whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[zh] Tidy up and fix links in tasks section (8/10)

Browse Source
This commit is contained in:
Qiming Teng
2020-08-16 11:05:13 +08:00
parent fb6364da0a
commit c2aae6890f
10 changed files with 613 additions and 540 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/zh/docs/tasks/administer-cluster/network-policy-provider/calico-network-policy.md
+34 -46
View File
@@ -1,53 +1,38 @@
---
reviewers:
- caseydavenport
title: 使用 Calico 作为 NetworkPolicy
title: 使用 Calico 提供 NetworkPolicy
content_type: task
weight: 10
---
<!-- overview -->
<!-- This page shows a couple of quick ways to create a Calico cluster on Kubernetes. -->
本页展示了两种在 Kubernetes 上快速创建 Calico 集群的方法。
<!--
This page shows a couple of quick ways to create a Calico cluster on Kubernetes.
-->
本页展示了几种在 Kubernetes 上快速创建 Calico 集群的方法。
## {{% heading "prerequisites" %}}
<!-- Decide whether you want to deploy a [cloud](#creating-a-calico-cluster-with-google-kubernetes-engine-gke) or [local](#creating-a-local-calico-cluster-with-kubeadm) cluster. -->
决定您想部署一个[云](#在-Google-Kubernetes-Engine-GKE-上创建一个-Calico-集群) 还是 [本地](#使用-kubeadm-创建一个本地-Calico-集群) 集群。
<!--
Decide whether you want to deploy a [cloud](#creating-a-calico-cluster-with-google-kubernetes-engine-gke) or [local](#creating-a-local-calico-cluster-with-kubeadm) cluster.
-->
确定你想部署一个[云版本](#gke-cluster)还是[本地版本](#local-cluster)的集群。
<!-- steps -->
<!-- ## Creating a Calico cluster with Google Kubernetes Engine (GKE)
<!--
## Creating a Calico cluster with Google Kubernetes Engine (GKE)
**Prerequisite**: [gcloud](https://cloud.google.com/sdk/docs/quickstarts).
1. To launch a GKE cluster with Calico, just include the `--enable-network-policy` flag.
**Syntax**
```shell
gcloud container clusters create [CLUSTER_NAME] --enable-network-policy
```
**Example**
```shell
gcloud container clusters create my-calico-cluster --enable-network-policy
```
1. To verify the deployment, use the following command.
```shell
kubectl get pods --namespace=kube-system
```
The Calico pods begin with `calico`. Check to make sure each one has a status of `Running`.
-->
## 在 Google Kubernetes Engine (GKE) 上创建一个 Calico 集群
-->
## 在 Google Kubernetes Engine (GKE) 上创建一个 Calico 集群 {#gke-cluster}
**先决条件**: [gcloud](https://cloud.google.com/sdk/docs/quickstarts)
1. 启动一个带有 Calico 的 GKE 集群，只需加上flag `--enable-network-policy`。
<!--
1. To launch a GKE cluster with Calico, just include the `--enable-network-policy` flag.
-->
1. To launch a GKE cluster with Calico, just include the `--enable-network-policy` flag.
1. 启动一个带有 Calico 的 GKE 集群，只需加上参数 `--enable-network-policy`。
**语法**
```shell
@@ -59,33 +44,36 @@ weight: 10
gcloud container clusters create my-calico-cluster --enable-network-policy
```
1. 使用如下命令验证部署是否正确。
<!--
1. To verify the deployment, use the following command.
-->
2. 使用如下命令验证部署是否正确。
```shell
kubectl get pods --namespace=kube-system
```
<!--
The Calico pods begin with `calico`. Check to make sure each one has a status of `Running`.
-->
Calico 的 pods 名以 `calico` 打头，检查确认每个 pods 状态为 `Running`。
<!--
<!--
## Creating a local Calico cluster with kubeadm
To get a local single-host Calico cluster in fifteen minutes using kubeadm, refer to the
[Calico Quickstart](https://docs.projectcalico.org/latest/getting-started/kubernetes/).
