull-image-private-registry.md (#11912) * zh-trans: add pull-image-private-registry.md zh-trans: add pull-image-private-registry.md * Update pull-image-private-registry.md * Update pull-image-private-registry.md * ZH-trans: add kubeadm_alpha_phase_kubelet_config_annotate-cri.md (#11972) * Create kubeadm_alpha_phase_kubelet_config_annotate-cri.md * Update kubeadm_alpha_phase_kubelet_config_annotate-cri.md * ZH-trans: add kubeadm_alpha_phase_kubelet_config.md (#11974) * Create kubeadm_alpha_phase_kubelet_config.md * Update kubeadm_alpha_phase_kubelet_config.md * fix Typo "##" -> "## " (#12011) * fix Typo "##" -> "## " fix Typo "##" -> "## " * update basic-stateful-set.md * fix web style error (#12010) fix web style error * Create kubeadm_alpha_phase_selfhosting.md (#12006) * Create kubeadm_alpha_phase_controlplane_apiserver.md (#12005) * zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitor… (#11995) * zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitoring.md zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitoring.md * Update resource-usage-monitoring.md * Update resource-usage-monitoring.md * zh-trans:/docs/tasks/debug-application-cluster/core-metrics-pipeline.md (#11990) zh-trans:/docs/tasks/debug-application-cluster/core-metrics-pipeline.md * zh-trans:/docs/tasks/debug-application-cluster/troubleshooting.md (#11989) zh-trans:/docs/tasks/debug-application-cluster/troubleshooting.md * Create kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md (#11969) * Create kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md * Update kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md * zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md (#11962) * zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md * Update debug-init-containers.md * zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md (#11930) * zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md * Update horizontal-pod-autoscaler.md * zh-trans: add /docs/tasks/configure-pod-container/configure-projected… (#11911) * zh-trans: add /docs/tasks/configure-pod-container/configure-projected-volume-storage.md zh-trans: add /docs/tasks/configure-pod-container/configure-projected-volume-storage.md * Update configure-projected-volume-storage.md * Update configure-projected-volume-storage.md * zh-trans: /docs/tasks/configure-pod-container/extended-resource.md (#11918) * zh-trans: /docs/tasks/configure-pod-container/extended-resource.md zh-trans: /docs/tasks/configure-pod-container/extended-resource.md * Update extended-resource.md * Update extended-resource.md * zh-trans: add translate-compose-kubernetes.md (#11910) * zh-trans: add translate-compose-kubernetes.md zh-trans: add translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * zh-trans: zh/docs/reference/glossary/flexvolume.md (#11925) * zh-trans: zh/docs/reference/glossary/flexvolume.md zh-trans: zh/docs/reference/glossary/flexvolume.md * Update flexvolume.md * zh_trans: kubeadm_alpha_phase_bootstrap-token_create.md (#11947) * zh_trans: kubeadm_alpha_phase_bootstrap-token_create.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_create.md * better translation better translation * zh-trans:add docs/setup/turnkey/alibaba-cloud.md (#11959) * zh_trans: kubeadm_completion.md (#11895) * zh_trans: kubeadm_completion.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node.md * Better translation Better translation * Update kubeadm_completion.md * better translation better translation * zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md (#11961) * zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md * Update crictl.md * ZH-trans: add kubeadm_alpha_phase_certs_front-proxy-ca.md (#11968) * ZH-trans: add kubeadm_alpha_phase_controlplane_all.md (#11970) * Create kubeadm_alpha_phase_controlplane_all.md * Update kubeadm_alpha_phase_controlplane_all.md * Update kubeadm_alpha_phase_controlplane_all.md * Update kubeadm_alpha_phase_controlplane_all.md * ZH-trans: add kubeadm_alpha_phase_upload-config.md (#11971) * Create kubeadm_alpha_phase_upload-config.md * Update kubeadm_alpha_phase_upload-config.md * Update kubeadm_alpha_phase_upload-config.md * ZH-trans: Fixed some incorrect translations (#11973) * zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-… (#11977) * zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-failure.md zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-failure.md * Update determine-reason-pod-failure.md * zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md (#11988) * zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md * Update local-debugging.md * zh-trans:/docs/tasks/debug-application-cluster/events-stackdriver.md (#11996) zh-trans:/docs/tasks/debug-application-cluster/events-stackdriver.md * zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-cont… (#11998) * zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-container.md zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-container.md * Update get-shell-running-container.md * zh-trans:/docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md (#12001) zh-trans:/docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md * ZH-trans: ad kubeadm_alpha_phase_kubelet_config_write-to-disk.md (#12004) * Create kubeadm_alpha_phase_kubelet_config_write-to-disk.md * Update kubeadm_alpha_phase_kubelet_config_write-to-disk.md * Remove old-generated kubefed docs (generated on 25-march-2018) (#12093) * Update _index.md (#12061) * Update kubeadm_reset.md (#12047) * ZH-trasn: add kubeadm_alpha_phase_kubeconfig_controller-manager.md (#12032) * Create kubeadm_alpha_phase_kubeconfig_controller-manager.md * Update kubeadm_alpha_phase_kubeconfig_controller-manager.md * ZH-trans: add kubeadm_alpha_phase_preflight_node.md (#12035) * Create kubeadm_alpha_phase_preflight_node.md * Update kubeadm_alpha_phase_preflight_node.md * Update kubeadm_alpha_phase_preflight_node.md * ZH-trans: add kubeadm_alpha_phase_controlplane_scheduler.md (#12031) * Create kubeadm_alpha_phase_controlplane_scheduler.md * Update kubeadm_alpha_phase_controlplane_scheduler.md * ZH-trans: add kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md (#12039) * Create kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md * Update kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md * ZH-trans: add kubeadm_alpha_phase_kubelet_write-env-file.md (#12034) * Create kubeadm_alpha_phase_kubelet_write-env-file.md * Update kubeadm_alpha_phase_kubelet_write-env-file.md * ZH-trans: add kubeadm_upgrade_node_experimental-control-plane.md (#12036) * Create kubeadm_upgrade_node_experimental-control-plane.md * Update kubeadm_upgrade_node_experimental-control-plane.md * Create kubeadm_alpha_phase_bootstrap-token_node_allow-auto-approve.md (#12038) * Create kubeadm_alpha_phase_etcd.md (#12040) * ZH-trans: add kubeadm_alpha_phase_certs_renew_etcd-server.md (#12041) * Create kubeadm_alpha_phase_certs_renew_etcd-server.md * Update kubeadm_alpha_phase_certs_renew_etcd-server.md * Update advanced.md (#12044) * ZH-trans: add kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md (#12042) * Create kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md * Update kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md * Update kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md * Update kubeadm_version.md (#12046) * Update _index.md (#12063) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_version.md (#12085) zh-trans:/docs/reference/setup-tools/kubefed/kubefed_version.md * ZH-trans: add kubeadm_alpha_phase_certs_etcd-peer.md (#12037) * Create kubeadm_alpha_phase_certs_etcd-peer.md * Update kubeadm_alpha_phase_certs_etcd-peer.md * Update kubeadm_alpha_phase_certs_etcd-peer.md * ZH-trans: add kubeadm_alpha_phase_kubelet_config_download.md (#12033) * Create kubeadm_alpha_phase_kubelet_config_download.md * Update kubeadm_alpha_phase_kubelet_config_download.md * zh-trans: add docs/tasks/access-application-cluster/_index.md (#12048) * zh-trans: update cpu-constraint-namespace.md and cpu-default-namespace.md (#12106) * ZH-trans: update kubeadm_alpha_phase_upload-config.md (#12110) * zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md (#12022) * zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md * Update kubefed_unjoin.md * Update kubefed_unjoin.md * Update kubefed_unjoin.md * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_… (#12114) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_apiserver.md zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_apiserver.md * Update kubeadm_alpha_phase_certs_apiserver.md * Update kubeadm_alpha_phase_certs_apiserver.md * zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md (#12088) * zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md * Update docker-cli-to-kubectl.md * zh-trans: /docs/reference/kubectl/conventions.md (#12089) * zh-trans: /docs/reference/kubectl/conventions.md zh-trans: /docs/reference/kubectl/conventions.md * Update conventions.md * zh-trans