whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[zh] Remove reviewer for best-practices

Browse Source
This commit is contained in:
Sean Wei
2022-05-26 16:51:00 +08:00
parent b05bcc9823
commit 6e7c8bb9f5
2 changed files with 113 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/zh/docs/setup/best-practices/certificates.md
+59 -15
View File
@@ -1,7 +1,5 @@
--- ---
title: PKI 证书和要求 title: PKI 证书和要求
reviewers:
- sig-cluster-lifecycle
content_type: concept content_type: concept
weight: 40 weight: 40
--- ---
@@ -18,7 +16,7 @@ weight: 40
<!-- <!--
Kubernetes requires PKI certificates for authentication over TLS. Kubernetes requires PKI certificates for authentication over TLS.
If you install Kubernetes with [kubeadm](/docs/reference/setup-tools/kubeadm/), the certificates that your cluster requires are automatically generated. If you install Kubernetes with [kubeadm](/docs/reference/setup-tools/kubeadm/), the certificates that your cluster requires are automatically generated.
You can also generate your own certificates - for example, to keep your private keys more secure by not storing them on the API server. You can also generate your own certificates -- for example, to keep your private keys more secure by not storing them on the API server.
This page explains the certificates that your cluster requires. This page explains the certificates that your cluster requires.
--> -->
Kubernetes 需要 PKI 证书才能进行基于 TLS 的身份验证。如果你是使用 Kubernetes 需要 PKI 证书才能进行基于 TLS 的身份验证。如果你是使用
@@ -33,7 +31,7 @@ Kubernetes 需要 PKI 证书才能进行基于 TLS 的身份验证。如果你
Kubernetes requires PKI for the following operations: Kubernetes requires PKI for the following operations:
--> -->
## 集群是如何使用证书的 ## 集群是如何使用证书的 {#how-certificates-are-used-by-your-cluster}
Kubernetes 需要 PKI 才能执行以下操作： Kubernetes 需要 PKI 才能执行以下操作：
@@ -61,7 +59,7 @@ Kubernetes 需要 PKI 才能执行以下操作：
* [前端代理](/zh/docs/tasks/extend-kubernetes/configure-aggregation-layer/) 的客户端及服务端证书 * [前端代理](/zh/docs/tasks/extend-kubernetes/configure-aggregation-layer/) 的客户端及服务端证书
<!-- <!--
`front-proxy` certificates are required only if you run kube-proxy to support [an extension API server](/docs/tasks/access-kubernetes-api/setup-extension-api-server/). `front-proxy` certificates are required only if you run kube-proxy to support [an extension API server](/docs/tasks/extend-kubernetes/setup-extension-api-server/).
--> -->
{{< note >}} {{< note >}}
只有当你运行 kube-proxy 并要支持 只有当你运行 kube-proxy 并要支持
@@ -79,7 +77,7 @@ etcd 还实现了双向 TLS 来对客户端和对其他对等节点进行身份
If you install Kubernetes with kubeadm, most certificates are stored in `/etc/kubernetes/pki`. All paths in this documentation are relative to that directory, with the exception of user account certificates which kubeadm places in `/etc/kubernetes`. If you install Kubernetes with kubeadm, most certificates are stored in `/etc/kubernetes/pki`. All paths in this documentation are relative to that directory, with the exception of user account certificates which kubeadm places in `/etc/kubernetes`.
--> -->
## 证书存放的位置 ## 证书存放的位置 {#where-certificates-are-stored}
假如通过 kubeadm 安装 Kubernetes，大多数证书都存储在 `/etc/kubernetes/pki`。 假如通过 kubeadm 安装 Kubernetes，大多数证书都存储在 `/etc/kubernetes/pki`。
本文档中的所有路径都是相对于该目录的，但用户账户证书除外，kubeadm 将其放在 `/etc/kubernetes` 中。 本文档中的所有路径都是相对于该目录的，但用户账户证书除外，kubeadm 将其放在 `/etc/kubernetes` 中。
@@ -90,7 +88,7 @@ If you install Kubernetes with kubeadm, most certificates are stored in `/etc/ku
If you don't want kubeadm to generate the required certificates, you can create them using a single root CA or by providing all certificates. See [Certificates](/docs/tasks/administer-cluster/certificates/) for details on creating your own certificate authority. If you don't want kubeadm to generate the required certificates, you can create them using a single root CA or by providing all certificates. See [Certificates](/docs/tasks/administer-cluster/certificates/) for details on creating your own certificate authority.