-->
## 使用 kubeadm 创建一个本地 Calico 集群 {#local-cluster}
## 使用 kubeadm 创建一个本地 Calico 集群
在15分钟内使用 kubeadm 得到一个本地单主机 Calico 集群，请参考
使用 kubeadm 在 15 分钟内得到一个本地单主机 Calico 集群，请参考
[Calico 快速入门](https://docs.projectcalico.org/latest/getting-started/kubernetes/)。
## {{% heading "whatsnext" %}}
<!-- Once your cluster is running, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy. -->
集群运行后，您可以按照 [声明 Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) 去尝试使用 Kubernetes NetworkPolicy。
<!--
Once your cluster is running, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy.
-->
集群运行后，您可以按照[声明网络策略](/zh/docs/tasks/administer-cluster/declare-network-policy/)
去尝试使用 Kubernetes NetworkPolicy。
content/zh/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md
+80 -62
View File
@@ -1,30 +1,25 @@
---
reviewers:
- danwent
title: 使用 Cilium 作为 NetworkPolicy
title: 使用 Cilium 提供 NetworkPolicy
content_type: task
weight: 20
---
<!-- overview -->
<!-- This page shows how to use Cilium for NetworkPolicy.
<!--
This page shows how to use Cilium for NetworkPolicy.
For background on Cilium, read the [Introduction to Cilium](https://cilium.readthedocs.io/en/latest/intro). -->
本页展示了如何使用 Cilium 作为 NetworkPolicy。
For background on Cilium, read the [Introduction to Cilium](https://cilium.readthedocs.io/en/latest/intro).
-->
本页展示如何使用 Cilium 提供 NetworkPolicy。
关于 Cilium 的背景知识，请阅读 [Cilium 介绍](https://cilium.readthedocs.io/en/latest/intro)。
## {{% heading "prerequisites" %}}
{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
<!-- steps -->
<!--
## Deploying Cilium on Minikube for Basic Testing
@@ -32,32 +27,68 @@ To get familiar with Cilium easily you can follow the
[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/latest/gettingstarted/minikube/)
to perform a basic DaemonSet installation of Cilium in minikube.
Installation in a minikube setup uses a simple ''all-in-one'' YAML
file that includes DaemonSet configurations for Cilium, to connect
to the minikube's etcd instance as well as appropriate RBAC settings:
-->
To start minikube, minimal version required is >= v1.3.1, run the with the
following arguments:
-->
## 在 Minikube 上部署 Cilium 用于基本测试
为了轻松熟悉 Cilium 您可以根据[Cilium Kubernetes 入门指南](https://docs.cilium.io/en/latest/gettingstarted/minikube/)在 minikube 中执行一个 cilium 的基本的 DaemonSet 安装。
为了轻松熟悉 Cilium 你可以根据
[Cilium Kubernetes 入门指南](https://docs.cilium.io/en/latest/gettingstarted/minikube/)
在 minikube 中执行一个 cilium 的基本 DaemonSet 安装。
在 minikube 中的安装配置使用一个简单的“一体化” YAML 文件，包括了 Cilium 的 DaemonSet 配置，连接 minikube 的 etcd 实例，以及适当的 RBAC 设置。
要启动 minikube，需要的最低版本为 1.3.1，使用下面的参数运行：
```shell
$ kubectl create -f https://raw.githubusercontent.com/cilium/cilium/master/examples/kubernetes/cilium.yaml
configmap "cilium-config" created
secret "cilium-etcd-secrets" created
serviceaccount "cilium" created
clusterrolebinding "cilium" created
daemonset "cilium" created
clusterrole "cilium" created
minikube version
```
```
minikube version: v1.3.1
```
```shell
minikube start --network-plugin=cni --memory=4096
```
<!--
Mount the BPF filesystem:
-->
挂载 BPF 文件系统：
```shell
minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf
```
<!--
For minikube you can deploy this simple ''all-in-one'' YAML file that includes
DaemonSet configurations for Cilium as well as appropriate RBAC settings:
-->
在 minikube 环境中，你可以部署下面的"一体化" YAML 文件，其中包含 Cilium
的 DaemonSet 配置以及适当的 RBAC 配置：
```shell
kubectl create -f https://raw.githubusercontent.com/cilium/cilium/master/examples/kubernetes/cilium.yaml
```
```
configmap/cilium-config created
serviceaccount/cilium created
serviceaccount/cilium-operator created
clusterrole.rbac.authorization.k8s.io/cilium created
clusterrole.rbac.authorization.k8s.io/cilium-operator created
clusterrolebinding.rbac.authorization.k8s.io/cilium created
clusterrolebinding.rbac.authorization.k8s.io/cilium-operator created
daemonset.apps/cilium create
deployment.apps/cilium-operator created
```
<!--
The remainder of the Getting Started Guide explains how to enforce both L3/L4
(i.e., IP address + port) security policies, as well as L7 (e.g., HTTP) security
policies using an example application.
