whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[zh] Remove reviewer for best-practices

Browse Source
This commit is contained in:
Sean Wei
2022-05-26 16:51:00 +08:00
parent b05bcc9823
commit 6e7c8bb9f5
2 changed files with 113 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/zh/docs/setup/best-practices/certificates.md
+60 -16
View File
@@ -1,7 +1,5 @@
---
title: PKI 证书和要求
reviewers:
- sig-cluster-lifecycle
content_type: concept
weight: 40
---
@@ -18,7 +16,7 @@ weight: 40
<!--
Kubernetes requires PKI certificates for authentication over TLS.
If you install Kubernetes with [kubeadm](/docs/reference/setup-tools/kubeadm/), the certificates that your cluster requires are automatically generated.
You can also generate your own certificates - for example, to keep your private keys more secure by not storing them on the API server.
You can also generate your own certificates -- for example, to keep your private keys more secure by not storing them on the API server.
This page explains the certificates that your cluster requires.
-->
Kubernetes 需要 PKI 证书才能进行基于 TLS 的身份验证。如果你是使用
@@ -33,7 +31,7 @@ Kubernetes 需要 PKI 证书才能进行基于 TLS 的身份验证。如果你
Kubernetes requires PKI for the following operations:
-->
## 集群是如何使用证书的
## 集群是如何使用证书的 {#how-certificates-are-used-by-your-cluster}
Kubernetes 需要 PKI 才能执行以下操作：
@@ -61,7 +59,7 @@ Kubernetes 需要 PKI 才能执行以下操作：
* [前端代理](/zh/docs/tasks/extend-kubernetes/configure-aggregation-layer/) 的客户端及服务端证书
<!--
`front-proxy` certificates are required only if you run kube-proxy to support [an extension API server](/docs/tasks/access-kubernetes-api/setup-extension-api-server/).
`front-proxy` certificates are required only if you run kube-proxy to support [an extension API server](/docs/tasks/extend-kubernetes/setup-extension-api-server/).
-->
{{< note >}}
只有当你运行 kube-proxy 并要支持
@@ -79,7 +77,7 @@ etcd 还实现了双向 TLS 来对客户端和对其他对等节点进行身份
If you install Kubernetes with kubeadm, most certificates are stored in `/etc/kubernetes/pki`. All paths in this documentation are relative to that directory, with the exception of user account certificates which kubeadm places in `/etc/kubernetes`.
-->
## 证书存放的位置
## 证书存放的位置 {#where-certificates-are-stored}
假如通过 kubeadm 安装 Kubernetes，大多数证书都存储在 `/etc/kubernetes/pki`。
本文档中的所有路径都是相对于该目录的，但用户账户证书除外，kubeadm 将其放在 `/etc/kubernetes` 中。
@@ -90,7 +88,7 @@ If you install Kubernetes with kubeadm, most certificates are stored in `/etc/ku
If you don't want kubeadm to generate the required certificates, you can create them using a single root CA or by providing all certificates. See [Certificates](/docs/tasks/administer-cluster/certificates/) for details on creating your own certificate authority.
See [Certificate Management with kubeadm](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/) for more on managing certificates.
-->
## 手动配置证书
## 手动配置证书 {#configure-certificates-manually}
如果你不想通过 kubeadm 生成这些必需的证书，你可以使用一个单一的根 CA
来创建这些证书或者直接提供所有证书。
@@ -102,14 +100,14 @@ See [Certificate Management with kubeadm](/docs/tasks/administer-cluster/kubeadm
You can create a single root CA, controlled by an administrator. This root CA can then create multiple intermediate CAs, and delegate all further creation to Kubernetes itself.
