From 6e7c8bb9f5bcd76bb71719874f24f72f73297ccb Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Thu, 26 May 2022 16:51:00 +0800
Subject: [PATCH] [zh] Remove reviewer for best-practices

---
 .../docs/setup/best-practices/certificates.md | 76 +++++++++++----
 .../setup/best-practices/node-conformance.md  | 93 +++++++++++--------
 2 files changed, 113 insertions(+), 56 deletions(-)

diff --git a/content/zh/docs/setup/best-practices/certificates.md b/content/zh/docs/setup/best-practices/certificates.md
index bb96a887f6..2acb106748 100644
--- a/content/zh/docs/setup/best-practices/certificates.md
+++ b/content/zh/docs/setup/best-practices/certificates.md
@@ -1,7 +1,5 @@
 ---
 title: PKI 证书和要求
-reviewers:
-- sig-cluster-lifecycle
 content_type: concept
 weight: 40
 ---
@@ -18,7 +16,7 @@ weight: 40
 <!--
 Kubernetes requires PKI certificates for authentication over TLS.
 If you install Kubernetes with [kubeadm](/docs/reference/setup-tools/kubeadm/), the certificates that your cluster requires are automatically generated.
-You can also generate your own certificates - for example, to keep your private keys more secure by not storing them on the API server.
+You can also generate your own certificates -- for example, to keep your private keys more secure by not storing them on the API server.
 This page explains the certificates that your cluster requires.
 -->
 Kubernetes 需要 PKI 证书才能进行基于 TLS 的身份验证。如果你是使用
@@ -33,7 +31,7 @@ Kubernetes 需要 PKI 证书才能进行基于 TLS 的身份验证。如果你
 
 Kubernetes requires PKI for the following operations:
 -->
-## 集群是如何使用证书的
+## 集群是如何使用证书的    {#how-certificates-are-used-by-your-cluster}
 
 Kubernetes 需要 PKI 才能执行以下操作：
 
@@ -61,7 +59,7 @@ Kubernetes 需要 PKI 才能执行以下操作：
 * [前端代理](/zh/docs/tasks/extend-kubernetes/configure-aggregation-layer/) 的客户端及服务端证书
 
 <!--
-`front-proxy` certificates are required only if you run kube-proxy to support [an extension API server](/docs/tasks/access-kubernetes-api/setup-extension-api-server/).
+`front-proxy` certificates are required only if you run kube-proxy to support [an extension API server](/docs/tasks/extend-kubernetes/setup-extension-api-server/).
 -->
 {{< note >}}
 只有当你运行 kube-proxy 并要支持
@@ -79,7 +77,7 @@ etcd 还实现了双向 TLS 来对客户端和对其他对等节点进行身份
 
 If you install Kubernetes with kubeadm, most certificates are stored in `/etc/kubernetes/pki`. All paths in this documentation are relative to that directory, with the exception of user account certificates which kubeadm places in `/etc/kubernetes`.
 -->
-## 证书存放的位置
+## 证书存放的位置    {#where-certificates-are-stored}
 
 假如通过 kubeadm 安装 Kubernetes，大多数证书都存储在 `/etc/kubernetes/pki`。
 本文档中的所有路径都是相对于该目录的，但用户账户证书除外，kubeadm 将其放在 `/etc/kubernetes` 中。
@@ -90,7 +88,7 @@ If you install Kubernetes with kubeadm, most certificates are stored in `/etc/ku
 If you don't want kubeadm to generate the required certificates, you can create them using a single root CA or by providing all certificates. See [Certificates](/docs/tasks/administer-cluster/certificates/) for details on creating your own certificate authority.
 See [Certificate Management with kubeadm](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/) for more on managing certificates.
 -->
-## 手动配置证书
+## 手动配置证书    {#configure-certificates-manually}
 
 如果你不想通过 kubeadm 生成这些必需的证书，你可以使用一个单一的根 CA
 来创建这些证书或者直接提供所有证书。
@@ -102,14 +100,14 @@ See [Certificate Management with kubeadm](/docs/tasks/administer-cluster/kubeadm
 
 You can create a single root CA, controlled by an administrator. This root CA can then create multiple intermediate CAs, and delegate all further creation to Kubernetes itself.
 -->
-### 单根 CA
+### 单根 CA    {#single-root-ca}
 
 你可以创建一个单根 CA，由管理员控制器它。该根 CA 可以创建多个中间 CA，并将所有进一步的创建委托给 Kubernetes。
 
 <!--
 Required CAs:
 