-->
入门指南其余的部分用一个示例应用说明了如何强制执行L3/L4（即 IP 地址+端口）的安全策略以及L7 （如 HTTP）的安全策略。
入门指南其余的部分用一个示例应用说明了如何强制执行 L3/L4（即 IP 地址+端口）的安全策略
以及L7 （如 HTTP）的安全策略。
<!--
## Deploying Cilium for Production Use
@@ -67,14 +98,14 @@ For detailed instructions around deploying Cilium for production, see:
This documentation includes detailed requirements, instructions and example
production DaemonSet files.
-->
## 部署 Cilium 用于生产用途
关于部署 Cilium 用于生产的详细说明，请见[Cilium Kubernetes 安装指南](https://cilium.readthedocs.io/en/latest/gettingstarted/#installation)
，此文档包括详细的需求、说明和生产用途 DaemonSet 文件示例。
关于部署 Cilium 用于生产的详细说明，请见
[Cilium Kubernetes 安装指南](https://cilium.readthedocs.io/en/latest/gettingstarted/#installation)，
此文档包括详细的需求、说明和生产用途 DaemonSet 文件示例。
<!-- discussion -->
<!--
## Understanding Cilium components
@@ -83,53 +114,40 @@ this list of Pods run:
-->
## 了解 Cilium 组件
部署使用 Cilium 的集群会添加 Pods 到`kube-system`命名空间。 要查看此Pod列表，运行：
部署使用 Cilium 的集群会添加 Pods 到 `kube-system` 命名空间。要查看 Pod 列表，运行：
```shell
kubectl get pods --namespace=kube-system
```
<!-- You'll see a list of Pods similar to this: -->
您将看到像这样的 Pods 列表：
你将看到像这样的 Pods 列表：
```console
NAME DESIRED CURRENT READY NODE-SELECTOR AGE
cilium 1 1 1 <none> 2m
NAME READY STATUS RESTARTS AGE
cilium-6rxbd 1/1 Running 0 1m
...
```
<!--
There are two main components to be aware of:
- One `cilium` Pod runs on each node in your cluster and enforces network policy
A `cilium` Pod runs on each node in your cluster and enforces network policy
on the traffic to/from Pods on that node using Linux BPF.
- For production deployments, Cilium should leverage the key-value store cluster
(e.g., etcd) used by Kubernetes, which typically runs on the Kubernetes master nodes.
The [Cilium Kubernetes Installation Guide](https://cilium.readthedocs.io/en/latest/gettingstarted/#installation)
includes an example DaemonSet which can be customized to point to this key-value
store cluster. The simple ''all-in-one'' DaemonSet for minikube requires no such
configuration because it automatically connects to the minikube's etcd instance.
