whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge release 1.12 into release 1.13 (#14171)

Browse Source 
* ZH-trans: Update coarse-parallel-processing-work-queue.md (#11862)

* ZH-trans: Update coarse-parallel-processing-work-queue.md

* Update coarse-parallel-processing-work-queue.md

* zh-trans: add /docs/concepts/architecture/cloud-controller.md (#11799)

* docs/concepts/architecture/cloud-controller.md

* docs/concepts/architecture/cloud-controller.md

* docs/concepts/architecture/cloud-controller.md

* fix

* fix

* fix

* zh-trans: /docs/contribute/style/kubernetes-components.md (#11838)

Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn>

zh-trans: /docs/contribute/generate-ref-docs/kubernetes-components.md; update

Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn>

* Update weave-network-policy.md (#11858)

* ZH-trans: add Update define-environment-variable-container.md (#11859)

* Update define-environment-variable-container.md

* Update define-environment-variable-container.md

* Update define-environment-variable-container.md

* Update define-environment-variable-container.md

* Update define-environment-variable-container.md

* Update fine-parallel-processing-work-queue.md (#11863)

* Update fine-parallel-processing-work-queue.md

* Update fine-parallel-processing-work-queue.md

* Update setup-extension-api-server.md (#11864)

* zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md (#11798)

* zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md

zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md

* Update kubeadm-join.md

* Create kubeadm_join.md

* zh-trans: update docs/concepts/containers/images.md (#11877)

* zh-trans: update docs/concepts/containers/images.md

* zh-trans: update docs/concepts/containers/images.md

* Update kubeadm_alpha_phase_controlplane.md (#11878)

* 更新第 115 行翻译

* zh_trans: kubeadm_token_generate.md (#11884)

* zh_trans: kubeadm_token_generate.md

zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_token_generate.md

* Better translation  

Better translation
 

* zh-trans: add /docs/tasks/configure-pod-container/configure-pod-initialization.md (#11886)

zh-trans: add /docs/tasks/configure-pod-container/configure-pod-initialization.md

* zh-trans:add content/zh/docs/reference/issues-security (#11890)

* zh-trans: add content/zh/docs/tutorials/online-training/overview.md (#11892)

* zh_trans: kubeadm_token_delete.md (#11883)

* zh_trans: kubeadm_token_delete.md

zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_token_create.md

* fix tpye error

fix tpye error

*  Better translation  

Better translation

* zh_trans: independent/create-cluster-kubeadm.md (#11882)

* zh_trans: independent/create-cluster-kubeadm.md

zh_trans: docs/setup/independent/create-cluster-kubeadm.md

* fix word style error

* fix type error

* better zhtran

better zhtran

* fix "Create" -> "create"

fix "Create" -> "create"

* zh-trans: add docs⁩/concept⁨s/storage/storage-classes.md (#11788)

* ZH-trans: fixing formatting errors (#11661)

* ZH-trans: fixing formatting errors

* Update ZH-trans: fixing formatting errors

storage-classes zh part 1

* storage-classes zh trans

* fix typo

update trans for provisioner & fix typo

* fix typo

* 根据校对更新翻译

* zh_trans: kubeadm-token.md (#11898)

zh_trans: /docs/reference/setup-tools/kubeadm/kubeadm-token.md

* zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md (#11900)

* zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md

zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md

* Update quality-service-pod.md

* zh_trans: kubeadm_alpha_phase_bootstrap-token_node.md (#11897)

zh_trans: Path：/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node.md

* zh-trans: add /docs/concepts/storage/volumes.md (#11767)

* zh-trans: add /docs/concepts/storage/volumes.md

zh-trans: add /docs/concepts/storage/volumes.md

* Update volumes.md

* Update volumes.md

* self-review

* Update volumes.md

* fix docs format error (#11934)

fix docs format error of https://v1-12.docs.kubernetes.io/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/

* Update cloud-controller.md (#11922)

* zh-trans: /docs/reference/glossary/approver.md (#11924)

zh-trans: /docs/reference/glossary/approver.md

* zh-trans: add docs/setup/on-premises-vm/dcos.md (#11891)

* zh-trans: add docs/setup/on-premises-vm/dcos.md

* Update content/zh/docs/setup/on-premises-vm/dcos.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* zh-trans: /docs/tasks/configure-pod-container/configure-persistent-vo… (#11915)

* zh-trans: /docs/tasks/configure-pod-container/configure-persistent-volume-storage.md

zh-trans: /docs/tasks/configure-pod-container/configure-persistent-volume-storage.md

* Update configure-persistent-volume-storage.md

* zh_trans: kubeadm_alpha.md (#11902)

* zh_trans: kubeadm_alpha.md

zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha.md

* Better translation

Better translation

* zh-trans: /docs/reference/glossary/downstream.md (#11931)

* zh-trans: /docs/reference/glossary/downstream.md

zh-trans: /docs/reference/glossary/downstream.md

* Update downstream.md

* Update downstream.md

* ZH-trans: Update install-kubeadm.md (#11955)

* fix typo of install-kubeadm.md

fix typo of install-kubeadm.md

* Update install-kubeadm.md

* zh-trans: add kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md (#11952)

* zh-trans: add /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md

zh-trans: add /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md

* Update kubeadm_alpha_phase_certs_renew_all.md

* renew 的翻译更新为续期

* zh-trans:kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md (#11953)

* zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md

/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md

* Update kubeadm_alpha_phase_certs_renew_etcd-peer.md

* zh-trans: /docs/contribute/generate-ref-docs/kubectl.md (#11941)

Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn>

* fix docs format error (#11936)

fix docs format error of https://v1-12.docs.kubernetes.io/zh/docs/reference/setup-tools/kubeadm/kubeadm-config/

* Update pull request (#11921)

* Update pull request (#11960)

* ZH-trans: add kubefed-options.md (#11956)

* Update ZH-trans: add kubefed-options.md

* Update kubefed-options.md

* ZH-trans: add generated/... (#11880)

* Update pull request

* Update kubeadm_alpha_phase_certs_renew.md

* Update pull request (#11881)

* ZH-trans: add generated/... (#11879)

* Update pull request

* Resolving file conflicts

* zh-trans: add zh/ docs/tasks/configure-pod-container/configure-servic… (#11889)

* zh-trans: add zh/ docs/tasks/configure-pod-container/configure-service-account.md

zh-trans: add zh/ docs/tasks/configure-pod-container/configure-service-account.md

* Update configure-service-account.md

* Update configure-service-account.md

* zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md (#11875)

* zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md

* zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md

* zh-trans:update kubelet-garbage-collection.md

* zh_trans: kubeadm_alpha_phase_kubeconfig_user.md (#11901)

* zh_trans: kubeadm_alpha_phase_kubeconfig_user.md

zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_user.md

* Better translation

* zh-trans:add docs/reference/using-api/client-libraries.md (#11958)

* zh-trans:add docs/reference/using-api/client-libraries.md

* Update content/zh/docs/reference/using-api/client-libraries.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* zh-trans: add pull-image-private-registry.md (#11912)

* zh-trans: add pull-image-private-registry.md

zh-trans: add pull-image-private-registry.md

* Update pull-image-private-registry.md

* Update pull-image-private-registry.md

* ZH-trans: add kubeadm_alpha_phase_kubelet_config_annotate-cri.md (#11972)

* Create kubeadm_alpha_phase_kubelet_config_annotate-cri.md

* Update kubeadm_alpha_phase_kubelet_config_annotate-cri.md

* ZH-trans: add kubeadm_alpha_phase_kubelet_config.md (#11974)

* Create kubeadm_alpha_phase_kubelet_config.md

* Update kubeadm_alpha_phase_kubelet_config.md

* fix Typo "##" -> "## " (#12011)

* fix Typo "##" -> "## "

fix Typo "##" -> "## "

* update basic-stateful-set.md

* fix web style error (#12010)

fix web style error

* Create kubeadm_alpha_phase_selfhosting.md (#12006)

* Create kubeadm_alpha_phase_controlplane_apiserver.md (#12005)

* zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitor… (#11995)

* zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitoring.md

zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitoring.md

* Update resource-usage-monitoring.md

* Update resource-usage-monitoring.md

* zh-trans:/docs/tasks/debug-application-cluster/core-metrics-pipeline.md (#11990)

zh-trans:/docs/tasks/debug-application-cluster/core-metrics-pipeline.md

* zh-trans:/docs/tasks/debug-application-cluster/troubleshooting.md (#11989)

zh-trans:/docs/tasks/debug-application-cluster/troubleshooting.md

* Create kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md (#11969)

* Create kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md

* Update kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md

* zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md (#11962)

* zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md

zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md

* Update debug-init-containers.md

* zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md (#11930)

* zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md

zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md

* Update horizontal-pod-autoscaler.md

* zh-trans: add /docs/tasks/configure-pod-container/configure-projected… (#11911)

* zh-trans: add /docs/tasks/configure-pod-container/configure-projected-volume-storage.md

zh-trans: add /docs/tasks/configure-pod-container/configure-projected-volume-storage.md

* Update configure-projected-volume-storage.md

* Update configure-projected-volume-storage.md

* zh-trans: /docs/tasks/configure-pod-container/extended-resource.md (#11918)

* zh-trans: /docs/tasks/configure-pod-container/extended-resource.md

zh-trans: /docs/tasks/configure-pod-container/extended-resource.md

* Update extended-resource.md

* Update extended-resource.md

* zh-trans: add translate-compose-kubernetes.md (#11910)

* zh-trans: add translate-compose-kubernetes.md

zh-trans: add translate-compose-kubernetes.md

* Update translate-compose-kubernetes.md

* Update translate-compose-kubernetes.md

* Update translate-compose-kubernetes.md

* Update translate-compose-kubernetes.md

* Update translate-compose-kubernetes.md

* Update translate-compose-kubernetes.md

* zh-trans: zh/docs/reference/glossary/flexvolume.md (#11925)

* zh-trans: zh/docs/reference/glossary/flexvolume.md

zh-trans: zh/docs/reference/glossary/flexvolume.md

* Update flexvolume.md

* zh_trans: kubeadm_alpha_phase_bootstrap-token_create.md (#11947)

* zh_trans: kubeadm_alpha_phase_bootstrap-token_create.md

zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_create.md

* better translation  

better translation  

* zh-trans:add docs/setup/turnkey/alibaba-cloud.md (#11959)

* zh_trans: kubeadm_completion.md (#11895)

* zh_trans: kubeadm_completion.md

zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node.md

* Better translation  

Better translation

* Update kubeadm_completion.md

* better translation

better translation

* zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md (#11961)

* zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md

zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md

* Update crictl.md

* ZH-trans: add kubeadm_alpha_phase_certs_front-proxy-ca.md (#11968)

* ZH-trans: add kubeadm_alpha_phase_controlplane_all.md (#11970)

* Create kubeadm_alpha_phase_controlplane_all.md

* Update kubeadm_alpha_phase_controlplane_all.md

* Update kubeadm_alpha_phase_controlplane_all.md

* Update kubeadm_alpha_phase_controlplane_all.md

* ZH-trans: add kubeadm_alpha_phase_upload-config.md (#11971)

* Create kubeadm_alpha_phase_upload-config.md

* Update kubeadm_alpha_phase_upload-config.md

* Update kubeadm_alpha_phase_upload-config.md

* ZH-trans: Fixed some incorrect translations (#11973)

* zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-… (#11977)

* zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-failure.md

zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-failure.md

* Update determine-reason-pod-failure.md

* zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md (#11988)

* zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md

zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md

* Update local-debugging.md

* zh-trans:/docs/tasks/debug-application-cluster/events-stackdriver.md (#11996)

zh-trans:/docs/tasks/debug-application-cluster/events-stackdriver.md

* zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-cont… (#11998)

* zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-container.md

zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-container.md

* Update get-shell-running-container.md

* zh-trans:/docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md (#12001)

zh-trans:/docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md

* ZH-trans: ad kubeadm_alpha_phase_kubelet_config_write-to-disk.md (#12004)

* Create kubeadm_alpha_phase_kubelet_config_write-to-disk.md

* Update kubeadm_alpha_phase_kubelet_config_write-to-disk.md

* Remove old-generated kubefed docs (generated on 25-march-2018) (#12093)

* Update _index.md (#12061)

* Update kubeadm_reset.md (#12047)

* ZH-trasn: add kubeadm_alpha_phase_kubeconfig_controller-manager.md (#12032)

* Create kubeadm_alpha_phase_kubeconfig_controller-manager.md

* Update kubeadm_alpha_phase_kubeconfig_controller-manager.md

* ZH-trans: add kubeadm_alpha_phase_preflight_node.md (#12035)

* Create kubeadm_alpha_phase_preflight_node.md

* Update kubeadm_alpha_phase_preflight_node.md

* Update kubeadm_alpha_phase_preflight_node.md

* ZH-trans: add kubeadm_alpha_phase_controlplane_scheduler.md (#12031)

* Create kubeadm_alpha_phase_controlplane_scheduler.md

* Update kubeadm_alpha_phase_controlplane_scheduler.md

* ZH-trans: add kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md (#12039)

* Create kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md

* Update kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md

* ZH-trans: add kubeadm_alpha_phase_kubelet_write-env-file.md (#12034)

* Create kubeadm_alpha_phase_kubelet_write-env-file.md

* Update kubeadm_alpha_phase_kubelet_write-env-file.md

* ZH-trans: add kubeadm_upgrade_node_experimental-control-plane.md (#12036)

* Create kubeadm_upgrade_node_experimental-control-plane.md

* Update kubeadm_upgrade_node_experimental-control-plane.md

* Create kubeadm_alpha_phase_bootstrap-token_node_allow-auto-approve.md (#12038)

* Create kubeadm_alpha_phase_etcd.md (#12040)

* ZH-trans: add kubeadm_alpha_phase_certs_renew_etcd-server.md (#12041)

* Create kubeadm_alpha_phase_certs_renew_etcd-server.md

* Update kubeadm_alpha_phase_certs_renew_etcd-server.md

* Update advanced.md (#12044)

* ZH-trans: add kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md (#12042)

* Create kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md

* Update kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md

* Update kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md

* Update kubeadm_version.md (#12046)

* Update _index.md (#12063)

* zh-trans:/docs/reference/setup-tools/kubefed/kubefed_version.md (#12085)

zh-trans:/docs/reference/setup-tools/kubefed/kubefed_version.md

* ZH-trans: add kubeadm_alpha_phase_certs_etcd-peer.md (#12037)

* Create kubeadm_alpha_phase_certs_etcd-peer.md

* Update kubeadm_alpha_phase_certs_etcd-peer.md

* Update kubeadm_alpha_phase_certs_etcd-peer.md

* ZH-trans: add kubeadm_alpha_phase_kubelet_config_download.md (#12033)

* Create kubeadm_alpha_phase_kubelet_config_download.md

* Update kubeadm_alpha_phase_kubelet_config_download.md

* zh-trans: add docs/tasks/access-application-cluster/_index.md (#12048)

* zh-trans: update cpu-constraint-namespace.md and cpu-default-namespace.md (#12106)

* ZH-trans: update kubeadm_alpha_phase_upload-config.md (#12110)

* zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md (#12022)

* zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md

zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md

* Update kubefed_unjoin.md

* Update kubefed_unjoin.md

* Update kubefed_unjoin.md

* zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_… (#12114)

* zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_apiserver.md

zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_apiserver.md

* Update kubeadm_alpha_phase_certs_apiserver.md

* Update kubeadm_alpha_phase_certs_apiserver.md

* zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md (#12088)

* zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md

zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md

* Update docker-cli-to-kubectl.md

* zh-trans: /docs/reference/kubectl/conventions.md (#12089)

* zh-trans: /docs/reference/kubectl/conventions.md

zh-trans: /docs/reference/kubectl/conventions.md

* Update conventions.md

* zh-trans organize-cluster-access-kubeconfig.md (#12094)

* zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md (#12086)

* zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md

zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md

* Update kubefed.md

* zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md (#12029)

* zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md

zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md

* Update kubefed_join.md

* Update kubefed_join.md

* zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md (#12020)

* zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md

zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md

* Update kubefed_init.md

* Update kubefed_init.md

* Update kubefed_init.md

* zh-trans: add docs/setup/independent/control-plane-flags.md (#12043)

* zh-trans: add docs/setup/independent/control-plane-flags.md

* update content/zh/docs/setup/independent/control-plane-flags.md

* zh-trans:/docs/tasks/tools/install-kubectl.md (#11992)

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* Update configure-aggregation-layer.md

* .

* .

* .

* .

* .

* .

* .

* .

* configure-aggregation-layer.md

* .

* .

* Update configure-aggregation-layer.md

* .

* .

* .

* .

* zh-trans: add /docs/concepts/cluster-administration/manage-deployment.md (#11899)

* add /docs/concepts/cluster-administration/manage-deployment.md

* 更新部分翻译，去除多余的反引号

* 更新部分翻译

* zh-trans: add docs/tasks/service-catalog/install-service-catalog-using-sc.md (#12045)

* zh-trans: add docs/tasks/service-catalog/install-service-catalog-using-sc.md

* update docs/tasks/service-catalog/install-service-catalog-using-sc.md

* zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md (#12087)

* zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md

zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md

* Update kubefed_options.md

* Update kubefed_options.md

* zh-trans: Fix some blog links issue (#12115)

* zh-trans: Fix some blog links issue

* Revert the space change

* update Set Kubelet parameters via a config file (#12150)

* zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_all.md (#12185)

zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_all.md

* zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_… (#12184)

* zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_etcd_local.md

zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_etcd_local.md

* Update kubeadm_alpha_phase_etcd_local.md

* zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubelet_config_upload.md (#12130)

zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubelet_config_upload.md

* zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubeconfig_admin.md (#12131)

zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubeconfig_admin.md

* zh-trans: /docs/contribute/generate-ref-docs/kubernetes-api.md (#12141)

Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn>

* zh-trans:/docs/concepts/overview/object-management-kubectl/imperative… (#12151)

* zh-trans:/docs/concepts/overview/object-management-kubectl/imperative-config.md

zh-trans:/docs/concepts/overview/object-management-kubectl/imperative-config.md

* Update imperative-config.md

* ZH-trans: added a blog post Chinese translation: 2018-05-01-developing-on-kubernetes.md (#12009)

* added a blog post chinese translation

* Update 2018-05-01-developing-on-kubernetes.md

apply some suggested changes per review comments

* Update 2018-05-01-developing-on-kubernetes.md

cont to review and improve the wording, up to squash

* more update and rewording

* ZH-trans: add kubeadm_alpha_phase_kubelet_config_enable-dynamic.md (#12209)

* ZH-trans: add kubeadm_alpha_phase_kubelet_config_enable-dynamic.md

* Update kubeadm_alpha_phase_kubelet_config_enable-dynamic.md

* ZH-trans: add kubeadm_alpha_phase_certs_renew_apiserver.md (#12210)

* ZH-trans: add kubeadm_alpha_phase_certs_renew_apiserver.md

* Update kubeadm_alpha_phase_certs_renew_apiserver.md

* Update kubeadm_alpha_phase_certs_renew_apiserver.md

* ZH-trans: add kubeadm_alpha_phase_certs_front-proxy-client.md (#12212)

* fix docs style (#12225)

* fix docs style

fix docs style

* fix docs style

fix docs style

* ZH-trans: add rbac.md (#12263)

* ZH-trans: add rbac.md

* Update rbac.md

* ZH-trans: add persistent-volume-claim.md (#12264)

* ZH-trans: add persistent-volume-claim.md

* Update persistent-volume-claim.md

* Update persistent-volume-claim.md

* Update docker-cli-to-kubectl.md (#12288)

* ZH-trans: add kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md (#12285)

* ZH-trans: add kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md

* Update kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md

* ZH-trans: add coredns.md (#12282)

* ZH-trans: add coredns.md

* Update coredns.md

* ZH-trans: add kubeadm_alpha_phase_certs_etcd-healthcheck-client.md (#12286)

* ZH-trans: add kubeadm_alpha_phase_certs_etcd-healthcheck-client.md

* Update kubeadm_alpha_phase_certs_etcd-healthcheck-client.md

* ZH-trans: add kubeadm_alpha_phase_kubeconfig_kubelet.md (#12284)

* ZH-trans: add kubeadm_alpha_phase_kubeconfig_kubelet.md

* Update kubeadm_alpha_phase_kubeconfig_kubelet.md

* ZH-trans: add service-account.md (#12261)

* ZH-trans: add service-account.md

* Update service-account.md

* ZH-trans: add security-context.md (#12262)

* ZH-trans: add security-context.md

* Update security-context.md

* Update security-context.md

* Update security-context.md

* fix typo "_必须_" -> "必须" (#12300)

fix typo "_必须_" -> "必须"

* fix docs style error (#12307)

fix docs style error

* Create explore-interactive.html (#12311)

* fix docs style error (#12314)

fix docs style error

* ZH-trans: add kube-controller-manager.md (#12260)

* ZH-trans: add kube-controller-manager.md

* Update kube-controller-manager.md

* Update kube-controller-manager.md

* Update kube-controller-manager.md

* zh-trans: /docs/contribute/localization.md (#12295)

Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn>

zh-trans: /docs/contribute/localization.md; update

Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn>

zh-trans: /docs/contribute/localization.md; update2

Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn>

* ZH-trans: update tools.md (#12320)

ZH-trans: update tools.md

* ZH-trans: fix "kubead -config" -> "kubeadm-config" (#12319)

* ZH-trans: update kubeadm_config.md

* fix style error

* correct "availability” trans for chinese (#12394)

* ZH-trans:/docs/tasks/debug-application-cluster/debug-service.md (#12275)

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* Update configure-aggregation-layer.md

* .

* .

* .

* .

* .

* .

* .

* .

* configure-aggregation-layer.md

* .

* .

* Update configure-aggregation-layer.md

* .

* .

* .

* .

* .

* .

* .

* .

* Translate some remnant partials for localization (#12240)

* zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md (#12415)

* zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md

zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md

* Update limit-storage-consumption.md

* Update limit-storage-consumption.md

* update link to SSH tunneling (#12615)

Signed-off-by: PingWang <wang.ping5@zte.com.cn>

* zh-trans: update content/zh/docs/setup/certificates.md (#12620)

* ZH-trans: add kubeadm_alpha_phase_certs_apiserver-kubelet-client.md (#12619)

* ZH-trans: add kubeadm_alpha_phase_certs_apiserver-kubelet-client.md

* Update kubeadm_alpha_phase_certs_apiserver-kubelet-client.md

* zh-trans: node-conformance.md (#12356)

* zh-trans: node-conformance.md

zh-trans: node-conformance.md

* better translation

better translation

* zh-trans: translate docs/getting-started-guides/ubuntu/operational-co… (#12353)

* zh-trans: translate docs/getting-started-guides/ubuntu/operational-considerations.md

* Adopt PR suggestions

* add period sign

* zh-trans: krib.md (#12363)

* zh-trans: krib.md

zh-trans: krib.md

* Update krib.md

* Update krib.md

* Update krib.md

* Update krib.md

* zh-trans: /docs/tasks/administer-federation/events.md (#12411)

* zh-trans: /docs/tasks/administer-federation/events.md

zh-trans: /docs/tasks/administer-federation/events.md

* Update events.md

* Update events.md

* zh-trans: /docs/setup/turnkey/azure.md (#12412)

zh-trans: /docs/setup/turnkey/azure.md

* zh-trans:/docs/tasks/administer-federation/hpa.md & /docs/tasks/administer-cluster/extended-resource-node.md (#12432)

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* Update configure-aggregation-layer.md

* .