See [Certificate Management with kubeadm](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/) for more on managing certificates. See [Certificate Management with kubeadm](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/) for more on managing certificates.
--> -->
## 手动配置证书 ## 手动配置证书 {#configure-certificates-manually}
如果你不想通过 kubeadm 生成这些必需的证书，你可以使用一个单一的根 CA 如果你不想通过 kubeadm 生成这些必需的证书，你可以使用一个单一的根 CA
来创建这些证书或者直接提供所有证书。 来创建这些证书或者直接提供所有证书。
@@ -102,14 +100,14 @@ See [Certificate Management with kubeadm](/docs/tasks/administer-cluster/kubeadm
You can create a single root CA, controlled by an administrator. This root CA can then create multiple intermediate CAs, and delegate all further creation to Kubernetes itself. You can create a single root CA, controlled by an administrator. This root CA can then create multiple intermediate CAs, and delegate all further creation to Kubernetes itself.
--> -->
### 单根 CA ### 单根 CA {#single-root-ca}
你可以创建一个单根 CA，由管理员控制器它。该根 CA 可以创建多个中间 CA，并将所有进一步的创建委托给 Kubernetes。 你可以创建一个单根 CA，由管理员控制器它。该根 CA 可以创建多个中间 CA，并将所有进一步的创建委托给 Kubernetes。
<!-- <!--
Required CAs: Required CAs:
| 路径 | 默认 CN | 描述 | | path | Default CN | description |
|------------------------|---------------------------|----------------------------------| |------------------------|---------------------------|----------------------------------|
| ca.crt,key | kubernetes-ca | Kubernetes general CA | | ca.crt,key | kubernetes-ca | Kubernetes general CA |
| etcd/ca.crt,key | etcd-ca | For all etcd-related functions | | etcd/ca.crt,key | etcd-ca | For all etcd-related functions |
@@ -148,12 +146,23 @@ If you don't wish to copy the CA private keys to your cluster, you can generate
Required certificates: Required certificates:
--> -->
### 所有的证书 ### 所有的证书 {#all-certificates}
如果你不想将 CA 的私钥拷贝至你的集群中，你也可以自己生成全部的证书。 如果你不想将 CA 的私钥拷贝至你的集群中，你也可以自己生成全部的证书。
需要这些证书： 需要这些证书：
<!--
| Default CN | Parent CA | O (in Subject) | kind | hosts (SAN) |
|-------------------------------|---------------------------|----------------|----------------------------------------|---------------------------------------------|
| kube-etcd | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
| kube-etcd-peer | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
| kube-etcd-healthcheck-client | etcd-ca | | client | |
| kube-apiserver-etcd-client | etcd-ca | system:masters | client | |
| kube-apiserver | kubernetes-ca | | server | `<hostname>`, `<Host_IP>`, `<advertise_IP>`, `[1]` |
| kube-apiserver-kubelet-client | kubernetes-ca | system:masters | client | |
| front-proxy-client | kubernetes-front-proxy-ca | | client | |
-->
| 默认 CN | 父级 CA | O (位于 Subject 中) | 类型 | 主机 (SAN) | | 默认 CN | 父级 CA | O (位于 Subject 中) | 类型 | 主机 (SAN) |
|-------------------------------|---------------------------|----------------|----------------------------------------|---------------------------------------------| |-------------------------------|---------------------------|----------------|----------------------------------------|---------------------------------------------|
| kube-etcd | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` | | kube-etcd | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
@@ -165,7 +174,8 @@ Required certificates:
| front-proxy-client | kubernetes-front-proxy-ca | | client | | | front-proxy-client | kubernetes-front-proxy-ca | | client | |
<!-- <!--
[1]: any other IP or DNS name you contact your cluster on (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/) the load balancer stable IP and/or DNS name, `kubernetes`, `kubernetes.default`, `kubernetes.default.svc`, [1]: any other IP or DNS name you contact your cluster on (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)
the load balancer stable IP and/or DNS name, `kubernetes`, `kubernetes.default`, `kubernetes.default.svc`,
`kubernetes.default.svc.cluster`, `kubernetes.default.svc.cluster.local`) `kubernetes.default.svc.cluster`, `kubernetes.default.svc.cluster.local`)
where `kind` maps to one or more of the [x509 key usage](https://pkg.go.dev/k8s.io/api/certificates/v1beta1#KeyUsage) types: where `kind` maps to one or more of the [x509 key usage](https://pkg.go.dev/k8s.io/api/certificates/v1beta1#KeyUsage) types:
@@ -213,12 +223,32 @@ For kubeadm users only:
<!-- <!--
### Certificate paths ### Certificate paths
Certificates should be placed in a recommended path (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)). Paths should be specified using the given argument regardless of location. Certificates should be placed in a recommended path (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)).
