[zh] Resync some concepts pages (concepts-4)
This commit is contained in:
Qiming Teng
@@ -7,43 +7,46 @@ description: Kubernetes 网络背后的概念和资源。
|
||||
<!--
|
||||
## The Kubernetes network model
|
||||
|
||||
Every [`Pod`](/docs/concepts/workloads/pods/) gets its own IP address.
|
||||
Every [`Pod`](/docs/concepts/workloads/pods/) in a cluster gets its own unique cluster-wide IP address.
|
||||
This means you do not need to explicitly create links between `Pods` and you
|
||||
almost never need to deal with mapping container ports to host ports.
|
||||
This creates a clean, backwards-compatible model where `Pods` can be treated
|
||||
much like VMs or physical hosts from the perspectives of port allocation,
|
||||
naming, service discovery, [load balancing](/docs/concepts/services-networking/ingress/#load-balancing), application configuration,
|
||||
and migration.
|
||||
|
||||
Kubernetes imposes the following fundamental requirements on any networking
|
||||
implementation (barring any intentional network segmentation policies):
|
||||
|
||||
* pods on a [node](/docs/concepts/architecture/nodes/) can communicate with all pods on all nodes without NAT
|
||||
* agents on a node (e.g. system daemons, kubelet) can communicate with all
|
||||
pods on that node
|
||||
|
||||
Note: For those platforms that support `Pods` running in the host network (e.g.
|
||||
Linux):
|
||||
|
||||
* pods in the host network of a node can communicate with all pods on all
|
||||
nodes without NAT
|
||||
naming, service discovery, [load balancing](/docs/concepts/services-networking/ingress/#load-balancing),
|
||||
application configuration, and migration.
|
||||
-->
|
||||
## Kubernetes 网络模型 {#the-kubernetes-network-model}
|
||||
|
||||
每一个 [`Pod`](/zh/docs/concepts/workloads/pods/) 都有它自己的IP地址，
|
||||
这就意味着你不需要显式地在 `Pod` 之间创建链接， 你几乎不需要处理容器端口到主机端口之间的映射。
|
||||
集群中每一个 [`Pod`](/zh-cn/docs/concepts/workloads/pods/) 都会获得自己的、
|
||||
独一无二的 IP 地址，
|
||||
这就意味着你不需要显式地在 `Pod` 之间创建链接，你几乎不需要处理容器端口到主机端口之间的映射。
|
||||
这将形成一个干净的、向后兼容的模型；在这个模型里，从端口分配、命名、服务发现、
|
||||
[负载均衡](/zh/docs/concepts/services-networking/ingress/#load-balancing)、应用配置和迁移的角度来看，
|
||||
`Pod` 可以被视作虚拟机或者物理主机。
|
||||
[负载均衡](/zh/docs/concepts/services-networking/ingress/#load-balancing)、
|
||||
应用配置和迁移的角度来看，`Pod` 可以被视作虚拟机或者物理主机。
|
||||
|
||||
<!--
|
||||
Kubernetes imposes the following fundamental requirements on any networking
|
||||
implementation (barring any intentional network segmentation policies):
|
||||
-->
|
||||
Kubernetes 强制要求所有网络设施都满足以下基本要求（从而排除了有意隔离网络的策略）：
|
||||
|
||||
* [节点](/zh/docs/concepts/architecture/nodes/)上的 Pod 可以不通过 NAT 和其他任何节点上的 Pod 通信
|
||||
<!--
|
||||
* pods can communicate with all other pods on any other [node](/docs/concepts/architecture/nodes/)
|
||||
without NAT
|
||||
* agents on a node (e.g. system daemons, kubelet) can communicate with all
|
||||
pods on that node
|
||||
-->
|
||||
* Pod 能够与所有其他[节点](/zh-cn/docs/concepts/architecture/nodes/)上的 Pod 通信，
|
||||
且不需要网络地址转译（NAT）
|
||||
* 节点上的代理（比如：系统守护进程、kubelet）可以和节点上的所有 Pod 通信
|
||||
|
||||
备注：对于支持在主机网络中运行 `Pod` 的平台（比如：Linux）：
|
||||
|
||||
* 运行在节点主机网络里的 Pod 可以不通过 NAT 和所有节点上的 Pod 通信
|
||||
<!--
|
||||
Note: For those platforms that support `Pods` running in the host network (e.g.
|
||||
Linux), when pods are attached to the host network of a node they can still communicate
|
||||
with all pods on all nodes without NAT.
|
||||
-->
|
||||
说明：对于支持在主机网络中运行 `Pod` 的平台（比如：Linux），
|
||||
当 Pod 挂接到节点的宿主网络上时，它们仍可以不通过 NAT 和所有节点上的 Pod 通信。
|
||||
|
||||
<!--
|
||||
This model is not only less complex overall, but it is principally compatible
|
||||
@@ -62,7 +65,8 @@ usage, but this is no different from processes in a VM. This is called the
|
||||
如果你的任务开始是在虚拟机中运行的，你的虚拟机有一个 IP，
|
||||
可以和项目中其他虚拟机通信。这里的模型是基本相同的。
|
||||
|
||||
Kubernetes 的 IP 地址存在于 `Pod` 范围内 - 容器共享它们的网络命名空间 - 包括它们的 IP 地址和 MAC 地址。
|
||||
Kubernetes 的 IP 地址存在于 `Pod` 范围内 —— 容器共享它们的网络命名空间 ——
|
||||
包括它们的 IP 地址和 MAC 地址。
|
||||
这就意味着 `Pod` 内的容器都可以通过 `localhost` 到达对方端口。
|
||||
这也意味着 `Pod` 内的容器需要相互协调端口的使用，但是这和虚拟机中的进程似乎没有什么不同，
|
||||
这也被称为“一个 Pod 一个 IP”模型。
|
||||
@@ -90,9 +94,10 @@ Kubernetes networking addresses four concerns:
|
||||
-->
|
||||
|
||||
Kubernetes 网络解决四方面的问题：
|
||||
- 一个 Pod 中的容器之间[通过本地回路（loopback）通信](/zh/docs/concepts/services-networking/dns-pod-service/)。
|
||||
|
||||
- 一个 Pod 中的容器之间[通过本地回路（loopback）通信](/zh-cn/docs/concepts/services-networking/dns-pod-service/)。
|
||||
- 集群网络在不同 pod 之间提供通信。
|
||||
- [Service 资源](/zh/docs/concepts/services-networking/service/)允许你
|
||||
[对外暴露 Pods 中运行的应用程序](/zh/docs/concepts/services-networking/connect-applications-service/)，
|
||||
- [Service 资源](/zh-cn/docs/concepts/services-networking/service/)允许你
|
||||
[向外暴露 Pods 中运行的应用](/zh-cn/docs/concepts/services-networking/connect-applications-service/)，
|
||||
以支持来自于集群外部的访问。
|
||||
- 可以使用 Services 来[发布仅供集群内部使用的服务](/zh/docs/concepts/services-networking/service-traffic-policy/)。
|
||||
- 可以使用 Services 来[发布仅供集群内部使用的服务](/zh-cn/docs/concepts/services-networking/service-traffic-policy/)。
|
||||
|
||||
Reference in New Issue
Block a user