Merge release 1.12 into release 1.13 (#14171)
* ZH-trans: Update coarse-parallel-processing-work-queue.md (#11862) * ZH-trans: Update coarse-parallel-processing-work-queue.md * Update coarse-parallel-processing-work-queue.md * zh-trans: add /docs/concepts/architecture/cloud-controller.md (#11799) * docs/concepts/architecture/cloud-controller.md * docs/concepts/architecture/cloud-controller.md * docs/concepts/architecture/cloud-controller.md * fix * fix * fix * zh-trans: /docs/contribute/style/kubernetes-components.md (#11838) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/generate-ref-docs/kubernetes-components.md; update Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * Update weave-network-policy.md (#11858) * ZH-trans: add Update define-environment-variable-container.md (#11859) * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update fine-parallel-processing-work-queue.md (#11863) * Update fine-parallel-processing-work-queue.md * Update fine-parallel-processing-work-queue.md * Update setup-extension-api-server.md (#11864) * zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md (#11798) * zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md * Update kubeadm-join.md * Create kubeadm_join.md * zh-trans: update docs/concepts/containers/images.md (#11877) * zh-trans: update docs/concepts/containers/images.md * zh-trans: update docs/concepts/containers/images.md * Update kubeadm_alpha_phase_controlplane.md (#11878) * 更新第 115 行翻译 * zh_trans: kubeadm_token_generate.md (#11884) * zh_trans: kubeadm_token_generate.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_token_generate.md * Better translation Better translation * zh-trans: add /docs/tasks/configure-pod-container/configure-pod-initialization.md (#11886) zh-trans: add /docs/tasks/configure-pod-container/configure-pod-initialization.md * zh-trans:add content/zh/docs/reference/issues-security (#11890) * zh-trans: add content/zh/docs/tutorials/online-training/overview.md (#11892) * zh_trans: kubeadm_token_delete.md (#11883) * zh_trans: kubeadm_token_delete.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_token_create.md * fix tpye error fix tpye error * Better translation Better translation * zh_trans: independent/create-cluster-kubeadm.md (#11882) * zh_trans: independent/create-cluster-kubeadm.md zh_trans: docs/setup/independent/create-cluster-kubeadm.md * fix word style error * fix type error * better zhtran better zhtran * fix "Create" -> "create" fix "Create" -> "create" * zh-trans: add docs/concepts/storage/storage-classes.md (#11788) * ZH-trans: fixing formatting errors (#11661) * ZH-trans: fixing formatting errors * Update ZH-trans: fixing formatting errors storage-classes zh part 1 * storage-classes zh trans * fix typo update trans for provisioner & fix typo * fix typo * 根据校对更新翻译 * zh_trans: kubeadm-token.md (#11898) zh_trans: /docs/reference/setup-tools/kubeadm/kubeadm-token.md * zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md (#11900) * zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md * Update quality-service-pod.md * zh_trans: kubeadm_alpha_phase_bootstrap-token_node.md (#11897) zh_trans: Path：/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node.md * zh-trans: add /docs/concepts/storage/volumes.md (#11767) * zh-trans: add /docs/concepts/storage/volumes.md zh-trans: add /docs/concepts/storage/volumes.md * Update volumes.md * Update volumes.md * self-review * Update volumes.md * fix docs format error (#11934) fix docs format error of https://v1-12.docs.kubernetes.io/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/ * Update cloud-controller.md (#11922) * zh-trans: /docs/reference/glossary/approver.md (#11924) zh-trans: /docs/reference/glossary/approver.md * zh-trans: add docs/setup/on-premises-vm/dcos.md (#11891) * zh-trans: add docs/setup/on-premises-vm/dcos.md * Update content/zh/docs/setup/on-premises-vm/dcos.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: /docs/tasks/configure-pod-container/configure-persistent-vo… (#11915) * zh-trans: /docs/tasks/configure-pod-container/configure-persistent-volume-storage.md zh-trans: /docs/tasks/configure-pod-container/configure-persistent-volume-storage.md * Update configure-persistent-volume-storage.md * zh_trans: kubeadm_alpha.md (#11902) * zh_trans: kubeadm_alpha.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha.md * Better translation Better translation * zh-trans: /docs/reference/glossary/downstream.md (#11931) * zh-trans: /docs/reference/glossary/downstream.md zh-trans: /docs/reference/glossary/downstream.md * Update downstream.md * Update downstream.md * ZH-trans: Update install-kubeadm.md (#11955) * fix typo of install-kubeadm.md fix typo of install-kubeadm.md * Update install-kubeadm.md * zh-trans: add kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md (#11952) * zh-trans: add /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md zh-trans: add /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md * Update kubeadm_alpha_phase_certs_renew_all.md * renew 的翻译更新为续期 * zh-trans:kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md (#11953) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md * Update kubeadm_alpha_phase_certs_renew_etcd-peer.md * zh-trans: /docs/contribute/generate-ref-docs/kubectl.md (#11941) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * fix docs format error (#11936) fix docs format error of https://v1-12.docs.kubernetes.io/zh/docs/reference/setup-tools/kubeadm/kubeadm-config/ * Update pull request (#11921) * Update pull request (#11960) * ZH-trans: add kubefed-options.md (#11956) * Update ZH-trans: add kubefed-options.md * Update kubefed-options.md * ZH-trans: add generated/... (#11880) * Update pull request * Update kubeadm_alpha_phase_certs_renew.md * Update pull request (#11881) * ZH-trans: add generated/... (#11879) * Update pull request * Resolving file conflicts * zh-trans: add zh/ docs/tasks/configure-pod-container/configure-servic… (#11889) * zh-trans: add zh/ docs/tasks/configure-pod-container/configure-service-account.md zh-trans: add zh/ docs/tasks/configure-pod-container/configure-service-account.md * Update configure-service-account.md * Update configure-service-account.md * zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md (#11875) * zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md * zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md * zh-trans:update kubelet-garbage-collection.md * zh_trans: kubeadm_alpha_phase_kubeconfig_user.md (#11901) * zh_trans: kubeadm_alpha_phase_kubeconfig_user.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_user.md * Better translation * zh-trans:add docs/reference/using-api/client-libraries.md (#11958) * zh-trans:add docs/reference/using-api/client-libraries.md * Update content/zh/docs/reference/using-api/client-libraries.