Switch language name 'zh' to 'zh-cn'
This is the first step to rename 'zh' to 'zh-cn'. There are several reasons why we rename the language name.
- The upstream docsy theme changed the language name, leading to many warnings during site build;
The side-effect is that the i18n strings are no longer working.
- We believe renaming the language is the right thing to do, because this move can make room for other variants of Chinese language, such as 'zh-tw', 'zh-sg' etc.
There would be several follow-ups to this PR, such as fixing the intra-site links, adding redirects etc.
We will lock up changes to zh/zh-cn pages for the moment, until this one gets in.
This PR is based on commit cdad0a7342.
This commit is contained in:
Qiming Teng
@@ -0,0 +1,5 @@
|
||||
---
|
||||
title: 配置 API
|
||||
weight: 65
|
||||
---
|
||||
|
||||
@@ -0,0 +1,843 @@
|
||||
---
|
||||
title: kube-apiserver Audit 配置 (v1)
|
||||
content_type: tool-reference
|
||||
package: audit.k8s.io/v1
|
||||
auto_generated: true
|
||||
---
|
||||
|
||||
<!---
|
||||
title: kube-apiserver Audit Configuration (v1)
|
||||
content_type: tool-reference
|
||||
package: audit.k8s.io/v1
|
||||
auto_generated: true
|
||||
-->
|
||||
|
||||
<!--
|
||||
## Resource Types
|
||||
-->
|
||||
## 资源类型 {#resource-types}
|
||||
|
||||
- [Event](#audit-k8s-io-v1-Event)
|
||||
- [EventList](#audit-k8s-io-v1-EventList)
|
||||
- [Policy](#audit-k8s-io-v1-Policy)
|
||||
- [PolicyList](#audit-k8s-io-v1-PolicyList)
|
||||
|
||||
## `Event` {#audit-k8s-io-v1-Event}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [EventList](#audit-k8s-io-v1-EventList)
|
||||
|
||||
<!--
|
||||
Event captures all the information that can be included in an API audit log.
|
||||
-->
|
||||
<p>
|
||||
Event 结构包含可出现在 API 审计日志中的所有信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>audit.k8s.io/v1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>Event</code></td></tr>
|
||||
|
||||
<tr><td><code>level</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="#audit-k8s-io-v1-Level"><code>Level</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--AuditLevel at which event was generated-->
|
||||
<p>
|
||||
生成事件所对应的审计级别。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>auditID</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/types#UID"><code>k8s.io/apimachinery/pkg/types.UID</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Unique audit ID, generated for each request.-->
|
||||
<p>
|
||||
为每个请求所生成的唯一审计 ID。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>stage</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="#audit-k8s-io-v1-Stage"><code>Stage</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Stage of the request handling when this event instance was generated.-->
|
||||
<p>
|
||||
生成此事件时请求的处理阶段。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>requestURI</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--RequestURI is the request URI as sent by the client to a server.-->
|
||||
<p>
|
||||
requestURI 是客户端发送到服务器端的请求 URI。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>verb</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--Verb is the kubernetes verb associated with the request.
|
||||
For non-resource requests, this is the lower-cased HTTP method.-->
|
||||
<p>
|
||||
verb 是与请求对应的 Kubernetes 动词。对于非资源请求，此字段为 HTTP 方法的小写形式。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>user</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#userinfo-v1-authentication"><code>authentication/v1.UserInfo</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Authenticated user information.-->
|
||||
<p>
|
||||
关于认证用户的信息。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>impersonatedUser</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#userinfo-v1-authentication"><code>authentication/v1.UserInfo</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Impersonated user information.-->
|
||||
<p>
|
||||
关于所伪装（impersonated）的用户的信息。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>sourceIPs</code><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
Source IPs, from where the request originated and intermediate proxies.
|
||||
The source IPs are listed from (in order):
|
||||
-->
|
||||
<p>
|
||||
发起请求和中间代理的源 IP 地址。
|
||||
源 IP 从以下（按顺序）列出：
|
||||
</p>
|
||||
<ol>
|
||||
<li>
|
||||
<!--
|
||||
X-Forwarded-For request header IPs
|
||||
-->
|
||||
X-Forwarded-For 请求标头 IP
|
||||
</li>
|
||||
<li>
|
||||
<!--
|
||||
X-Real-Ip header, if not present in the X-Forwarded-For list
|
||||
-->
|
||||
X-Real-Ip 标头，如果 X-Forwarded-For 列表中不存在
|
||||
</li>
|
||||
<li>
|
||||
<!--
|
||||
The remote address for the connection, if it doesn't match the last
|
||||
IP in the list up to here (X-Forwarded-For or X-Real-Ip).
|
||||
Note: All but the last IP can be arbitrarily set by the client.
|
||||
-->
|
||||
连接的远程地址，如果它无法与此处列表中的最后一个 IP（X-Forwarded-For 或 X-Real-Ip）匹配。
|
||||
注意：除最后一个 IP 外的所有 IP 均可由客户端任意设置。
|
||||
</li>
|
||||
</ol>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>userAgent</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--UserAgent records the user agent string reported by the client.
|
||||
Note that the UserAgent is provided by the client, and must not be trusted.-->
|
||||
<p>
|
||||
userAgent 中记录客户端所报告的用户代理（User Agent）字符串。
|
||||
注意 userAgent 信息是由客户端提供的，一定不要信任。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>objectRef</code><br/>
|
||||
<a href="#audit-k8s-io-v1-ObjectReference"><code>ObjectReference</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!-- Object reference this request is targeted at.
|
||||
Does not apply for List-type requests, or non-resource requests.-->
|
||||
<p>
|
||||
此请求所指向的对象引用。对于 List 类型的请求或者非资源请求，此字段可忽略。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>responseStatus</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#status-v1-meta"><code>meta/v1.Status</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--The response status, populated even when the ResponseObject is not a Status type.
|
||||
For successful responses, this will only include the Code and StatusSuccess.
|
||||
For non-status type error responses, this will be auto-populated with the error Message.-->
|
||||
<p>
|
||||
响应的状态，当 responseObject 不是 Status 类型时被赋值。
|
||||
对于成功的请求，此字段仅包含 code 和 statusSuccess。
|
||||
对于非 Status 类型的错误响应，此字段会被自动赋值为出错信息。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>requestObject</code><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/runtime#Unknown"><code>k8s.io/apimachinery/pkg/runtime.Unknown</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--API object from the request, in JSON format. The RequestObject is recorded as-is in the request
|
||||
(possibly re-encoded as JSON), prior to version conversion, defaulting, admission or
|
||||
merging. It is an external versioned object type, and may not be a valid object on its own.