Paths should be specified using the given argument regardless of location.
--> -->
### 证书路径 ### 证书路径 {#certificate-paths}
证书应放置在建议的路径中（以便 [kubeadm](/zh/docs/reference/setup-tools/kubeadm/)使用）。无论使用什么位置，都应使用给定的参数指定路径。 证书应放置在建议的路径中（以便 [kubeadm](/zh/docs/reference/setup-tools/kubeadm/)
使用）。无论使用什么位置，都应使用给定的参数指定路径。
<!--
| Default CN | recommended key path | recommended cert path | command | key argument | cert argument |
|------------------------------|------------------------------|-----------------------------|----------------|------------------------------|-------------------------------------------|
| etcd-ca | etcd/ca.key | etcd/ca.crt | kube-apiserver | | --etcd-cafile |
| kube-apiserver-etcd-client | apiserver-etcd-client.key | apiserver-etcd-client.crt | kube-apiserver | --etcd-keyfile | --etcd-certfile |
| kubernetes-ca | ca.key | ca.crt | kube-apiserver | | --client-ca-file |
| kubernetes-ca | ca.key | ca.crt | kube-controller-manager | --cluster-signing-key-file | --client-ca-file, --root-ca-file, --cluster-signing-cert-file |
| kube-apiserver | apiserver.key | apiserver.crt | kube-apiserver | --tls-private-key-file | --tls-cert-file |
| kube-apiserver-kubelet-client| apiserver-kubelet-client.key | apiserver-kubelet-client.crt| kube-apiserver | --kubelet-client-key | --kubelet-client-certificate |
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-apiserver | | --requestheader-client-ca-file |
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-controller-manager | | --requestheader-client-ca-file |
| front-proxy-client | front-proxy-client.key | front-proxy-client.crt | kube-apiserver | --proxy-client-key-file | --proxy-client-cert-file |
| etcd-ca | etcd/ca.key | etcd/ca.crt | etcd | | --trusted-ca-file, --peer-trusted-ca-file |
| kube-etcd | etcd/server.key | etcd/server.crt | etcd | --key-file | --cert-file |
| kube-etcd-peer | etcd/peer.key | etcd/peer.crt | etcd | --peer-key-file | --peer-cert-file |
| etcd-ca | | etcd/ca.crt | etcdctl | | --cacert |
| kube-etcd-healthcheck-client | etcd/healthcheck-client.key | etcd/healthcheck-client.crt | etcdctl | --key | --cert |
-->
| 默认 CN | 建议的密钥路径 | 建议的证书路径 | 命令 | 密钥参数 | 证书参数 | | 默认 CN | 建议的密钥路径 | 建议的证书路径 | 命令 | 密钥参数 | 证书参数 |
|------------------------------|------------------------------|-----------------------------|----------------|------------------------------|-------------------------------------------| |------------------------------|------------------------------|-----------------------------|----------------|------------------------------|-------------------------------------------|
| etcd-ca | etcd/ca.key | etcd/ca.crt | kube-apiserver | | --etcd-cafile | | etcd-ca | etcd/ca.key | etcd/ca.crt | kube-apiserver | | --etcd-cafile |
@@ -241,6 +271,12 @@ Same considerations apply for the service account key pair:
--> -->
注意事项同样适用于服务帐户密钥对： 注意事项同样适用于服务帐户密钥对：
<!--
| private key path | public key path | command | argument |
|------------------------------|-----------------------------|-------------------------|--------------------------------------|
| sa.key | | kube-controller-manager | --service-account-private-key-file |
| | sa.pub | kube-apiserver | --service-account-key-file |