-->
有两个主要组件需要注意：
- 在集群中的每个节点上都会运行一个 `cilium` Pod，并利用Linux BPF执行网络策略管理该节点上进出 Pod 的流量。
- 对于生产部署，Cilium 应该复用 Kubernetes 所使用的键值存储集群（如 etcd），其通常在Kubernetes 的 master 节点上运行。
[Cilium Kubernetes安装指南](https://cilium.readthedocs.io/en/latest/gettingstarted/#installation)
包括了一个示例 DaemonSet，可以自定义指定此键值存储集群。
简单的 minikube 的“一体化” DaemonSet 不需要这样的配置，因为它会自动连接到 minikube 的 etcd 实例。
-->
你的集群中的每个节点上都会运行一个 `cilium` Pod，通过使用 Linux BPF
针对该节点上的 Pod 的入站、出站流量实施网络策略控制。
## {{% heading "whatsnext" %}}
<!-- Once your cluster is running, you can follow the
<!--
Once your cluster is running, you can follow the
[Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/)
to try out Kubernetes NetworkPolicy with Cilium.
Have fun, and if you have questions, contact us using the
[Cilium Slack Channel](https://cilium.herokuapp.com/). -->
群集运行后，您可以按照[声明网络策略](/docs/tasks/administer-cluster/declare-network-policy/)
用 Cilium 试用 Kubernetes NetworkPolicy。
玩得开心，如果您有任何疑问，请联系我们
[Cilium Slack Channel](https://cilium.herokuapp.com/)。
[Cilium Slack Channel](https://cilium.herokuapp.com/).
-->
集群运行后，你可以按照
[声明网络策略](/zh/docs/tasks/administer-cluster/declare-network-policy/)
试用基于 Cilium 的 Kubernetes NetworkPolicy。
玩得开心，如果你有任何疑问，请到 [Cilium Slack 频道](https://cilium.herokuapp.com/)
联系我们。
content/zh/docs/tasks/administer-cluster/network-policy-provider/kube-router-network-policy.md
+24 -15
View File
@@ -1,33 +1,42 @@
---
reviewers:
- murali-reddy
title: 使用 Kube-router 作为 NetworkPolicy
title: 使用 kube-router 提供 NetworkPolicy
content_type: task
weight: 30
---
<!-- overview -->
<!-- This page shows how to use [Kube-router](https://github.com/cloudnativelabs/kube-router) for NetworkPolicy. -->
本页展示了如何使用 [Kube-router](https://github.com/cloudnativelabs/kube-router) 作为 NetworkPolicy。
<!--
This page shows how to use [Kube-router](https://github.com/cloudnativelabs/kube-router) for NetworkPolicy.
-->
本页展示如何使用 [Kube-router](https://github.com/cloudnativelabs/kube-router) 提供 NetworkPolicy。
## {{% heading "prerequisites" %}}
<!-- You need to have a Kubernetes cluster running. If you do not already have a cluster, you can create one by using any of the cluster installers like Kops, Bootkube, Kubeadm etc. -->
您需要拥有一个正在运行的 Kubernetes 集群。如果您还没有集群，可以使用任意的集群安装器如 Kops，Bootkube，Kubeadm 等创建一个。
<!--
You need to have a Kubernetes cluster running. If you do not already have a cluster, you can create one by using any of the cluster installers like Kops, Bootkube, Kubeadm etc.
-->
你需要拥有一个运行中的 Kubernetes 集群。如果你还没有集群，可以使用任意的集群
安装程序如 Kops、Bootkube、Kubeadm 等创建一个。
<!-- steps -->
<!-- ## Installing Kube-router addon
The Kube-router Addon comes with a Network Policy Controller that watches Kubernetes API server for any NetworkPolicy and pods updated and configures iptables rules and ipsets to allow or block traffic as directed by the policies. Please follow the [trying Kube-router with cluster installers](https://www.kube-router.io/docs/user-guide/#try-kube-router-with-cluster-installers) guide to install Kube-router addon. -->
<!--
## Installing Kube-router addon
## 安装 Kube-router 插件
Kube-router 插件自带一个Network Policy 控制器，监视来自于Kubernetes API server 的 NetworkPolicy 和 pods 的变化，根据策略指示配置 iptables 规则和 ipsets 来允许或阻止流量。请根据 [尝试通过集群安装器使用 Kube-router](https://www.kube-router.io/docs/user-guide/#try-kube-router-with-cluster-installers) 指南安装 Kube-router 插件。
The Kube-router Addon comes with a Network Policy Controller that watches Kubernetes API server for any NetworkPolicy and pods updated and configures iptables rules and ipsets to allow or block traffic as directed by the policies. Please follow the [trying Kube-router with cluster installers](https://www.kube-router.io/docs/user-guide/#try-kube-router-with-cluster-installers) guide to install Kube-router addon.