|
||||
Omitted for non-resource requests. Only logged at Request Level and higher.-->
|
||||
<p>
|
||||
来自请求的 API 对象，以 JSON 格式呈现。requestObject 在请求中按原样记录
|
||||
（可能会采用 JSON 重新编码），之后会进入版本转换、默认值填充、准入控制以及
|
||||
配置信息合并等阶段。此对象为外部版本化的对象类型，甚至其自身可能并不是一个
|
||||
合法的对象。对于非资源请求，此字段被忽略。
|
||||
只有当审计级别为 Request 或更高的时候才会记录。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>responseObject</code><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/runtime#Unknown"><code>k8s.io/apimachinery/pkg/runtime.Unknown</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--API object returned in the response, in JSON. The ResponseObject is recorded after conversion
|
||||
to the external type, and serialized as JSON. Omitted for non-resource requests. Only logged
|
||||
at Response Level.-->
|
||||
<p>
|
||||
响应中包含的 API 对象，以 JSON 格式呈现。requestObject 是在被转换为外部类型
|
||||
并序列化为 JSON 格式之后才被记录的。
|
||||
对于非资源请求，此字段会被忽略。
|
||||
只有审计级别为 Response 时才会记录。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>requestReceivedTimestamp</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#microtime-v1-meta"><code>meta/v1.MicroTime</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Time the request reached the apiserver.-->
|
||||
<p>
|
||||
请求到达 API 服务器时的时间。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>stageTimestamp</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#microtime-v1-meta"><code>meta/v1.MicroTime</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Time the request reached current audit stage.-->
|
||||
<p>
|
||||
请求到达当前审计阶段时的时间。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>annotations</code><br/>
|
||||
<code>map[string]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--Annotations is an unstructured key value map stored with an audit event that may be set by
|
||||
plugins invoked in the request serving chain, including authentication, authorization and
|
||||
admission plugins. Note that these annotations are for the audit event, and do not correspond
|
||||
to the metadata.annotations of the submitted object. Keys should uniquely identify the informing
|
||||
component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values
|
||||
should be short. Annotations are included in the Metadata level.-->
|
||||
<p>
|
||||
annotations 是一个无结构的键-值映射，其中保存的是一个审计事件。
|
||||
该事件可以由请求处理链路上的插件来设置，包括身份认证插件、鉴权插件以及
|
||||
准入控制插件等。
|
||||
注意这些注解是针对审计事件本身的，与所提交的对象中的 metadata.annotations
|
||||
之间不存在对应关系。
|
||||
映射中的键名应该唯一性地标识生成该事件的组件，从而避免名字上的冲突
|
||||
（例如 podsecuritypolicy.admission.k8s.io/policy）。
|
||||
映射中的键值应该比较简洁。
|
||||
当审计级别为 Metadata 时会包含 annotations 字段。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `EventList` {#audit-k8s-io-v1-EventList}
|
||||
|
||||
<!--
|
||||
EventList is a list of audit Events.
|
||||
-->
|
||||
<p>
|
||||
EventList 是审计事件（Event）的列表。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>audit.k8s.io/v1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>EventList</code></td></tr>
|
||||
|
||||
<tr><td><code>metadata</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#listmeta-v1-meta"><code>meta/v1.ListMeta</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted"><!--No description provided.-->列表结构元数据</span>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>items</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="#audit-k8s-io-v1-Event"><code>[]Event</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted"><!--No description provided.-->事件对象列表</span>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `Policy` {#audit-k8s-io-v1-Policy}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [PolicyList](#audit-k8s-io-v1-PolicyList)
|
||||
|
||||
<!--
|
||||
Policy defines the configuration of audit logging, and the rules for how different request
|
||||
categories are logged.
|
||||
-->
|
||||
<p>
|
||||
Policy 定义的是审计日志的配置以及不同类型请求的日志记录规则。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>audit.k8s.io/v1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>Policy</code></td></tr>
|
||||
|
||||
<tr><td><code>metadata</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#objectmeta-v1-meta"><code>meta/v1.ObjectMeta</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--ObjectMeta is included for interoperability with API infrastructure.Refer to the Kubernetes API documentation for the fields of the <code>metadata</code> field.-->
|
||||
<p>
|
||||
包含 <code>metadata</code> 字段是为了便于与 API 基础设施之间实现互操作。
|
||||
</p>
|
||||
参考 Kubernetes API 文档了解 <code>metadata</code> 字段的详细信息。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>rules</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="#audit-k8s-io-v1-PolicyRule"><code>[]PolicyRule</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Rules specify the audit Level a request should be recorded at.
|
||||
A request may match multiple rules, in which case the FIRST matching rule is used.
|
||||
The default audit level is None, but can be overridden by a catch-all rule at the end of the list.
|
||||
PolicyRules are strictly ordered.-->
|
||||
<p>
|
||||
字段 rules 设置请求要被记录的审计级别（level）。
|
||||
每个请求可能会与多条规则相匹配；发生这种状况时遵从第一条匹配规则。
|
||||
默认的审计级别是 None，不过可以在列表的末尾使用一条全抓（catch-all）规则
|
||||
重载其设置。
|
||||
列表中的规则（PolicyRule）是严格有序的。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>omitStages</code><br/>
|
||||
<a href="#audit-k8s-io-v1-Stage"><code>[]Stage</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--OmitStages is a list of stages for which no events are created. Note that this can also
|
||||
be specified per rule in which case the union of both are omitted.-->
|
||||
<p>
|
||||
字段 omitStages 是一个阶段（Stage）列表，其中包含无须生成事件的阶段。
|
||||
注意这一选项也可以通过每条规则来设置。
|
||||
审计组件最终会忽略出现在 omitStages 中阶段，也会忽略规则中的阶段。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr>
|
||||
<td>
|
||||
<code>omitManagedFields</code><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
OmitManagedFields indicates whether to omit the managed fields of the request
|
||||
and response bodies from being written to the API audit log.
|
||||
This is used as a global default - a value of 'true' will omit the managed fileds,
|
||||
otherwise the managed fields will be included in the API audit log.
|
||||
Note that this can also be specified per rule in which case the value specified
|
||||
in a rule will override the global default.
|
||||
-->
|
||||
<p>
|
||||
omitManagedFields 标明将请求和响应主体写入 API 审计日志时，是否省略其托管字段。
|
||||
此字段值用作全局默认值 - 'true' 值将省略托管字段，否则托管字段将包含在 API 审计日志中。
|
||||
请注意，也可以按规则指定此值，在这种情况下，规则中指定的值将覆盖全局默认值。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `PolicyList` {#audit-k8s-io-v1-PolicyList}
|
||||
|
||||
<!--
|
||||
PolicyList is a list of audit Policies.
|
||||
-->
|
||||
<p>
|
||||
PolicyList 是由审计策略（Policy）组成的列表。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>audit.k8s.io/v1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>PolicyList</code></td></tr>
|
||||
|
||||
<tr><td><code>metadata</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#listmeta-v1-meta"><code>meta/v1.ListMeta</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted"><!--No description provided.-->列表结构元数据。</span>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>items</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="#audit-k8s-io-v1-Policy"><code>[]Policy</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted"><!--No description provided.-->策略（Policy）对象列表。</span>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `GroupResources` {#audit-k8s-io-v1-GroupResources}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [PolicyRule](#audit-k8s-io-v1-PolicyRule)
|
||||
|
||||
<!--
|
||||
GroupResources represents resource kinds in an API group.
|
||||
-->
|
||||
<p>
|
||||
GroupResources 代表的是某 API 组中的资源类别。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>group</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--Group is the name of the API group that contains the resources.
|
||||
The empty string represents the core API group.-->
|
||||
字段 group 给出包含资源的 API 组的名称。
|
||||
空字符串代表 <code>core</code> API 组。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>resources</code><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
Resources is a list of resources this rule applies to.
|
||||
For example:
|
||||
'pods' matches pods.
|
||||
'pods/log' matches the log subresource of pods.
|
||||
'∗' matches all resources and their subresources.
|
||||
'pods/∗' matches all subresources of pods.
|
||||
'∗/scale' matches all scale subresources.
|
||||
-->
|
||||
<p>
|
||||
字段 resources 是此规则所适用的资源的列表。
|
||||
</p>
|
||||
<br/>
|
||||
<p>
|
||||
例如：<br/>
|
||||
'pods' 匹配 Pods；<br/>
|
||||
'pods/log' 匹配 Pods 的 log 子资源；<br/>
|
||||
'∗' 匹配所有资源及其子资源；<br/>
|
||||
'pods/∗' 匹配 Pods 的所有子资源；<br/>
|
||||
'∗/scale' 匹配所有的 scale 子资源。<br/><br/>
|
||||
</p>
|
||||
|
||||
<!--If wildcard is present, the validation rule will ensure resources do not
|
||||
overlap with each other.