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: add pull-image-private-registry.md (#11912) * zh-trans: add pull-image-private-registry.md zh-trans: add pull-image-private-registry.md * Update pull-image-private-registry.md * Update pull-image-private-registry.md * ZH-trans: add kubeadm_alpha_phase_kubelet_config_annotate-cri.md (#11972) * Create kubeadm_alpha_phase_kubelet_config_annotate-cri.md * Update kubeadm_alpha_phase_kubelet_config_annotate-cri.md * ZH-trans: add kubeadm_alpha_phase_kubelet_config.md (#11974) * Create kubeadm_alpha_phase_kubelet_config.md * Update kubeadm_alpha_phase_kubelet_config.md * fix Typo "##" -> "## " (#12011) * fix Typo "##" -> "## " fix Typo "##" -> "## " * update basic-stateful-set.md * fix web style error (#12010) fix web style error * Create kubeadm_alpha_phase_selfhosting.md (#12006) * Create kubeadm_alpha_phase_controlplane_apiserver.md (#12005) * zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitor… (#11995) * zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitoring.md zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitoring.md * Update resource-usage-monitoring.md * Update resource-usage-monitoring.md * zh-trans:/docs/tasks/debug-application-cluster/core-metrics-pipeline.md (#11990) zh-trans:/docs/tasks/debug-application-cluster/core-metrics-pipeline.md * zh-trans:/docs/tasks/debug-application-cluster/troubleshooting.md (#11989) zh-trans:/docs/tasks/debug-application-cluster/troubleshooting.md * Create kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md (#11969) * Create kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md * Update kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md * zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md (#11962) * zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md * Update debug-init-containers.md * zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md (#11930) * zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md * Update horizontal-pod-autoscaler.md * zh-trans: add /docs/tasks/configure-pod-container/configure-projected… (#11911) * zh-trans: add /docs/tasks/configure-pod-container/configure-projected-volume-storage.md zh-trans: add /docs/tasks/configure-pod-container/configure-projected-volume-storage.md * Update configure-projected-volume-storage.md * Update configure-projected-volume-storage.md * zh-trans: /docs/tasks/configure-pod-container/extended-resource.md (#11918) * zh-trans: /docs/tasks/configure-pod-container/extended-resource.md zh-trans: /docs/tasks/configure-pod-container/extended-resource.md * Update extended-resource.md * Update extended-resource.md * zh-trans: add translate-compose-kubernetes.md (#11910) * zh-trans: add translate-compose-kubernetes.md zh-trans: add translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * zh-trans: zh/docs/reference/glossary/flexvolume.md (#11925) * zh-trans: zh/docs/reference/glossary/flexvolume.md zh-trans: zh/docs/reference/glossary/flexvolume.md * Update flexvolume.md * zh_trans: kubeadm_alpha_phase_bootstrap-token_create.md (#11947) * zh_trans: kubeadm_alpha_phase_bootstrap-token_create.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_create.md * better translation better translation * zh-trans:add docs/setup/turnkey/alibaba-cloud.md (#11959) * zh_trans: kubeadm_completion.md (#11895) * zh_trans: kubeadm_completion.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node.md * Better translation Better translation * Update kubeadm_completion.md * better translation better translation * zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md (#11961) * zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md * Update crictl.md * ZH-trans: add kubeadm_alpha_phase_certs_front-proxy-ca.md (#11968) * ZH-trans: add kubeadm_alpha_phase_controlplane_all.md (#11970) * Create kubeadm_alpha_phase_controlplane_all.md * Update kubeadm_alpha_phase_controlplane_all.md * Update kubeadm_alpha_phase_controlplane_all.md * Update kubeadm_alpha_phase_controlplane_all.md * ZH-trans: add kubeadm_alpha_phase_upload-config.md (#11971) * Create kubeadm_alpha_phase_upload-config.md * Update kubeadm_alpha_phase_upload-config.md * Update kubeadm_alpha_phase_upload-config.md * ZH-trans: Fixed some incorrect translations (#11973) * zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-… (#11977) * zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-failure.md zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-failure.md * Update determine-reason-pod-failure.md * zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md (#11988) * zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md * Update local-debugging.md * zh-trans:/docs/tasks/debug-application-cluster/events-stackdriver.md (#11996) zh-trans:/docs/tasks/debug-application-cluster/events-stackdriver.md * zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-cont… (#11998) * zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-container.md zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-container.md * Update get-shell-running-container.md * zh-trans:/docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md (#12001) zh-trans:/docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md * ZH-trans: ad kubeadm_alpha_phase_kubelet_config_write-to-disk.md (#12004) * Create kubeadm_alpha_phase_kubelet_config_write-to-disk.md * Update kubeadm_alpha_phase_kubelet_config_write-to-disk.md * Remove old-generated kubefed docs (generated on 25-march-2018) (#12093) * Update _index.md (#12061) * Update kubeadm_reset.md (#12047) * ZH-trasn: add kubeadm_alpha_phase_kubeconfig_controller-manager.md (#12032) * Create kubeadm_alpha_phase_kubeconfig_controller-manager.md * Update kubeadm_alpha_phase_kubeconfig_controller-manager.md * ZH-trans: add kubeadm_alpha_phase_preflight_node.md (#12035) * Create kubeadm_alpha_phase_preflight_node.md * Update kubeadm_alpha_phase_preflight_node.md * Update kubeadm_alpha_phase_preflight_node.md * ZH-trans: add kubeadm_alpha_phase_controlplane_scheduler.md (#12031) * Create kubeadm_alpha_phase_controlplane_scheduler.md * Update kubeadm_alpha_phase_controlplane_scheduler.md * ZH-trans: add kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md (#12039) * Create kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md * Update kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md * ZH-trans: add kubeadm_alpha_phase_kubelet_write-env-file.md (#12034) * Create kubeadm_alpha_phase_kubelet_write-env-file.md * Update kubeadm_alpha_phase_kubelet_write-env-file.md * ZH-trans: add kubeadm_upgrade_node_experimental-control-plane.md (#12036) * Create kubeadm_upgrade_node_experimental-control-plane.md * Update kubeadm_upgrade_node_experimental-control-plane.md * Create kubeadm_alpha_phase_bootstrap-token_node_allow-auto-approve.md (#12038) * Create kubeadm_alpha_phase_etcd.md (#12040) * ZH-trans: add kubeadm_alpha_phase_certs_renew_etcd-server.md (#12041) * Create kubeadm_alpha_phase_certs_renew_etcd-server.md * Update kubeadm_alpha_phase_certs_renew_etcd-server.md * Update advanced.md (#12044) * ZH-trans: add kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md (#12042) * Create kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md * Update kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md * Update kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md * Update kubeadm_version.md (#12046) * Update _index.md (#12063) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_version.md (#12085) zh-trans:/docs/reference/setup-tools/kubefed/kubefed_version.md * ZH-trans: add kubeadm_alpha_phase_certs_etcd-peer.md (#12037) * Create kubeadm_alpha_phase_certs_etcd-peer.md * Update kubeadm_alpha_phase_certs_etcd-peer.md * Update kubeadm_alpha_phase_certs_etcd-peer.md * ZH-trans: add kubeadm_alpha_phase_kubelet_config_download.md (#12033) * Create kubeadm_alpha_phase_kubelet_config_download.md * Update kubeadm_alpha_phase_kubelet_config_download.md * zh-trans: add docs/tasks/access-application-cluster/_index.md (#12048) * zh-trans: update cpu-constraint-namespace.md and cpu-default-namespace.md (#12106) * ZH-trans: update kubeadm_alpha_phase_upload-config.md (#12110) * zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md (#12022) * zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md * Update kubefed_unjoin.md * Update kubefed_unjoin.md * Update kubefed_unjoin.md * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_… (#12114) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_apiserver.md zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_apiserver.md * Update kubeadm_alpha_phase_certs_apiserver.md * Update kubeadm_alpha_phase_certs_apiserver.md * zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md (#12088) * zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md * Update docker-cli-to-kubectl.md * zh-trans: /docs/reference/kubectl/conventions.md (#12089) * zh-trans: /docs/reference/kubectl/conventions.md zh-trans: /docs/reference/kubectl/conventions.md * Update conventions.md * zh-trans organize-cluster-access-kubeconfig.md (#12094) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md (#12086) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md * Update kubefed.md * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md (#12029) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md * Update kubefed_join.md * Update kubefed_join.md * zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md (#12020) * zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md * Update kubefed_init.md * Update kubefed_init.md * Update kubefed_init.md * zh-trans: add docs/setup/independent/control-plane-flags.md (#12043) * zh-trans: add docs/setup/independent/control-plane-flags.md * update content/zh/docs/setup/independent/control-plane-flags.md * zh-trans:/docs/tasks/tools/install-kubectl.md (#11992) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * zh-trans: add /docs/concepts/cluster-administration/manage-deployment.md (#11899) * add /docs/concepts/cluster-administration/manage-deployment.md * 更新部分翻译，去除多余的反引号 * 更新部分翻译 * zh-trans: add docs/tasks/service-catalog/install-service-catalog-using-sc.md (#12045) * zh-trans: add docs/tasks/service-catalog/install-service-catalog-using-sc.md * update docs/tasks/service-catalog/install-service-catalog-using-sc.md * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md (#12087) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md * Update kubefed_options.md * Update kubefed_options.md * zh-trans: Fix some blog links issue (#12115) * zh-trans: Fix some blog links issue * Revert the space change * update Set Kubelet parameters via a config file (#12150) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_all.md (#12185) zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_all.md * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_… (#12184) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_etcd_local.md zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_etcd_local.md * Update kubeadm_alpha_phase_etcd_local.md * zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubelet_config_upload.md (#12130) zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubelet_config_upload.md * zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubeconfig_admin.md (#12131) zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubeconfig_admin.md * zh-trans: /docs/contribute/generate-ref-docs/kubernetes-api.md (#12141) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * zh-trans:/docs/concepts/overview/object-management-kubectl/imperative… (#12151) * zh-trans:/docs/concepts/overview/object-management-kubectl/imperative-config.md zh-trans:/docs/concepts/overview/object-management-kubectl/imperative-config.md * Update imperative-config.md * ZH-trans: added a blog post Chinese translation: 2018-05-01-developing-on-kubernetes.md (#12009) * added a blog post chinese translation * Update 2018-05-01-developing-on-kubernetes.md apply some suggested changes per review comments * Update 2018-05-01-developing-on-kubernetes.md cont to review and improve the wording, up to squash * more update and rewording * ZH-trans: add kubeadm_alpha_phase_kubelet_config_enable-dynamic.md (#12209) * ZH-trans: add kubeadm_alpha_phase_kubelet_config_enable-dynamic.md * Update kubeadm_alpha_phase_kubelet_config_enable-dynamic.md * ZH-trans: add kubeadm_alpha_phase_certs_renew_apiserver.md (#12210) * ZH-trans: add kubeadm_alpha_phase_certs_renew_apiserver.md * Update kubeadm_alpha_phase_certs_renew_apiserver.md * Update kubeadm_alpha_phase_certs_renew_apiserver.md * ZH-trans: add kubeadm_alpha_phase_certs_front-proxy-client.md (#12212) * fix docs style (#12225) * fix docs style fix docs style * fix docs style fix docs style * ZH-trans: add rbac.md (#12263) * ZH-trans: add rbac.md * Update rbac.md * ZH-trans: add persistent-volume-claim.md (#12264) * ZH-trans: add persistent-volume-claim.md * Update persistent-volume-claim.md * Update persistent-volume-claim.md * Update docker-cli-to-kubectl.md (#12288) * ZH-trans: add kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md (#12285) * ZH-trans: add kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md * Update kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md * ZH-trans: add coredns.md (#12282) * ZH-trans: add coredns.md * Update coredns.md * ZH-trans: add kubeadm_alpha_phase_certs_etcd-healthcheck-client.md (#12286) * ZH-trans: add kubeadm_alpha_phase_certs_etcd-healthcheck-client.md * Update kubeadm_alpha_phase_certs_etcd-healthcheck-client.md * ZH-trans: add kubeadm_alpha_phase_kubeconfig_kubelet.md (#12284) * ZH-trans: add kubeadm_alpha_phase_kubeconfig_kubelet.md * Update kubeadm_alpha_phase_kubeconfig_kubelet.md * ZH-trans: add service-account.md (#12261) * ZH-trans: add service-account.md * Update service-account.md * ZH-trans: add security-context.md (#12262) * ZH-trans: add security-context.md * Update security-context.md * Update security-context.md * Update security-context.md * fix typo "_必须_" -> "必须" (#12300) fix typo "_必须_" -> "必须" * fix docs style error (#12307) fix docs style error * Create explore-interactive.html (#12311) * fix docs style error (#12314) fix docs style error * ZH-trans: add kube-controller-manager.md (#12260) * ZH-trans: add kube-controller-manager.md * Update kube-controller-manager.md * Update kube-controller-manager.md * Update kube-controller-manager.md * zh-trans: /docs/contribute/localization.md (#12295) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/localization.md; update Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/localization.md; update2 Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * ZH-trans: update tools.md (#12320) ZH-trans: update tools.md * ZH-trans: fix "kubead -config" -> "kubeadm-config" (#12319) * ZH-trans: update kubeadm_config.md * fix style error * correct "availability” trans for chinese (#12394) * ZH-trans:/docs/tasks/debug-application-cluster/debug-service.md (#12275) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * Translate some remnant partials for localization (#12240) * zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md (#12415) * zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md * Update limit-storage-consumption.md * Update limit-storage-consumption.md * update link to SSH tunneling (#12615) Signed-off-by: PingWang <wang.ping5@zte.com.cn> * zh-trans: update content/zh/docs/setup/certificates.md (#12620) * ZH-trans: add kubeadm_alpha_phase_certs_apiserver-kubelet-client.md (#12619) * ZH-trans: add kubeadm_alpha_phase_certs_apiserver-kubelet-client.md * Update kubeadm_alpha_phase_certs_apiserver-kubelet-client.md * zh-trans: node-conformance.md (#12356) * zh-trans: node-conformance.md zh-trans: node-conformance.md * better translation better translation * zh-trans: translate docs/getting-started-guides/ubuntu/operational-co… (#12353) * zh-trans: translate docs/getting-started-guides/ubuntu/operational-considerations.md * Adopt PR suggestions * add period sign * zh-trans: krib.md (#12363) * zh-trans: krib.md zh-trans: krib.md * Update krib.md * Update krib.md * Update krib.md * Update krib.md * zh-trans: /docs/tasks/administer-federation/events.md (#12411) * zh-trans: /docs/tasks/administer-federation/events.md zh-trans: /docs/tasks/administer-federation/events.md * Update events.md * Update events.md * zh-trans: /docs/setup/turnkey/azure.md (#12412) zh-trans: /docs/setup/turnkey/azure.md * zh-trans:/docs/tasks/administer-federation/hpa.md & /docs/tasks/administer-cluster/extended-resource-node.md (#12432) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * . * Add arm64, ppc64le and s390x platforms for calico (#12666) Signed-off-by: PingWang <wang.ping5@zte.com.cn> add only Signed-off-by: PingWang <wang.ping5@zte.com.cn> * zh-trans: developing-cloud-controller-manager.md (#12413) * zh-trans: /docs/tasks/administer-cluster/developing-cloud-controller-manager.md zh-trans: /docs/tasks/administer-cluster/developing-cloud-controller-manager.md * Update developing-cloud-controller-manager.md * fix typo: delete useless "**" * Update developing-cloud-controller-manager.md * ZH-trans: add 2018-05-01-developing-on-kubernetes.md (#12814) * ZH-trans: update encrypt-data.md (#12939) * ZH-trans: update encrypt-data.md * Update encrypt-data.md * ZH-trans: add example-task-template.md (#12940) * ZH-trans: add example-task-template.md * Update example-task-template.md * Added Instana to tools (#12978) Instana is already available in the english version of the text, therefore I added it here too. Hope my skills were enough to make the text still correct :-) * ZH-trans: add expose-interactive.html (#12965) * ZH-trans: add expose-interactive.html * Update content/zh/docs/tutorials/kubernetes-basics/expose/expose-interactive.html Co-Authored-By: xichengliudui <1693291525@qq.com> * ZH-trans: add cloudstack.md (#12967) * Create cloudstack.md * Update cloudstack.md * Update cloudstack.md * Update cloudstack.md * ZH-trans: add container-lifecycle-hooks.md (#12941) * ZH-trans: add container-lifecycle-hooks.md * Update container-lifecycle-hooks.md * translate content/zh/docs/tasks/administer-cluster/dns-debugging-resolution.md to chinese (#12904) * ZH-trans: add expose-external-ip-address.md (#12955) * ZH-trans: add expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * ZH-trans: add dns-horizontal-autoscaling.md (#12948) * ZH-trans: add dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * zh-trans: update content/zh/docs/concepts/_index.md (#13182) * zh-trans: update content/zh/docs/reference/access-authn-authz/node.md (#13181) * Update dns-horizontal-autoscaling.md (#13119) * Update dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * ZH-trans: add 2018-10-03-kubedirector.md (#13048) * ZH-trans: add 2018-10-03-kubedirector.md * Update 2018-10-03-kubedirector.md * Update 2018-10-03-kubedirector.md * ZH-trans: add guestbook.md (#12953) * ZH-trans: add guestbook.md * Update guestbook.md * Update guestbook.md * Update guestbook.md * Update guestbook.md * ZH-trans: add set-up-placement-policies-federation.md (#12947) * ZH-trans: add set-up-placement-policies-federation.md * update pull request * Update set-up-placement-policies-federation.md * Update set-up-placement-policies-federation.md * Update set-up-placement-policies-federation.md * Update set-up-placement-policies-federation.md * ZH-trans: add service-accounts-admin.md (#13047) * ZH-trans: add service-accounts-admin.md * Update service-accounts-admin.md * Update service-accounts-admin.md * ZH-trans: add update-api-object-kubectl-patch.md (#12943) * ZH-trans: add update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * ZH-trans: add parallel-processing-expansion.md (#12944) * ZH-trans: add parallel-processing-expansion.md * Update parallel-processing-expansion.md * Update parallel-processing-expansion.md * zh-trans: add 2018-12-05-new-contributor-shanghai.md (#12778) * add zh 2017-03-00-Five-Days-Of-Kubernetes-1-6.md add zh 2018-12-05-new-contributor-shanghai.md * Delete 2017-03-00-Five-Days-Of-Kubernetes-1-6.md * zh-trans: /docs/contribute/style/write-new-topic.md (#12572) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/style/write-new-topic.md; update Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * zh-trans: update content/zh/docs/setup/salt.md (#13202) * zh-trans: add docs/reference/setup-tools/kubeadm/generated/kubeadm_token.md (#13198) * ZH-trans: add kubeadm_upgrade_diff.md (#13170) * ZH-trans: add kubeadm_upgrade_diff.md * Update kubeadm_upgrade_diff.md * Update kubeadm_upgrade_diff.md * zh-trans: update docs/reference/access-authn-authz/authorization.md (#13180) * zh-trans: update docs/reference/setup-tools/kubeadm/kubeadm-config.md (#13179) * zh-trans: add docs/concepts/storage/dynamic-provisioning.md (#13171) * ZH-trans: add 2015-05-00-Kubernetes-On-Openstack.md (#13149) * ZH-trans: add Kubernetes开源项目产品经理 * Update 2015-05-00-Kubernetes-On-Openstack.md * ZH-trans: add 2015-03-00-Welcome-To-Kubernetes-Blog.md (#13131) * ZH-trans: add 2015-03-00-Welcome-To-Kubernetes-Blog.md * Update 2015-03-00-Welcome-To-Kubernetes-Blog.md * ZH-trans: add 2015-06-00-Slides-Cluster-Management-With.md (#13123) * ZH-trans: add 2015-06-00-Slides-Cluster-Management-With.md * Update 2015-06-00-Slides-Cluster-Management-With.md * Create 2015-03-00-Kubernetes-Gathering-Videos.md (#13124) * ZH-trans: add 2015-03-00-Weekly-Kubernetes-Community-Hangout.md (#13129) * ZH-trans: add 2015-03-00-Weekly-Kubernetes-Community-Hangout.md * Update 2015-03-00-Weekly-Kubernetes-Community-Hangout.md * ZH-trans: add 2015-04-00-Kubernetes-Release-0150.md (#13130) * ZH-trans: add 2015-04-00-Kubernetes-Release-0150.md * Update 2015-04-00-Kubernetes-Release-0150.md * ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md (#13132) * ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_29.md (#13147) * ZH-trans: add 2015-05-00-Weekly-Kubernetes-Community-Hangout.md (#13148) * ZH-trans: add flannel_multi_node_cluster.md (#13195) * ZH-trans: add flannel_multi_node_cluster.md * Update flannel_multi_node_cluster.md * Update flannel_multi_node_cluster.md * zh-trans: add docs/reference/command-line-tools-reference/kubelet-authentication-authorization.md (#13200) * zh-trans: add docs/reference/command-line-tools-reference/kubelet-authentication-authorization.md * Update kubelet-authentication-authorization.md * zh-trans: /docs/tasks/administer-cluster/out-of-resource.md (#12879) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * . * . * zh-trans: update docs/setup/node-conformance.md (#13201) * zh-trans: update docs/setup/node-conformance.md * zh-trans: update docs/setup/on-premises-vm/dcos.md * zh-trans: add content/zh/blog/_posts/2018-10-15-steering-election-results.md (#13227) * zh-trans: add content/zh/blog/_posts/2018-10-15-steering-election-results.md * Update content/zh/blog/_posts/2018-10-15-steering-election-results.md Co-Authored-By: SataQiu <1527062125@qq.com> * Add @xichengliudui to sig-docs-zh-owners (release-1.12) (#13167) * Add @xichengliudui to sig-docs-zh-owners * Update OWNERS_ALIASES * ZH-trans: add coreos.md (#13193) * ZH-trans: coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * add SataQiu as a sig-docs-zh-owner (#13271) * Fix relative links issue in zh content (#13312) * `http://kubernetes.io/docs/` -> `/docs/` * `https://kubernetes.io/docs/` -> `/docs/` * zh-trans: add docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md (#13194) * zh-trans: add docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md * Update content/zh/docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update kubeadm-upgrade.md * ZH-trans: add kubeadm-upgrade-ha-1-12.md (#13306) * ZH-trans: add kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update config.toml (#13408) * zh-trans: add content/zh/blog/_posts/2018-11-08-kubernetes-docs-update-i18n.md (#13221) * zh-trans: add content/zh/docs/reference/kubernetes-api/labels-annotations-taints.md (#13236) * zh-trans: add content/zh/blog/_posts/2018-10-16-kubernetes-2018-north-american-contributor-summit.md (#13274) * zh-trans: add content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md (#13268) * zh-trans: add content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md * Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md * ZH-trans: add 2017-10-00-Five-Days-Of-Kubernetes-18.md (#13427) * ZH-trans: add 2017-10-00-Five-Days-Of-Kubernetes-18.md * Update 2017-10-00-Five-Days-Of-Kubernetes-18.md * zh-trans: add content/zh/docs/tasks/administer-federation/daemonset.md (#13239) * message * more message * remove data.json * ZH-trans: add aws.md (#13276) * ZH-trans: add aws.md * Update aws.md * Update aws.md * ZH-trans: add cluster-interactive.html (#13479) * ZH-trans: add cluster-interactive.html * Update cluster-interactive.html * ZH-trans: add update-intro.html (#13480) * Create update-intro.html * Update update-intro.html * Update update-intro.html * Update update-intro.html * Update update-intro.html * Update update-intro.html * ZH-trans: add README.md (#13235) * ZH-trans: add vendoring * Update README.md * zh: docs/cocepts/cluster-administration/logging.md (#13541) * zh: docs/cocepts/cluster-administration/logging.md * Update logging.md * zh-trans: update docker-cli-to-kubectl.md (#13591) * Update docker-cli-to-kubectl.md * Update docker-cli-to-kubectl.md * zh-trans: update advanced.md (#13592) * ZH-trans: add 2017-11-00-Autoscaling-In-Kubernetes.md (#13424) * ZH-trans: add 2017-11-00-Autoscaling-In-Kubernetes.md * Update 2017-11-00-Autoscaling-In-Kubernetes.md * ZH-trans: add fedora_manual_config.md (#13439) * ZH-trans: add fedora_manual_config.md * Update fedora_manual_config.md * zh-trans: content/zh/docs/concepts/overview/working-with-objects/labe… (#12277) * zh-trans: content/zh/docs/concepts/overview/working-with-objects/labels.md * update trans * update trans * zh: docs/contribute/start.md trans (#13632) * zh：docs/contribute/start.md trans * Update start.md * Update start.md * Update start.md * Update start.md * Update content/zh/docs/contribute/start.md Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com> * Update content/zh/docs/contribute/start.md Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com> * Update content/zh/docs/contribute/start.md Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com> * zh-trans: update docs/reference/setup-tools/kubefed (#13729) * Update 2017-10-00-Five-Days-Of-Kubernetes-18.md (#13472) * zh-trans: add configure-multiple-schedulers.md (#13492) * zh-trans: add configure-multiple-schedulers.md * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update configure-multiple-schedulers.md * Update configure-multiple-schedulers.md * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update configure-multiple-schedulers.md * zh-trans: add docs/tasks/configure-pod-container/share-process-namespace.md (#13551) * zh-trans: add docs/tasks/configure-pod-container/share-process-namespace.md * Update share-process-namespace.md * zh-trans: update docs/admin/accessing-the-api.md (#13744) * zh-trans: add content/zh/blog/_posts/2018-10-11-topology-aware-volume-provisioning.md (#13303) * ZH-trans: add 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md (#13241) * ZH-trans: add 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md * Update 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md * Update 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md * ZH-trans: add 2016-07-00-Citrix-Netscaler-And-Kubernetes.md (#13242) * ZH-trans: add 2016-07-00-Citrix-Netscaler-And-Kubernetes.md * Update 2016-07-00-Citrix-Netscaler-And-Kubernetes.md * Update 2016-07-00-Citrix-Netscaler-And-Kubernetes.md * zh-trans: update docs/admin/bootstrap-tokens.md (#13770) * zh-trans: update content/zh/docs/admin/cluster-large.md (#13771) * zh-trans: update content/zh/docs/admin/kube-apiserver.md (#13774) * zh-trans: update content/zh/docs/admin/kube-apiserver.md * Update kube-apiserver.md * Update content/zh/docs/admin/kube-apiserver.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/admin/multiple-zones.md (#13775) * zh-trans: update content/zh/docs/admin/multiple-zones.md * Update multiple-zones.md * zh-trans: update node-conformance.md and ovs-networking.md (#13776) * zh-trans: update high-availability/_index.md and authorization/webhook.md (#13780) * zh-trans: update content/zh/docs/admin/authorization/_index.md (#13779) * zh-trans: update content/zh/docs/admin/authorization/_index.md * Update _index.md * Update content/zh/docs/admin/authorization/_index.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/admin/authorization/_index.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/admin/authorization/_index.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/admin/authorization/abac.md (#13777) * zh-trans: update content/zh/docs/admin/authorization/abac.md * Update content/zh/docs/admin/authorization/abac.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update abac.md * zh-trans: update content/zh/docs/admin/service-accounts-admin.md (#13778) * zh-trans: update content/zh/docs/admin/service-accounts-admin.md * Update content/zh/docs/admin/service-accounts-admin.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/concepts/architecture (#13797) * ZH-trans: add cluster.md (#13500) * ZH-trans: add cluster.md * Update cluster.md * Update cluster.md * Update cluster.md * zh-trans: update docs/concepts/cluster-administration (#13825) * Exclude content-en changes in the PR * Exclude content/ko changes in the PR * Exclude OWNERS_ALIASES change in the PR * rm kubeadm/generated/README.md to fix the build * Remove generated sass assets
This commit is contained in:
chenrui
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
d437c2e5e5
commit
577b431931
@@ -16,63 +16,62 @@ content_template: templates/concept
|
||||
|
||||
{{% capture body %}}
|
||||
|
||||
在 Kubernetes 里，您必须经过身份验证(登录)，才能授权您的请求(授予访问权限).。有关认证的信息，请参阅[访问控制概述](/docs/admin/access-the-api/)。
|
||||
在 Kubernetes 里，您必须经过身份验证 ( 登录 )，才能授权您的请求 ( 授予访问权限 ).。有关认证的信息，请参阅[访问控制概述](/docs/admin/access-the-api/)。
|
||||
|
||||
Kubernetes 提供通用的 REST API 请求。这意味着 Kubernetes 授权可以与现有的组织或云提供商的访问控制系统一起使用，该系统可以处理除 Kubernetes API 之外的其他 API。
|
||||
|
||||
## 确定请求是允许还是被拒绝
|
||||
Kubernetes 使用 API 服务器授权 API 请求。它根据所有策略评估所有请求属性，并允许或拒绝请求。某些策略必须允许 API 请求的所有部分继续进行，这意味着默认情况下是拒绝权限。
|
||||
Kubernetes 使用 API 服务器授权 API 请求。它根据所有策略评估所有请求属性，并允许或拒绝请求。某些策略必须允许 API 请求的所有部分继续进行，这意味着默认情况下是拒绝权限。
|
||||
|
||||
(虽然 Kubernetes 使用 API 服务器，访问控制和依赖特定类型对象的特定领域策略由 Admission 控制器处理。)
|
||||
( 虽然 Kubernetes 使用 API 服务器，访问控制和依赖特定类型对象的特定领域策略由 Admission 控制器处理。)
|
||||
|
||||
当配置多个授权模块时，按顺序检查每个模块，如果有任何模块授权请求，则可以继续执行该请求。如果所有模块拒绝请求，则拒绝该请求(HTTP状态代码403)。
|
||||
当配置多个授权模块时，按顺序检查每个模块，如果有任何模块授权请求，则可以继续执行该请求。如果所有模块拒绝请求，则拒绝该请求 (HTTP 状态代码 403)。
|
||||
|
||||
## 查看您的请求属性
|
||||
|
||||
Kubernetes 仅查看以下API请求属性:
|
||||
Kubernetes 仅查看以下 API 请求属性 :
|
||||
|
||||
* **user** - 验证期间提供的 `user` 字符串
|
||||
* **group** - 认证用户所属的组名列表
|
||||
* **“extra"** - 由认证层提供的任意字符串键到字符串值的映射
|
||||
* **API** - 指示请求是否用于API资源
|
||||
* **Request path** - 诸如`/api`或`/healthz`的其他非资源端点的路径(请参阅[kubectl](#kubectl)).
|
||||
* **API request verb** - API 动词 `get`，`list`，`create`，`update`，`patch`，`watch`，`proxy`，`redirect`，`delete`和`deletecollection`用于资源请求。要确定资源 API 端点的请求动词，请参阅**确定下面的请求动词**.
|
||||
* **HTTP request verb** - HTTP动词`get`，`post`，`put`和`delete`用于非资源请求
|
||||
* **Resource** - 正在访问的资源的ID或名称(仅适用于资源请求)
|
||||
--* 对于使用`get`, `update`, `patch`, 和 `delete`动词的资源请求，您必须提供资源名称。
|
||||
* **Subresource** - 正在访问的子资源(仅用于资源请求)
|
||||
* **Namespace** - 正在被访问的对象的命名空间(仅针对命名空间的资源请求)
|
||||
* **API group** - 正在访问的API组(仅用于资源请求). 一个空字符串指定[核心 API 组](/docs/api/).
|
||||
* **extra** - 由认证层提供的任意字符串键到字符串值的映射
|
||||
* **API** - 指示请求是否用于 API 资源
|
||||
* **Request path** - 诸如 `/api` 或 `/healthz` 的其他非资源端点的路径 ( 请参阅[kubectl](#kubectl)).
|
||||
* **API request verb** - API 动词 `get`，`list`，`create`，`update`，`patch`，`watch`，`proxy`，`redirect`，`delete` 和 `deletecollection` 用于资源请求。要确定资源 API 端点的请求动词，请参阅**确定下面的请求动词**.