-| 路径                    | 默认 CN                    | 描述                             |
+| path                   | Default CN                | description                      |
 |------------------------|---------------------------|----------------------------------|
 | ca.crt,key             | kubernetes-ca             | Kubernetes general CA            |
 | etcd/ca.crt,key        | etcd-ca                   | For all etcd-related functions   |
@@ -148,13 +146,24 @@ If you don't wish to copy the CA private keys to your cluster, you can generate
 
 Required certificates:
 -->
-### 所有的证书
+### 所有的证书    {#all-certificates}
 
 如果你不想将 CA 的私钥拷贝至你的集群中，你也可以自己生成全部的证书。
 
 需要这些证书：
 
-| 默认 CN                    | 父级 CA                 | O (位于 Subject 中) | 类型                                   | 主机 (SAN)                                 |
+<!--
+| Default CN                    | Parent CA                 | O (in Subject) | kind                                   | hosts (SAN)                                 |
+|-------------------------------|---------------------------|----------------|----------------------------------------|---------------------------------------------|
+| kube-etcd                     | etcd-ca                   |                | server, client                         | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
+| kube-etcd-peer                | etcd-ca                   |                | server, client                         | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
+| kube-etcd-healthcheck-client  | etcd-ca                   |                | client                                 |                                             |
+| kube-apiserver-etcd-client    | etcd-ca                   | system:masters | client                                 |                                             |
+| kube-apiserver                | kubernetes-ca             |                | server                                 | `<hostname>`, `<Host_IP>`, `<advertise_IP>`, `[1]` |
+| kube-apiserver-kubelet-client | kubernetes-ca             | system:masters | client                                 |                                             |
+| front-proxy-client            | kubernetes-front-proxy-ca |                | client                                 |                                             |
+-->
+| 默认 CN                       | 父级 CA                   | O (位于 Subject 中) | 类型                              | 主机 (SAN)                                  |
 |-------------------------------|---------------------------|----------------|----------------------------------------|---------------------------------------------|
 | kube-etcd                     | etcd-ca                   |                | server, client                         | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
 | kube-etcd-peer                | etcd-ca                   |                | server, client                         | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
@@ -165,7 +174,8 @@ Required certificates:
 | front-proxy-client            | kubernetes-front-proxy-ca |                | client                                 |                                             |
 
 <!--
-[1]: any other IP or DNS name you contact your cluster on (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/) the load balancer stable IP and/or DNS name, `kubernetes`, `kubernetes.default`, `kubernetes.default.svc`,
+[1]: any other IP or DNS name you contact your cluster on (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)
+the load balancer stable IP and/or DNS name, `kubernetes`, `kubernetes.default`, `kubernetes.default.svc`,
 `kubernetes.default.svc.cluster`, `kubernetes.default.svc.cluster.local`)
 
 where `kind` maps to one or more of the [x509 key usage](https://pkg.go.dev/k8s.io/api/certificates/v1beta1#KeyUsage) types:
@@ -213,12 +223,32 @@ For kubeadm users only:
 <!--
 ### Certificate paths
 
-Certificates should be placed in a recommended path (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)). Paths should be specified using the given argument regardless of location.
+Certificates should be placed in a recommended path (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)).
+Paths should be specified using the given argument regardless of location.
 -->
-### 证书路径
+### 证书路径    {#certificate-paths}
 
-证书应放置在建议的路径中（以便 [kubeadm](/zh/docs/reference/setup-tools/kubeadm/)使用）。无论使用什么位置，都应使用给定的参数指定路径。
+证书应放置在建议的路径中（以便 [kubeadm](/zh/docs/reference/setup-tools/kubeadm/)
+使用）。无论使用什么位置，都应使用给定的参数指定路径。
 