|
||||
|
||||
An empty list implies all resources and subresources in this API groups apply.-->
|
||||
<p>
|
||||
如果存在通配符，则合法性检查逻辑会确保 resources 中的条目不会彼此重叠。
|
||||
</p>
|
||||
<br/>
|
||||
<p>
|
||||
空的列表意味着规则适用于该 API 组中的所有资源及其子资源。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>resourceNames</code><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--ResourceNames is a list of resource instance names that the policy matches.
|
||||
Using this field requires Resources to be specified.
|
||||
An empty list implies that every instance of the resource is matched.-->
|
||||
<p>
|
||||
字段 resourceNames 是策略将匹配的资源实例名称列表。
|
||||
使用此字段时，<code>resources</code> 必须指定。
|
||||
空的 resourceNames 列表意味着资源的所有实例都会匹配到此策略。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `Level` {#audit-k8s-io-v1-Level}
|
||||
|
||||
<!--
|
||||
(Alias of `string`)
|
||||
-->
|
||||
<code>string</code> 数据类型的别名。
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [Event](#audit-k8s-io-v1-Event)
|
||||
- [PolicyRule](#audit-k8s-io-v1-PolicyRule)
|
||||
|
||||
<!--
|
||||
Level defines the amount of information logged during auditing
|
||||
-->
|
||||
<p>
|
||||
Level 定义的是审计过程中在日志内记录的信息量。
|
||||
</p>
|
||||
|
||||
## `ObjectReference` {#audit-k8s-io-v1-ObjectReference}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [Event](#audit-k8s-io-v1-Event)
|
||||
|
||||
<!--
|
||||
ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
-->
|
||||
<p>
|
||||
ObjectReference 包含的是用来检查或修改所引用对象时将需要的全部信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>resource</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted"><!--No description provided.-->资源类别。</span>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>namespace</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted"><!--No description provided.-->资源对象所在名字空间。</span>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>name</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted"><!--No description provided.-->资源对象名称。</span>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>uid</code><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/types#UID"><code>k8s.io/apimachinery/pkg/types.UID</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted"><!--No description provided.-->资源对象的唯一标识（UID）。</span>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>apiGroup</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--APIGroup is the name of the API group that contains the referred object.
|
||||
The empty string represents the core API group.-->
|
||||
<p>
|
||||
字段 apiGroup 给出包含所引用对象的 API 组的名称。
|
||||
空字符串代表 <code>core</code> API 组。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--APIVersion is the version of the API group that contains the referred object.-->
|
||||
<p>
|
||||
字段 apiVersion 是包含所引用对象的 API 组的版本。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>resourceVersion</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted"><!--No description provided.-->资源对象自身的版本值。</span>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>subresource</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted"><!--No description provided.-->子资源的类别。</span>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `PolicyRule` {#audit-k8s-io-v1-PolicyRule}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [Policy](#audit-k8s-io-v1-Policy)
|
||||
|
||||
<!--
|
||||
PolicyRule maps requests based off metadata to an audit Level.
|
||||
Requests must match the rules of every field (an intersection of rules).
|
||||
-->
|
||||
<p>
|
||||
PolicyRule 包含一个映射，基于元数据将请求映射到某审计级别。
|
||||
请求必须与每个字段所定义的规则都匹配（即 rules 的交集）才被视为匹配。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>level</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="#audit-k8s-io-v1-Level"><code>Level</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--The Level that requests matching this rule are recorded at.-->
|
||||
<p>
|
||||
与此规则匹配的请求所对应的日志记录级别（Level）。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>users</code><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--The users (by authenticated user name) this rule applies to.
|
||||
An empty list implies every user.-->
|
||||
<p>
|
||||
根据身份认证所确定的用户名的列表，给出此规则所适用的用户。
|
||||
空列表意味着适用于所有用户。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>userGroups</code><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--The user groups this rule applies to. A user is considered matching
|
||||
if it is a member of any of the UserGroups.
|
||||
An empty list implies every user group.-->
|
||||
<p>
|
||||
此规则所适用的用户组的列表。如果用户是所列用户组中任一用户组的成员，则视为匹配。
|
||||
空列表意味着适用于所有用户组。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>verbs</code><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--The verbs that match this rule.
|
||||
An empty list implies every verb.-->
|
||||
<p>
|
||||
此规则所适用的动词（verb）列表。
|
||||
空列表意味着适用于所有动词。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>resources</code><br/>
|
||||
<a href="#audit-k8s-io-v1-GroupResources"><code>[]GroupResources</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Resources that this rule matches. An empty list implies all kinds in all API groups.-->
|
||||
<p>
|
||||
此规则所适用的资源类别列表。
|
||||
空列表意味着适用于 API 组中的所有资源类别。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>namespaces</code><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--Namespaces that this rule matches.
|
||||
The empty string "" matches non-namespaced resources.
|
||||
An empty list implies every namespace.-->
|
||||
</td>
|
||||
<p>
|
||||
此规则所适用的名字空间列表。
|
||||
空字符串（""）意味着适用于非名字空间作用域的资源。
|
||||
空列表意味着适用于所有名字空间。
|
||||
</p>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>nonResourceURLs</code><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--NonResourceURLs is a set of URL paths that should be audited.
|
||||
∗s are allowed, but only as the full, final step in the path.
|
||||
Examples:
|
||||
"/metrics" - Log requests for apiserver metrics
|
||||
"/healthz∗" - Log all health checks-->
|
||||
<p>
|
||||
字段 nonResourceURLs 给出一组需要被审计的 URL 路径。
|
||||
允许使用 ∗，但只能作为路径中最后一个完整分段。<br/>
|
||||
例如：<br/>
|
||||
"/metrics" - 记录对 API 服务器度量值（metrics）的所有请求；<br/>
|
||||
"/healthz∗" - 记录所有健康检查请求。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>omitStages</code><br/>
|
||||
<a href="#audit-k8s-io-v1-Stage"><code>[]Stage</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--OmitStages is a list of stages for which no events are created. Note that this can also
|
||||
be specified policy wide in which case the union of both are omitted.
|
||||
An empty list means no restrictions will apply.-->
|
||||
<p>
|
||||
字段 omitStages 是一个阶段（Stage）列表，针对所列的阶段服务器不会生成审计事件。
|
||||
注意这一选项也可以在策略（Policy）级别指定。服务器审计组件会忽略
|
||||
omitStages 中给出的阶段，也会忽略策略中给出的阶段。
|
||||
空列表意味着不对阶段作任何限制。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr>
|
||||
<td><code>omitManagedFields</code><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
OmitManagedFields indicates whether to omit the managed fields of the request
|
||||
and response bodies from being written to the API audit log.
|
||||
a value of 'true' will drop the managed fields from the API audit log
|
||||
a value of 'false' indicates that the managed fileds should be included in the API audit log
|
||||
Note that the value, if specified, in this rule will override the global default
|
||||
If a value is not specified then the global default specified in
|
||||
Policy.OmitManagedFields will stand.
|
||||
-->
|
||||
<p>
|
||||
omitManagedFields 决定将请求和响应主体写入 API 审计日志时，是否省略其托管字段。
|
||||
</p>
|
||||
<ul>
|
||||
<li>值为 'true' 将从 API 审计日志中删除托管字段</li>
|
||||
<li>
|
||||
值为 'false' 表示托管字段应包含在 API 审计日志中
|
||||
请注意，如果指定此规则中的值将覆盖全局默认值。
|
||||
如果未指定，则使用 policy.omitManagedFields 中指定的全局默认值。
|
||||
</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `Stage` {#audit-k8s-io-v1-Stage}
|
||||
|
||||
<!--
|
||||
(Alias of `string`)
|
||||
-->
|
||||
<code>string</code> 数据类型的别名。
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [Event](#audit-k8s-io-v1-Event)
|
||||
- [Policy](#audit-k8s-io-v1-Policy)
|
||||
- [PolicyRule](#audit-k8s-io-v1-PolicyRule)
|
||||
|
||||
<!--
|
||||
Stage defines the stages in request handling that audit events may be generated.
