Update localization guidelines (#10485)

* Update localization guidelines for language labels Continuing work Continuing work Continuing work More work in progress Add local OWNERS folders Add an OWNERS file to Chinese Remove shortcode for repos Add Japanese Alphabetize languages, change weights accordingly More updates Add Korean in Korean Add English to languageName Feedback from gochist Move Chinese content from cn/ to zh/ Move OWNERS from cn/ to zh/ Resolve merge conflicts by updating from master Add files back in to prep for resolution After rebase on upstream/master, remove files Review and update localization guidelines Feedback from gochist, tnir, cstoku Add a trailing newline to content/ja/OWNERS Add a trailing newline to content/zh/OWNERS Drop requirement for GH repo project Clarify language about forks/branches Edits and typos Remove a shortcode specific to a multi-repo language setup Update aliases and owners Add explicit OWNERS for content/en Migrate content from Chinese repo, update regex in config.toml Remove untranslated strings Add trailing newline to content/en/OWNERS Add trailing newlines to OWNERS files add Jaguar project description (#10433) * add Jaguar project description [Jaguar](https://gitlab.com/sdnlab/jaguar) is an open source solution for Kubernetes's network based on OpenDaylight. Jaguar provides overlay network using vxlan and Jaguar CNIPlugin provides one IP address per pod. * Minor newline tweak blog post for azure vmss (#10538) Add microk8s to pick-right-solution.md (#10542) * Add microk8s to pick-right-solution.md Microk8s is a single-command installation of upstream Kubernetes on any Linux and should be included in the list of local-machine solutions. * capitalized Istio Add microk8s to foundational.md (#10543) * Add microk8s to foundational.md Adding microk8s as credible and stable alternative to get started with Kubernetes on a local machine. This is especially attractive for those not wanting to incur the overhead of running a VM for a local cluster. * Update foundational.md Thank you for your suggestions! LMK if this works now? * Rewrote first paragraph And included a bullet list of features of microk8s * Copyedit fix typo (#10545) Fix the kubectl subcommands links. (#10550) Signed-off-by: William Zhang <warmchang@outlook.com> Fix command issue (#10515) Signed-off-by: mooncake <xcoder@tenxcloud.com> remove imported community files per issue 10184 (#10501) networking.md: Markdown fix (#10498) Fix front matter, federation command-line tools (#10500) Clean up glossary entry (#10399) update slack link (#10536) typo in StatefulSet docs (#10558) fix discription about horizontal pod autoscale (#10557) Remove redundant symbols (#10556) Fix issue #10520 (#10554) Signed-off-by: William Zhang <warmchang@outlook.com> Update api-concepts.md (#10534) Revert "Fix command issue (#10515)" This reverts commit c02a7fb9f9. Update memory-constraint-namespace.md (#10530) update memory request to 100MiB corresponding the yaml content Blog: Introducing Volume Snapshot Alpha for Kubernetes (#10562) * blog post for azure vmss * snapshot blog post Resolve merge conflicts in OWNERS* Minor typo fix (#10567) Not sure what's supposed to be here, proposing removing it. * Feedback from gochist Tweaks to feedback * Feedback from ClaudiaJKang
2018-10-12 14:25:01 -07:00
parent 753f57f0e6
commit abcee2dccd
316 changed files with 9227 additions and 169 deletions
@@ -0,0 +1,65 @@
+---
+approvers:
+- jcbsmpsn
+- mikedanese
+title: 证书轮换
+content_template: templates/task
+---
+
+{{% capture overview %}}
+本文展示如何在 kubelet 中启用并配置证书轮换。
+{{% /capture %}}
+
+{{% capture prerequisites %}}
+
+* 要求 Kubernetes 1.8.0 或更高的版本
+
+* Kubelet 证书轮换在 1.8.0 版本中处于 beta 阶段, 这意味着该特性可能在没有通知的情况下发生变化。
+
+{{% /capture %}}
+
+{{% capture steps %}}
+
+## 概述
+
+Kubelet 使用证书进行 Kubernetes API 的认证。 
+默认情况下，这些证书的签发期限为一年，所以不需要太频繁地进行更新。
+
+Kubernetes 1.8 版本中包含 beta 特性 [kubelet 证书轮换](/docs/tasks/administer-cluster/certificate-rotation/)，
+在当前证书即将过期时，
+将自动生成新的秘钥，并从 Kubernetes API 申请新的证书。 一旦新的证书可用，它将被用于与 
+Kubernetes API 间的连接认证。
+
+## 启用客户端证书轮换
+
+ `kubelet` 进程接收 `--rotate-certificates` 参数，该参数决定 kubelet 在当前使用的证书即将到期时，
+是否会自动申请新的证书。 由于证书轮换是 beta 特性，必须通过参数 `--feature-gates=RotateKubeletClientCertificate=true` 进行启用。
+
+
+`kube-controller-manager` 进程接收
+`--experimental-cluster-signing-duration` 参数，该参数控制证书签发的有效期限。
+
+## 理解证书轮换配置
+
+当 kubelet 启动时，如被配置为自举（使用`--bootstrap-kubeconfig` 参数），kubelet 会使用其初始证书连接到
+Kubernetes API ，并发送证书签名的请求。 可以通过以下方式查看证书签名请求的状态：
+
+```sh
+kubectl get csr
+```
+
+最初，来自节点上 kubelet 的证书签名请求处于 `Pending` 状态。 如果证书签名请求满足特定条件，
+控制器管理器会自动批准，此时请求会处于 `Approved` 状态。 接下来，控制器管理器会签署证书，
+证书的有效期限由 `--experimental-cluster-signing-duration` 参数指定，签署的证书会被附加到证书签名请求中。
+
+Kubelet 会从 Kubernetes API 取回签署的证书，并将其写入磁盘，存储位置通过 `--cert-dir` 参数指定。
+然后 kubelet 会使用新的证书连接到 Kubernetes API。
+
+当签署的证书即将到期时，kubelet 会使用 Kubernetes API，发起新的证书签名请求。
+同样地，控制器管理器会自动批准证书请求，并将签署的证书附加到证书签名请求中。 Kubelet
+会从 Kubernetes API 取回签署的证书，并将其写入磁盘。 然后它会更新与 Kubernetes API 
+的连接，使用新的证书重新连接到 Kubernetes API。
+
+{{% /capture %}}
+
+