organize-cluster-access-kubeconfig.md (#12094) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md (#12086) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md * Update kubefed.md * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md (#12029) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md * Update kubefed_join.md * Update kubefed_join.md * zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md (#12020) * zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md * Update kubefed_init.md * Update kubefed_init.md * Update kubefed_init.md * zh-trans: add docs/setup/independent/control-plane-flags.md (#12043) * zh-trans: add docs/setup/independent/control-plane-flags.md * update content/zh/docs/setup/independent/control-plane-flags.md * zh-trans:/docs/tasks/tools/install-kubectl.md (#11992) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * zh-trans: add /docs/concepts/cluster-administration/manage-deployment.md (#11899) * add /docs/concepts/cluster-administration/manage-deployment.md * 更新部分翻译，去除多余的反引号 * 更新部分翻译 * zh-trans: add docs/tasks/service-catalog/install-service-catalog-using-sc.md (#12045) * zh-trans: add docs/tasks/service-catalog/install-service-catalog-using-sc.md * update docs/tasks/service-catalog/install-service-catalog-using-sc.md * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md (#12087) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md * Update kubefed_options.md * Update kubefed_options.md * zh-trans: Fix some blog links issue (#12115) * zh-trans: Fix some blog links issue * Revert the space change * update Set Kubelet parameters via a config file (#12150) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_all.md (#12185) zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_all.md * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_… (#12184) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_etcd_local.md zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_etcd_local.md * Update kubeadm_alpha_phase_etcd_local.md * zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubelet_config_upload.md (#12130) zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubelet_config_upload.md * zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubeconfig_admin.md (#12131) zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubeconfig_admin.md * zh-trans: /docs/contribute/generate-ref-docs/kubernetes-api.md (#12141) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * zh-trans:/docs/concepts/overview/object-management-kubectl/imperative… (#12151) * zh-trans:/docs/concepts/overview/object-management-kubectl/imperative-config.md zh-trans:/docs/concepts/overview/object-management-kubectl/imperative-config.md * Update imperative-config.md * ZH-trans: added a blog post Chinese translation: 2018-05-01-developing-on-kubernetes.md (#12009) * added a blog post chinese translation * Update 2018-05-01-developing-on-kubernetes.md apply some suggested changes per review comments * Update 2018-05-01-developing-on-kubernetes.md cont to review and improve the wording, up to squash * more update and rewording * ZH-trans: add kubeadm_alpha_phase_kubelet_config_enable-dynamic.md (#12209) * ZH-trans: add kubeadm_alpha_phase_kubelet_config_enable-dynamic.md * Update kubeadm_alpha_phase_kubelet_config_enable-dynamic.md * ZH-trans: add kubeadm_alpha_phase_certs_renew_apiserver.md (#12210) * ZH-trans: add kubeadm_alpha_phase_certs_renew_apiserver.md * Update kubeadm_alpha_phase_certs_renew_apiserver.md * Update kubeadm_alpha_phase_certs_renew_apiserver.md * ZH-trans: add kubeadm_alpha_phase_certs_front-proxy-client.md (#12212) * fix docs style (#12225) * fix docs style fix docs style * fix docs style fix docs style * ZH-trans: add rbac.md (#12263) * ZH-trans: add rbac.md * Update rbac.md * ZH-trans: add persistent-volume-claim.md (#12264) * ZH-trans: add persistent-volume-claim.md * Update persistent-volume-claim.md * Update persistent-volume-claim.md * Update docker-cli-to-kubectl.md (#12288) * ZH-trans: add kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md (#12285) * ZH-trans: add kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md * Update kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md * ZH-trans: add coredns.md (#12282) * ZH-trans: add coredns.md * Update coredns.md * ZH-trans: add kubeadm_alpha_phase_certs_etcd-healthcheck-client.md (#12286) * ZH-trans: add kubeadm_alpha_phase_certs_etcd-healthcheck-client.md * Update kubeadm_alpha_phase_certs_etcd-healthcheck-client.md * ZH-trans: add kubeadm_alpha_phase_kubeconfig_kubelet.md (#12284) * ZH-trans: add kubeadm_alpha_phase_kubeconfig_kubelet.md * Update kubeadm_alpha_phase_kubeconfig_kubelet.md * ZH-trans: add service-account.md (#12261) * ZH-trans: add service-account.md * Update service-account.md * ZH-trans: add security-context.md (#12262) * ZH-trans: add security-context.md * Update security-context.md * Update security-context.md * Update security-context.md * fix typo "_必须_" -> "必须" (#12300) fix typo "_必须_" -> "必须" * fix docs style error (#12307) fix docs style error * Create explore-interactive.html (#12311) * fix docs style error (#12314) fix docs style error * ZH-trans: add kube-controller-manager.md (#12260) * ZH-trans: add kube-controller-manager.md * Update kube-controller-manager.md * Update kube-controller-manager.md * Update kube-controller-manager.md * zh-trans: /docs/contribute/localization.md (#12295) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/localization.md; update Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/localization.md; update2 Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * ZH-trans: update tools.md (#12320) ZH-trans: update tools.md * ZH-trans: fix "kubead -config" -> "kubeadm-config" (#12319) * ZH-trans: update kubeadm_config.md * fix style error * correct "availability” trans for chinese (#12394) * ZH-trans:/docs/tasks/debug-application-cluster/debug-service.md (#12275) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * Translate some remnant partials for localization (#12240) * zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md (#12415) * zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md * Update limit-storage-consumption.md * Update limit-storage-consumption.md * update link to SSH tunneling (#12615) Signed-off-by: PingWang <wang.ping5@zte.com.cn> * zh-trans: update content/zh/docs/setup/certificates.md (#12620) * ZH-trans: add kubeadm_alpha_phase_certs_apiserver-kubelet-client.md (#12619) * ZH-trans: add kubeadm_alpha_phase_certs_apiserver-kubelet-client.md * Update kubeadm_alpha_phase_certs_apiserver-kubelet-client.md * zh-trans: node-conformance.md (#12356) * zh-trans: node-conformance.md zh-trans: node-conformance.md * better translation better translation * zh-trans: translate docs/getting-started-guides/ubuntu/operational-co… (#12353) * zh-trans: translate docs/getting-started-guides/ubuntu/operational-considerations.md * Adopt PR suggestions * add period sign * zh-trans: krib.md (#12363) * zh-trans: krib.md zh-trans: krib.md * Update krib.md * Update krib.md * Update krib.md * Update krib.md * zh-trans: /docs/tasks/administer-federation/events.md (#12411) * zh-trans: /docs/tasks/administer-federation/events.md zh-trans: /docs/tasks/administer-federation/events.md * Update events.md * Update events.md * zh-trans: /docs/setup/turnkey/azure.md (#12412) zh-trans: /docs/setup/turnkey/azure.md * zh-trans:/docs/tasks/administer-federation/hpa.md & /docs/tasks/administer-cluster/extended-resource-node.md (#12432) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * . * Add arm64, ppc64le and s390x platforms for calico (#12666) Signed-off-by: PingWang <wang.ping5@zte.com.cn> add only Signed-off-by: PingWang <wang.ping5@zte.com.cn> * zh-trans: developing-cloud-controller-manager.md (#12413) * zh-trans: /docs/tasks/administer-cluster/developing-cloud-controller-manager.md zh-trans: /docs/tasks/administer-cluster/developing-cloud-controller-manager.md * Update developing-cloud-controller-manager.md * fix typo: delete useless "**" * Update developing-cloud-controller-manager.md * ZH-trans: add 2018-05-01-developing-on-kubernetes.md (#12814) * ZH-trans: update encrypt-data.md (#12939) * ZH-trans: update encrypt-data.md * Update encrypt-data.md * ZH-trans: add example-task-template.md (#12940) * ZH-trans: add example-task-template.md * Update example-task-template.md * Added Instana to tools (#12978) Instana is already available in the english version of the text, therefore I added it here too. Hope my skills were enough to make the text still correct :-) * ZH-trans: add expose-interactive.html (#12965) * ZH-trans: add expose-interactive.html * Update content/zh/docs/tutorials/kubernetes-basics/expose/expose-interactive.html Co-Authored-By: xichengliudui <1693291525@qq.com> * ZH-trans: add cloudstack.md (#12967) * Create cloudstack.md * Update cloudstack.md * Update cloudstack.md * Update cloudstack.md * ZH-trans: add container-lifecycle-hooks.md (#12941) * ZH-trans: add container-lifecycle-hooks.md * Update container-lifecycle-hooks.md * translate content/zh/docs/tasks/administer-cluster/dns-debugging-resolution.md to chinese (#12904) * ZH-trans: add expose-external-ip-address.md (#12955) * ZH-trans: add expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * ZH-trans: add dns-horizontal-autoscaling.md (#12948) * ZH-trans: add dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * zh-trans: update content/zh/docs/concepts/_index.md (#13182) * zh-trans: update content/zh/docs/reference/access-authn-authz/node.md (#13181) * Update dns-horizontal-autoscaling.md (#13119) * Update dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * ZH-trans: add 2018-10-03-kubedirector.md (#13048) * ZH-trans: add 2018-10-03-kubedirector.md * Update 2018-10-03-kubedirector.md * Update 2018-10-03-kubedirector.md * ZH-trans: add guestbook.md (#12953) * ZH-trans: add guestbook.md * Update guestbook.md * Update guestbook.md * Update guestbook.md * Update guestbook.md * ZH-trans: add set-up-placement-policies-federation.md (#12947) * ZH-trans: add set-up-placement-policies-federation.md * update pull request * Update set-up-placement-policies-federation.md * Update set-up-placement-policies-federation.md * Update set-up-placement-policies-federation.md * Update set-up-placement-policies-federation.md * ZH-trans: add service-accounts-admin.md (#13047) * ZH-trans: add service-accounts-admin.md * Update service-accounts-admin.md * Update service-accounts-admin.md * ZH-trans: add update-api-object-kubectl-patch.md (#12943) * ZH-trans: add update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * ZH-trans: add parallel-processing-expansion.md (#12944) * ZH-trans: add parallel-processing-expansion.md * Update parallel-processing-expansion.md * Update parallel-processing-expansion.md * zh-trans: add 2018-12-05-new-contributor-shanghai.md (#12778) * add zh 2017-03-00-Five-Days-Of-Kubernetes-1-6.md add zh 2018-12-05-new-contributor-shanghai.md * Delete 2017-03-00-Five-Days-Of-Kubernetes-1-6.md * zh-trans: /docs/contribute/style/write-new-topic.md (#12572) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/style/write-new-topic.md; update Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * zh-trans: update content/zh/docs/setup/salt.md (#13202) * zh-trans: add docs/reference/setup-tools/kubeadm/generated/kubeadm_token.md (#13198) * ZH-trans: add kubeadm_upgrade_diff.md (#13170) * ZH-trans: add kubeadm_upgrade_diff.md * Update kubeadm_upgrade_diff.md * Update kubeadm_upgrade_diff.md * zh-trans: update docs/reference/access-authn-authz/authorization.md (#13180) * zh-trans: update docs/reference/setup-tools/kubeadm/kubeadm-config.md (#13179) * zh-trans: add docs/concepts/storage/dynamic-provisioning.md (#13171) * ZH-trans: add 2015-05-00-Kubernetes-On-Openstack.md (#13149) * ZH-trans: add Kubernetes开源项目产品经理 * Update 2015-05-00-Kubernetes-On-Openstack.md * ZH-trans: add 2015-03-00-Welcome-To-Kubernetes-Blog.md (#13131) * ZH-trans: add 2015-03-00-Welcome-To-Kubernetes-Blog.md * Update 2015-03-00-Welcome-To-Kubernetes-Blog.md * ZH-trans: add 2015-06-00-Slides-Cluster-Management-With.md (#13123) * ZH-trans: add 2015-06-00-Slides-Cluster-Management-With.md * Update 2015-06-00-Slides-Cluster-Management-With.md * Create 2015-03-00-Kubernetes-Gathering-Videos.md (#13124) * ZH-trans: add 2015-03-00-Weekly-Kubernetes-Community-Hangout.md (#13129) * ZH-trans: add 2015-03-00-Weekly-Kubernetes-Community-Hangout.md * Update 2015-03-00-Weekly-Kubernetes-Community-Hangout.md * ZH-trans: add 2015-04-00-Kubernetes-Release-0150.md (#13130) * ZH-trans: add 2015-04-00-Kubernetes-Release-0150.md * Update 2015-04-00-Kubernetes-Release-0150.md * ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md (#13132) * ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_29.md (#13147) * ZH-trans: add 2015-05-00-Weekly-Kubernetes-Community-Hangout.md (#13148) * ZH-trans: add flannel_multi_node_cluster.md (#13195) * ZH-trans: add flannel_multi_node_cluster.md * Update flannel_multi_node_cluster.md * Update flannel_multi_node_cluster.md * zh-trans: add docs/reference/command-line-tools-reference/kubelet-authentication-authorization.md (#13200) * zh-trans: add docs/reference/command-line-tools-reference/kubelet-authentication-authorization.md * Update kubelet-authentication-authorization.md * zh-trans: /docs/tasks/administer-cluster/out-of-resource.md (#12879) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * . * . * zh-trans: update docs/setup/node-conformance.md (#13201) * zh-trans: update docs/setup/node-conformance.md * zh-trans: update docs/setup/on-premises-vm/dcos.md * zh-trans: add content/zh/blog/_posts/2018-10-15-steering-election-results.md (#13227) * zh-trans: add content/zh/blog/_posts/2018-10-15-steering-election-results.md * Update content/zh/blog/_posts/2018-10-15-steering-election-results.md Co-Authored-By: SataQiu <1527062125@qq.com> * Add @xichengliudui to sig-docs-zh-owners (release-1.12) (#13167) * Add @xichengliudui to sig-docs-zh-owners * Update OWNERS_ALIASES * ZH-trans: add coreos.md (#13193) * ZH-trans: coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * add SataQiu as a sig-docs-zh-owner (#13271) * Fix relative links issue in zh content (#13312) * `http://kubernetes.io/docs/` -> `/docs/` * `https://kubernetes.io/docs/` -> `/docs/` * zh-trans: add docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md (#13194) * zh-trans: add docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md * Update content/zh/docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update kubeadm-upgrade.md * ZH-trans: add kubeadm-upgrade-ha-1-12.md (#13306) * ZH-trans: add kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update config.toml (#13408) * zh-trans: add content/zh/blog/_posts/2018-11-08-kubernetes-docs-update-i18n.md (#13221) * zh-trans: add content/zh/docs/reference/kubernetes-api/labels-annotations-taints.md (#13236) * zh-trans: add content/zh/blog/_posts/2018-10-16-kubernetes-2018-north-american-contributor-summit.md (#13274) * zh-trans: add content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md (#13268) * zh-trans: add content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md * Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md * ZH-trans: add 2017-10-00-Five-Days-Of-Kubernetes-18.md (#13427) * ZH-trans: add 2017-10-00-Five-Days-Of-Kubernetes-18.md * Update 2017-10-00-Five-Days-Of-Kubernetes-18.md * zh-trans: add content/zh/docs/tasks/administer-federation/daemonset.md (#13239) * message * more message * remove data.json * ZH-trans: add aws.md (#13276) * ZH-trans: add aws.md * Update aws.md * Update aws.md * ZH-trans: add cluster-interactive.html (#13479) * ZH-trans: add cluster-interactive.html * Update cluster-interactive.html * ZH-trans: add update-intro.html (#13480) * Create update-intro.html * Update update-intro.html * Update update-intro.html * Update update-intro.html * Update update-intro.html * Update update-intro.html * ZH-trans: add README.md (#13235) * ZH-trans: add vendoring * Update README.md * zh: docs/cocepts/cluster-administration/logging.md (#13541) * zh: docs/cocepts/cluster-administration/logging.md * Update logging.md * zh-trans: update docker-cli-to-kubectl.md (#13591) * Update docker-cli-to-kubectl.md * Update docker-cli-to-kubectl.md * zh-trans: update advanced.md (#13592) * ZH-trans: add 2017-11-00-Autoscaling-In-Kubernetes.md (#13424) * ZH-trans: add 2017-11-00-Autoscaling-In-Kubernetes.md * Update 2017-11-00-Autoscaling-In-Kubernetes.md * ZH-trans: add fedora_manual_config.md (#13439) * ZH-trans: add fedora_manual_config.md * Update fedora_manual_config.md * zh-trans: content/zh/docs/concepts/overview/working-with-objects/labe… (#12277) * zh-trans: content/zh/docs/concepts/overview/working-with-objects/labels.md * update trans * update trans * zh: docs/contribute/start.md trans (#13632) * zh：docs/contribute/start.md trans * Update start.md * Update start.md * Update start.md * Update start.md * Update content/zh/docs/contribute/start.md Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com> * Update content/zh/docs/contribute/start.md Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com> * Update content/zh/docs/contribute/start.md Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com> * zh-trans: update docs/reference/setup-tools/kubefed (#13729) * Update 2017-10-00-Five-Days-Of-Kubernetes-18.md (#13472) * zh-trans: add configure-multiple-schedulers.md (#13492) * zh-trans: add configure-multiple-schedulers.md * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update configure-multiple-schedulers.md * Update configure-multiple-schedulers.md * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update configure-multiple-schedulers.md * zh-trans: add docs/tasks/configure-pod-container/share-process-namespace.md (#13551) * zh-trans: add docs/tasks/configure-pod-container/share-process-namespace.md * Update share-process-namespace.md * zh-trans: update docs/admin/accessing-the-api.md (#13744) * zh-trans: add content/zh/blog/_posts/2018-10-11-topology-aware-volume-provisioning.md (#13303) * ZH-trans: add 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md (#13241) * ZH-trans: add 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md * Update 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md * Update 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md * ZH-trans: add 2016-07-00-Citrix-Netscaler-And-Kubernetes.md (#13242) * ZH-trans: add 2016-07-00-Citrix-Netscaler-And-Kubernetes.md * Update 2016-07-00-Citrix-Netscaler-And-Kubernetes.md * Update 2016-07-00-Citrix-Netscaler-And-Kubernetes.md * zh-trans: update docs/admin/bootstrap-tokens.md (#13770) * zh-trans: update content/zh/docs/admin/cluster-large.md (#13771) * zh-trans: update content/zh/docs/admin/kube-apiserver.md (#13774) * zh-trans: update content/zh/docs/admin/kube-apiserver.md * Update kube-apiserver.md * Update content/zh/docs/admin/kube-apiserver.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/admin/multiple-zones.md (#13775) * zh-trans: update content/zh/docs/admin/multiple-zones.md * Update multiple-zones.md * zh-trans: update node-conformance.md and ovs-networking.md (#13776) * zh-trans: update high-availability/_index.md and authorization/webhook.md (#13780) * zh-trans: update content/zh/docs/admin/authorization/_index.md (#13779) * zh-trans: update content/zh/docs/admin/authorization/_index.md * Update _index.md * Update content/zh/docs/admin/authorization/_index.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/admin/authorization/_index.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/admin/authorization/_index.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/admin/authorization/abac.md (#13777) * zh-trans: update content/zh/docs/admin/authorization/abac.md * Update content/zh/docs/admin/authorization/abac.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update abac.md * zh-trans: update content/zh/docs/admin/service-accounts-admin.md (#13778) * zh-trans: update content/zh/docs/admin/service-accounts-admin.md * Update content/zh/docs/admin/service-accounts-admin.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/concepts/architecture (#13797) * ZH-trans: add cluster.md (#13500) * ZH-trans: add cluster.md * Update cluster.md * Update cluster.md * Update cluster.md * zh-trans: update docs/concepts/cluster-administration (#13825) * Exclude content-en changes in the PR * Exclude content/ko changes in the PR * Exclude OWNERS_ALIASES change in the PR * rm kubeadm/generated/README.md to fix the build * Remove generated sass assets
This commit is contained in:
chenrui
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
d437c2e5e5
commit
577b431931
@@ -3,40 +3,40 @@ approvers:
|
||||
- bgrant0607
|
||||
- erictune
|
||||
- lavalamp
|
||||
title: Kubernetes API访问控制
|
||||
title: Kubernetes API 访问控制
|
||||
---
|
||||
|
||||
用户通过 `kubectl`、客户端库或者通过发送REST请求[访问API](/docs/user-guide/accessing-the-cluster)。 用户（自然人）和[Kubernetes服务账户](/docs/tasks/configure-pod-container/configure-service-account/) 都可以被授权进行API访问。
|
||||
请求到达API服务器后会经过几个阶段，具体说明如图：
|
||||
用户通过 `kubectl`、客户端库或者通过发送 REST 请求[访问 API](/docs/user-guide/accessing-the-cluster)。 用户（自然人）和 [Kubernetes 服务账户](/docs/tasks/configure-pod-container/configure-service-account/) 都可以被授权进行 API 访问。
|
||||
请求到达 API 服务器后会经过几个阶段，具体说明如图：
|
||||
|
||||
|
||||
|
||||
## 传输层安全
|
||||
|
||||
在典型的Kubernetes集群中，API通过443端口提供服务。
|
||||
API服务器会提供一份证书。 该证书一般是自签名的， 所以用户机器上的 `$USER/.kube/config` 目录通常
|
||||
包含该API服务器证书的根证书，用来代替系统默认根证书。 当用户使用 `kube-up.sh` 创建集群时，该证书通常会被自动写入用户的`$USER/.kube/config`。 如果集群中存在多个用户，则创建者需要与其他用户共享证书。
|
||||
在典型的 Kubernetes 集群中，API 通过 443 端口提供服务。
|
||||
API 服务器会提供一份证书。 该证书一般是自签名的， 所以用户机器上的 `$USER/.kube/config` 目录通常
|
||||
包含该 API 服务器证书的根证书，用来代替系统默认根证书。 当用户使用 `kube-up.sh` 创建集群时，该证书通常会被自动写入用户的 `$USER/.kube/config`。 如果集群中存在多个用户，则创建者需要与其他用户共享证书。
|
||||
|
||||
## 认证
|
||||
|
||||
一旦 TLS 连接建立，HTTP请求就进入到了认证的步骤。即图中的步骤 **1** 。
|
||||
集群创建脚本或集群管理员会为API服务器配置一个或多个认证模块。
|
||||
更具体的认证相关的描述详见 [这里](/docs/admin/authentication/)。
|
||||
一旦 TLS 连接建立，HTTP 请求就进入到了认证的步骤。即图中的步骤 **1** 。
|
||||
集群创建脚本或集群管理员会为 API 服务器配置一个或多个认证模块。
|
||||
更具体的认证相关的描述详见[这里](/docs/admin/authentication/)。
|
||||
|
||||
认证步骤的输入是整个HTTP请求，但这里通常只是检查请求头和/或客户端证书。
|
||||
认证步骤的输入是整个 HTTP 请求，但这里通常只是检查请求头和 / 或客户端证书。
|
||||
|
||||
认证模块支持客户端证书，密码和Plain Tokens，
|
||||
Bootstrap Tokens，以及JWT Tokens (用于服务账户)。
|
||||
认证模块支持客户端证书，密码和 Plain Tokens，
|
||||