|
||||
-->
|
||||
<p>
|
||||
Stage 定义在请求处理过程中可以生成审计事件的阶段。
|
||||
</p>
|
||||
|
||||
@@ -0,0 +1,112 @@
|
||||
---
|
||||
title: kube-apiserver 配置 (v1)
|
||||
content_type: tool-reference
|
||||
package: apiserver.config.k8s.io/v1
|
||||
auto_generated: true
|
||||
---
|
||||
<!--
|
||||
title: kube-apiserver Configuration (v1)
|
||||
content_type: tool-reference
|
||||
package: apiserver.config.k8s.io/v1
|
||||
auto_generated: true
|
||||
-->
|
||||
|
||||
<!--
|
||||
<p>Package v1 is the v1 version of the API.</p>
|
||||
-->
|
||||
|
||||
<p>v1 包中包含 API 的 v1 版本。</p>
|
||||
|
||||
<!--
|
||||
## Resource Types
|
||||
-->
|
||||
## 资源类型
|
||||
|
||||
- [AdmissionConfiguration](#apiserver-config-k8s-io-v1-AdmissionConfiguration)
|
||||
|
||||
## `AdmissionConfiguration` {#apiserver-config-k8s-io-v1-AdmissionConfiguration}
|
||||
|
||||
<!--
|
||||
<p>AdmissionConfiguration provides versioned configuration for admission controllers.</p>
|
||||
-->
|
||||
<p>AdmissionConfiguration 为准入控制器提供版本化的配置。</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.config.k8s.io/v1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>AdmissionConfiguration</code></td></tr>
|
||||
|
||||
<tr><td><code>plugins</code><br/>
|
||||
<a href="#apiserver-config-k8s-io-v1-AdmissionPluginConfiguration"><code>[]AdmissionPluginConfiguration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
<p>Plugins allows specifying a configuration per admission control plugin.</p>
|
||||
-->
|
||||
<p><code>plugins</code> 字段允许为每个准入控制插件设置配置选项。</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `AdmissionPluginConfiguration` {#apiserver-config-k8s-io-v1-AdmissionPluginConfiguration}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [AdmissionConfiguration](#apiserver-config-k8s-io-v1-AdmissionConfiguration)
|
||||
|
||||
<!--
|
||||
<p>AdmissionPluginConfiguration provides the configuration for a single plug-in.</p>
|
||||
-->
|
||||
<p>AdmissionPluginConfiguration 为某个插件提供配置信息。</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!-- Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>name</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
<p>Name is the name of the admission controller.
|
||||
It must match the registered admission plugin name.</p>
|
||||
-->
|
||||
<p><code>name</code> 是准入控制器的名称。它必须与所注册的准入插件名称匹配。</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>path</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
<p>Path is the path to a configuration file that contains the plugin's
|
||||
configuration</p>
|
||||
-->
|
||||
<p><code>path</code> 是指向包含插件配置信息的配置文件的路径。</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>configuration</code><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/runtime#Unknown"><code>k8s.io/apimachinery/pkg/runtime.Unknown</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
<p>Configuration is an embedded configuration object to be used as the plugin's
|
||||
configuration. If present, it will be used instead of the path to the configuration file.</p>
|
||||
-->
|
||||
<p><code>configuration</code> 是一个内嵌的配置对象，用来保存插件的配置信息。
|
||||
如果存在，则使用这里的配置信息而不是指向配置文件的路径。</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
@@ -0,0 +1,447 @@
|
||||
---
|
||||
title: kube-apiserver 配置 (v1alpha1)
|
||||
content_type: tool-reference
|
||||
package: apiserver.k8s.io/v1alpha1
|
||||
auto_generated: true
|
||||
---
|
||||
<!--
|
||||
title: kube-apiserver Configuration (v1alpha1)
|
||||
content_type: tool-reference
|
||||
package: apiserver.k8s.io/v1alpha1
|
||||
auto_generated: true
|
||||
-->
|
||||
<!-- Package v1alpha1 is the v1alpha1 version of the API.-->
|
||||
<p>包 v1alpha1 包含 API 的 v1alpha1 版本。</p>
|
||||
|
||||
<!--
|
||||
## Resource Types
|
||||
-->
|
||||
## 资源类型
|
||||
|
||||
- [AdmissionConfiguration](#apiserver-k8s-io-v1alpha1-AdmissionConfiguration)
|
||||
- [EgressSelectorConfiguration](#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration)
|
||||
- [TracingConfiguration](#apiserver-k8s-io-v1alpha1-TracingConfiguration)
|
||||
|
||||
## `AdmissionConfiguration` {#apiserver-k8s-io-v1alpha1-AdmissionConfiguration}
|
||||
|
||||
<p><!--AdmissionConfiguration provides versioned configuration for admission controllers.-->
|
||||
AdmissionConfiguration 为准入控制器提供版本化的配置信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.k8s.io/v1alpha1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>AdmissionConfiguration</code></td></tr>
|
||||
|
||||
<tr><td><code>plugins</code><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-AdmissionPluginConfiguration"><code>[]AdmissionPluginConfiguration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--Plugins allows specifying a configuration per admission control plugin.-->
|
||||
<code>plugins</code> 允许用户为每个准入控制插件指定设置。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `EgressSelectorConfiguration` {#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration}
|
||||
|
||||
<p><!--EgressSelectorConfiguration provides versioned configuration for egress selector clients.-->
|
||||
EgressSelectorConfiguration 为 Egress 选择算符客户端提供版本化的配置选项。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.k8s.io/v1alpha1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>EgressSelectorConfiguration</code></td></tr>
|
||||
|
||||
<tr><td><code>egressSelections</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-EgressSelection"><code>[]EgressSelection</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--connectionServices contains a list of egress selection client configurations-->
|
||||
<code>connectionServices</code> 包含一组 Egress 选择算符客户端配置选项。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `TracingConfiguration` {#apiserver-k8s-io-v1alpha1-TracingConfiguration}
|
||||
|
||||
<p><!--TracingConfiguration provides versioned configuration for tracing clients.-->
|
||||
TracingConfiguration 为跟踪客户端提供版本化的配置信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.k8s.io/v1alpha1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>TracingConfiguration</code></td></tr>
|
||||
|
||||
<tr><td><code>endpoint</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--
|
||||
Endpoint of the collector that's running on the control-plane node.
|
||||
The APIServer uses the egressType ControlPlane when sending data to the collector.
|
||||
The syntax is defined in https://github.com/grpc/grpc/blob/master/doc/naming.md.
|
||||
Defaults to the otlpgrpc default, localhost:4317
|
||||
The connection is insecure, and does not support TLS.
|
||||
-->
|
||||
在控制面节点上运行的采集器的端点。
|
||||
API 服务器在向采集器发送数据时将 <code>egressType</code> 设置为 ControlPlane。
|
||||
这里的语法定义在 https://github.com/grpc/grpc/blob/master/doc/naming.md。
|
||||
默认值为 otlpgrpc 的默认值，即 <code>localhost:4317</code>
|
||||
这一连接是不安全的，且不支持 TLS。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>samplingRatePerMillion</code><br/>
|
||||
<code>int32</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--
|
||||
SamplingRatePerMillion is the number of samples to collect per million spans.