-->
### 单根 CA
### 单根 CA {#single-root-ca}
你可以创建一个单根 CA，由管理员控制器它。该根 CA 可以创建多个中间 CA，并将所有进一步的创建委托给 Kubernetes。
<!--
Required CAs:
| 路径 | 默认 CN | 描述 |
| path | Default CN | description |
|------------------------|---------------------------|----------------------------------|
| ca.crt,key | kubernetes-ca | Kubernetes general CA |
| etcd/ca.crt,key | etcd-ca | For all etcd-related functions |
@@ -148,13 +146,24 @@ If you don't wish to copy the CA private keys to your cluster, you can generate
Required certificates:
-->
### 所有的证书
### 所有的证书 {#all-certificates}
如果你不想将 CA 的私钥拷贝至你的集群中，你也可以自己生成全部的证书。
需要这些证书：
| 默认 CN | 父级 CA | O (位于 Subject 中) | 类型 | 主机 (SAN) |
<!--
| Default CN | Parent CA | O (in Subject) | kind | hosts (SAN) |
|-------------------------------|---------------------------|----------------|----------------------------------------|---------------------------------------------|
| kube-etcd | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
| kube-etcd-peer | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
| kube-etcd-healthcheck-client | etcd-ca | | client | |
| kube-apiserver-etcd-client | etcd-ca | system:masters | client | |
| kube-apiserver | kubernetes-ca | | server | `<hostname>`, `<Host_IP>`, `<advertise_IP>`, `[1]` |
| kube-apiserver-kubelet-client | kubernetes-ca | system:masters | client | |
| front-proxy-client | kubernetes-front-proxy-ca | | client | |
-->
| 默认 CN | 父级 CA | O (位于 Subject 中) | 类型 | 主机 (SAN) |
|-------------------------------|---------------------------|----------------|----------------------------------------|---------------------------------------------|
| kube-etcd | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
| kube-etcd-peer | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
@@ -165,7 +174,8 @@ Required certificates:
| front-proxy-client | kubernetes-front-proxy-ca | | client | |
<!--
[1]: any other IP or DNS name you contact your cluster on (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/) the load balancer stable IP and/or DNS name, `kubernetes`, `kubernetes.default`, `kubernetes.default.svc`,
[1]: any other IP or DNS name you contact your cluster on (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)
the load balancer stable IP and/or DNS name, `kubernetes`, `kubernetes.default`, `kubernetes.default.svc`,
`kubernetes.default.svc.cluster`, `kubernetes.default.svc.cluster.local`)
where `kind` maps to one or more of the [x509 key usage](https://pkg.go.dev/k8s.io/api/certificates/v1beta1#KeyUsage) types:
@@ -213,12 +223,32 @@ For kubeadm users only:
<!--
### Certificate paths
Certificates should be placed in a recommended path (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)). Paths should be specified using the given argument regardless of location.
Certificates should be placed in a recommended path (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)).
Paths should be specified using the given argument regardless of location.
-->
### 证书路径
### 证书路径 {#certificate-paths}
证书应放置在建议的路径中（以便 [kubeadm](/zh/docs/reference/setup-tools/kubeadm/)使用）。无论使用什么位置，都应使用给定的参数指定路径。
证书应放置在建议的路径中（以便 [kubeadm](/zh/docs/reference/setup-tools/kubeadm/)
使用）。无论使用什么位置，都应使用给定的参数指定路径。
<!--
| Default CN | recommended key path | recommended cert path | command | key argument | cert argument |
|------------------------------|------------------------------|-----------------------------|----------------|------------------------------|-------------------------------------------|
| etcd-ca | etcd/ca.key | etcd/ca.crt | kube-apiserver | | --etcd-cafile |
| kube-apiserver-etcd-client | apiserver-etcd-client.key | apiserver-etcd-client.crt | kube-apiserver | --etcd-keyfile | --etcd-certfile |
| kubernetes-ca | ca.key | ca.crt | kube-apiserver | | --client-ca-file |
| kubernetes-ca | ca.key | ca.crt | kube-controller-manager | --cluster-signing-key-file | --client-ca-file, --root-ca-file, --cluster-signing-cert-file |
| kube-apiserver | apiserver.key | apiserver.crt | kube-apiserver | --tls-private-key-file | --tls-cert-file |
| kube-apiserver-kubelet-client| apiserver-kubelet-client.key | apiserver-kubelet-client.crt| kube-apiserver | --kubelet-client-key | --kubelet-client-certificate |
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-apiserver | | --requestheader-client-ca-file |
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-controller-manager | | --requestheader-client-ca-file |
| front-proxy-client | front-proxy-client.key | front-proxy-client.crt | kube-apiserver | --proxy-client-key-file | --proxy-client-cert-file |
| etcd-ca | etcd/ca.key | etcd/ca.crt | etcd | | --trusted-ca-file, --peer-trusted-ca-file |