|
||||
* **HTTP request verb** - HTTP 动词 `get`，`post`，`put` 和 `delete` 用于非资源请求
|
||||
* **Resource** - 正在访问的资源的 ID 或名称 ( 仅适用于资源请求 )，对于使用 `get`, `update`, `patch`, 和 `delete` 动词的资源请求，您必须提供资源名称。
|
||||
* **Subresource** - 正在访问的子资源 ( 仅用于资源请求 )
|
||||
* **Namespace** - 正在被访问的对象的命名空间 ( 仅针对命名空间的资源请求 )
|
||||
* **API group** - 正在访问的 API 组 ( 仅用于资源请求 ). 一个空字符串指定[核心 API 组](/docs/api/).
|
||||
|
||||
## 确定请求动词
|
||||
|
||||
要确定资源 API 端点的请求动词，请查看所使用的HTTP动词以及请求是否对单个资源或资源集合进行操作:
|
||||
要确定资源 API 端点的请求动词，请查看所使用的 HTTP 动词以及请求是否对单个资源或资源集合进行操作 :
|
||||
|
||||
HTTP动词| 请求动词
|
||||
HTTP 动词 | 请求动词
|
||||
---------- | ---------------
|
||||
POST | 创建
|
||||
GET，HEAD | 获取(个人资源)，列表(集合)
|
||||
GET，HEAD | 获取 ( 个人资源 )，列表 ( 集合 )
|
||||
PUT | 更新
|
||||
PATCH | 补丁
|
||||
DELETE| 删除(个人资源)，删除(收藏)
|
||||
DELETE| 删除 ( 个人资源 )，删除 ( 收藏 )
|
||||
|
||||
Kubernetes 有时会使用专门的动词检查授权以获得额外的权限。例如:
|
||||
Kubernetes 有时会使用专门的动词检查授权以获得额外的权限。例如 :
|
||||
|
||||
* [PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/)在`extensions` API组中的`podsecuritypolicies`资源上检查`use`动词的授权。
|
||||
* [RBAC](/docs/admin/authorization/rbac/#privilege-escalation-prevention-and-bootstrapping) 在`rbac.authorization.k8s.io` API组中的`roles`和`clusterroles`资源上检查`bind`动词的授权。
|
||||
* [认证](/docs/admin/authentication/) 在核心API组中的`users`，`groups`和`serviceaccounts`上的`impersonate`动词的授权以及`authentication.k8s.io` API组中的`userextras`进行层次检查。
|
||||
* [PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/) 在 `extensions` API 组中的 `podsecuritypolicies` 资源上检查 `use` 动词的授权。
|
||||
* [RBAC](/docs/admin/authorization/rbac/#privilege-escalation-prevention-and-bootstrapping) 在 `rbac.authorization.k8s.io` API 组中的 `roles` 和 `clusterroles` 资源上检查 `bind` 动词的授权。
|
||||
* [认证](/docs/admin/authentication/) 在核心 API 组中的 `users`，`groups` 和 `serviceaccounts` 上的 `impersonate` 动词的授权以及 `authentication.k8s.io` API 组中的 `userextras` 进行层次检查。
|
||||
|
||||
## 授权模块
|
||||
* **ABAC模式** - 基于属性的访问控制(ABAC)定义了访问控制范例，通过使用将属性组合在一起的策略来授予用户访问权限。策略可以使用任何类型的属性(用户属性，资源属性，对象，环境属性等)。要了解有关使用ABAC模式的更多信息，请参阅[ABAC模式](/docs/admin/authorization/abac/)
|
||||
* **RBAC模式** - 基于角色的访问控制(RBAC)是一种根据企业内个人用户的角色来调整对计算机或网络资源的访问的方法。在这种情况下，访问是单个用户执行特定任务(例如查看，创建或修改文件)的能力。要了解有关使用RBAC模式的更多信息，请参阅[RBAC模式](/docs/admin/authorization/rbac/)
|
||||
*当指定 "RBAC"(基于角色的访问控制)使用 "rbac.authorization.k8s.io" API组来驱动授权决定时，允许管理员通过Kubernetes API动态配置权限策略.
|
||||
.. *截至1.6 RBAC模式是测试版.
|
||||
.. *要启用RBAC，请使用 `--authorization-mode=RBAC` 启动 apiserver.
|
||||
* **Webhook模式** - WebHook 是HTTP回调:发生事件时发生的HTTP POST; 通过HTTP POST简单的事件通知. 实施 WebHooks 的 Web 应用程序将在某些事情发生时向URL发送消息. 要了解有关使用Webhook模式的更多信息，请参阅[Webhook模式](/docs/admin/authorization/webhook/)
|
||||
* **自定义模块** - 您可以创建使用Kubernetes的自定义模块. 要了解更多信息，请参阅下面的**自定义模块**。
|
||||
* **ABAC 模式** - 基于属性的访问控制 (ABAC) 定义了访问控制范例，通过使用将属性组合在一起的策略来授予用户访问权限。策略可以使用任何类型的属性 ( 用户属性，资源属性，对象，环境属性等 )。要了解有关使用 ABAC 模式的更多信息，请参阅 [ABAC 模式](/docs/admin/authorization/abac/)
|
||||
* **RBAC 模式** - 基于角色的访问控制 (RBAC) 是一种根据企业内个人用户的角色来调整对计算机或网络资源的访问的方法。在这种情况下，访问是单个用户执行特定任务 ( 例如查看，创建或修改文件 ) 的能力。要了解有关使用 RBAC 模式的更多信息，请参阅 [RBAC 模式](/docs/admin/authorization/rbac/)
|
||||
*当指定 "RBAC"( 基于角色的访问控制 ) 使用 "rbac.authorization.k8s.io" API 组来驱动授权决定时，允许管理员通过 Kubernetes API 动态配置权限策略 .
|
||||
.. *截至 1.6 RBAC 模式是测试版 .
|
||||
.. *要启用 RBAC，请使用 `--authorization-mode=RBAC` 启动 apiserver.
|
||||
* **Webhook 模式** - WebHook 是 HTTP 回调 : 发生事件时发生的 HTTP POST; 通过 HTTP POST 简单的事件通知 . 实施 WebHooks 的 Web 应用程序将在某些事情发生时向 URL 发送消息 . 要了解有关使用 Webhook 模式的更多信息，请参阅[Webhook 模式](/docs/admin/authorization/webhook/)
|
||||
* **自定义模块** - 您可以创建使用 Kubernetes 的自定义模块 . 要了解更多信息，请参阅下面的**自定义模块**。
|
||||
|
||||
### 自定义模块
|
||||
可以相当容易地开发其他实现,APIserver 调用 Authorizer 接口：
|
||||
可以相当容易地开发其他实现 ,APIserver 调用 Authorizer 接口：
|
||||
|
||||
```go
|
||||
type Authorizer interface {
|
||||
@@ -80,15 +79,15 @@ type Authorizer interface {
|
||||
}
|
||||
```
|
||||
|
||||
以确定是否允许每个API操作.
|
||||
以确定是否允许每个 API 操作 .