|
||||
Defaults to 0.-->
|
||||
<code>samplingRatePerMillion</code> 设置每一百万个数据点中要采样的样本个数。默认值为 0。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `AdmissionPluginConfiguration` {#apiserver-k8s-io-v1alpha1-AdmissionPluginConfiguration}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [AdmissionConfiguration](#apiserver-k8s-io-v1alpha1-AdmissionConfiguration)
|
||||
|
||||
<p><!--AdmissionPluginConfiguration provides the configuration for a single plug-in.-->
|
||||
AdmissionPluginConfiguration 为某个插件提供配置信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>name</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--Name is the name of the admission controller.
|
||||
It must match the registered admission plugin name.-->
|
||||
<code>name</code> 是准入控制器的名称。此名称必须与所注册的准入插件名称匹配。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>path</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--Path is the path to a configuration file that contains the plugin's configuration-->
|
||||
<code>path</code> 为指向包含插件配置数据的配置文件的路径。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>configuration</code><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/runtime#Unknown"><code>k8s.io/apimachinery/pkg/runtime.Unknown</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!-- Configuration is an embedded configuration object to be used as the plugin's
|
||||
configuration. If present, it will be used instead of the path to the configuration file.-->
|
||||
<code>configuration</code> 是一个嵌入的配置对象，用作插件的配置数据来源。
|
||||
如果设置了此字段，则使用此字段而不是指向配置文件的路径。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `Connection` {#apiserver-k8s-io-v1alpha1-Connection}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [EgressSelection](#apiserver-k8s-io-v1alpha1-EgressSelection)
|
||||
|
||||
<p><!-- Connection provides the configuration for a single egress selection client.-->
|
||||
Connection 提供某个 Egress 选择客户端的配置信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!-- Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>proxyProtocol</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-ProtocolType"><code>ProtocolType</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--Protocol is the protocol used to connect from client to the konnectivity server.-->
|
||||
<code>proxyProtocol</code> 是客户端连接到 konnectivity 服务器所使用的协议。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>transport</code><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-Transport"><code>Transport</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--Transport defines the transport configurations we use to dial to the konnectivity server.
|
||||
This is required if ProxyProtocol is HTTPConnect or GRPC.-->
|
||||
<code>transport</code> 定义的是传输层的配置。我们使用这个配置来联系 konnectivity 服务器。
|
||||
当 <code>proxyProtocol</code> 是 HTTPConnect 或 GRPC 时需要设置此字段。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `EgressSelection` {#apiserver-k8s-io-v1alpha1-EgressSelection}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [EgressSelectorConfiguration](#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration)
|
||||
|
||||
<p><!--EgressSelection provides the configuration for a single egress selection client.-->
|
||||
EgressSelection 为某个 Egress 选择客户端提供配置信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>name</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--name is the name of the egress selection.
|
||||
Currently supported values are "controlplane", "master", "etcd" and "cluster"
|
||||
The "master" egress selector is deprecated in favor of "controlplane"-->
|
||||
<code>name</code> 是 Egress 选择器的名称。当前支持的取值有 "controlplane"，
|
||||
"master"，"etcd" 和 "cluster"。
|
||||
"master" Egress 选择器已被弃用，推荐使用 "controlplane"。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>connection</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-Connection"><code>Connection</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--connection is the exact information used to configure the egress selection-->
|
||||
<code>connection</code> 是用来配置 Egress 选择器的配置信息。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `ProtocolType` {#apiserver-k8s-io-v1alpha1-ProtocolType}
|
||||
|
||||
<!--
|
||||
(Alias of `string`)
|
||||
|
||||
**Appears in:**
|
||||
-->
|
||||
（`string` 类型的别名）
|
||||
|
||||
**出现在：**
|
||||
|
||||
- [Connection](#apiserver-k8s-io-v1alpha1-Connection)
|
||||
|
||||
<p><!--ProtocolType is a set of valid values for Connection.ProtocolType-->
|
||||
ProtocolType 是 <code>connection.protocolType</code> 的合法值集合。
|
||||
</p>
|
||||
|
||||
## `TCPTransport` {#apiserver-k8s-io-v1alpha1-TCPTransport}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [Transport](#apiserver-k8s-io-v1alpha1-Transport)
|
||||
|
||||
<p><!--TCPTransport provides the information to connect to konnectivity server via TCP-->
|
||||
TCPTransport 提供使用 TCP 连接 konnectivity 服务器时需要的信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>url</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--URL is the location of the konnectivity server to connect to.
|
||||
As an example it might be "https://127.0.0.1:8131"-->
|
||||
<code>url</code> 是要连接的 konnectivity 服务器的位置。例如 "https://127.0.0.1:8131"。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>tlsConfig</code><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-TLSConfig"><code>TLSConfig</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!-- TLSConfig is the config needed to use TLS when connecting to konnectivity server-->
|
||||
<code>tlsConfig</code> 是使用 TLS 来连接 konnectivity 服务器时需要的信息。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `TLSConfig` {#apiserver-k8s-io-v1alpha1-TLSConfig}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [TCPTransport](#apiserver-k8s-io-v1alpha1-TCPTransport)
|
||||
|
||||
|
||||
<p><!--TLSConfig provides the authentication information to connect to konnectivity server
|
||||
Only used with TCPTransport-->
|
||||
TLSConfig 为连接 konnectivity 服务器提供身份认证信息。仅用于 TCPTransport。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>caBundle</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--caBundle is the file location of the CA to be used to determine trust with the konnectivity server.
|
||||
Must be absent/empty if TCPTransport.URL is prefixed with http://
|
||||
If absent while TCPTransport.URL is prefixed with https://, default to system trust roots.-->
|
||||
<code>caBundle</code> 是指向用来确定与 konnectivity 服务器间信任欢喜的 CA 证书包的文件位置。
|
||||
当 <code>tcpTransport.url</code> 前缀为 "http://" 时必须不设置，或者设置为空。
|
||||
如果 <code>tcpTransport.url</code> 前缀为 "https://" 并且此字段未设置，则默认使用系统的信任根。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>clientKey</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--clientKey is the file location of the client key to be used in mtls handshakes with the konnectivity server.
|
||||
Must be absent/empty if TCPTransport.URL is prefixed with http://
|
||||
Must be configured if TCPTransport.URL is prefixed with https://-->
|
||||
<code>clientKey</code> 是与 konnectivity 服务器进行 mtls 握手时使用的客户端秘钥文件位置。
|
||||
如果 `tcp.url` 前缀为 <code>http://</code>，必须不指定或者为空；
|
||||
如果 `tcp.url` 前缀为 <code>https://</code>，必须设置。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>clientCert</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--clientCert is the file location of the client certificate to be used in mtls handshakes with the konnectivity server.