| kube-etcd | etcd/server.key | etcd/server.crt | etcd | --key-file | --cert-file |
| kube-etcd-peer | etcd/peer.key | etcd/peer.crt | etcd | --peer-key-file | --peer-cert-file |
| etcd-ca | | etcd/ca.crt | etcdctl | | --cacert |
| kube-etcd-healthcheck-client | etcd/healthcheck-client.key | etcd/healthcheck-client.crt | etcdctl | --key | --cert |
-->
| 默认 CN | 建议的密钥路径 | 建议的证书路径 | 命令 | 密钥参数 | 证书参数 |
|------------------------------|------------------------------|-----------------------------|----------------|------------------------------|-------------------------------------------|
| etcd-ca | etcd/ca.key | etcd/ca.crt | kube-apiserver | | --etcd-cafile |
@@ -241,6 +271,12 @@ Same considerations apply for the service account key pair:
-->
注意事项同样适用于服务帐户密钥对：
<!--
| private key path | public key path | command | argument |
|------------------------------|-----------------------------|-------------------------|--------------------------------------|
| sa.key | | kube-controller-manager | --service-account-private-key-file |
| | sa.pub | kube-apiserver | --service-account-key-file |
-->
| 私钥路径 | 公钥路径 | 命令 | 参数 |
|------------------------------|-----------------------------|-------------------------|--------------------------------------|
| sa.key | | kube-controller-manager | --service-account-private-key-file |
@@ -282,10 +318,18 @@ The following example illustrates the file paths [from the previous tables](/doc
You must manually configure these administrator account and service accounts:
-->
## 为用户帐户配置证书
## 为用户帐户配置证书 {#configure-certificates-for-user-accounts}
你必须手动配置以下管理员帐户和服务帐户：
<!--
| filename | credential name | Default CN | O (in Subject) |
|-------------------------|----------------------------|--------------------------------|----------------|
| admin.conf | default-admin | kubernetes-admin | system:masters |
| kubelet.conf | default-auth | system:node:`<nodeName>` (see note) | system:nodes |
| controller-manager.conf | default-controller-manager | system:kube-controller-manager | |
| scheduler.conf | default-scheduler | system:kube-scheduler | |
-->
| 文件名 | 凭据名称 | 默认 CN | O (位于 Subject 中) |
|-------------------------|----------------------------|--------------------------------|---------------------|
| admin.conf | default-admin | kubernetes-admin | system:masters |
content/zh/docs/setup/best-practices/node-conformance.md
+53 -40
View File
@@ -1,16 +1,12 @@
---
reviewers:
- Random-Liu
title: 校验节点设置
weight: 30
---
<!--
---
reviewers:
- Random-Liu
title: Validate node setup
weight: 30
---
-->
{{< toc >}}
@@ -18,13 +14,16 @@ weight: 30
<!--
## Node Conformance Test
-->
## 节点一致性测试
## 节点一致性测试 {#node-conformance-test}
<!--
*Node conformance test* is a containerized test framework that provides a system
verification and functionality test for a node.
verification and functionality test for a node. The test validates whether the
node meets the minimum requirements for Kubernetes; a node that passes the test
is qualified to join a Kubernetes cluster.
-->
*节点一致性测试* 是一个容器化的测试框架，提供了针对节点的系统验证和功能测试。
**节点一致性测试** 是一个容器化的测试框架，提供了针对节点的系统验证和功能测试。
测试验证节点是否满足 Kubernetes 的最低要求；通过测试的节点有资格加入 Kubernetes 集群。
<!--
The test validates whether the node meets the minimum requirements for Kubernetes; a node that passes the testis qualified to join a Kubernetes cluster.
@@ -34,10 +33,12 @@ The test validates whether the node meets the minimum requirements for Kubernete
<!--
## Node Prerequisite
-->
## 节点的前提条件
## 节点的前提条件 {#node-prerequisite}
<!--
To run node conformance test, a node must satisfy the same prerequisites as astandard Kubernetes node. At a minimum, the node should have the following daemons installed:
To run node conformance test, a node must satisfy the same prerequisites as a
standard Kubernetes node. At a minimum, the node should have the following
daemons installed:
-->
要运行节点一致性测试，节点必须满足与标准 Kubernetes 节点相同的前提条件。节点至少应安装以下守护程序：
@@ -51,7 +52,7 @@ To run node conformance test, a node must satisfy the same prerequisites as asta
<!--
## Running Node Conformance Test
-->
## 运行节点一致性测试
## 运行节点一致性测试 {#running-node-conformance-test}
<!--
To run the node conformance test, perform the following steps:
@@ -67,16 +68,23 @@ To run the node conformance test, perform the following steps:
* `--cloud-provider`: If you are using `--cloud-provider=gce`, you should
remove the flag to run the test.
-->
1. 得出 kubelet 的 `--kubeconfig` 的值；例如：`--kubeconfig=/var/lib/kubelet/config.yaml`.
由于测试框架启动了本地控制平面来测试 kubelet， 因此使用 `http://localhost:8080`
1. 得出 kubelet 的 `--kubeconfig` 的值；例如：`--kubeconfig=/var/lib/kubelet/config.yaml`。