* .

* .

* .

* .

* .

* .

* .

* configure-aggregation-layer.md

* .

* .

* Update configure-aggregation-layer.md

* .

* .

* .

* .

* .

* Add arm64, ppc64le and s390x platforms for calico (#12666)

Signed-off-by: PingWang <wang.ping5@zte.com.cn>

add only

Signed-off-by: PingWang <wang.ping5@zte.com.cn>

* zh-trans: developing-cloud-controller-manager.md (#12413)

* zh-trans: /docs/tasks/administer-cluster/developing-cloud-controller-manager.md

zh-trans: /docs/tasks/administer-cluster/developing-cloud-controller-manager.md

* Update developing-cloud-controller-manager.md

* fix typo: delete useless "**"

* Update developing-cloud-controller-manager.md

* ZH-trans: add 2018-05-01-developing-on-kubernetes.md (#12814)

* ZH-trans: update encrypt-data.md (#12939)

* ZH-trans: update encrypt-data.md

* Update encrypt-data.md

* ZH-trans: add example-task-template.md (#12940)

* ZH-trans: add example-task-template.md

* Update example-task-template.md

* Added Instana to tools (#12978)

Instana is already available in the english version of the text, therefore I added it here too. Hope my skills were enough to make the text still correct :-)

* ZH-trans: add expose-interactive.html (#12965)

* ZH-trans: add expose-interactive.html

* Update content/zh/docs/tutorials/kubernetes-basics/expose/expose-interactive.html

Co-Authored-By: xichengliudui <1693291525@qq.com>

* ZH-trans: add cloudstack.md (#12967)

* Create cloudstack.md

* Update cloudstack.md

* Update cloudstack.md

* Update cloudstack.md

* ZH-trans: add container-lifecycle-hooks.md (#12941)

* ZH-trans: add container-lifecycle-hooks.md

* Update container-lifecycle-hooks.md

* translate content/zh/docs/tasks/administer-cluster/dns-debugging-resolution.md to chinese (#12904)

* ZH-trans: add expose-external-ip-address.md (#12955)

* ZH-trans: add expose-external-ip-address.md

* Update expose-external-ip-address.md

* Update expose-external-ip-address.md

* Update expose-external-ip-address.md

* Update expose-external-ip-address.md

* Update expose-external-ip-address.md

* ZH-trans: add dns-horizontal-autoscaling.md (#12948)

* ZH-trans: add dns-horizontal-autoscaling.md

* Update dns-horizontal-autoscaling.md

* Update dns-horizontal-autoscaling.md

* zh-trans: update content/zh/docs/concepts/_index.md (#13182)

* zh-trans: update content/zh/docs/reference/access-authn-authz/node.md (#13181)

* Update dns-horizontal-autoscaling.md (#13119)

* Update dns-horizontal-autoscaling.md

* Update dns-horizontal-autoscaling.md

* Update dns-horizontal-autoscaling.md

* ZH-trans: add 2018-10-03-kubedirector.md (#13048)

* ZH-trans: add 2018-10-03-kubedirector.md

* Update 2018-10-03-kubedirector.md

* Update 2018-10-03-kubedirector.md

* ZH-trans: add guestbook.md (#12953)

* ZH-trans: add guestbook.md

* Update guestbook.md

* Update guestbook.md

* Update guestbook.md

* Update guestbook.md

* ZH-trans: add set-up-placement-policies-federation.md (#12947)

* ZH-trans: add set-up-placement-policies-federation.md

* update pull request

* Update set-up-placement-policies-federation.md

* Update set-up-placement-policies-federation.md

* Update set-up-placement-policies-federation.md

* Update set-up-placement-policies-federation.md

* ZH-trans: add service-accounts-admin.md (#13047)

* ZH-trans: add service-accounts-admin.md

* Update service-accounts-admin.md

* Update service-accounts-admin.md

* ZH-trans: add update-api-object-kubectl-patch.md (#12943)

* ZH-trans: add update-api-object-kubectl-patch.md

* Update update-api-object-kubectl-patch.md

* Update update-api-object-kubectl-patch.md

* Update update-api-object-kubectl-patch.md

* Update update-api-object-kubectl-patch.md

* ZH-trans: add parallel-processing-expansion.md (#12944)

* ZH-trans: add parallel-processing-expansion.md

* Update parallel-processing-expansion.md

* Update parallel-processing-expansion.md

* zh-trans: add 2018-12-05-new-contributor-shanghai.md (#12778)

* add zh 2017-03-00-Five-Days-Of-Kubernetes-1-6.md

add zh 2018-12-05-new-contributor-shanghai.md

* Delete 2017-03-00-Five-Days-Of-Kubernetes-1-6.md

* zh-trans: /docs/contribute/style/write-new-topic.md (#12572)

Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn>

zh-trans: /docs/contribute/style/write-new-topic.md; update

Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn>

* zh-trans: update content/zh/docs/setup/salt.md (#13202)

* zh-trans: add docs/reference/setup-tools/kubeadm/generated/kubeadm_token.md (#13198)

* ZH-trans: add kubeadm_upgrade_diff.md (#13170)

* ZH-trans: add kubeadm_upgrade_diff.md

* Update kubeadm_upgrade_diff.md

* Update kubeadm_upgrade_diff.md

* zh-trans: update docs/reference/access-authn-authz/authorization.md (#13180)

* zh-trans: update docs/reference/setup-tools/kubeadm/kubeadm-config.md (#13179)

* zh-trans: add docs/concepts/storage/dynamic-provisioning.md (#13171)

* ZH-trans: add 2015-05-00-Kubernetes-On-Openstack.md (#13149)

* ZH-trans: add Kubernetes开源项目产品经理

* Update 2015-05-00-Kubernetes-On-Openstack.md

* ZH-trans: add 2015-03-00-Welcome-To-Kubernetes-Blog.md (#13131)

* ZH-trans: add 2015-03-00-Welcome-To-Kubernetes-Blog.md

* Update 2015-03-00-Welcome-To-Kubernetes-Blog.md

* ZH-trans: add 2015-06-00-Slides-Cluster-Management-With.md (#13123)

* ZH-trans: add 2015-06-00-Slides-Cluster-Management-With.md

* Update 2015-06-00-Slides-Cluster-Management-With.md

* Create 2015-03-00-Kubernetes-Gathering-Videos.md (#13124)

* ZH-trans: add 2015-03-00-Weekly-Kubernetes-Community-Hangout.md (#13129)

* ZH-trans: add 2015-03-00-Weekly-Kubernetes-Community-Hangout.md

* Update 2015-03-00-Weekly-Kubernetes-Community-Hangout.md

* ZH-trans: add 2015-04-00-Kubernetes-Release-0150.md (#13130)

* ZH-trans: add 2015-04-00-Kubernetes-Release-0150.md

* Update 2015-04-00-Kubernetes-Release-0150.md

* ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md (#13132)

* ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md

* Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md

* Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md

* Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md

* ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_29.md (#13147)

* ZH-trans: add 2015-05-00-Weekly-Kubernetes-Community-Hangout.md (#13148)

* ZH-trans: add flannel_multi_node_cluster.md (#13195)

* ZH-trans: add flannel_multi_node_cluster.md

* Update flannel_multi_node_cluster.md

* Update flannel_multi_node_cluster.md

* zh-trans: add docs/reference/command-line-tools-reference/kubelet-authentication-authorization.md (#13200)

* zh-trans: add docs/reference/command-line-tools-reference/kubelet-authentication-authorization.md

* Update kubelet-authentication-authorization.md

* zh-trans: /docs/tasks/administer-cluster/out-of-resource.md (#12879)

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* configure-aggregation-layer.md

* Update configure-aggregation-layer.md

* .

* .

* .

* .

* .

* .

* .

* .

* configure-aggregation-layer.md

* .

* .

* Update configure-aggregation-layer.md

* .

* .

* .

* .

* .

* .

* zh-trans: update docs/setup/node-conformance.md (#13201)

* zh-trans: update docs/setup/node-conformance.md

* zh-trans: update docs/setup/on-premises-vm/dcos.md

* zh-trans: add content/zh/blog/_posts/2018-10-15-steering-election-results.md (#13227)

* zh-trans: add content/zh/blog/_posts/2018-10-15-steering-election-results.md

* Update content/zh/blog/_posts/2018-10-15-steering-election-results.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Add @xichengliudui to sig-docs-zh-owners (release-1.12) (#13167)

* Add @xichengliudui to sig-docs-zh-owners

* Update OWNERS_ALIASES

* ZH-trans: add coreos.md (#13193)

* ZH-trans: coreos.md

* Update coreos.md

* Update coreos.md

* Update coreos.md

* Update coreos.md

* Update coreos.md

* Update coreos.md

* add SataQiu as a sig-docs-zh-owner (#13271)

* Fix relative links issue in zh content (#13312)

* `http://kubernetes.io/docs/` -> `/docs/`

* `https://kubernetes.io/docs/` -> `/docs/`

* zh-trans: add docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md (#13194)

* zh-trans: add docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md

* Update content/zh/docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update kubeadm-upgrade.md

* ZH-trans: add kubeadm-upgrade-ha-1-12.md (#13306)

* ZH-trans: add kubeadm-upgrade-ha-1-12.md

* Update kubeadm-upgrade-ha-1-12.md

* Update kubeadm-upgrade-ha-1-12.md

* Update kubeadm-upgrade-ha-1-12.md

* Update kubeadm-upgrade-ha-1-12.md

* Update kubeadm-upgrade-ha-1-12.md

* Update kubeadm-upgrade-ha-1-12.md

* Update config.toml (#13408)

* zh-trans: add content/zh/blog/_posts/2018-11-08-kubernetes-docs-update-i18n.md (#13221)

* zh-trans: add content/zh/docs/reference/kubernetes-api/labels-annotations-taints.md (#13236)

* zh-trans: add content/zh/blog/_posts/2018-10-16-kubernetes-2018-north-american-contributor-summit.md (#13274)

* zh-trans: add content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md (#13268)

* zh-trans: add content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md

* Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* zh-trans: update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md

* ZH-trans: add 2017-10-00-Five-Days-Of-Kubernetes-18.md (#13427)

* ZH-trans: add 2017-10-00-Five-Days-Of-Kubernetes-18.md

* Update 2017-10-00-Five-Days-Of-Kubernetes-18.md

* zh-trans: add content/zh/docs/tasks/administer-federation/daemonset.md (#13239)

* message

* more message

* remove data.json

* ZH-trans: add aws.md (#13276)

* ZH-trans: add aws.md

* Update aws.md

* Update aws.md

* ZH-trans: add cluster-interactive.html (#13479)

* ZH-trans: add cluster-interactive.html

* Update cluster-interactive.html

* ZH-trans: add update-intro.html (#13480)

