Merge pull request #35410 from Sea-n/zh-ref-auth

[zh-cn] Update kubelet-authn-authz.md

content/zh-cn/docs/reference/access-authn-authz/kubelet-authn-authz.md

@@ -10,7 +10,7 @@ title: Kubelet authentication/authorization
 <!--
 ## Overview
 -->
-## 概述
+## 概述  {#overview}
 
 <!--
 A kubelet's HTTPS endpoint exposes APIs which give access to data of varying sensitivity,
@@ -28,7 +28,7 @@ This document describes how to authenticate and authorize access to the kubelet'
 <!--
 ## Kubelet authentication
 -->
-## Kubelet 身份认证 
+## Kubelet 身份认证   {#kubelet-authentication}
 
 <!--
 By default, requests to the kubelet's HTTPS endpoint that are not rejected by other configured
@@ -59,9 +59,9 @@ To enable X509 client certificate authentication to the kubelet's HTTPS endpoint
 * see the [apiserver authentication documentation](/docs/reference/access-authn-authz/authentication/#x509-client-certs) for more details
 -->
 * 带 `--client-ca-file` 标志启动 kubelet，提供一个 CA 证书包以供验证客户端证书
-* 带 `--kubelet-client-certificate` 和 `--kubelet-client-key` 标志启动 apiserver
+* 带 `--kubelet-client-certificate` 和 `--kubelet-client-key` 标志启动 API 服务器
 * 有关更多详细信息，请参见
-  [apiserver 身份验证文档](/zh/docs/reference/access-authn-authz/authentication/#x509-client-certs)
+  [API 服务器身份验证文档](/zh-cn/docs/reference/access-authn-authz/authentication/#x509-client-certs)
 
 <!--
 To enable API bearer tokens (including service account tokens) to be used to authenticate to the kubelet's HTTPS endpoint:
@@ -70,7 +70,7 @@ To enable API bearer tokens (including service account tokens) to be used to aut
 
 <!--
 * ensure the `authentication.k8s.io/v1beta1` API group is enabled in the API server
-* start the kubelet with the `--authentication-token-webhook` and the `--kubeconfig` flags
+* start the kubelet with the `--authentication-token-webhook` and `--kubeconfig` flags
 * the kubelet calls the `TokenReview` API on the configured API server to determine user information from bearer tokens
 -->
 * 确保在 API 服务器中启用了 `authentication.k8s.io/v1beta1` API 组
@@ -80,7 +80,7 @@ To enable API bearer tokens (including service account tokens) to be used to aut
 <!--
 ## Kubelet authorization
 -->
-## Kubelet 鉴权 
+## Kubelet 鉴权   {#kubelet-authorization}
 
 <!--
 Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is `AlwaysAllow`, which allows all requests.
@@ -120,8 +120,8 @@ To subdivide access to the kubelet API, delegate authorization to the API server
 <!--
 The kubelet authorizes API requests using the same [request attributes](/docs/reference/access-authn-authz/authorization/#review-your-request-attributes) approach as the apiserver.
 -->
-kubelet 使用与 apiserver 相同的
+kubelet 使用与 API 服务器相同的
-[请求属性](/zh/docs/reference/access-authn-authz/authorization/#review-your-request-attributes)
+[请求属性](/zh-cn/docs/reference/access-authn-authz/authorization/#review-your-request-attributes)
 方法对 API 请求执行鉴权。
 
 <!--
@@ -154,7 +154,7 @@ Kubelet API  | 资源 | 子资源
 /metrics/\*   | nodes    | metrics
 /logs/\*      | nodes    | log
 /spec/\*      | nodes    | spec
-*其它所有* | nodes    | proxy
+**其它所有**  | nodes    | proxy
 
 <!--
 The namespace and API group attributes are always an empty string, and
@@ -167,7 +167,7 @@ the resource name is always the name of the kubelet's `Node` API object.
 When running in this mode, ensure the user identified by the `--kubelet-client-certificate` and `--kubelet-client-key`
 flags passed to the apiserver is authorized for the following attributes:
 -->
-在此模式下运行时，请确保传递给 apiserver 的由 `--kubelet-client-certificate` 和
+在此模式下运行时，请确保传递给 API 服务器的由 `--kubelet-client-certificate` 和
 `--kubelet-client-key` 标志标识的用户具有以下属性的鉴权：
 
 * verb=\*, resource=nodes, subresource=proxy