-->
## 安装 kube-router 插件
kube-router 插件自带一个网络策略控制器，监视来自于 Kubernetes API 服务器的
NetworkPolicy 和 Pod 的变化，根据策略指示配置 iptables 规则和 ipsets 来允许或阻止流量。
请根据 [通过集群安装程序尝试 kube-router](https://www.kube-router.io/docs/user-guide/#try-kube-router-with-cluster-installers) 指南安装 kube-router 插件。
## {{% heading "whatsnext" %}}
<!-- Once you have installed the Kube-router addon, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy. -->
在您安装 Kube-router 插件后，可以根据 [声明 Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) 去尝试使用 Kubernetes NetworkPolicy。
<!--
Once you have installed the Kube-router addon, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy.
-->
在你安装了 kube-router 插件后，可以参考
[声明网络策略](/zh/docs/tasks/administer-cluster/declare-network-policy/)
去尝试使用 Kubernetes NetworkPolicy。
content/zh/docs/tasks/administer-cluster/network-policy-provider/romana-network-policy.md
+8 -16
View File
@@ -1,7 +1,5 @@
---
reviewers:
- chrismarino
title: 使用 Romana 作为 NetworkPolicy
title: 使用 Romana 提供 NetworkPolicy
content_type: task
weight: 40
---
@@ -11,15 +9,10 @@ weight: 40
<!-- This page shows how to use Romana for NetworkPolicy. -->
本页展示如何使用 Romana 作为 NetworkPolicy。
## {{% heading "prerequisites" %}}
<!-- Complete steps 1, 2, and 3 of the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/). -->
完成[kubeadm 入门指南](/docs/getting-started-guides/kubeadm/)中的1、2、3步。
完成 [kubeadm 入门指南](/zh/docs/reference/setup-tools/kubeadm/kubeadm/)中的 1、2、3 步。
<!-- steps -->
<!--
@@ -37,23 +30,22 @@ To apply network policies use one of the following:
-->
## 使用 kubeadm 安装 Romana
按照[容器化安装指南](https://github.com/romana/romana/tree/master/containerize)获取 kubeadm。
按照[容器化安装指南](https://github.com/romana/romana/tree/master/containerize)，使用 kubeadm 安装。
## 运用网络策略
## 应用网络策略
使用以下的一种方式去运用网络策略：
使用以下的一种方式应用网络策略：
* [Romana 网络策略](https://github.com/romana/romana/wiki/Romana-policies)
* [Romana 网络策略例子](https://github.com/romana/core/blob/master/doc/policy.md)
* NetworkPolicy API
## {{% heading "whatsnext" %}}
<!--
Once you have installed Romana, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy.
-->
Romana 安装完成后，您可以按照[声明 Network Policy](/docs/tasks/administer-cluster/declare-network-policy/)去尝试使用 Kubernetes NetworkPolicy。
Romana 安装完成后，你可以按照
[声明网络策略](/zh/docs/tasks/administer-cluster/declare-network-policy/)
去尝试使用 Kubernetes NetworkPolicy。
content/zh/docs/tasks/administer-cluster/network-policy-provider/weave-network-policy.md
+26 -21
View File
@@ -1,28 +1,28 @@
---
reviewers:
- bboreham
title: 使用 Weave Net 作为 NetworkPolicy
title: 使用 Weave Net 提供 NetworkPolicy
content_type: task
weight: 50
---
<!-- overview -->
<!-- This page shows how to use Weave Net for NetworkPolicy. -->
本页展示了如何使用使用 Weave Net 作为 NetworkPolicy。
<!--
This page shows how to use Weave Net for NetworkPolicy.