* Create update-intro.html

* Update update-intro.html

* Update update-intro.html

* Update update-intro.html

* Update update-intro.html

* Update update-intro.html

* ZH-trans: add README.md (#13235)

* ZH-trans: add vendoring

* Update README.md

* zh: docs/cocepts/cluster-administration/logging.md (#13541)

* zh: docs/cocepts/cluster-administration/logging.md

* Update logging.md

* zh-trans: update docker-cli-to-kubectl.md (#13591)

* Update docker-cli-to-kubectl.md

* Update docker-cli-to-kubectl.md

* zh-trans: update advanced.md (#13592)

* ZH-trans: add 2017-11-00-Autoscaling-In-Kubernetes.md (#13424)

* ZH-trans: add 2017-11-00-Autoscaling-In-Kubernetes.md

* Update 2017-11-00-Autoscaling-In-Kubernetes.md

* ZH-trans: add fedora_manual_config.md (#13439)

* ZH-trans: add fedora_manual_config.md

* Update fedora_manual_config.md

* zh-trans: content/zh/docs/concepts/overview/working-with-objects/labe… (#12277)

* zh-trans: content/zh/docs/concepts/overview/working-with-objects/labels.md

* update trans

* update trans

*  zh: docs/contribute/start.md trans (#13632)

* zh：docs/contribute/start.md trans

* Update start.md

* Update start.md

* Update start.md

* Update start.md

* Update content/zh/docs/contribute/start.md

Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com>

* Update content/zh/docs/contribute/start.md

Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com>

* Update content/zh/docs/contribute/start.md

Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com>

* zh-trans: update docs/reference/setup-tools/kubefed (#13729)

* Update 2017-10-00-Five-Days-Of-Kubernetes-18.md (#13472)

* zh-trans: add configure-multiple-schedulers.md (#13492)

* zh-trans: add configure-multiple-schedulers.md

* Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update configure-multiple-schedulers.md

* Update configure-multiple-schedulers.md

* Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update configure-multiple-schedulers.md

* zh-trans: add docs/tasks/configure-pod-container/share-process-namespace.md (#13551)

* zh-trans: add docs/tasks/configure-pod-container/share-process-namespace.md

* Update share-process-namespace.md

* zh-trans: update docs/admin/accessing-the-api.md (#13744)

* zh-trans: add content/zh/blog/_posts/2018-10-11-topology-aware-volume-provisioning.md (#13303)

* ZH-trans: add 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md (#13241)

* ZH-trans: add 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md

* Update 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md

* Update 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md

* ZH-trans: add  2016-07-00-Citrix-Netscaler-And-Kubernetes.md (#13242)

* ZH-trans: add  2016-07-00-Citrix-Netscaler-And-Kubernetes.md

* Update 2016-07-00-Citrix-Netscaler-And-Kubernetes.md

* Update 2016-07-00-Citrix-Netscaler-And-Kubernetes.md

* zh-trans: update docs/admin/bootstrap-tokens.md (#13770)

* zh-trans: update content/zh/docs/admin/cluster-large.md (#13771)

* zh-trans: update content/zh/docs/admin/kube-apiserver.md (#13774)

* zh-trans: update content/zh/docs/admin/kube-apiserver.md

* Update kube-apiserver.md

* Update content/zh/docs/admin/kube-apiserver.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* zh-trans: update content/zh/docs/admin/multiple-zones.md (#13775)

* zh-trans: update content/zh/docs/admin/multiple-zones.md

* Update multiple-zones.md

* zh-trans: update node-conformance.md and ovs-networking.md (#13776)

* zh-trans: update high-availability/_index.md and authorization/webhook.md (#13780)

* zh-trans: update content/zh/docs/admin/authorization/_index.md (#13779)

* zh-trans: update content/zh/docs/admin/authorization/_index.md

* Update _index.md

* Update content/zh/docs/admin/authorization/_index.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update content/zh/docs/admin/authorization/_index.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update content/zh/docs/admin/authorization/_index.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* zh-trans: update content/zh/docs/admin/authorization/abac.md (#13777)

* zh-trans: update content/zh/docs/admin/authorization/abac.md

* Update content/zh/docs/admin/authorization/abac.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* Update abac.md

* zh-trans: update content/zh/docs/admin/service-accounts-admin.md (#13778)

* zh-trans: update content/zh/docs/admin/service-accounts-admin.md

* Update content/zh/docs/admin/service-accounts-admin.md

Co-Authored-By: SataQiu <1527062125@qq.com>

* zh-trans: update content/zh/docs/concepts/architecture (#13797)

* ZH-trans: add cluster.md (#13500)

* ZH-trans: add cluster.md

* Update cluster.md

* Update cluster.md

* Update cluster.md

* zh-trans: update docs/concepts/cluster-administration (#13825)