+<!--
+| Default CN                   | recommended key path         | recommended cert path       | command        | key argument                 | cert argument                             |
+|------------------------------|------------------------------|-----------------------------|----------------|------------------------------|-------------------------------------------|
+| etcd-ca                      |     etcd/ca.key                         | etcd/ca.crt                 | kube-apiserver |                              | --etcd-cafile                             |
+| kube-apiserver-etcd-client   | apiserver-etcd-client.key    | apiserver-etcd-client.crt   | kube-apiserver | --etcd-keyfile               | --etcd-certfile                           |
+| kubernetes-ca                |    ca.key                          | ca.crt                      | kube-apiserver |                              | --client-ca-file                          |
+| kubernetes-ca                |    ca.key                          | ca.crt                      | kube-controller-manager | --cluster-signing-key-file      | --client-ca-file, --root-ca-file, --cluster-signing-cert-file  |
+| kube-apiserver               | apiserver.key                | apiserver.crt               | kube-apiserver | --tls-private-key-file       | --tls-cert-file                           |
+| kube-apiserver-kubelet-client|     apiserver-kubelet-client.key                         | apiserver-kubelet-client.crt| kube-apiserver | --kubelet-client-key | --kubelet-client-certificate              |
+| front-proxy-ca               |     front-proxy-ca.key                         | front-proxy-ca.crt          | kube-apiserver |                              | --requestheader-client-ca-file            |
+| front-proxy-ca               |     front-proxy-ca.key                         | front-proxy-ca.crt          | kube-controller-manager |                              | --requestheader-client-ca-file |
+| front-proxy-client           | front-proxy-client.key       | front-proxy-client.crt      | kube-apiserver | --proxy-client-key-file      | --proxy-client-cert-file                  |
+| etcd-ca                      |         etcd/ca.key                     | etcd/ca.crt                 | etcd           |                              | --trusted-ca-file, --peer-trusted-ca-file |
+| kube-etcd                    | etcd/server.key              | etcd/server.crt             | etcd           | --key-file                   | --cert-file                               |
+| kube-etcd-peer               | etcd/peer.key                | etcd/peer.crt               | etcd           | --peer-key-file              | --peer-cert-file                          |
+| etcd-ca                      |                              | etcd/ca.crt                 | etcdctl    |                              | --cacert                                  |
+| kube-etcd-healthcheck-client | etcd/healthcheck-client.key  | etcd/healthcheck-client.crt | etcdctl     | --key                        | --cert                                    |
+-->
 | 默认 CN                   | 建议的密钥路径         | 建议的证书路径       | 命令        | 密钥参数               | 证书参数                             |
 |------------------------------|------------------------------|-----------------------------|----------------|------------------------------|-------------------------------------------|
 | etcd-ca                      |     etcd/ca.key                         | etcd/ca.crt                 | kube-apiserver |                              | --etcd-cafile                             |
@@ -241,6 +271,12 @@ Same considerations apply for the service account key pair:
 -->
 注意事项同样适用于服务帐户密钥对：
 
+<!--
+| private key path             | public key path             | command                 | argument                             |
+|------------------------------|-----------------------------|-------------------------|--------------------------------------|
+|  sa.key                      |                             | kube-controller-manager | --service-account-private-key-file   |
+|                              | sa.pub                      | kube-apiserver          | --service-account-key-file           |
+-->
 | 私钥路径            | 公钥路径            | 命令                 | 参数                             |
 |------------------------------|-----------------------------|-------------------------|--------------------------------------|
 |  sa.key                      |                             | kube-controller-manager | --service-account-private-key-file              |
@@ -282,10 +318,18 @@ The following example illustrates the file paths [from the previous tables](/doc
 
 You must manually configure these administrator account and service accounts:
 -->
-## 为用户帐户配置证书
+## 为用户帐户配置证书    {#configure-certificates-for-user-accounts}
 
 你必须手动配置以下管理员帐户和服务帐户：
 
+<!--
+| filename                | credential name            | Default CN                     | O (in Subject) |
+|-------------------------|----------------------------|--------------------------------|----------------|
+| admin.conf              | default-admin              | kubernetes-admin               | system:masters |
+| kubelet.conf            | default-auth               | system:node:`<nodeName>` (see note) | system:nodes   |
+| controller-manager.conf | default-controller-manager | system:kube-controller-manager |                |
+| scheduler.conf          | default-scheduler          | system:kube-scheduler          |                |
+-->
 | 文件名                  | 凭据名称                   | 默认 CN                        | O (位于 Subject 中) |
 |-------------------------|----------------------------|--------------------------------|---------------------|
 | admin.conf              | default-admin              | kubernetes-admin               | system:masters      |
diff --git a/content/zh/docs/setup/best-practices/node-conformance.md b/content/zh/docs/setup/best-practices/node-conformance.md
index 71e97ac73a..9fe0ce0d90 100644
--- a/content/zh/docs/setup/best-practices/node-conformance.md
+++ b/content/zh/docs/setup/best-practices/node-conformance.md
@@ -1,16 +1,12 @@
 ---
-reviewers:
-- Random-Liu
 title: 校验节点设置
 weight: 30
 ---
 <!--
----
 reviewers:
 - Random-Liu
 title: Validate node setup
 weight: 30
----
 -->
 