-->
本页展示如何使用使用 Weave Net 提供 NetworkPolicy。
## {{% heading "prerequisites" %}}
<!--
You need to have a Kubernetes cluster. Follow the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/) to bootstrap one.
-->
您需要拥有一个 Kubernetes 集群。按照[kubeadm 入门指南](/docs/getting-started-guides/kubeadm/)来引导一个。
你需要拥有一个 Kubernetes 集群。按照
[kubeadm 入门指南](/zh/docs/reference/setup-tools/kubeadm/kubeadm/)
来启动一个。
<!-- steps -->
<!--
## Install the Weave Net addon
@@ -32,20 +32,21 @@ The Weave Net addon for Kubernetes comes with a [Network Policy Controller](http
-->
## 安装 Weave Net 插件
按照[通过插件集成Kubernetes](https://www.weave.works/docs/net/latest/kube-addon/)指南。
按照[通过插件集成 Kubernetes](https://www.weave.works/docs/net/latest/kube-addon/)
指南执行安装。
Kubernetes 的 Weave Net 插件带有[网络策略控制器](https://www.weave.works/docs/net/latest/kube-addon/#npc)，可自动监控 Kubernetes 所有名称空间中的任何 NetworkPolicy 注释。 配置`iptables`规则以允许或阻止策略指示的流量。
Kubernetes 的 Weave Net 插件带有
[网络策略控制器](https://www.weave.works/docs/net/latest/kube-addon/#npc)，
可自动监控 Kubernetes 所有名字空间的 NetworkPolicy 注释，
配置 `iptables` 规则以允许或阻止策略指示的流量。
<!--
## Test the installation
Verify that the weave works.
Enter the following command:
-->
## 测试安装
验证 weave 是否有效。
@@ -67,17 +68,21 @@ weave-net-7nmwt 2/2 Running 3 9d
weave-net-pmw8w 2/2 Running 0 9d 192.168.2.216 worknode2
```
<!-- Each Node has a weave Pod, and all Pods are `Running` and `2/2 READY`. (`2/2` means that each Pod has `weave` and `weave-npc`.) -->
每个 Node 都有一个 weave Pod，所有 Pod 都是`Running`和`2/2 READY`。（`2/2`表示每个Pod都有`weave`和`weave-npc`。）
<!--
Each Node has a weave Pod, and all Pods are `Running` and `2/2 READY`. (`2/2` means that each Pod has `weave` and `weave-npc`.)
-->
每个 Node 都有一个 weave Pod，所有 Pod 都是`Running` 和 `2/2 READY`。
（`2/2` 表示每个 Pod 都有 `weave` 和 `weave-npc`）
## {{% heading "whatsnext" %}}
<!--
Once you have installed the Weave Net addon, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy. If you have any question, contact us at [#weave-community on Slack or Weave User Group](https://github.com/weaveworks/weave#getting-help).
-->
安装Weave Net插件后，您可以按照[声明网络策略](/docs/tasks/administration-cluster/declare-network-policy/)来试用 Kubernetes NetworkPolicy。 如果您有任何疑问，请联系我们[#weave-community on Slack 或 Weave User Group](https://github.com/weaveworks/weave#getting-help)。
安装 Weave Net 插件后，你可以参考
[声明网络策略](/zh/docs/tasks/administration-cluster/declare-network-policy/)
来试用 Kubernetes NetworkPolicy。
如果你有任何疑问，请通过
[Slack 上的 #weave-community 频道或者 Weave 用户组](https://github.com/weaveworks/weave#getting-help)
联系我们。