* Exclude content-en changes in the PR

* Exclude content/ko changes in the PR

* Exclude OWNERS_ALIASES change in the PR

* rm kubeadm/generated/README.md to fix the build

* Remove generated sass assets
This commit is contained in:
chenrui
2019-06-17 12:28:11 -04:00
committed by Kubernetes Prow Robot
parent d437c2e5e5
commit 577b431931
717 changed files with 76342 additions and 1681 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/zh/docs/reference/access-authn-authz/_index.md
+13
View File
@@ -0,0 +1,13 @@
---
title: 访问 API
weight: 20
toc-hide: true
---
<!--
---
title: Accessing the API
weight: 20
toc-hide: true
---
-->
content/zh/docs/reference/access-authn-authz/authorization.md
+47 -47
View File
@@ -28,12 +28,12 @@ that Kubernetes authorization works with existing organization-wide or
cloud-provider-wide access control systems which may handle other APIs besides
the Kubernetes API. -->
在Kubernetes中，您必须在授权（授予访问权限）之前进行身份验证（登录），有关身份验证的信息，
在 Kubernetes 中，您必须在授权（授予访问权限）之前进行身份验证（登录），有关身份验证的信息，
请参阅 [访问控制概述](/docs/reference/access-authn-authz/controlling-access/).
Kubernetes期望REST API请求中常见的属性。
这意味着Kubernetes授权适用于现有的组织范围或云提供商范围的访问控制系统，
除了Kubernetes API之外，它还可以处理其他API。
Kubernetes 期望 REST API 请求中常见的属性。
这意味着 Kubernetes 授权适用于现有的组织范围或云提供商范围的访问控制系统，
除了 Kubernetes API 之外，它还可以处理其他 API。
<!-- ## Determine Whether a Request is Allowed or Denied
Kubernetes authorizes API requests using the API server. It evaluates all of the
@@ -52,7 +52,7 @@ the request, then the request is denied. A deny returns an HTTP status code 403.
## 确定是允许还是拒绝请求
Kubernetes 使用 API ​​服务器授权 API 请求。它根据所有策略评估所有请求属性来决定允许或拒绝请求。
一个API请求的所有部分必须被某些策略允许才能继续。这意味着默认情况下拒绝权限。
一个 API 请求的所有部分必须被某些策略允许才能继续。这意味着默认情况下拒绝权限。
（尽管 Kubernetes 使用 API ​​服务器，但是依赖于特定种类对象的特定字段的访问控制和策略由准入控制器处理。）
@@ -78,19 +78,19 @@ Kubernetes reviews only the following API request attributes:
-->
## 审查您的请求属性
Kubernetes仅审查以下API请求属性：
Kubernetes 仅审查以下 API 请求属性：
* **user** - 身份验证期间提供的`user`字符串。
* **user** - 身份验证期间提供的 `user` 字符串。
* **group** - 经过身份验证的用户所属的组名列表。
* **extra** - 由身份验证层提供的任意字符串键到字符串值的映射。
* **API** - 指示请求是否针对 API 资源。
* **Request path** - 各种非资源端点的路径，如`/api`或`/healthz`。
* **API request verb** - API 动词`get`，`list`，`create`，`update`，`patch`，`watch`，`proxy`，`redirect`，`delete`和`deletecollection`用于资源请求。要确定资源API端点的请求动词，请参阅[确定请求动词](/docs/reference/access-authn-authz/authorization/#determine-whether-a-request-is-allowed-or-denied)。
* **HTTP request verb** - HTTP 动词`get`，`post`，`put`和`delete`用于非资源请求。
* **Resource** - 正在访问的资源的 ID 或名称（仅限资源请求） - 对于使用`get`，`update`，`patch`和`delete`动词的资源请求，您必须提供资源名称。
* **Request path** - 各种非资源端点的路径，如 `/api` 或 `/healthz`。
* **API request verb** - API 动词 `get`，`list`，`create`，`update`，`patch`，`watch`，`proxy`，`redirect`，`delete` 和 `deletecollection` 用于资源请求。要确定资源 API 端点的请求动词，请参阅[确定请求动词](/docs/reference/access-authn-authz/authorization/#determine-whether-a-request-is-allowed-or-denied)。
* **HTTP request verb** - HTTP 动词 `get`，`post`，`put` 和 `delete` 用于非资源请求。
* **Resource** - 正在访问的资源的 ID 或名称（仅限资源请求） - 对于使用 `get`，`update`，`patch` 和 `delete` 动词的资源请求，您必须提供资源名称。
* **Subresource** - 正在访问的子资源（仅限资源请求）。
* **Namespace** - 正在访问的对象的名称空间（仅适用于命名空间资源请求）。
* **API group** - 正在访问的 API 组（仅限资源请求）。空字符串表示[核心API组](/docs/concepts/overview/kubernetes-api/)。
* **API group** - 正在访问的 API 组（仅限资源请求）。空字符串表示[核心 API 组](/docs/concepts/overview/kubernetes-api/)。
<!--
## Determine the Request Verb
@@ -116,21 +116,21 @@ of the `bind` verb on `roles` and `clusterroles` resources in the `rbac.authoriz
## 确定请求动词
要确定资源API端点的请求谓词，请检查所使用的 HTTP 动词以及请求是否对单个资源或资源集合起作用：
要确定资源 API 端点的请求谓词，请检查所使用的 HTTP 动词以及请求是否对单个资源或资源集合起作用：
HTTP 动词 | request 动词
----------|---------------
POST | create
GET, HEAD | get (单个资源), list (资源集合)
GET, HEAD | get (单个资源)，list (资源集合)
PUT | update
PATCH | patch
DELETE | delete (单个资源), deletecollection (资源集合)
DELETE | delete (单个资源)，deletecollection (资源集合)
Kubernetes有时使用专门的动词检查授权以获得额外的权限。例如：
Kubernetes 有时使用专门的动词检查授权以获得额外的权限。例如：
* [Pod安全策略](/docs/concepts/policy/pod-security-policy/) 检查`policy` API组中`podsecuritypolicies`资源的`use`动词的授权。
* [RBAC](/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping) 检查`rbac.authorization.k8s.io` API 组中`roles`和`clusterroles`资源的`bind`动词的授权。
* [认证](/docs/reference/access-authn-authz/authentication/) layer检查核心API组中`users`，`groups`和`serviceaccounts`的`impersonate`动词的授权，以及`authentication.k8s.io` API组中的`userextras`。
* [Pod 安全策略](/docs/concepts/policy/pod-security-policy/) 检查 `policy` API 组中 `podsecuritypolicies` 资源的 `use` 动词的授权。
* [RBAC](/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping) 检查 `rbac.authorization.k8s.io` API 组中 `roles` 和 `clusterroles` 资源的 `bind` 动词的授权。
* [认证](/docs/reference/access-authn-authz/authentication/) layer 检查核心 API 组中 `users`，`groups` 和 `serviceaccounts` 的 `impersonate` 动词的授权，以及 `authentication.k8s.io` API 组中的 `userextras`。
<!--
## Authorization Modules
@@ -144,11 +144,11 @@ Kubernetes有时使用专门的动词检查授权以获得额外的权限。例
## 授权模块
* **Node** - 一个专用授权程序，根据计划运行的 pod 为 kubelet 授予权限。了解有关使用节点授权模式的更多信息，请参阅[节点授权](/docs/reference/access-authn-authz/node/).
* **ABAC** - 基于属性的访问控制（ABAC) 定义了一种访问控制范例，通过使用将属性组合在一起的策略，将访问权限授予用户。策略可以使用任何类型的属性（用户属性，资源属性，对象，环境属性等）。要了解有关使用 ABAC 模式的更多信息，请参阅[ABAC 模式](/docs/reference/access-authn-authz/abac/)。
* **RBAC** - 基于角色的访问控制（RBAC）是一种基于企业内个人用户的角色来管理对计算机或网络资源的访问的方法。在此上下文中，权限是单个用户执行特定任务的能力，例如查看，创建或修改文件。要了解有关使用 RBAC 模式的更多信息，请参阅[RBAC 模式](/docs/reference/access-authn-authz/rbac/)。
* 当指定的RBAC（基于角色的访问控制）使用`rbac.authorization.k8s.io` API 组来驱动授权决策时，允许管理员通过 Kubernetes API 动态配置权限策略。
* 要启用RBAC，请使用`--authorization-mode = RBAC`启动 apiserver 。
* **Webhook** - WebHook 是一个 HTTP 回调: 发生某些事情时调用的 HTTP POST;通过 HTTP POST 进行简单的事件通知。实现 WebHooks 的 Web 应用程序会在发生某些事情时将消息发布到URL。要了解有关使用 Webhook 模式的更多信息，请参阅[Webhook 模式](/docs/reference/access-authn-authz/webhook/)。
* **ABAC** - 基于属性的访问控制（ABAC）定义了一种访问控制范例，通过使用将属性组合在一起的策略，将访问权限授予用户。策略可以使用任何类型的属性（用户属性，资源属性，对象，环境属性等）。要了解有关使用 ABAC 模式的更多信息，请参阅 [ABAC 模式](/docs/reference/access-authn-authz/abac/)。
* **RBAC** - 基于角色的访问控制（RBAC）是一种基于企业内个人用户的角色来管理对计算机或网络资源的访问的方法。在此上下文中，权限是单个用户执行特定任务的能力，例如查看，创建或修改文件。要了解有关使用 RBAC 模式的更多信息，请参阅 [RBAC 模式](/docs/reference/access-authn-authz/rbac/)。
* 当指定的 RBAC（基于角色的访问控制）使用 `rbac.authorization.k8s.io` API 组来驱动授权决策时，允许管理员通过 Kubernetes API 动态配置权限策略。
* 要启用 RBAC，请使用 `--authorization-mode = RBAC` 启动 apiserver 。
* **Webhook** - WebHook 是一个 HTTP 回调：发生某些事情时调用的 HTTP POST；通过 HTTP POST 进行简单的事件通知。实现 WebHook 的 Web 应用程序会在发生某些事情时将消息发布到 URL。要了解有关使用 Webhook 模式的更多信息，请参阅 [Webhook 模式](/docs/reference/access-authn-authz/webhook/)。
<!--
#### Checking API Access
@@ -158,10 +158,10 @@ The command uses the `SelfSubjectAccessReview` API to determine if the current u
a given action, and works regardless of the authorization mode used.
-->
#### 检查API访问
#### 检查 API 访问
`kubectl`提供`auth can-i`子命令，用于快速查询 API 授权层。
该命令使用`SelfSubjectAccessReview` API来确定当前用户是否可以执行给定操作，并且无论使用何种授权模式都可以工作。
`kubectl` 提供 `auth can-i` 子命令，用于快速查询 API 授权层。
该命令使用 `SelfSubjectAccessReview` API 来确定当前用户是否可以执行给定操作，并且无论使用何种授权模式都可以工作。
```bash
$ kubectl auth can-i create deployments --namespace dev
@@ -192,14 +192,14 @@ These APIs can be queried by creating normal Kubernetes resources, where the res
field of the returned object is the result of the query.
-->
`SelfSubjectAccessReview`是`authorization.k8s.io` API组的一部分，它将 API 服务器授权公开给外部服务。
`SelfSubjectAccessReview` 是 `authorization.k8s.io` API 组的一部分，它将 API 服务器授权公开给外部服务。
该组中的其他资源包括：
* `SubjectAccessReview` - 访问任何用户的 Review ，而不仅仅是当前用户。用于将授权决策委派给API服务器。例如，kubelet 和扩展 API 服务器使用它来确定用户对自己的API的访问权限。
* `LocalSubjectAccessReview` - 与`SubjectAccessReview`类似，但仅限于特定的命名空间。
* `SelfSubjectRulesReview` - 返回用户可在命名空间内执行的操作集的审阅。用户可以快速汇总自己的访问权限，或者用于隐藏/显示操作的UI。
* `SubjectAccessReview` - 访问任何用户的 Review ，而不仅仅是当前用户。用于将授权决策委派给 API 服务器。例如，kubelet 和扩展 API 服务器使用它来确定用户对自己的 API 的访问权限。
* `LocalSubjectAccessReview` - 与 `SubjectAccessReview` 类似，但仅限于特定的命名空间。
* `SelfSubjectRulesReview` - 返回用户可在命名空间内执行的操作集的审阅。用户可以快速汇总自己的访问权限，或者用于 UI 中的隐藏/显示动作。
可以通过创建普通 Kubernetes 资源来查询这些 API ，其中返回对象的响应“status”字段是查询的结果。
可以通过创建普通 Kubernetes 资源来查询这些 API ，其中返回对象的响应 “status” 字段是查询的结果。
```bash
$ kubectl create -f - -o yaml << EOF
@@ -247,20 +247,20 @@ You can choose more than one authorization module. Modules are checked in order
so an earlier module has higher priority to allow or deny a request.
-->
## 为您的授权模块使用标志
## 为您的授权模块应用参数
您必须在策略中包含一个标志，以指明您的策略包含哪个授权模块：
您必须在策略中包含一个参数标志，以指明您的策略包含哪个授权模块：
可以使用以下标志：
可以使用以下参数：
* `--authorization-mode=ABAC` 基于属性的访问控制（ABAC）模式允许您使用本地文件配置策略。
* `--authorization-mode=RBAC` 基于角色的访问控制（RBAC）模式允许您使用 Kubernetes API 创建和存储策略。
* `--authorization-mode=Webhook` WebHook 是一种 HTTP 回调模式，允许您使用远程REST端点管理授权。
* `--authorization-mode=Node` 节点授权是一种特殊用途的授权模式，专门授权由 kubelet 发出的API请求。
* `--authorization-mode=Webhook` WebHook 是一种 HTTP 回调模式，允许您使用远程 REST 端点管理授权。
* `--authorization-mode=Node` 节点授权是一种特殊用途的授权模式，专门授权由 kubelet 发出的 API 请求。
* `--authorization-mode=AlwaysDeny` 该标志阻止所有请求。仅将此标志用于测试。
* `--authorization-mode=AlwaysAllow` 此标志允许所有请求。仅在您不需要 API 请求的授权时才使用此标志。
您可以选择多个授权模块。按顺序检查模块，以便较早的模块具有更高的优先级来允许或拒绝请求。
您可以选择多个授权模块。模块按顺序检查，以便较早的模块具有更高的优先级来允许或拒绝请求。
<!--
## Privilege escalation via pod creation
@@ -271,11 +271,11 @@ access their privileges within that namespace. They can create pods that access
secrets the user cannot themselves read, or that run under a service account
with different/greater permissions.
-->
## 通过pod创建权限升级
## 通过 Pod 创建升级权限
能够在命名空间中创建 pod 的用户可能会升级其在该命名空间内的权限。
他们可以创建在该命名空间内访问其权限的 pod 。
他们可以创建用户无法自己读取 secret 的 pod ，或者在具有不同/更高权限的服务帐户下运行的 pod 。
能够在命名空间中创建 Pod 的用户可能会升级其在该命名空间内的权限。
他们可以创建在该命名空间内访问其权限的 Pod 。
他们可以创建用户无法自己读取 secret 的 Pod ，或者在具有不同/更高权限的服务帐户下运行的 Pod 。
{{< caution >}}
<!--
@@ -286,9 +286,9 @@ maps in the namespace; and impersonate any service account in the namespace and
take any action the account could take. This applies regardless of authorization
mode.
-->
**注意：** 系统管理员在授予对 pod 创建的访问权限时要小心。
授予在命名空间中创建 pod（或创建pod的控制器）的权限的用户可以：
读取命名空间中的所有秘密;读取命名空间中的所有配置映射;
**注意：** 系统管理员在授予对 Pod 创建的访问权限时要小心。
授予在命名空间中创建 Pod（或创建 Pod 的控制器）的权限的用户可以：
读取命名空间中的所有 secret；读取命名空间中的所有 ConfigMap；
并模拟命名空间中的任何服务帐户并执行帐户可以执行的任何操作。
无论采用何种授权方式，这都适用。
{{< /caution >}}
@@ -299,6 +299,6 @@ mode.
* To learn more about Authentication, see **Authentication** in [Controlling Access to the Kubernetes API](/docs/reference/access-authn-authz/controlling-access/).
* To learn more about Admission Control, see [Using Admission Controllers](/docs/reference/access-authn-authz/admission-controllers/).