|
||||
Must be absent/empty if TCPTransport.URL is prefixed with http://
|
||||
Must be configured if TCPTransport.URL is prefixed with https://-->
|
||||
<code>clientCert</code> 是与 konnectivity 服务器进行 mtls 握手时使用的客户端证书文件位置。
|
||||
如果 `tcp.url` 前缀为 <code>http://</code>，必须不指定或者为空；
|
||||
如果 `tcp.url` 前缀为 <code>https://</code>，必须设置。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `Transport` {#apiserver-k8s-io-v1alpha1-Transport}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [Connection](#apiserver-k8s-io-v1alpha1-Connection)
|
||||
|
||||
|
||||
<p><!--Transport defines the transport configurations we use to dial to the konnectivity server-->
|
||||
Transport 定义联系 konnectivity 服务器时要使用的传输层配置。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>tcp</code><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-TCPTransport"><code>TCPTransport</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--TCP is the TCP configuration for communicating with the konnectivity server via TCP
|
||||
ProxyProtocol of GRPC is not supported with TCP transport at the moment
|
||||
Requires at least one of TCP or UDS to be set-->
|
||||
<code>tcp</code> 包含通过 TCP 与 konnectivity 服务器通信时使用的 TCP 配置。
|
||||
目前使用 TCP 传输时不支持 GRPC 的 <code>proxyProtocol</code>。
|
||||
<code>tcp</code> 和 <code>uds</code> 二者至少设置一个。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>uds</code><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-UDSTransport"><code>UDSTransport</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--UDS is the UDS configuration for communicating with the konnectivity server via UDS
|
||||
Requires at least one of TCP or UDS to be set-->
|
||||
<code>uds</code> 包含通过 UDS 与 konnectivity 服务器通信时使用的 UDS 配置。
|
||||
<code>tcp</code> 和 <code>uds</code> 二者至少设置一个。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `UDSTransport` {#apiserver-k8s-io-v1alpha1-UDSTransport}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [Transport](#apiserver-k8s-io-v1alpha1-Transport)
|
||||
|
||||
<p><!--UDSTransport provides the information to connect to konnectivity server via UDS-->
|
||||
UDSTransport 设置通过 UDS 连接 konnectivity 服务器时需要的信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
<tr><td><code>udsName</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--UDSName is the name of the unix domain socket to connect to konnectivity server
|
||||
This does not use a unix:// prefix. (Eg: /etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket)-->
|
||||
<code>udsName</code> 是与 konnectivity 服务器连接时使用的 UNIX 域套接字名称。
|
||||
字段取值不要求包含 <code>unix://</code> 前缀。
|
||||
（例如：<code>/etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket</code>）
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
@@ -0,0 +1,322 @@
|
||||
---
|
||||
title: kube-apiserver 加密配置 (v1)
|
||||
content_type: tool-reference
|
||||
package: apiserver.config.k8s.io/v1
|
||||
auto_generated: true
|
||||
---
|
||||
|
||||
<!--
|
||||
title: kube-apiserver Encryption Configuration (v1)
|
||||
content_type: tool-reference
|
||||
package: apiserver.config.k8s.io/v1
|
||||
auto_generated: true
|
||||
-->
|
||||
|
||||
<p><!--Package v1 is the v1 version of the API.-->
|
||||
包 v1 是 API 的 v1 版本。</p>
|
||||
|
||||
<!--
|
||||
## Resource Types
|
||||
-->
|
||||
## 资源类型
|
||||
|
||||
- [EncryptionConfiguration](#apiserver-config-k8s-io-v1-EncryptionConfiguration)
|
||||
|
||||
## `EncryptionConfiguration` {#apiserver-config-k8s-io-v1-EncryptionConfiguration}
|
||||
|
||||
<p><!--EncryptionConfiguration stores the complete configuration for encryption providers.-->
|
||||
EncryptionConfiguration 为加密驱动保存完整的配置信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.config.k8s.io/v1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>EncryptionConfiguration</code></td></tr>
|
||||
<tr><td><code>resources</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-config-k8s-io-v1-ResourceConfiguration"><code>[]ResourceConfiguration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--resources is a list containing resources, and their corresponding encryption providers.-->
|
||||
<code>resources</code> 是一个包含资源及其对应的加密驱动的列表。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `AESConfiguration` {#apiserver-config-k8s-io-v1-AESConfiguration}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
|
||||
|
||||
<p><!--AESConfiguration contains the API configuration for an AES transformer.-->
|
||||
AESConfiguration 包含 AES 转换器的 API 配置信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>keys</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-config-k8s-io-v1-Key"><code>[]Key</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--keys is a list of keys to be used for creating the AES transformer.
|
||||
Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.-->
|
||||
<code>keys</code> 是一组用于创建 AES 转换器的秘钥。
|
||||
对于 AES-CBC，每个秘钥必须是 32 字节长；对于 AES-GCM，每个秘钥可以是 16、24、32 字节长。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `IdentityConfiguration` {#apiserver-config-k8s-io-v1-IdentityConfiguration}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
|
||||
|
||||
<p><!--IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.-->
|
||||
IdentityConfiguration 是一个空的结构，用来支持在驱动配置中支持标识转换器。
|
||||
</p>
|
||||
|
||||
## `KMSConfiguration` {#apiserver-config-k8s-io-v1-KMSConfiguration}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
|
||||
|
||||
<p><!--KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.-->
|
||||
KMSConfiguration 包含基于 KMS 的封套转换器的名称、缓存大小以及配置文件路径信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>name</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--name is the name of the KMS plugin to be used.-->
|
||||
<code>name</code> 是要使用的 KMS 插件名称。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>cachesize</code><br/>
|
||||
<code>int32</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--cachesize is the maximum number of secrets which are cached in memory. The default value is 1000. Set to a negative value to disable caching.-->
|
||||
<code>cachesize</code> 是可在内存中缓存的 Secret 数量上限。默认值是 1000。将此字段设置为负值会禁用缓存。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>endpoint</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".-->
|
||||
<code>endpoint</code> 是 gRPC 服务器的监听地址，例如 "unix:///var/run/kms-provider.sock"。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>timeout</code><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.-->
|
||||
对 KMS 插件执行 gRPC 调用的超时时长（例如，'5s'）。默认值为 3 秒。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `Key` {#apiserver-config-k8s-io-v1-Key}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [AESConfiguration](#apiserver-config-k8s-io-v1-AESConfiguration)
|
||||
- [SecretboxConfiguration](#apiserver-config-k8s-io-v1-SecretboxConfiguration)
|
||||
|
||||
<p><!--Key contains name and secret of the provided key for a transformer.-->
|
||||
Key 中包含为某转换器所提供的键名和对应的私密数据。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>name</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--name is the name of the key to be used while storing data to disk.-->
|
||||
<code>name</code> 是在向磁盘中存储数据时使用的键名。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>secret</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--secret is the actual key, encoded in base64.-->
|
||||
<code>secret</code> 是实际的秘钥，用 base64 编码。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `ProviderConfiguration` {#apiserver-config-k8s-io-v1-ProviderConfiguration}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [ResourceConfiguration](#apiserver-config-k8s-io-v1-ResourceConfiguration)
|
||||
|
||||
<p><!--ProviderConfiguration stores the provided configuration for an encryption provider.-->
|
||||
ProviderConfiguration 为加密驱动存储配置信息。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>aesgcm</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-config-k8s-io-v1-AESConfiguration"><code>AESConfiguration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--aesgcm is the configuration for the AES-GCM transformer.-->
|
||||
<code>aesgcm</code> 是用于 AES-GCM 转换器的配置。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>aescbc</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-config-k8s-io-v1-AESConfiguration"><code>AESConfiguration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--aescbc is the configuration for the AES-CBC transformer.-->
|
||||
<code>aescbc</code> 是用于 AES-CBC 转换器的配置。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>secretbox</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-config-k8s-io-v1-SecretboxConfiguration"><code>SecretboxConfiguration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--secretbox is the configuration for the Secretbox based transformer.-->
|
||||
<code>secretbox</code> 是用于基于 Secretbox 的转换器的配置。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>identity</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-config-k8s-io-v1-IdentityConfiguration"><code>IdentityConfiguration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--identity is the (empty) configuration for the identity transformer.-->
|
||||
<code>identity</code> 是用于标识转换器的配置（空）。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>kms</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-config-k8s-io-v1-KMSConfiguration"><code>KMSConfiguration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.-->
|
||||
<code>kms</code> 中包含用于基于 KMS 的封套转换器的名称、缓存大小以及配置文件路径信息。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `ResourceConfiguration` {#apiserver-config-k8s-io-v1-ResourceConfiguration}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [EncryptionConfiguration](#apiserver-config-k8s-io-v1-EncryptionConfiguration)
|
||||
|
||||
<p><!--ResourceConfiguration stores per resource configuration.-->
|
||||
ResourceConfiguration 中保存资源配置。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>resources</code> <B>[必需]</B><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--resources is a list of kubernetes resources which have to be encrypted.-->
|
||||
<code>resources</code> 是必需要加密的 Kubernetes 资源的列表。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>providers</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-config-k8s-io-v1-ProviderConfiguration"><code>[]ProviderConfiguration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--providers is a list of transformers to be used for reading and writing the resources to disk. eg: aesgcm, aescbc, secretbox, identity.-->
|
||||
<code>providers</code> 是一个转换器列表，用来将资源写入到磁盘或从磁盘上读出。
|
||||
例如：'aesgcm'、'aescbc'、'secretbox'、'identity'。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `SecretboxConfiguration` {#apiserver-config-k8s-io-v1-SecretboxConfiguration}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
|
||||
|
||||
<p><!--SecretboxConfiguration contains the API configuration for an Secretbox transformer.-->
|
||||
SecretboxConfiguration 包含用于某 Secretbox 转换器的 API 配置。
|
||||
</p>
|
||||
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>keys</code> <B>[必需]</B><br/>
|
||||
<a href="#apiserver-config-k8s-io-v1-Key"><code>[]Key</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<p><!--keys is a list of keys to be used for creating the Secretbox transformer.