Bootstrap Tokens，以及 JWT Tokens（用于服务账户）。
|
||||
|
||||
（管理员）可以同时设置多种认证模块，在设置了多个认证模块的情况下，每个模块会依次尝试认证，
|
||||
直到其中一个认证成功。
|
||||
|
||||
在 GCE 平台中，客户端证书，密码和Plain Tokens，Bootstrap Tokens，以及JWT Tokens同时被启用。
|
||||
在 GCE 平台中，客户端证书，密码和 Plain Tokens，Bootstrap Tokens，以及 JWT Tokens 同时被启用。
|
||||
|
||||
如果请求认证失败，则请求被拒绝，返回401状态码。
|
||||
如果请求认证失败，则请求被拒绝，返回 401 状态码。
|
||||
如果认证成功，则被认证为具体的 `username`，该用户名可供随后的步骤中使用。一些认证模块还提供了用户的组成员关系，另一些则没有。
|
||||
|
||||
尽管Kubernetes使用 "用户名" 来进行访问控制和请求记录，但它实际上并没有 `user` 对象，也不存储用户名称或其他相关信息。
|
||||
尽管 Kubernetes 使用“用户名”来进行访问控制和请求记录，但它实际上并没有 `user` 对象，也不存储用户名称或其他相关信息。
|
||||
|
||||
## 授权
|
||||
|
||||
@@ -44,7 +44,7 @@ Bootstrap Tokens，以及JWT Tokens (用于服务账户)。
|
||||
|
||||
请求须包含请求者的用户名，请求动作，以及该动作影响的对象。 如果存在相应策略，声明该用户具有进行相应操作的权限，则该请求会被授权。
|
||||
|
||||
例如，如果Bob有如下策略，那么他只能够读取`projectCaribou`命名空间下的pod资源：
|
||||
例如，如果 Bob 有如下策略，那么他只能够读取 `projectCaribou` 命名空间下的 pod 资源：
|
||||
|
||||
```json
|
||||
{
|
||||
@@ -58,7 +58,7 @@ Bootstrap Tokens，以及JWT Tokens (用于服务账户)。
|
||||
}
|
||||
}
|
||||
```
|
||||
如果Bob发起以下请求，那么请求能够通过授权，因为Bob被允许访问 `projectCaribou` 命名空间下的对象：
|
||||
如果 Bob 发起以下请求，那么请求能够通过授权，因为 Bob 被允许访问 `projectCaribou` 命名空间下的对象：
|
||||
|
||||
```json
|
||||
{
|
||||
@@ -74,20 +74,20 @@ Bootstrap Tokens，以及JWT Tokens (用于服务账户)。
|
||||
}
|
||||
}
|
||||
```
|
||||
如果Bob对 `projectCaribou` 命名空间下的对象发起一个写（`create` 或者 `update`）请求，那么它的授权会被拒绝。 如果Bob请求读取(`get`) 其他命名空间，例如 `projectFish`下的对象，其授权也会被拒绝。
|
||||
如果 Bob 对 `projectCaribou` 命名空间下的对象发起一个写（`create` 或者 `update`）请求，那么它的授权会被拒绝。 如果 Bob 请求读取 （`get`）其他命名空间，例如 `projectFish` 下的对象，其授权也会被拒绝。
|
||||
|
||||
Kubernetes的授权要求使用通用的REST属性与现有的组织或云服务提供商的访问控制系统进行交互。 采用REST格式是必要的，因为除Kubernetes外，这些访问控制系统还可能与其他的API进行交互。
|
||||
Kubernetes 的授权要求使用通用的 REST 属性与现有的组织或云服务提供商的访问控制系统进行交互。 采用 REST 格式是必要的，因为除 Kubernetes 外，这些访问控制系统还可能与其他的 API 进行交互。
|
||||
|
||||
Kubernetes 支持多种授权模块，例如ABAC模式，RBAC模式和 Webhook模式。 管理员创建集群时，会配置API服务器应用的授权模块。 如果多种授权模式同时被启用，Kubernetes将检查所有模块，如果其中一种通过授权，则请求授权通过。 如果所有的模块全部拒绝，则请求被拒绝(HTTP状态码403)。
|
||||
Kubernetes 支持多种授权模块，例如 ABAC 模式，RBAC 模式和 Webhook 模式。 管理员创建集群时，会配置 API 服务器应用的授权模块。 如果多种授权模式同时被启用，Kubernetes 将检查所有模块，如果其中一种通过授权，则请求授权通过。 如果所有的模块全部拒绝，则请求被拒绝（HTTP 状态码 403）。
|
||||
|
||||
要了解更多的Kubernetes授权相关信息，包括使用授权模块创建策略的具体说明等，可参考[授权概述](/docs/admin/authorization)。
|
||||
要了解更多的 Kubernetes 授权相关信息，包括使用授权模块创建策略的具体说明等，可参考[授权概述](/docs/admin/authorization)。
|
||||
|
||||
|
||||
## 准入控制
|
||||
|
||||
准入控制模块是能够修改或拒绝请求的软件模块。
|
||||
作为授权模块的补充，准入控制模块会访问被创建或更新的对象的内容。
|
||||
它们作用于对象的创建，删除，更新和连接 (proxy)阶段，但不包括对象的读取。
|
||||
它们作用于对象的创建，删除，更新和连接（proxy）阶段，但不包括对象的读取。
|
||||
|
||||
可以同时配置多个准入控制器，它们会按顺序依次被调用。
|
||||
|
||||
@@ -99,23 +99,23 @@ Kubernetes 支持多种授权模块，例如ABAC模式，RBAC模式和 Webhook
|
||||
|
||||
可用的准入控制模块描述 [如下](/docs/admin/admission-controllers/)。
|
||||
|
||||
一旦请求通过所有准入控制器，将使用对应API对象的验证流程对其进行验证，然后写入对象存储 (如步骤 **4**)。
|
||||
一旦请求通过所有准入控制器，将使用对应 API 对象的验证流程对其进行验证，然后写入对象存储 （如步骤 **4**）。
|
||||
|
||||
|
||||
## API的端口和IP
|
||||
## API 的端口和 IP
|
||||
|
||||
上述讨论适用于发送请求到API服务器的安全端口(典型情况)。
|
||||
实际上API服务器可以通过两个端口提供服务：
|
||||
上述讨论适用于发送请求到 API 服务器的安全端口（典型情况）。
|
||||
实际上 API 服务器可以通过两个端口提供服务：
|
||||
|
||||
默认情况下，API服务器在2个端口上提供HTTP服务：
|
||||
默认情况下，API 服务器在 2 个端口上提供 HTTP 服务：
|
||||
|
||||
1. `Localhost Port`:
|
||||
|
||||
- 用于测试和启动，以及管理节点的其他组件
|
||||
(scheduler, controller-manager)与API的交互
|
||||
- 没有TLS
|
||||
- 默认值为8080，可以通过 `--insecure-port` 标记来修改。
|
||||
- 默认的IP地址为localhost， 可以通过 `--insecure-bind-address`标记来修改。
|
||||
（scheduler, controller-manager）与 API 的交互
|
||||
- 没有 TLS
|
||||
- 默认值为 8080，可以通过 `--insecure-port` 标记来修改。
|
||||
- 默认的 IP 地址为 localhost， 可以通过 `--insecure-bind-address` 标记来修改。
|
||||
- 请求会 **绕过** 认证和鉴权模块。
|
||||
- 请求会被准入控制模块处理。
|
||||
- 其访问需要主机访问的权限。
|
||||
@@ -124,12 +124,12 @@ Kubernetes 支持多种授权模块，例如ABAC模式，RBAC模式和 Webhook
|
||||
|
||||
- 尽可能使用该端口访问
|
||||
- 应用 TLS。 可以通过 `--tls-cert-file` 设置证书， 通过 `--tls-private-key-file` 设置私钥。
|
||||
- 默认值为6443，可以通过 `--secure-port` 标记来修改。
|
||||
- 默认IP是首个非本地的网络接口地址，可以通过 `--bind-address` 标记来修改。
|
||||
- 默认值为 6443，可以通过 `--secure-port` 标记来修改。
|
||||
- 默认 IP 是首个非本地的网络接口地址，可以通过 `--bind-address` 标记来修改。
|
||||
- 请求会经过认证和鉴权模块处理。
|
||||
- 请求会被准入控制模块处理。
|
||||
- 要求认证和授权模块正常运行。
|
||||
|
||||
通过 `kube-up.sh`创建集群时， 对 Google Compute Engine (GCE)
|
||||
和一些其他的云供应商来说， API通过443端口提供服务。 对
|
||||
GCE而言，项目上配置了防火墙规则，允许外部的HTTPS请求访问API，其他（厂商的）集群设置方法各不相同。
|
||||
通过 `kube-up.sh` 创建集群时， 对 Google Compute Engine（GCE）
|
||||
和一些其他的云供应商来说， API 通过 443 端口提供服务。 对
|
||||
GCE 而言，项目上配置了防火墙规则，允许外部的 HTTPS 请求访问 API，其他（厂商的）集群设置方法各不相同。
|
||||
|
||||
Reference in New Issue
Block a user