-->
* 要了解有关身份验证的更多信息，请参阅 **身份验证** [控制对Kubernetes API的访问](/docs/reference/access-authn-authz/controlling-access/).
* 要了解有关准入控制的更多信息，请参阅 [使用准入控制器](/docs/reference/access-authn-authz/admission-controllers/).
* 要了解有关身份验证的更多信息，请参阅 **身份验证** [控制对 Kubernetes API 的访问](/docs/reference/access-authn-authz/controlling-access/)。
* 要了解有关准入控制的更多信息，请参阅 [使用准入控制器](/docs/reference/access-authn-authz/admission-controllers/)。
{{% /capture %}}
content/zh/docs/reference/access-authn-authz/bootstrap-tokens.md
+296
View File
@@ -0,0 +1,296 @@
---
reviewers:
- jbeda
title: 使用 Bootstrap Token 进行鉴权
content_template: templates/concept
weight: 20
---
<!--
---
reviewers:
- jbeda
title: Authenticating with Bootstrap Tokens
content_template: templates/concept
weight: 20
---
-->
{{% capture overview %}}
<!--
Bootstrap tokens are a simple bearer token that is meant to be used when
creating new clusters or joining new nodes to an existing cluster. It was built
to support [kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm/), but can be used in other contexts
for users that wish to start clusters without `kubeadm`. It is also built to
work, via RBAC policy, with the [Kubelet TLS
Bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) system.
-->
Bootstrap token 是一种简单的 bearer token，用于创建新集群或将新节点连接到现有集群。它被用来支持 [kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm/)，但是对于那些希望在没有 `kubeadm` 的情况下创建集群的用户，也可以在其他环境中使用。它也可以通过 RBAC 策略用于 [Kubelet TLS
Bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) 系统。
{{% /capture %}}
{{% capture body %}}
<!--
## Bootstrap Tokens Overview
-->
## Bootstrap Token 概览
<!--
Bootstrap Tokens are defined with a specific type
(`bootstrap.kubernetes.io/token`) of secrets that lives in the `kube-system`
namespace. These Secrets are then read by the Bootstrap Authenticator in the
API Server. Expired tokens are removed with the TokenCleaner controller in the
Controller Manager. The tokens are also used to create a signature for a
specific ConfigMap used in a "discovery" process through a BootstrapSigner
controller.
-->
Bootstrap Token 在 `kube-system` 命名空间中使用特定类型 (`bootstrap.kubernetes.io/token`) 的 secret 来定义。
然后，这些 Secret 被 API Server 中的 Bootstrap Authenticator 读取。过期的 token 被 Controller Manager 中的 TokenCleaner 控制器移除。
这些 Token 也被 BootstrapSigner 控制器在一个"发现"的过程中用来为特定的 ConfigMap 创建签名。
{{< feature-state state="beta" >}}
<!--
## Token Format
-->
## Token 格式
<!--
Bootstrap Tokens take the form of `abcdef.0123456789abcdef`. More formally,
they must match the regular expression `[a-z0-9]{6}\.[a-z0-9]{16}`.
-->
Bootstrap Token 采用 `abcdef.0123456789abcdef` 的形式。为了更加正式，它们必须匹配正则表达式 `[a-z0-9]{6}\.[a-z0-9]{16}`。
<!--
The first part of the token is the "Token ID" and is considered public
information. It is used when referring to a token without leaking the secret
part used for authentication. The second part is the "Token Secret" and should
only be shared with trusted parties.
-->
Token 的第一部分是 "Token ID" 并且被认为是公共信息。这部分会在引用一个 token 但是不想泄露那些用于鉴权的私密部分时被用到。第二部分则是 "Token Secret"，应该仅与受信任方共享。
<!--
## Enabling Bootstrap Token Authentication
-->
## 启用 Bootstrap Token 鉴权
<!--
The Bootstrap Token authenticator can be enabled using the following flag on the
API server:
-->
Bootstrap Token authenticator 可以通过在 API server 上添加下列标志来启用。
```
--enable-bootstrap-token-auth
```
<!--
When enabled, bootstrapping tokens can be used as bearer token credentials to
authenticate requests against the API server.
-->
被启用时，Bootstrap Token 可以被用来作为针对 API server 鉴权请求的 bearer token 凭据。
```http
Authorization: Bearer 07401b.f395accd246ae52d
```
<!--
Tokens authenticate as the username `system:bootstrap:<token id>` and are members
of the group `system:bootstrappers`. Additional groups may be specified in the
token's Secret.
-->
Token 鉴权信息为：用户名 `system:bootstrap:<token id>` 且在 `system:bootstrappers` 组内。我们也可以在 token 的 Secret 中指定其它组信息。
<!-- Expired tokens can be deleted automatically by enabling the `tokencleaner`
controller on the controller manager. -->
过期的 token 可以通过启用 controller manager 中的 `tokencleaner` 控制器来自动删除。
```
--controllers=*,tokencleaner
```
<!--
## Bootstrap Token Secret Format
-->
## Bootstrap Token Secret 格式
<!--
Each valid token is backed by a secret in the `kube-system` namespace. You can
find the full design doc
[here](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/cluster-lifecycle/bootstrap-discovery.md).
-->
每个有效的 token 都对应着 `kube-system` 命名空间中的一个 secret。您可以从 [这里](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/cluster-lifecycle/bootstrap-discovery.md) 获得整个的设计文档。
<!--
Here is what the secret looks like.
-->
Secret 样例如下所示。
```yaml
apiVersion: v1
kind: Secret
metadata:
# Name MUST be of form "bootstrap-token-<token id>"
name: bootstrap-token-07401b
namespace: kube-system
# Type MUST be 'bootstrap.kubernetes.io/token'
type: bootstrap.kubernetes.io/token
stringData:
# Human readable description. Optional.
description: "The default bootstrap token generated by 'kubeadm init'."
# Token ID and secret. Required.
token-id: 07401b
token-secret: f395accd246ae52d
# Expiration. Optional.
expiration: 2017-03-10T03:22:11Z
# Allowed usages.
usage-bootstrap-authentication: "true"
usage-bootstrap-signing: "true"
# Extra groups to authenticate the token as. Must start with "system:bootstrappers:"
auth-extra-groups: system:bootstrappers:worker,system:bootstrappers:ingress
```
<!--
The type of the secret must be `bootstrap.kubernetes.io/token` and the name must
be `bootstrap-token-<token id>`. It must also exist in the `kube-system`
namespace.
-->
Secret 的类型必须是 `bootstrap.kubernetes.io/token` 并且名字的格式必须是 `bootstrap-token-<token id>`。它必须被放在 `kube-system` 命名空间中。
<!--
The `usage-bootstrap-*` members indicate what this secret is intended to be used
for. A value must be set to `true` to be enabled.
-->
`usage-bootstrap-*` 的成员指出了这个 secret 的作用。值被设定为 `true` 时才会启用。
<!-- * `usage-bootstrap-authentication` indicates that the token can be used to
authenticate to the API server as a bearer token. -->
* `usage-bootstrap-authentication` 表示这个 token 可以被用来作为针对 API server 鉴权请求的 bearer token 凭据。
<!-- * `usage-bootstrap-signing` indicates that the token may be used to sign the
`cluster-info` ConfigMap as described below. -->
* `usage-bootstrap-signing` 表示这个 token 可以被用来对 `cluster-info` ConfigMap 通过下述方式来签名。
<!--
The `expiration` field controls the expiry of the token. Expired tokens are
rejected when used for authentication and ignored during ConfigMap signing.
The expiry value is encoded as an absolute UTC time using RFC3339. Enable the
`tokencleaner` controller to automatically delete expired tokens.
-->
`expiration` 字段控制 token 的到期。过期的 token 会在用于身份验证时被拒绝，在 ConfigMap 签名时被忽略。
使用 RFC3339 将过期时间编码为绝对 UTC 时间。启用 `tokencleaner` 控制器来自动删除过期的 token。
<!--
## Token Management with kubeadm
-->
## 使用 kubeadm 管理 token
<!--
You can use the `kubeadm` tool to manage tokens on a running cluster. See the
[kubeadm token docs](/docs/reference/setup-tools/kubeadm/kubeadm-token/) for details.
-->
您可以在集群中使用 `kubeadm` 工具来管理 token。查阅 [kubeadm token 文档](/docs/reference/setup-tools/kubeadm/kubeadm-token/) 获取更多信息。
<!--
## ConfigMap Signing
-->
## ConfigMap 签名
<!--
In addition to authentication, the tokens can be used to sign a ConfigMap. This
is used early in a cluster bootstrap process before the client trusts the API
server. The signed ConfigMap can be authenticated by the shared token.
-->
除了身份验证之外，token 还可用于对 ConfigMap 进行签名。
这个用于在客户端和 API Server 互信之前，在集群引导过程的前期使用。
签名的 ConfigMap 可以通过共享 token 进行身份鉴权。
<!--
Enable ConfigMap signing by enabling the `bootstrapsigner` controller on the
Controller Manager.
-->
通过启用 Controller Manager 中的 `bootstrapsigner` 控制器来启用 ConfigMap 签名选项。
```
--controllers=*,bootstrapsigner
```
<!--
The ConfigMap that is signed is `cluster-info` in the `kube-public` namespace.
The typical flow is that a client reads this ConfigMap while unauthenticated and
ignoring TLS errors. It then validates the payload of the ConfigMap by looking
at a signature embedded in the ConfigMap.
-->
被签名的 ConfigMap 作为 `kube-public` 命名空间中的 `cluster-info` 存在。
典型的流程是客户端在未经身份验证和忽略 TLS 错误时读取此 ConfigMap。
然后通过嵌入 ConfigMap 中的签名来校验 ConfigMap。
<!--
The ConfigMap may look like this:
-->
ConfigMap 样例如下所示:
```yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-info
namespace: kube-public
data:
jws-kubeconfig-07401b: eyJhbGciOiJIUzI1NiIsImtpZCI6IjA3NDAxYiJ9..tYEfbo6zDNo40MQE07aZcQX2m3EB2rO3NuXtxVMYm9U
kubeconfig: |
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: <really long certificate data>
server: https://10.138.0.2:6443
name: ""
contexts: []
current-context: ""
kind: Config
preferences: {}
users: []
```
<!--
The `kubeconfig` member of the ConfigMap is a config file with just the cluster
information filled out. The key thing being communicated here is the
`certificate-authority-data`. This may be expanded in the future.
-->
ConfigMap 的 `kubeconfig` 成员是一个配置文件，里面只填写了集群信息。
在通信过程中的关键是 `certificate-authority-data`。这部分可能在将来会扩展。
<!--
The signature is a JWS signature using the "detached" mode. To validate the
signature, the user should encode the `kubeconfig` payload according to JWS
rules (base64 encoded while discarding any trailing `=`). That encoded payload
is then used to form a whole JWS by inserting it between the 2 dots. You can
verify the JWS using the `HS256` scheme (HMAC-SHA256) with the full token (e.g.
`07401b.f395accd246ae52d`) as the shared secret. Users _must_ verify that HS256
is used.
-->
签名是使用“分离”模式的 JWS 签名。
为了验证签名，用户应该根据 JWS 规则加密 `kubeconfig`的信息（base64 编码，同时丢弃任何的 `=`）。
然后将使用该编码的信息插入 2 个点之间来形成整个 JWS。
您可以使用 `HS256` 方案（HMAC-SHA256）验证 JWS，并使用完整令牌（例如 `07401b.f395accd246ae52d`）作为共享密钥。 用户 _必须_ 验证 HS256 是否被使用。
{{< warning >}}
<!--
**Warning:** Any party with a bootstrapping token can create a valid signature for that
token. When using ConfigMap signing it's discouraged to share the same token with
many clients, since a compromised client can potentially man-in-the middle another
client relying on the signature to bootstrap TLS trust.
-->
**注意:** 拥有 bootstrapping token 任何一方都可以为该 token 创建有效签名。
当使用 ConfigMap 签名时，不建议许多客户端共享相同的 token，因为受入侵的客户端可能会作为中间人为其它客户端来引导 TLS 信任。
{{< /warning >}}
<!--
Consult the [kubeadm security model](/docs/reference/generated/kubeadm/#security-model)
section for more information.
-->