|
||||
Each key has to be 32 bytes long.-->
|
||||
<code>keys</code> 是一个秘钥列表，用来创建 Secretbox 转换器。每个秘钥必须是 32 字节长。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
---
|
||||
title: WebhookAdmission 配置 (v1)
|
||||
content_type: tool-reference
|
||||
package: apiserver.config.k8s.io/v1
|
||||
auto_generated: true
|
||||
---
|
||||
|
||||
<!--
|
||||
title: WebhookAdmission Configuration (v1)
|
||||
content_type: tool-reference
|
||||
package: apiserver.config.k8s.io/v1
|
||||
auto_generated: true
|
||||
-->
|
||||
|
||||
<!--
|
||||
<p>Package v1 is the v1 version of the API.</p>
|
||||
|
||||
## Resource Types
|
||||
-->
|
||||
<p>此 API 的版本是 v1。</p>
|
||||
|
||||
## 资源类型 {#resource-types}
|
||||
|
||||
- [WebhookAdmission](#apiserver-config-k8s-io-v1-WebhookAdmission)
|
||||
|
||||
## `WebhookAdmission` {#apiserver-config-k8s-io-v1-WebhookAdmission}
|
||||
|
||||
<!--
|
||||
<p>WebhookAdmission provides configuration for the webhook admission controller.</p>
|
||||
-->
|
||||
<p>WebhookAdmission 为 Webhook 准入控制器提供配置信息。</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.config.k8s.io/v1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>WebhookAdmission</code></td></tr>
|
||||
|
||||
|
||||
<tr><td><code>kubeConfigFile</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--<p>KubeConfigFile is the path to the kubeconfig file.</p>-->
|
||||
<p>字段 kubeConfigFile 包含指向 kubeconfig 文件的路径。</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
@@ -0,0 +1,285 @@
|
||||
---
|
||||
title: 客户端身份认证（Client Authentication） (v1)
|
||||
content_type: tool-reference
|
||||
package: client.authentication.k8s.io/v1
|
||||
auto_generated: true
|
||||
---
|
||||
|
||||
<!--
|
||||
title: Client Authentication (v1)
|
||||
content_type: tool-reference
|
||||
package: client.authentication.k8s.io/v1
|
||||
auto_generated: true
|
||||
-->
|
||||
|
||||
<!--
|
||||
## Resource Types
|
||||
-->
|
||||
## 资源类型 {#resource-types}
|
||||
|
||||
- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential)
|
||||
|
||||
## `ExecCredential` {#client-authentication-k8s-io-v1-ExecCredential}
|
||||
|
||||
<!--
|
||||
ExecCredential is used by exec-based plugins to communicate credentials to
|
||||
HTTP transports.
|
||||
-->
|
||||
ExecCredential 由基于 exec 的插件使用，与 HTTP 传输组件沟通凭据信息。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>client.authentication.k8s.io/v1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>ExecCredential</code></td></tr>
|
||||
|
||||
<tr><td><code>spec</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="#client-authentication-k8s-io-v1-ExecCredentialSpec"><code>ExecCredentialSpec</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Spec holds information passed to the plugin by the transport.-->
|
||||
字段 spec 包含由 HTTP 传输组件传递给插件的信息。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>status</code><br/>
|
||||
<a href="#client-authentication-k8s-io-v1-ExecCredentialStatus"><code>ExecCredentialStatus</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Status is filled in by the plugin and holds the credentials that the transport
|
||||
should use to contact the API.-->
|
||||
字段 status 由插件填充，包含传输组件与 API 服务器连接时需要提供的凭据。
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `Cluster` {#client-authentication-k8s-io-v1-Cluster}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [ExecCredentialSpec](#client-authentication-k8s-io-v1-ExecCredentialSpec)
|
||||
|
||||
<!--
|
||||
Cluster contains information to allow an exec plugin to communicate
|
||||
with the kubernetes cluster being authenticated to.
|
||||
|
||||
To ensure that this struct contains everything someone would need to communicate
|
||||
with a kubernetes cluster (just like they would via a kubeconfig), the fields
|
||||
should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception
|
||||
of CertificateAuthority, since CA data will always be passed to the plugin as bytes.
|
||||
-->
|
||||
Cluster 中包含允许 exec 插件与 Kubernetes 集群进行通信身份认证时所需
|
||||
的信息。
|
||||
|
||||
为了确保该结构体包含需要与 Kubernetes 集群进行通信的所有内容（就像通过 Kubeconfig 一样），
|
||||
除了证书授权之外，该字段应该映射到 "k8s.io/client-go/tools/clientcmd/api/v1".cluster，
|
||||
由于 CA 数据将始终以字节形式传递给插件。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>server</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--Server is the address of the kubernetes cluster (https://hostname:port).-->
|
||||
字段 server 是 Kubernetes 集群的地址（https://hostname:port）。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>tls-server-name</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--TLSServerName is passed to the server for SNI and is used in the client to
|
||||
check server certificates against. If ServerName is empty, the hostname
|
||||
used to contact the server is used.-->
|
||||
tls-server-name 是用来提供给服务器用作 SNI 解析的，客户端以此检查服务器的证书。
|
||||
如此字段为空，则使用链接服务器时使用的主机名。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>insecure-skip-tls-verify</code><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--InsecureSkipTLSVerify skips the validity check for the server's certificate.
|
||||
This will make your HTTPS connections insecure.-->
|
||||
设置此字段之后，会令客户端跳过对服务器端证书的合法性检查。
|
||||
这会使得你的 HTTPS 链接不再安全。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>certificate-authority-data</code><br/>
|
||||
<code>[]byte</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--CAData contains PEM-encoded certificate authority certificates.
|
||||
If empty, system roots should be used.-->
|
||||
此字段包含 PEM 编码的证书机构（CA）证书。
|
||||
如果为空，则使用系统的根证书。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>proxy-url</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--ProxyURL is the URL to the proxy to be used for all requests to this
|
||||
cluster.-->
|
||||
此字段用来设置向集群发送所有请求时要使用的代理服务器。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>config</code><br/>
|
||||
<a href="https://godoc.org/k8s.io/apimachinery/pkg/runtime/#RawExtension"><code>k8s.io/apimachinery/pkg/runtime.RawExtension</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Config holds additional config data that is specific to the exec
|
||||
plugin with regards to the cluster being authenticated to.