由于测试框架启动了本地控制平面来测试 kubelet，因此使用 `http://localhost:8080`
作为API 服务器的 URL。
一些其他的 kubelet 命令行参数可能会被用到：
* `--cloud-provider`： 如果使用 `--cloud-provider=gce`，需要移除这个参数
来运行测试。
* `--cloud-provider`：如果使用 `--cloud-provider=gce`，需要移除这个参数来运行测试。
<!--
2. Run the node conformance test with command:
```shell
# $CONFIG_DIR is the pod manifest path of your Kubelet.
# $LOG_DIR is the test output path.
sudo docker run -it --rm --privileged --net=host \
-v /:/rootfs -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
k8s.gcr.io/node-test:0.2
```
-->
2. 使用以下命令运行节点一致性测试：
@@ -91,45 +99,48 @@ To run the node conformance test, perform the following steps:
<!--
## Running Node Conformance Test for Other Architectures
-->
## 针对其他硬件体系结构运行节点一致性测试
## 针对其他硬件体系结构运行节点一致性测试 {#running-node-conformance-test-for-other-architectures}
<!--
Kubernetes also provides node conformance test docker images for other architectures:
Kubernetes also provides node conformance test docker images for other
architectures:
-->
Kubernetes 也为其他硬件体系结构的系统提供了节点一致性测试的 Docker 镜像：
<!--
| Arch | Image | |
| ----- | :-------------: | ---- |
| amd64 | node-test-amd64 | |
| arm | node-test-arm | |
| arm64 | node-test-arm64 | |
Arch | Image |
--------|:-----------------:|
amd64 | node-test-amd64 |
arm | node-test-arm |
arm64 | node-test-arm64 |
-->
| 架构 | 镜像 | |
| ----- | :-------------: | ---- |
| amd64 | node-test-amd64 | |
| arm | node-test-arm | |
| arm64 | node-test-arm64 | |
架构 | 镜像 |
--------|:-----------------:|
amd64 | node-test-amd64 |
arm | node-test-arm |
arm64 | node-test-arm64 |
<!--
## Running Selected Test
-->
## 运行特定的测试
## 运行特定的测试 {#running-selected-test}
<!--
To run specific tests, overwrite the environment variable `FOCUS` with theregular expression of tests you want to run.
To run specific tests, overwrite the environment variable `FOCUS` with the
regular expression of tests you want to run.
-->
要运行特定测试，请使用你希望运行的测试的特定表达式覆盖环境变量 `FOCUS`。
```shell
sudo docker run -it --rm --privileged --net=host \
-v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-e FOCUS=MirrorPod \ # Only run MirrorPod test
k8s.gcr.io/node-test:0.2
-v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-e FOCUS=MirrorPod \ # Only run MirrorPod test
k8s.gcr.io/node-test:0.2
```
<!--
To skip specific tests, overwrite the environment variable `SKIP` with theregular expression of tests you want to skip.
To skip specific tests, overwrite the environment variable `SKIP` with the
regular expression of tests you want to skip.
-->
要跳过特定的测试，请使用你希望跳过的测试的常规表达式覆盖环境变量 `SKIP`。
@@ -138,35 +149,37 @@ To skip specific tests, overwrite the environment variable `SKIP` with theregula
sudo docker run -it --rm --privileged --net=host \
-v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-e SKIP=MirrorPod \ # Run all conformance tests but skip MirrorPod test
k8s.gcr.io/node-test:0.2
k8s.gcr.io/node-test:0.2
```
-->
```shell
sudo docker run -it --rm --privileged --net=host \
-v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-e SKIP=MirrorPod \ # 运行除 MirrorPod 测试外的所有一致性测试内容
k8s.gcr.io/node-test:0.2
k8s.gcr.io/node-test:0.2
```
<!--
Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/devel/e2e-node-tests.md).
Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/e2e-node-tests.md).
-->
节点一致性测试是[节点端到端测试](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/devel/e2e-node-tests.md)的容器化版本。
节点一致性测试是[节点端到端测试](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/e2e-node-tests.md)的容器化版本。
<!--
By default, it runs all conformance tests.
-->
默认情况下，它会运行所有一致性测试。
<!--
Theoretically, you can run any node e2e test if you configure the container andmount required volumes properly. But **it is strongly recommended to only run conformance test**, because it requires much more complex configuration to run non-conformance test.
Theoretically, you can run any node e2e test if you configure the container and
mount required volumes properly. But **it is strongly recommended to only run conformance
test**, because it requires much more complex configuration to run non-conformance test.
-->
理论上，只要合理地配置容器和挂载所需的卷，就可以运行任何的节点端到端测试用例。 但是这里**强烈建议只运行一致性测试**，因为运行非一致性测试需要很多复杂的配置。
理论上，只要合理地配置容器和挂载所需的卷，就可以运行任何的节点端到端测试用例。但是这里**强烈建议只运行一致性测试**，因为运行非一致性测试需要很多复杂的配置。
<!--
## Caveats
-->
## 注意
## 注意事项 {#caveats}
<!--
* The test leaves some docker images on the node, including the node conformance
@@ -176,5 +189,5 @@ Theoretically, you can run any node e2e test if you configure the container andm
during the functionality test.
-->
* 测试会在节点上遗留一些 Docker 镜像， 包括节点一致性测试本身的镜像和功能测试相关的镜像。
* 测试会在节点上遗留一些 Docker 镜像，包括节点一致性测试本身的镜像和功能测试相关的镜像。
* 测试会在节点上遗留一些死的容器。这些容器是在功能测试的过程中创建的。