|
||||
|
||||
授权插件是实现此接口的模块.授权插件代码位于 `pkg/auth/authorizer/$MODULENAME` 中。
|
||||
授权插件是实现此接口的模块 . 授权插件代码位于 `pkg/auth/authorizer/$MODULENAME` 中。
|
||||
|
||||
授权模块可以完全实现，也可以拨出远程授权服务。 授权模块可以实现自己的缓存，以减少具有相同或相似参数的重复授权调用的成本。 开发人员应该考虑缓存和撤销权限之间的交互。
|
||||
|
||||
#### 检查API访问
|
||||
#### 检查 API 访问
|
||||
|
||||
Kubernetes 将 `subjectaccessreviews.v1.authorization.k8s.io` 资源公开为允许外部访问API授权者决策的普通资源。 无论您选择使用哪个授权器，您都可以使用`SubjectAccessReview`发出一个`POST`，就像webhook授权器的`apis/authorization.k8s.io/v1/subjectaccessreviews` 端点一样，并回复一个响应。 例如：
|
||||
Kubernetes 将 `subjectaccessreviews.v1.authorization.k8s.io` 资源公开为允许外部访问 API 授权者决策的普通资源。 无论您选择使用哪个授权器，您都可以使用 `SubjectAccessReview` 发出一个 `POST`，就像 webhook 授权器的 `apis/authorization.k8s.io/v1/subjectaccessreviews` 端点一样，并回复一个响应。 例如：
|
||||
|
||||
|
||||
```bash
|
||||
@@ -128,16 +127,16 @@ subjectaccessreview "" created
|
||||
|
||||
## 为您的授权模块使用标志
|
||||
|
||||
您的策略中必须包含一个标志，以指出您的策略包含哪个授权模块:
|
||||
您的策略中必须包含一个标志，以指出您的策略包含哪个授权模块 :
|
||||
|
||||
可以使用以下标志:
|
||||
- `--authorization-mode=ABAC` 基于属性的访问控制(ABAC)模式允许您使用本地文件配置策略。
|
||||
- `--authorization-mode=RBAC` 基于角色的访问控制(RBAC)模式允许您使用Kubernetes API创建和存储策略.
|
||||
- `--authorization-mode=Webhook` WebHook是一种HTTP回调模式，允许您使用远程REST管理授权。
|
||||
- `--authorization-mode=AlwaysDeny` 此标志阻止所有请求. 仅使用此标志进行测试。
|
||||
- `--authorization-mode=AlwaysAllow` 此标志允许所有请求. 只有在您不需要API请求授权的情况下才能使用此标志。
|
||||
可以使用以下标志 :
|
||||
- `--authorization-mode=ABAC` 基于属性的访问控制 (ABAC) 模式允许您使用本地文件配置策略。
|
||||
- `--authorization-mode=RBAC` 基于角色的访问控制 (RBAC) 模式允许您使用 Kubernetes API 创建和存储策略 .
|
||||
- `--authorization-mode=Webhook` WebHook 是一种 HTTP 回调模式，允许您使用远程 REST 管理授权。
|
||||
- `--authorization-mode=AlwaysDeny` 此标志阻止所有请求 . 仅使用此标志进行测试。
|
||||
- `--authorization-mode=AlwaysAllow` 此标志允许所有请求 . 只有在您不需要 API 请求授权的情况下才能使用此标志。
|
||||
|
||||
您可以选择多个授权模块. 如果其中一种模式为 `AlwaysAllow`，则覆盖其他模式，并允许所有API请求。
|
||||
您可以选择多个授权模块，如果其中一种模式为 `AlwaysAllow`，则覆盖其他模式，并允许所有 API 请求。
|
||||
|
||||
## 版本控制
|
||||
|
||||
|
||||
@@ -20,36 +20,36 @@ content_template: templates/concept
|
||||
|
||||
基于 `ABAC` 模式，可以这样指定策略文件 `--authorization-policy-file=SOME_FILENAME`。
|
||||
|
||||
此文件是 JSON 格式[每行都是一个JSON对象](http://jsonlines.org/)，不应存在封闭的列表或映射，每行只有一个映射。
|
||||
此文件是 JSON 格式[每行都是一个 JSON 对象](http://jsonlines.org/)，不应存在封闭的列表或映射，每行只有一个映射。
|
||||
|
||||
每一行都是一个 "策略对象"，策略对象是具有以下映射的属性:
|
||||
每一行都是一个 " 策略对象 "，策略对象是具有以下映射的属性 :
|
||||
|
||||
- 版本控制属性:
|
||||
- `apiVersion`，字符串类型: 有效值为"abac.authorization.kubernetes.io/v1beta1"，允许版本控制和转换策略格式。
|
||||
- `kind`，字符串类型: 有效值为 "Policy"，允许版本控制和转换策略格式。
|
||||
- `spec` 配置为具有以下映射的属性:
|
||||
- 匹配属性:
|
||||
- `user`，字符串类型; 来自 `--token-auth-file` 的用户字符串，如果你指定`user`，它必须与验证用户的用户名匹配。
|
||||
- `group`，字符串类型; 如果指定`group`，它必须与经过身份验证的用户的一个组匹配，`system:authenticated`匹配所有经过身份验证的请求。`system:unauthenticated`匹配所有未经过身份验证的请求。
|
||||
- 资源匹配属性:
|
||||
- `apiGroup`，字符串类型; 一个 API 组。
|
||||
- 例: `extensions`
|
||||
- 通配符: `*`匹配所有 API 组。
|
||||
- `namespace`，字符串类型; 一个命名空间。
|
||||
- 例如: `kube-system`
|
||||
- 通配符: `*` 匹配所有资源请求。
|
||||
- `resource`，字符串类型; 资源类型。
|
||||
- 例:`pods`
|
||||
- 通配符: `*`匹配所有资源请求。
|
||||
- 非资源匹配属性:
|
||||
- `nonResourcePath`，字符串类型; 非资源请求路径。
|
||||
- 例如:`/version`或`/apis`
|
||||
- 通配符:
|
||||
- 版本控制属性 :
|
||||
- `apiVersion`，字符串类型 : 有效值为 "abac.authorization.kubernetes.io/v1beta1"，允许版本控制和转换策略格式。
|
||||
- `kind`，字符串类型 : 有效值为 "Policy"，允许版本控制和转换策略格式。
|
||||
- `spec` 配置为具有以下映射的属性 :
|
||||
- 匹配属性 :
|
||||
- `user`，字符串类型 ; 来自 `--token-auth-file` 的用户字符串，如果你指定 `user`，它必须与验证用户的用户名匹配。
|
||||
- `group`，字符串类型 ; 如果指定 `group`，它必须与经过身份验证的用户的一个组匹配，`system:authenticated` 匹配所有经过身份验证的请求。`system:unauthenticated` 匹配所有未经过身份验证的请求。
|
||||
- 资源匹配属性 :
|
||||
- `apiGroup`，字符串类型 ; 一个 API 组。
|
||||
- 例 : `extensions`
|
||||
- 通配符 : `*` 匹配所有 API 组。
|
||||
- `namespace`，字符串类型 ; 一个命名空间。
|
||||
- 例如 : `kube-system`
|
||||
- 通配符 : `*` 匹配所有资源请求。
|
||||
- `resource`，字符串类型 ; 资源类型。
|
||||
- 例 :`pods`
|
||||
- 通配符 : `*` 匹配所有资源请求。
|
||||
- 非资源匹配属性 :
|
||||
- `nonResourcePath`，字符串类型 ; 非资源请求路径。
|
||||
- 例如 :`/version` 或 `/apis`
|
||||
- 通配符 :
|
||||
- `*` 匹配所有非资源请求。
|
||||
- `/foo/*` 匹配`/foo/`的所有子路径。
|
||||
- `/foo/*` 匹配 `/foo/` 的所有子路径。
|
||||
- `readonly`，键入 boolean，如果为 true，则表示该策略仅适用于 get，list 和 watch 操作。
|
||||
|
||||
**注意:** 未设置的属性与类型设置为零值的属性相同(例如空字符串，0、false)，然而未知的应该可读性优先。
|
||||
**注意 :** 未设置的属性与类型设置为零值的属性相同 ( 例如空字符串，0、false)，然而未知的应该可读性优先。
|
||||
|
||||
在将来，策略可能以 JSON 格式表示，并通过 REST 界面进行管理。
|
||||
|
||||
@@ -57,58 +57,58 @@ content_template: templates/concept
|
||||
|
||||
请求具有与策略对象的属性对应的属性。
|
||||
|
||||
当接收到请求时，确定属性。 未知属性设置为其类型的零值（例如: 空字符串，0，false）。
|
||||
当接收到请求时，确定属性。 未知属性设置为其类型的零值（例如 : 空字符串，0，false）。
|
||||
|
||||
设置为`“*"`的属性将匹配相应属性的任何值。
|
||||
设置为 `"*"` 的属性将匹配相应属性的任何值。
|
||||
|
||||
检查属性的元组，以匹配策略文件中的每个策略。 如果至少有一行匹配请求属性，则请求被授权（但可能会在稍后验证失败）。
|
||||
|
||||
要允许任何经过身份验证的用户执行某些操作，请将策略组属性设置为 `"system:authenticated“`。
|
||||
要允许任何经过身份验证的用户执行某些操作，请将策略组属性设置为 `"system:authenticated"`。
|
||||
|
||||
要允许任何未经身份验证的用户执行某些操作，请将策略组属性设置为`"system:authentication“`。
|
||||
要允许任何未经身份验证的用户执行某些操作，请将策略组属性设置为 `"system:authentication"`。
|
||||
|
||||
要允许用户执行任何操作，请使用 apiGroup，命名空间，
|
||||
资源和 nonResourcePath 属性设置为 `“*"`的策略.