 {{< toc >}}
@@ -18,13 +14,16 @@ weight: 30
 <!--
 ## Node Conformance Test
 -->
-## 节点一致性测试
+## 节点一致性测试    {#node-conformance-test}
 
 <!--
 *Node conformance test* is a containerized test framework that provides a system
-verification and functionality test for a node. 
+verification and functionality test for a node. The test validates whether the
+node meets the minimum requirements for Kubernetes; a node that passes the test
+is qualified to join a Kubernetes cluster.
 -->
-*节点一致性测试* 是一个容器化的测试框架，提供了针对节点的系统验证和功能测试。
+**节点一致性测试** 是一个容器化的测试框架，提供了针对节点的系统验证和功能测试。
+测试验证节点是否满足 Kubernetes 的最低要求；通过测试的节点有资格加入 Kubernetes 集群。
 
 <!--
 The test validates whether the node meets the minimum requirements for Kubernetes; a node that passes the testis qualified to join a Kubernetes cluster.
@@ -34,10 +33,12 @@ The test validates whether the node meets the minimum requirements for Kubernete
 <!--
 ## Node Prerequisite
 -->
-## 节点的前提条件
+## 节点的前提条件    {#node-prerequisite}
 
 <!--
-To run node conformance test, a node must satisfy the same prerequisites as astandard Kubernetes node. At a minimum, the node should have the following daemons installed:
+To run node conformance test, a node must satisfy the same prerequisites as a
+standard Kubernetes node. At a minimum, the node should have the following
+daemons installed:
 -->
 要运行节点一致性测试，节点必须满足与标准 Kubernetes 节点相同的前提条件。节点至少应安装以下守护程序：
 
@@ -51,7 +52,7 @@ To run node conformance test, a node must satisfy the same prerequisites as asta
 <!--
 ## Running Node Conformance Test
 -->
-## 运行节点一致性测试
+## 运行节点一致性测试    {#running-node-conformance-test}
 
 <!--
 To run the node conformance test, perform the following steps:
@@ -67,16 +68,23 @@ To run the node conformance test, perform the following steps:
   * `--cloud-provider`: If you are using `--cloud-provider=gce`, you should
     remove the flag to run the test.
 -->
-1. 得出 kubelet 的 `--kubeconfig` 的值；例如：`--kubeconfig=/var/lib/kubelet/config.yaml`. 
-   由于测试框架启动了本地控制平面来测试 kubelet， 因此使用 `http://localhost:8080` 
+1. 得出 kubelet 的 `--kubeconfig` 的值；例如：`--kubeconfig=/var/lib/kubelet/config.yaml`。
+   由于测试框架启动了本地控制平面来测试 kubelet，因此使用 `http://localhost:8080`
    作为API 服务器的 URL。
    一些其他的 kubelet 命令行参数可能会被用到：
-   * `--cloud-provider`： 如果使用 `--cloud-provider=gce`，需要移除这个参数
-     来运行测试。
+   * `--cloud-provider`：如果使用 `--cloud-provider=gce`，需要移除这个参数来运行测试。
 
 
 <!--
 2. Run the node conformance test with command:
+
+```shell
+# $CONFIG_DIR is the pod manifest path of your Kubelet.
+# $LOG_DIR is the test output path.
+sudo docker run -it --rm --privileged --net=host \
+  -v /:/rootfs -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
+  k8s.gcr.io/node-test:0.2
+```
 -->
 2. 使用以下命令运行节点一致性测试：
 
@@ -91,45 +99,48 @@ To run the node conformance test, perform the following steps:
 <!--
 ## Running Node Conformance Test for Other Architectures
 -->
-## 针对其他硬件体系结构运行节点一致性测试
+## 针对其他硬件体系结构运行节点一致性测试    {#running-node-conformance-test-for-other-architectures}
 
 <!--
-Kubernetes also provides node conformance test docker images for other architectures:
+Kubernetes also provides node conformance test docker images for other
+architectures:
 -->
 Kubernetes 也为其他硬件体系结构的系统提供了节点一致性测试的 Docker 镜像：
 