-->
| 私钥路径 | 公钥路径 | 命令 | 参数 | | 私钥路径 | 公钥路径 | 命令 | 参数 |
|------------------------------|-----------------------------|-------------------------|--------------------------------------| |------------------------------|-----------------------------|-------------------------|--------------------------------------|
| sa.key | | kube-controller-manager | --service-account-private-key-file | | sa.key | | kube-controller-manager | --service-account-private-key-file |
@@ -282,10 +318,18 @@ The following example illustrates the file paths [from the previous tables](/doc
You must manually configure these administrator account and service accounts: You must manually configure these administrator account and service accounts:
--> -->
## 为用户帐户配置证书 ## 为用户帐户配置证书 {#configure-certificates-for-user-accounts}
你必须手动配置以下管理员帐户和服务帐户： 你必须手动配置以下管理员帐户和服务帐户：
<!--
| filename | credential name | Default CN | O (in Subject) |
|-------------------------|----------------------------|--------------------------------|----------------|
| admin.conf | default-admin | kubernetes-admin | system:masters |
| kubelet.conf | default-auth | system:node:`<nodeName>` (see note) | system:nodes |
| controller-manager.conf | default-controller-manager | system:kube-controller-manager | |
| scheduler.conf | default-scheduler | system:kube-scheduler | |
-->
| 文件名 | 凭据名称 | 默认 CN | O (位于 Subject 中) | | 文件名 | 凭据名称 | 默认 CN | O (位于 Subject 中) |
|-------------------------|----------------------------|--------------------------------|---------------------| |-------------------------|----------------------------|--------------------------------|---------------------|
| admin.conf | default-admin | kubernetes-admin | system:masters | | admin.conf | default-admin | kubernetes-admin | system:masters |
content/zh/docs/setup/best-practices/node-conformance.md
+51 -38
View File
@@ -1,16 +1,12 @@
--- ---
reviewers:
- Random-Liu
title: 校验节点设置 title: 校验节点设置
weight: 30 weight: 30
--- ---
<!-- <!--
---
reviewers: reviewers:
- Random-Liu - Random-Liu
title: Validate node setup title: Validate node setup
weight: 30 weight: 30
---
--> -->
{{< toc >}} {{< toc >}}
@@ -18,13 +14,16 @@ weight: 30
<!-- <!--
## Node Conformance Test ## Node Conformance Test
--> -->
## 节点一致性测试 ## 节点一致性测试 {#node-conformance-test}
<!-- <!--
*Node conformance test* is a containerized test framework that provides a system *Node conformance test* is a containerized test framework that provides a system
verification and functionality test for a node. verification and functionality test for a node. The test validates whether the
node meets the minimum requirements for Kubernetes; a node that passes the test
is qualified to join a Kubernetes cluster.
--> -->
*节点一致性测试* 是一个容器化的测试框架，提供了针对节点的系统验证和功能测试。 **节点一致性测试** 是一个容器化的测试框架，提供了针对节点的系统验证和功能测试。
测试验证节点是否满足 Kubernetes 的最低要求；通过测试的节点有资格加入 Kubernetes 集群。
<!-- <!--
The test validates whether the node meets the minimum requirements for Kubernetes; a node that passes the testis qualified to join a Kubernetes cluster. The test validates whether the node meets the minimum requirements for Kubernetes; a node that passes the testis qualified to join a Kubernetes cluster.