|
||||
资源和 nonResourcePath 属性设置为 `"*"` 的策略。
|
||||
|
||||
要允许用户执行任何操作，请使用设置为`“*”` 的 apiGroup，namespace，resource 和 nonResourcePath 属性编写策略。
|
||||
要允许用户执行任何操作，请使用设置为 `"*"` 的 apiGroup，namespace，resource 和 nonResourcePath 属性编写策略。
|
||||
|
||||
## Kubectl
|
||||
|
||||
Kubectl 使用 api-server 的 `/api` 和 `/apis` 端点进行协商客户端/服务器版本。 通过创建/更新来验证发送到API的对象操作，kubectl 查询某些 swagger 资源。 对于API版本"v1", 那就是`/swaggerapi/api/v1` ＆ `/swaggerapi/ experimental/v1`。
|
||||
Kubectl 使用 api-server 的 `/api` 和 `/apis` 端点进行协商客户端 / 服务器版本。 通过创建 / 更新来验证发送到 API 的对象操作，kubectl 查询某些 swagger 资源。 对于 API 版本 "v1", 那就是 `/swaggerapi/api/v1` ＆ `/swaggerapi/ experimental/v1`。
|
||||
|
||||
当使用 ABAC 授权时，这些特殊资源必须明确通过策略中的 `nonResourcePath` 属性暴露出来(参见下面的[例子](#examples)):
|
||||
当使用 ABAC 授权时，这些特殊资源必须明确通过策略中的 `nonResourcePath` 属性暴露出来 ( 参见下面的[例子](#examples)):
|
||||
|
||||
* `/api`，`/api/*`，`/apis`和`/apis/*` 用于 API 版本协商.
|
||||
* `/version` 通过 `kubectl version` 检索服务器版本.
|
||||
* `/swaggerapi/*` 用于创建/更新操作.
|
||||
* `/api`，`/api/*`，`/apis` 和 `/apis/*` 用于 API 版本协商。
|
||||
* `/version` 通过 `kubectl version` 检索服务器版本。
|
||||
* `/swaggerapi/*` 用于创建 / 更新操作。
|
||||
|
||||
要检查涉及到特定kubectl操作的HTTP调用，您可以调整详细程度：
|
||||
要检查涉及到特定 kubectl 操作的 HTTP 调用，您可以调整详细程度：
|
||||
|
||||
kubectl --v=8 version
|
||||
|
||||
## 例子
|
||||
|
||||
1. Alice 可以对所有资源做任何事情:
|
||||
1. Alice 可以对所有资源做任何事情 :
|
||||
|
||||
```json
|
||||
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "alice", "namespace": "*", "resource": "*", "apiGroup": "*"}}
|
||||
```
|
||||
2. Kubelet 可以读取任何pod:
|
||||
2. Kubelet 可以读取任何 pod:
|
||||
|
||||
```json
|
||||
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "pods", "readonly": true}}
|
||||
```
|
||||
3. Kubelet 可以读写事件:
|
||||
3. Kubelet 可以读写事件 :
|
||||
|
||||
```json
|
||||
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "events"}}
|
||||
```
|
||||
4. Bob 可以在命名空间“projectCaribou"中读取 pod:
|
||||
4. Bob 可以在命名空间 “projectCaribou” 中读取 pod：
|
||||
|
||||
```json
|
||||
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "bob", "namespace": "projectCaribou", "resource": "pods", "readonly": true}}
|
||||
```
|
||||
5. 任何人都可以对所有非资源路径进行只读请求:
|
||||
5. 任何人都可以对所有非资源路径进行只读请求：
|
||||
|
||||
```json
|
||||
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:authenticated", "readonly": true, "nonResourcePath": "*"}}
|
||||
@@ -119,7 +119,7 @@ Kubectl 使用 api-server 的 `/api` 和 `/apis` 端点进行协商客户端/服
|
||||
|
||||
## 服务帐户的快速说明
|
||||
|
||||
服务帐户自动生成用户。 用户名是根据命名约定生成的:
|
||||
服务帐户自动生成用户。 用户名是根据命名约定生成的：
|
||||
|
||||
```shell
|
||||
system:serviceaccount:<namespace>:<serviceaccountname>
|
||||
@@ -130,13 +130,13 @@ system:serviceaccount:<namespace>:<serviceaccountname>
|
||||
system:serviceaccount:<namespace>:default
|
||||
```
|
||||
|
||||
例如，如果要将 API 的 kube-system 完整权限中的默认服务帐户授予，则可以将此行添加到策略文件中:
|
||||
例如，如果要将 API 的 kube-system 完整权限中的默认服务帐户授予，则可以将此行添加到策略文件中 :
|
||||
|
||||
```json
|
||||
{"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"system:serviceaccount:kube-system:default","namespace":"*","resource":"*","apiGroup":"*"}}
|
||||
```
|
||||
|
||||
需要重新启动 apiserver 以获取新的策略行.
|
||||
需要重新启动 apiserver 以获取新的策略行。
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
@@ -29,10 +29,10 @@ WebHook 是一种 HTTP 回调：某些条件下触发的 HTTP POST 请求；通
|
||||
clusters:
|
||||
- name: name-of-remote-authz-service
|
||||
cluster:
|
||||
certificate-authority: /path/to/ca.pem # 对远程服务进行身份认证的CA。
|
||||
certificate-authority: /path/to/ca.pem # 对远程服务进行身份认证的 CA。
|
||||
server: https://authz.example.com/authorize # 远程服务的查询 URL. 必须使用 'https'。
|
||||
|
||||
# users 代表 API 服务器的 webhook 配置.
|
||||
# users 代表 API 服务器的 webhook 配置 .
|
||||
users:
|
||||
- name: name-of-api-server
|
||||
user:
|
||||
@@ -55,7 +55,7 @@ contexts:
|
||||
|
||||
需要注意的是 webhook API 对象与其他 Kubernetes API 对象一样都同样都服从 [版本兼容规则](/docs/api/) 。
|
||||
实施人员应该了解 beta 对象的更宽松的兼容性承诺，同时确认请求的 "apiVersion" 字段以确保能被正确地反序列化。
|
||||
此外，API 服务器还必须启用 `authorization.k8s.io/v1beta1` API 扩展组(`--runtime-config=authorization.k8s.io/v1beta1=true`)。
|
||||
此外，API 服务器还必须启用 `authorization.k8s.io/v1beta1` API 扩展组 (`--runtime-config=authorization.k8s.io/v1beta1=true`)。
|
||||
|
||||
|
||||
一个请求内容的例子：
|
||||
|
||||
Reference in New Issue
Block a user