 <!--
-| Arch  |      Image      |      |
-| ----- | :-------------: | ---- |
-| amd64 | node-test-amd64 |      |
-| arm   |  node-test-arm  |      |
-| arm64 | node-test-arm64 |      |
+  Arch  |       Image       |
+--------|:-----------------:|
+ amd64  |  node-test-amd64  |
+  arm   |    node-test-arm  |
+ arm64  |  node-test-arm64  |
 -->
-| 架构   |      镜像        |      |
-| ----- | :-------------: | ---- |
-| amd64 | node-test-amd64 |      |
-| arm   |  node-test-arm  |      |
-| arm64 | node-test-arm64 |      |
+  架构  |       镜像        |
+--------|:-----------------:|
+ amd64  |  node-test-amd64  |
+  arm   |    node-test-arm  |
+ arm64  |  node-test-arm64  |
 
 <!--
 ## Running Selected Test
 -->
-## 运行特定的测试
+## 运行特定的测试    {#running-selected-test}
 
 <!--
-To run specific tests, overwrite the environment variable `FOCUS` with theregular expression of tests you want to run.
+To run specific tests, overwrite the environment variable `FOCUS` with the
+regular expression of tests you want to run.
 -->
 要运行特定测试，请使用你希望运行的测试的特定表达式覆盖环境变量 `FOCUS`。
 
 ```shell
 sudo docker run -it --rm --privileged --net=host \
-   -v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-   -e FOCUS=MirrorPod \ # Only run MirrorPod test
-k8s.gcr.io/node-test:0.2
+  -v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
+  -e FOCUS=MirrorPod \ # Only run MirrorPod test
+  k8s.gcr.io/node-test:0.2
 ```
 
 <!--
-To skip specific tests, overwrite the environment variable `SKIP` with theregular expression of tests you want to skip.
+To skip specific tests, overwrite the environment variable `SKIP` with the
+regular expression of tests you want to skip.
 -->
 要跳过特定的测试，请使用你希望跳过的测试的常规表达式覆盖环境变量 `SKIP`。
 
@@ -138,35 +149,37 @@ To skip specific tests, overwrite the environment variable `SKIP` with theregula
 sudo docker run -it --rm --privileged --net=host \
   -v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
   -e SKIP=MirrorPod \ # Run all conformance tests but skip MirrorPod test
-k8s.gcr.io/node-test:0.2
+  k8s.gcr.io/node-test:0.2
 ```
 -->
 ```shell
 sudo docker run -it --rm --privileged --net=host \
   -v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
   -e SKIP=MirrorPod \ # 运行除 MirrorPod 测试外的所有一致性测试内容
-k8s.gcr.io/node-test:0.2
+  k8s.gcr.io/node-test:0.2
 ```
 
 
 <!--
-Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/devel/e2e-node-tests.md).
+Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/e2e-node-tests.md).
 -->
-节点一致性测试是[节点端到端测试](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/devel/e2e-node-tests.md)的容器化版本。
+节点一致性测试是[节点端到端测试](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/e2e-node-tests.md)的容器化版本。
 <!--
 By default, it runs all conformance tests.
 -->
 默认情况下，它会运行所有一致性测试。
 
 <!--
-Theoretically, you can run any node e2e test if you configure the container andmount required volumes properly. But **it is strongly recommended to only run conformance test**, because it requires much more complex configuration to run non-conformance test.
+Theoretically, you can run any node e2e test if you configure the container and
+mount required volumes properly. But **it is strongly recommended to only run conformance
+test**, because it requires much more complex configuration to run non-conformance test.
 -->
-理论上，只要合理地配置容器和挂载所需的卷，就可以运行任何的节点端到端测试用例。 但是这里**强烈建议只运行一致性测试**，因为运行非一致性测试需要很多复杂的配置。
+理论上，只要合理地配置容器和挂载所需的卷，就可以运行任何的节点端到端测试用例。但是这里**强烈建议只运行一致性测试**，因为运行非一致性测试需要很多复杂的配置。
 
 <!--
 ## Caveats
 -->
-## 注意
+## 注意事项    {#caveats}
 
 <!--
 * The test leaves some docker images on the node, including the node conformance
@@ -176,5 +189,5 @@ Theoretically, you can run any node e2e test if you configure the container andm
   during the functionality test.
 -->
 
-* 测试会在节点上遗留一些 Docker 镜像， 包括节点一致性测试本身的镜像和功能测试相关的镜像。
+* 测试会在节点上遗留一些 Docker 镜像，包括节点一致性测试本身的镜像和功能测试相关的镜像。
 * 测试会在节点上遗留一些死的容器。这些容器是在功能测试的过程中创建的。
\ No newline at end of file