@@ -34,10 +33,12 @@ The test validates whether the node meets the minimum requirements for Kubernete
<!-- <!--
## Node Prerequisite ## Node Prerequisite
--> -->
## 节点的前提条件 ## 节点的前提条件 {#node-prerequisite}
<!-- <!--
To run node conformance test, a node must satisfy the same prerequisites as astandard Kubernetes node. At a minimum, the node should have the following daemons installed: To run node conformance test, a node must satisfy the same prerequisites as a
standard Kubernetes node. At a minimum, the node should have the following
daemons installed:
--> -->
要运行节点一致性测试，节点必须满足与标准 Kubernetes 节点相同的前提条件。节点至少应安装以下守护程序： 要运行节点一致性测试，节点必须满足与标准 Kubernetes 节点相同的前提条件。节点至少应安装以下守护程序：
@@ -51,7 +52,7 @@ To run node conformance test, a node must satisfy the same prerequisites as asta
<!-- <!--
## Running Node Conformance Test ## Running Node Conformance Test
--> -->
## 运行节点一致性测试 ## 运行节点一致性测试 {#running-node-conformance-test}
<!-- <!--
To run the node conformance test, perform the following steps: To run the node conformance test, perform the following steps:
@@ -67,16 +68,23 @@ To run the node conformance test, perform the following steps:
* `--cloud-provider`: If you are using `--cloud-provider=gce`, you should * `--cloud-provider`: If you are using `--cloud-provider=gce`, you should
remove the flag to run the test. remove the flag to run the test.
--> -->
1. 得出 kubelet 的 `--kubeconfig` 的值；例如：`--kubeconfig=/var/lib/kubelet/config.yaml`. 1. 得出 kubelet 的 `--kubeconfig` 的值；例如：`--kubeconfig=/var/lib/kubelet/config.yaml`。
由于测试框架启动了本地控制平面来测试 kubelet， 因此使用 `http://localhost:8080` 由于测试框架启动了本地控制平面来测试 kubelet，因此使用 `http://localhost:8080`
作为API 服务器的 URL。 作为API 服务器的 URL。
一些其他的 kubelet 命令行参数可能会被用到： 一些其他的 kubelet 命令行参数可能会被用到：
* `--cloud-provider`： 如果使用 `--cloud-provider=gce`，需要移除这个参数 * `--cloud-provider`：如果使用 `--cloud-provider=gce`，需要移除这个参数来运行测试。
来运行测试。
<!-- <!--
2. Run the node conformance test with command: 2. Run the node conformance test with command:
```shell
# $CONFIG_DIR is the pod manifest path of your Kubelet.
# $LOG_DIR is the test output path.
sudo docker run -it --rm --privileged --net=host \
-v /:/rootfs -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
k8s.gcr.io/node-test:0.2
```
--> -->
2. 使用以下命令运行节点一致性测试： 2. 使用以下命令运行节点一致性测试：
@@ -91,33 +99,35 @@ To run the node conformance test, perform the following steps:
<!-- <!--
## Running Node Conformance Test for Other Architectures ## Running Node Conformance Test for Other Architectures
--> -->
## 针对其他硬件体系结构运行节点一致性测试 ## 针对其他硬件体系结构运行节点一致性测试 {#running-node-conformance-test-for-other-architectures}
<!-- <!--
Kubernetes also provides node conformance test docker images for other architectures: Kubernetes also provides node conformance test docker images for other
architectures:
--> -->
Kubernetes 也为其他硬件体系结构的系统提供了节点一致性测试的 Docker 镜像： Kubernetes 也为其他硬件体系结构的系统提供了节点一致性测试的 Docker 镜像：
<!-- <!--
| Arch | Image | | Arch | Image |
| ----- | :-------------: | ---- | --------|:-----------------:|
| amd64 | node-test-amd64 | | amd64 | node-test-amd64 |
| arm | node-test-arm | | arm | node-test-arm |
| arm64 | node-test-arm64 | | arm64 | node-test-arm64 |
--> -->
| 架构 | 镜像 | | 架构 | 镜像 |
| ----- | :-------------: | ---- | --------|:-----------------:|
| amd64 | node-test-amd64 | | amd64 | node-test-amd64 |
| arm | node-test-arm | | arm | node-test-arm |
| arm64 | node-test-arm64 | | arm64 | node-test-arm64 |
<!-- <!--
## Running Selected Test ## Running Selected Test
--> -->
## 运行特定的测试 ## 运行特定的测试 {#running-selected-test}
<!-- <!--
To run specific tests, overwrite the environment variable `FOCUS` with theregular expression of tests you want to run. To run specific tests, overwrite the environment variable `FOCUS` with the
regular expression of tests you want to run.