参阅 [kubeadm 安全模型](/docs/reference/generated/kubeadm/#security-model) 获取更多信息。
{{% /capture %}}
content/zh/docs/reference/access-authn-authz/node.md
+201
View File
@@ -0,0 +1,201 @@
---
title: 使用 Node 鉴权
content_template: templates/concept
weight: 90
---
<!--
---
reviewers:
- timstclair
- deads2k
- liggitt
- ericchiang
title: Using Node Authorization
content_template: templates/concept
weight: 90
---
-->
{{% capture overview %}}
节点鉴权是一种特殊用途的鉴权模式，专门对 kubelet 发出的 API 请求进行鉴权。
<!--
Node authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.
-->
{{% /capture %}}
{{% capture body %}}
## 概述
<!--
## Overview
-->
节点鉴权器允许 kubelet 执行 API 操作。包括：
<!--
The Node authorizer allows a kubelet to perform API operations. This includes:
-->
读取操作：
<!--
Read operations:
-->
* services
* endpoints
* nodes
* pods
* secrets、configmaps、以及绑定到 kubelet 的节点的 pod 的持久卷申领和持久卷
<!--
* services
* endpoints
* nodes
* pods
* secrets, configmaps, persistent volume claims and persistent volumes related to pods bound to the kubelet's node
-->
写入操作：
<!--
Write operations:
-->
* 节点和节点状态（启用 `NodeRestriction` 准入插件以限制 kubelet 只能修改自己的节点）
* Pod 和 Pod 状态 (启用 `NodeRestriction` 准入插件以限制 kubelet 只能修改绑定到自身的 Pod)
* 事件
<!--
* nodes and node status (enable the `NodeRestriction` admission plugin to limit a kubelet to modify its own node)
* pods and pod status (enable the `NodeRestriction` admission plugin to limit a kubelet to modify pods bound to itself)
* events
-->
鉴权相关操作：
<!--
Auth-related operations:
-->
* 对于基于 TLS 的启动引导过程时使用的 certificationsigningrequests API 的读/写权限
* 为委派的身份验证/授权检查创建 tokenreviews 和 subjectaccessreviews 的能力
<!--
* read/write access to the certificationsigningrequests API for TLS bootstrapping
* the ability to create tokenreviews and subjectaccessreviews for delegated authentication/authorization checks
-->
在将来的版本中，节点鉴权器可能会添加或删除权限，以确保 kubelet 具有正确操作所需的最小权限集。
<!--
In future releases, the node authorizer may add or remove permissions to ensure kubelets
have the minimal set of permissions required to operate correctly.
-->
为了获得节点鉴权器的授权，kubelet 必须使用一个凭证以表示它在 `system:nodes` 组中，用户名为 `system:node:<nodeName>`。
上述的组名和用户名格式要与 [kubelet TLS 启动引导](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/)过程中为每个 kubelet 创建的标识相匹配。
<!--
In order to be authorized by the Node authorizer, kubelets must use a credential that identifies them as
being in the `system:nodes` group, with a username of `system:node:<nodeName>`.
This group and user name format match the identity created for each kubelet as part of
[kubelet TLS bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/).
-->
要启用节点授权器，请使用 `--authorization-mode = Node` 启动 apiserver。
<!--
To enable the Node authorizer, start the apiserver with `--authorization-mode=Node`.
-->
要限制 kubelet 具有写入权限的 API 对象，请使用 `--enable-admission-plugins=...,NodeRestriction,...` 启动 apiserver，从而启用 [NodeRestriction](/docs/reference/access-authn-authz/admission-controllers#NodeRestriction) 准入插件。
<!--
To limit the API objects kubelets are able to write, enable the [NodeRestriction](/docs/reference/access-authn-authz/admission-controllers#NodeRestriction) admission plugin by starting the apiserver with `--enable-admission-plugins=...,NodeRestriction,...`
-->
## 迁移考虑因素
<!--
## Migration considerations
-->
### 在 `system:nodes` 组之外的 Kubelet
<!--
### Kubelets outside the `system:nodes` group
-->
`system:nodes` 组之外的 kubelet 不会被 `Node` 鉴权模式授权，并且需要继续通过当前授权它们的机制来授权。
节点准入插件不会限制来自这些 kubelet 的请求。
<!--
Kubelets outside the `system:nodes` group would not be authorized by the `Node` authorization mode,
and would need to continue to be authorized via whatever mechanism currently authorizes them.
The node admission plugin would not restrict requests from these kubelets.
-->
### 具有无差别用户名的 Kubelet
<!--
### Kubelets with undifferentiated usernames
-->
在一些部署中，kubelet 具有 `system:nodes` 组的凭证，但是无法给出它们所关联的节点的标识，因为它们没有 `system:node:...` 格式的用户名。
这些 kubelet 不会被 `Node` 授权模式授权，并且需要继续通过当前授权它们的任何机制来授权。
<!--
In some deployments, kubelets have credentials that place them in the `system:nodes` group,
but do not identify the particular node they are associated with,
because they do not have a username in the `system:node:...` format.
These kubelets would not be authorized by the `Node` authorization mode,
and would need to continue to be authorized via whatever mechanism currently authorizes them.
-->
因为默认的节点标识符实现不会把它当作节点身份标识，`NodeRestriction` 准入插件会忽略来自这些 kubelet 的请求。
<!--
The `NodeRestriction` admission plugin would ignore requests from these kubelets,
since the default node identifier implementation would not consider that a node identity.
-->
### 相对于以前使用 RBAC 的版本的更新
<!--
### Upgrades from previous versions using RBAC
-->
升级的 1.7 之前的使用 [RBAC](/docs/reference/access-authn-authz/rbac/) 的集群将继续按原样运行，因为 `system:nodes` 组绑定已经存在。
<!--
Upgraded pre-1.7 clusters using [RBAC](/docs/reference/access-authn-authz/rbac/) will continue functioning as-is because the `system:nodes` group binding will already exist.
-->
如果集群管理员希望开始使用 `Node` 鉴权器和 `NodeRestriction` 准入插件来限制节点对 API 的访问，这一需求可以通过下列操作来完成且不会影响已部署的应用：
<!--
If a cluster admin wishes to start using the `Node` authorizer and `NodeRestriction` admission plugin
to limit node access to the API, that can be done non-disruptively:
-->
1. 启用 `Node` 鉴权模式 (`--authorization-mode=Node,RBAC`) 和 `NodeRestriction` 准入插件
2. 确保所有 kubelet 的凭据符合组/用户名要求
3. 审核 apiserver 日志以确保 `Node` 鉴权器不会拒绝来自 kubelet 的请求（日志中没有持续的 `NODE DENY` 消息）
4. 删除 `system:node` 集群角色绑定
<!--
1. Enable the `Node` authorization mode (`--authorization-mode=Node,RBAC`) and the `NodeRestriction` admission plugin
2. Ensure all kubelets' credentials conform to the group/username requirements
3. Audit apiserver logs to ensure the `Node` authorizer is not rejecting requests from kubelets (no persistent `NODE DENY` messages logged)
4. Delete the `system:node` cluster role binding
-->
### RBAC 节点权限
<!--
### RBAC Node Permissions
-->
在 1.6 版本中，当使用 [RBAC 鉴权模式](/docs/reference/access-authn-authz/rbac/) 时，`system:nodes` 集群角色会被自动绑定到 `system:node` 组。
<!--
In 1.6, the `system:node` cluster role was automatically bound to the `system:nodes` group when using the [RBAC Authorization mode](/docs/reference/access-authn-authz/rbac/).
-->
在 1.7 版本中，不再推荐将 `system:nodes` 组自动绑定到 `system:node` 角色，因为节点鉴权器通过对 secret 和 configmap 访问的额外限制完成了相同的任务。
如果同时启用了 `Node` 和 `RBAC` 授权模式，1.7 版本则不会创建 `system:nodes` 组到 `system:node` 角色的自动绑定。
<!--
In 1.7, the automatic binding of the `system:nodes` group to the `system:node` role is deprecated
because the node authorizer accomplishes the same purpose with the benefit of additional restrictions
on secret and configmap access. If the `Node` and `RBAC` authorization modes are both enabled,
the automatic binding of the `system:nodes` group to the `system:node` role is not created in 1.7.
-->
在 1.8 版本中，绑定将根本不会被创建。
<!--
In 1.8, the binding will not be created at all.
-->
使用 RBAC 时，将继续创建 `system:node` 集群角色，以便与将其他用户或组绑定到该角色的部署方法兼容。
<!--
When using RBAC, the `system:node` cluster role will continue to be created,
for compatibility with deployment methods that bind other users or groups to that role.
-->
{{% /capture %}}
content/zh/docs/reference/access-authn-authz/service-accounts-admin.md
+220
View File
@@ -0,0 +1,220 @@
---
reviewers:
- bprashanth
- davidopp
- lavalamp
- liggitt
title: 管理 Service Accounts
content_template: templates/concept
weight: 50
---
<!--
---
reviewers:
- bprashanth
- davidopp
- lavalamp
- liggitt
title: Managing Service Accounts
content_template: templates/concept
weight: 50
---
-->
{{% capture overview %}}
<!--
This is a Cluster Administrator guide to service accounts. It assumes knowledge of
the [User Guide to Service Accounts](/docs/user-guide/service-accounts).
-->
这是一个关于 service accounts 的集群管理指南，它假设您了解 [Service Accounts 用户指南](/docs/user-guide/service-accounts)。
<!--
Support for authorization and user accounts is planned but incomplete. Sometimes
incomplete features are referred to in order to better describe service accounts.
-->
计划支持授权和用户帐户，但并不完整。有时会引用不完整的功能以便更好地描述 service accounts。
{{% /capture %}}
{{% capture body %}}
<!--
## User accounts vs service accounts
-->
## 用户帐户与 service accounts
<!--
Kubernetes distinguishes between the concept of a user account and a service account
for a number of reasons:
-->
Kubernetes 区分用户帐户和 service account 的概念有以下几个原因：
<!--
- User accounts are for humans. Service accounts are for processes, which
run in pods.
- User accounts are intended to be global. Names must be unique across all
namespaces of a cluster, future user resource will not be namespaced.
Service accounts are namespaced.
- Typically, a cluster's User accounts might be synced from a corporate
database, where new user account creation requires special privileges and
is tied to complex business processes. Service account creation is intended
to be more lightweight, allowing cluster users to create service accounts for
specific tasks (i.e. principle of least privilege).
- Auditing considerations for humans and service accounts may differ.
- A config bundle for a complex system may include definition of various service
accounts for components of that system. Because service accounts can be created
ad-hoc and have namespaced names, such config is portable.
-->
- 用户帐户是针对用户的。Service accounts 用于进程，这些进程在 pods 中运行。
- 用户帐户应该是全局性的。名称必须在集群的所有命名空间中都是唯一的，未来的用户资源将不会使用命名空间。Service accounts 使用命名空间。
- 通常，集群的用户帐户可能与企业数据库同步，在企业数据库中，新用户帐户的创建需要特殊的权限，并且与复杂的业务流程相关联。
Service account 创建的目的是更加轻量级，允许集群用户为特定任务创建 Service account (即：最小特权原则)。
- 对人员和 Service account 的审计考虑可能有所不同。
- 复杂系统的配置包可能包括该系统组件的各种 Service account 的定义。由于 Service account 可以临时创建并具有命名空间名称，因此这种配置是可移植的。
<!--
## Service account automation
-->
## Service account 自动化
<!--
Three separate components cooperate to implement the automation around service accounts:
-->
三个独立的组件合作实现 service accounts 的自动化：
<!--
- A Service account admission controller
- A Token controller
- A Service account controller
-->
- Service account 准入控制器
- 令牌控制器
- Service account 控制器
<!--
### Service Account Admission Controller
-->
### Service Account 准入控制器
<!--
The modification of pods is implemented via a plugin
called an [Admission Controller](/docs/reference/access-authn-authz/admission-controllers/). It is part of the apiserver.
It acts synchronously to modify pods as they are created or updated. When this plugin is active