--> -->
要运行特定测试，请使用你希望运行的测试的特定表达式覆盖环境变量 `FOCUS`。 要运行特定测试，请使用你希望运行的测试的特定表达式覆盖环境变量 `FOCUS`。
@@ -125,11 +135,12 @@ To run specific tests, overwrite the environment variable `FOCUS` with theregula
sudo docker run -it --rm --privileged --net=host \ sudo docker run -it --rm --privileged --net=host \
-v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \ -v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-e FOCUS=MirrorPod \ # Only run MirrorPod test -e FOCUS=MirrorPod \ # Only run MirrorPod test
k8s.gcr.io/node-test:0.2 k8s.gcr.io/node-test:0.2
``` ```
<!-- <!--
To skip specific tests, overwrite the environment variable `SKIP` with theregular expression of tests you want to skip. To skip specific tests, overwrite the environment variable `SKIP` with the
regular expression of tests you want to skip.
--> -->
要跳过特定的测试，请使用你希望跳过的测试的常规表达式覆盖环境变量 `SKIP`。 要跳过特定的测试，请使用你希望跳过的测试的常规表达式覆盖环境变量 `SKIP`。
@@ -138,35 +149,37 @@ To skip specific tests, overwrite the environment variable `SKIP` with theregula
sudo docker run -it --rm --privileged --net=host \ sudo docker run -it --rm --privileged --net=host \
-v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \ -v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-e SKIP=MirrorPod \ # Run all conformance tests but skip MirrorPod test -e SKIP=MirrorPod \ # Run all conformance tests but skip MirrorPod test
k8s.gcr.io/node-test:0.2 k8s.gcr.io/node-test:0.2
``` ```
--> -->
```shell ```shell
sudo docker run -it --rm --privileged --net=host \ sudo docker run -it --rm --privileged --net=host \
-v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \ -v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-e SKIP=MirrorPod \ # 运行除 MirrorPod 测试外的所有一致性测试内容 -e SKIP=MirrorPod \ # 运行除 MirrorPod 测试外的所有一致性测试内容
k8s.gcr.io/node-test:0.2 k8s.gcr.io/node-test:0.2
``` ```
<!-- <!--
Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/devel/e2e-node-tests.md). Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/e2e-node-tests.md).
--> -->
节点一致性测试是[节点端到端测试](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/devel/e2e-node-tests.md)的容器化版本。 节点一致性测试是[节点端到端测试](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/e2e-node-tests.md)的容器化版本。
<!-- <!--
By default, it runs all conformance tests. By default, it runs all conformance tests.
--> -->
默认情况下，它会运行所有一致性测试。 默认情况下，它会运行所有一致性测试。
<!-- <!--
Theoretically, you can run any node e2e test if you configure the container andmount required volumes properly. But **it is strongly recommended to only run conformance test**, because it requires much more complex configuration to run non-conformance test. Theoretically, you can run any node e2e test if you configure the container and
mount required volumes properly. But **it is strongly recommended to only run conformance
test**, because it requires much more complex configuration to run non-conformance test.
--> -->
理论上，只要合理地配置容器和挂载所需的卷，就可以运行任何的节点端到端测试用例。 但是这里**强烈建议只运行一致性测试**，因为运行非一致性测试需要很多复杂的配置。 理论上，只要合理地配置容器和挂载所需的卷，就可以运行任何的节点端到端测试用例。但是这里**强烈建议只运行一致性测试**，因为运行非一致性测试需要很多复杂的配置。
<!-- <!--
## Caveats ## Caveats
--> -->
## 注意 ## 注意事项 {#caveats}
<!-- <!--
* The test leaves some docker images on the node, including the node conformance * The test leaves some docker images on the node, including the node conformance
@@ -176,5 +189,5 @@ Theoretically, you can run any node e2e test if you configure the container andm
during the functionality test. during the functionality test.
--> -->
* 测试会在节点上遗留一些 Docker 镜像， 包括节点一致性测试本身的镜像和功能测试相关的镜像。 * 测试会在节点上遗留一些 Docker 镜像，包括节点一致性测试本身的镜像和功能测试相关的镜像。
* 测试会在节点上遗留一些死的容器。这些容器是在功能测试的过程中创建的。 * 测试会在节点上遗留一些死的容器。这些容器是在功能测试的过程中创建的。