(and it is by default on most distributions), then it does the following when a pod is created or modified:
-->
pod 的修改是通过一个名为[准入控制器](/docs/reference/access-authn-authz/admission-controllers/)的插件实现的。它是 apiserver 的一部分。它可以同步操作，以便在创建或更新 pod 时对其进行修改。
当此插件处于活动状态时（默认情况下在大多数发行版中），则在创建或修改 pod 时执行以下操作：
<!--
1. If the pod does not have a `ServiceAccount` set, it sets the `ServiceAccount` to `default`.
1. It ensures that the `ServiceAccount` referenced by the pod exists, and otherwise rejects it.
1. If the pod does not contain any `ImagePullSecrets`, then `ImagePullSecrets` of the `ServiceAccount` are added to the pod.
1. It adds a `volume` to the pod which contains a token for API access.
1. It adds a `volumeSource` to each container of the pod mounted at `/var/run/secrets/kubernetes.io/serviceaccount`.
-->
1. 如果 pod 没有设置 `ServiceAccount`，它将 `ServiceAccount` 设置为 `default`。
2. 它确保 pod 引用的 `ServiceAccount` 存在，否则拒绝它。
3. 如果 pod 不包含任何 `ImagePullSecrets`，则将 `ServiceAccount` 的 `ImagePullSecrets` 添加到 pod 中。
4. 它向包含 API 访问令牌的 pod 添加了一个 `volume`。
5. 它为 pod 内的每个容器添加一个 `volumeSource`，该 volume 被挂载到 `/var/run/secrets/kubernetes.io/serviceaccount`。
<!--
### Token Controller
-->
### 令牌控制器
<!--
TokenController runs as part of controller-manager. It acts asynchronously. It:
-->
TokenController 作为控制器-管理器的一部分异步运行。它用于:
<!--
- observes serviceAccount creation and creates a corresponding Secret to allow API access.
- observes serviceAccount deletion and deletes all corresponding ServiceAccountToken Secrets.
- observes secret addition, and ensures the referenced ServiceAccount exists, and adds a token to the secret if needed.
- observes secret deletion and removes a reference from the corresponding ServiceAccount if needed.
-->
- 观察 serviceAccount 创建并创建相应的 Secret 以允许 API 访问。
- 观察 serviceAccount 删除并删除所有相应的 ServiceAccountToken Secrets。
- 观察 secret 添加，并确保引用的 ServiceAccount 存在，并在需要时向该 secret 添加令牌。
- 观察 secret 删除并在需要时从相应的 ServiceAccount 中删除引用。
<!--
You must pass a service account private key file to the token controller in the controller-manager by using
the `--service-account-private-key-file` option. The private key will be used to sign generated service account tokens.
Similarly, you must pass the corresponding public key to the kube-apiserver using the `--service-account-key-file`
option. The public key will be used to verify the tokens during authentication.
-->
您必须使用 `--service-account-private-key-file` 选项将 service account 私钥文件传递给控制器-管理器中的令牌控制器。
私钥将用于签署生成的 service account 令牌。同样，您必须使用 `--service-account-key-file` 选项将相应的公钥传递给
kube-apiserver。公钥将用于在身份验证期间验证令牌。
<!--
#### To create additional API tokens
-->
#### 创建其他 API 令牌
<!--
A controller loop ensures a secret with an API token exists for each service
account. To create additional API tokens for a service account, create a secret
of type `ServiceAccountToken` with an annotation referencing the service
account, and the controller will update it with a generated token:
-->
控制器循环确保每个 service account 都存在具有 API 令牌的 secret。要为 service account 创建其他 API 令牌，
请使用 ServiceAccountToken 引用 service account 的注解创建类型的 secret，控制器将使用生成的令牌更新它：
secret.json:
```json
{
"kind": "Secret",
"apiVersion": "v1",
"metadata": {
"name": "mysecretname",
"annotations": {
"kubernetes.io/service-account.name": "myserviceaccount"
}
},
"type": "kubernetes.io/service-account-token"
}
```
```shell
kubectl create -f ./secret.json
kubectl describe secret mysecretname
```
<!--
#### To delete/invalidate a service account token
-->
#### 删除/无效化 一个 service account 令牌
```shell
kubectl delete secret mysecretname
```
<!--
### Service Account Controller
-->
### Service Account 控制器
<!--
Service Account Controller manages ServiceAccount inside namespaces, and ensures
a ServiceAccount named "default" exists in every active namespace.
-->
Service Account 控制器在命名空间中管理 ServiceAccount，并确保每个活动命名空间中都存在一个名为 `default` 的 ServiceAccount。
{{% /capture %}}
content/zh/docs/reference/access-authn-authz/webhook.md
+239
View File
@@ -0,0 +1,239 @@
---
title: Webhook 模式
content_template: templates/concept
weight: 95
---
<!--
---
reviewers:
- erictune
- lavalamp
- deads2k
- liggitt
title: Webhook Mode
content_template: templates/concept
weight: 95
---
-->
{{% capture overview %}}
<!--
A WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen.
-->
WebHook 是一种 HTTP 回调：一种当有事情发生时的 HTTP POST 请求；一种基于 HTTP POST 方式完成的事件通知。实现了 WebHook 的 Web 应用会在特定事件发生时通过 POST 向某 URL 发送消息。
{{% /capture %}}
{{% capture body %}}
<!--
When specified, mode `Webhook` causes Kubernetes to query an outside REST
service when determining user privileges.
-->
当 `Webhook` 模式被启用时，Kubernetes 会在需要确定用户权限时访问外部 REST 服务。
<!--
## Configuration File Format
-->
## 配置文件格式
<!-- Mode `Webhook` requires a file for HTTP configuration, specify by the
`--authorization-webhook-config-file=SOME_FILENAME` flag. -->
`Webhook` 模式需要一个通过 `--authorization-webhook-config-file=SOME_FILENAME` 参数指定的 HTTP 配置文件。
<!--
The configuration file uses the [kubeconfig](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/)
file format. Within the file "users" refers to the API Server webhook and
"clusters" refers to the remote service.
-->
配置文件使用 [kubeconfig](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/) 文件格式。在文件中，"users" 对应 API 服务器 webhook，"clusters" 指远程服务。
<!--
A configuration example which uses HTTPS client auth:
-->
使用 HTTPS 客户端鉴权的配置文件示例：
<!--
```yaml
# Kubernetes API version
apiVersion: v1
# kind of the API object
kind: Config
# clusters refers to the remote service.
clusters:
- name: name-of-remote-authz-service
cluster:
# CA for verifying the remote service.
certificate-authority: /path/to/ca.pem
# URL of remote service to query. Must use 'https'. May not include parameters.
server: https://authz.example.com/authorize
# users refers to the API Server's webhook configuration.
users:
- name: name-of-api-server
user:
client-certificate: /path/to/cert.pem # cert for the webhook plugin to use
client-key: /path/to/key.pem # key matching the cert
# kubeconfig files require a context. Provide one for the API Server.
current-context: webhook
contexts:
- context:
cluster: name-of-remote-authz-service
user: name-of-api-server
name: webhook
```
-->
```yaml
# Kubernetes API 版本
apiVersion: v1
# API 对象类型
kind: Config
# 远程服务对应的集群。
clusters:
- name: name-of-remote-authz-service
cluster:
# 远程服务验证所需 CA
certificate-authority: /path/to/ca.pem
# 用来访问远程服务的 URL。必须使用 'https'。不可以包含参数。
server: https://authz.example.com/authorize
# API 服务器的 webhook 配置对应的用户
users:
- name: name-of-api-server
user:
client-certificate: /path/to/cert.pem # webhook 插件所使用的证书
client-key: /path/to/key.pem # 与证书对应的密钥
# kubeconfig 文件所需上下文。提供给 API 服务器使用。
current-context: webhook
contexts:
- context:
cluster: name-of-remote-authz-service
user: name-of-api-server
name: webhook
```
<!--
## Request Payloads
-->
## 请求的载荷
<!--
When faced with an authorization decision, the API Server POSTs a JSON-
serialized `authorization.k8s.io/v1beta1` `SubjectAccessReview` object describing the
action. This object contains fields describing the user attempting to make the
request, and either details about the resource being accessed or requests
attributes.
-->
鉴权时，API 服务器使用 POST 方式发送一条 JSON-序列化的 `authorization.k8s.io/v1beta1` `SubjectAccessReview` 对象来描述操作。此对象包含了描述发出请求的用户的字段，还包含了将要被访问的资源信息或请求属性。
<!--
Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/concepts/overview/kubernetes-api/)
as other Kubernetes API objects. Implementers should be aware of looser
compatibility promises for beta objects and check the "apiVersion" field of the
request to ensure correct deserialization. Additionally, the API Server must
enable the `authorization.k8s.io/v1beta1` API extensions group (`--runtime-config=authorization.k8s.io/v1beta1=true`).
-->
请注意，webhook API 对象和其它 Kubernetes API 对象一样遵循[版本兼容性规则](/docs/concepts/overview/kubernetes-api/)。
实现者应当注意 beta 版本对象的兼容性承诺是相当宽松的，并检查请求的 "apiVersion" 字段来保证正确的反序列化。此外，API服务器必须启用 `authorization.k8s.io/v1beta1` API 扩展组 (`--runtime-config=authorization.k8s.io/v1beta1=true`)。
<!--
An example request body:
-->
请求体示例：
```json
{
"apiVersion": "authorization.k8s.io/v1beta1",
"kind": "SubjectAccessReview",
"spec": {
"resourceAttributes": {
"namespace": "kittensandponies",
"verb": "get",
"group": "unicorn.example.org",
"resource": "pods"
},
"user": "jane",
"group": [
"group1",
"group2"
]
}
}
```
<!--
The remote service is expected to fill the `status` field of
the request and respond to either allow or disallow access. The response body's
`spec` field is ignored and may be omitted. A permissive response would return:
-->
远程服务应当填写请求的 `status` 字段，并且返回是否允许访问的响应。响应体的 `spec` 字段应当被忽略，且可以被省略。允许访问的响应返回格式如下：
```json
{
"apiVersion": "authorization.k8s.io/v1beta1",
"kind": "SubjectAccessReview",
"status": {
"allowed": true
}
}
```
<!--
To disallow access, the remote service would return:
-->
远程服务拒绝访问的返回格式如下：
```json
{
"apiVersion": "authorization.k8s.io/v1beta1",
"kind": "SubjectAccessReview",
"status": {
"allowed": false,
"reason": "user does not have read access to the namespace"
}
}
```
<!--
Access to non-resource paths are sent as:
-->
对非资源路径的请求格式如下：
```json
{
"apiVersion": "authorization.k8s.io/v1beta1",
"kind": "SubjectAccessReview",
"spec": {
"nonResourceAttributes": {
"path": "/debug",
"verb": "get"
},
"user": "jane",
"group": [
"group1",
"group2"
]
}
}
```
<!--
Non-resource paths include: `/api`, `/apis`, `/metrics`, `/resetMetrics`,
`/logs`, `/debug`, `/healthz`, `/swagger-ui/`, `/swaggerapi/`, `/ui`, and
`/version.` Clients require access to `/api`, `/api/*`, `/apis`, `/apis/*`,
and `/version` to discover what resources and versions are present on the server.
Access to other non-resource paths can be disallowed without restricting access
to the REST api.
-->
非资源路径包括： `/api`、`/apis`、`/metrics`、`/resetMetrics`、`/logs`、`/debug`、
`/healthz`、`/swagger-ui/`、`/swaggerapi/`、`/ui` 和 `/version`。
客户端需要访问 `/api`、`/api/*`、`/apis`、`/apis/*` 和 `/version` 来获取服务器上存在资源和版本列表。
对其它非资源路径的访问可以被禁止；这样做并不会影响对 REST API 的访问。
<!--
For further documentation refer to the authorization.v1beta1 API objects and
[webhook.go](https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/webhook.go).
-->
关于 Webhook 模式的更多信息可参阅 authorization.v1beta1 API 对象的参考指南和 [webhook.go](https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/webhook.go) 文件。
{{% /capture %}}