|
||||
|
||||
This data is sourced from the clientcmd Cluster object's
|
||||
extensions[client.authentication.k8s.io/exec] field:
|
||||
-->
|
||||
<p>此字段包含一些额外的、特定于 exec 插件和所连接的集群的数据，</p>
|
||||
<p>此字段来自于 clientcmd 集群对象的 <code>extensions[client.authentication.k8s.io/exec]</code>
|
||||
字段：</p>
|
||||
<pre>
|
||||
clusters:
|
||||
- name: my-cluster
|
||||
cluster:
|
||||
...
|
||||
extensions:
|
||||
- name: client.authentication.k8s.io/exec # 针对每个集群 exec 配置所预留的扩展名称
|
||||
extension:
|
||||
audience: 06e3fbd18de8 # 任意配置信息
|
||||
</pre>
|
||||
|
||||
<!--In some environments, the user config may be exactly the same across many clusters
|
||||
(i.e. call this exec plugin) minus some details that are specific to each cluster
|
||||
such as the audience. This field allows the per cluster config to be directly
|
||||
specified with the cluster info. Using this field to store secret data is not
|
||||
recommended as one of the prime benefits of exec plugins is that no secrets need
|
||||
to be stored directly in the kubeconfig.-->
|
||||
<p>在某些环境中，用户配置可能对很多集群而言都完全一样（即调用同一个 exec 插件），
|
||||
只是针对不同集群会有一些细节上的差异，例如 audience。
|
||||
此字段使得特定于集群的配置可以直接使用集群信息来设置。
|
||||
不建议使用此字段来保存 Secret 数据，因为 exec 插件的主要优势之一是不需要在
|
||||
kubeconfig 中保存 Secret 数据。</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `ExecCredentialSpec` {#client-authentication-k8s-io-v1-ExecCredentialSpec}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential)
|
||||
|
||||
<!--
|
||||
ExecCredentialSpec holds request and runtime specific information provided by
|
||||
the transport.
|
||||
-->
|
||||
ExecCredentialSpec 保存传输组件所提供的特定于请求和运行时的信息。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>cluster</code><br/>
|
||||
<a href="#client-authentication-k8s-io-v1-Cluster"><code>Cluster</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Cluster contains information to allow an exec plugin to communicate with the
|
||||
kubernetes cluster being authenticated to. Note that Cluster is non-nil only
|
||||
when provideClusterInfo is set to true in the exec provider config (i.e.,
|
||||
ExecConfig.ProvideClusterInfo).-->
|
||||
此字段中包含的信息使得 exec 插件能够与要访问的 Kubernetes 集群通信。
|
||||
注意，cluster 字段只有在 exec 驱动的配置中 provideClusterInfo
|
||||
（即：ExecConfig.ProvideClusterInfo）被设置为 true 时才不能为空。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>interactive</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--Interactive declares whether stdin has been passed to this exec plugin.-->
|
||||
此字段用来标明标准输出信息是否已传递给 exec 插件。
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `ExecCredentialStatus` {#client-authentication-k8s-io-v1-ExecCredentialStatus}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential)
|
||||
|
||||
<!--
|
||||
ExecCredentialStatus holds credentials for the transport to use.
|
||||
|
||||
Token and ClientKeyData are sensitive fields. This data should only be
|
||||
transmitted in-memory between client and exec plugin process. Exec plugin
|
||||
itself should at least be protected via file permissions.
|
||||
-->
|
||||
<p>ExecCredentialStatus 中包含传输组件要使用的凭据。</p>
|
||||
<p>字段 token 和 clientKeyData 都是敏感字段。此数据只能在
|
||||
客户端与 exec 插件进程之间使用内存来传递。exec 插件本身至少
|
||||
应通过文件访问许可来实施保护。</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
<tr><td><code>expirationTimestamp</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#time-v1-meta"><code>meta/v1.Time</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--ExpirationTimestamp indicates a time when the provided credentials expire.-->
|
||||
给出所提供的凭据到期的时间。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>token</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--Token is a bearer token used by the client for request authentication.-->
|
||||
客户端用做请求身份认证的持有者令牌。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>clientCertificateData</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--PEM-encoded client TLS certificates (including intermediates, if any).-->
|
||||
PEM 编码的客户端 TLS 证书（如果有临时证书，也会包含）。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>clientKeyData</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--PEM-encoded private key for the above certificate.-->
|
||||
与上述证书对应的、PEM 编码的私钥。
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
@@ -0,0 +1,334 @@
|
||||
---
|
||||
title: 客户端身份认证（Client Authentication）(v1beta1)
|
||||
content_type: tool-reference
|
||||
package: client.authentication.k8s.io/v1beta1
|
||||
auto_generated: true
|
||||
---
|
||||
|
||||
<!--
|
||||
title: Client Authentication (v1beta1)
|
||||
content_type: tool-reference
|
||||
package: client.authentication.k8s.io/v1beta1
|
||||
auto_generated: true
|
||||
-->
|
||||
|
||||
|
||||
<!--
|
||||
## Resource Types
|
||||
-->
|
||||
## 资源类型 {#resource-types}
|
||||
|
||||
|
||||
- [ExecCredential](#client-authentication-k8s-io-v1beta1-ExecCredential)
|
||||
|
||||
|
||||
|
||||
|
||||
## `ExecCredential` {#client-authentication-k8s-io-v1beta1-ExecCredential}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<!--
|
||||
ExecCredential is used by exec-based plugins to communicate credentials to
|
||||
HTTP transports.
|
||||
-->
|
||||
ExecCredential 由基于 exec 的插件使用，与 HTTP 传输组件沟通凭据信息。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>client.authentication.k8s.io/v1beta1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>ExecCredential</code></td></tr>
|
||||
|
||||
|
||||
|
||||
|
||||
<tr><td><code>spec</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="#client-authentication-k8s-io-v1beta1-ExecCredentialSpec"><code>ExecCredentialSpec</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Spec holds information passed to the plugin by the transport.-->
|
||||
字段 spec 包含由 HTTP 传输组件传递给插件的信息。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>status</code><br/>
|
||||
<a href="#client-authentication-k8s-io-v1beta1-ExecCredentialStatus"><code>ExecCredentialStatus</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Status is filled in by the plugin and holds the credentials that the transport
|
||||
should use to contact the API.-->
|
||||
字段 status 由插件填充，包含传输组件与 API 服务器连接时需要提供的凭据。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `Cluster` {#client-authentication-k8s-io-v1beta1-Cluster}
|
||||
|
||||
|
||||
|
||||
|
||||
<!--**Appears in:**-->
|
||||
**出现在：**
|
||||
|
||||
- [ExecCredentialSpec](#client-authentication-k8s-io-v1beta1-ExecCredentialSpec)
|
||||
|
||||
|
||||
<!--
|
||||
Cluster contains information to allow an exec plugin to communicate
|
||||
with the kubernetes cluster being authenticated to.
|
||||
|
||||
To ensure that this struct contains everything someone would need to communicate
|
||||
with a kubernetes cluster (just like they would via a kubeconfig), the fields
|
||||
should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception
|
||||
of CertificateAuthority, since CA data will always be passed to the plugin as bytes.
|
||||
-->
|
||||
Cluster 中包含允许 exec 插件与 Kubernetes 集群进行通信身份认证时所需
|
||||
的信息。
|
||||
|
||||
为了确保该结构体包含需要与 Kubernetes 集群进行通信的所有内容（就像通过 Kubeconfig 一样），
|
||||
该字段应该映射到 "k8s.io/client-go/tools/clientcmd/api/v1".cluster，
|
||||
除了证书授权之外，由于 CA 数据将始终以字节形式传递给插件。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>server</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--Server is the address of the kubernetes cluster (https://hostname:port).-->
|
||||
字段 server 是 Kubernetes 集群的地址（https://hostname:port）。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>tls-server-name</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
TLSServerName is passed to the server for SNI and is used in the client to
|
||||
check server certificates against. If ServerName is empty, the hostname
|
||||
used to contact the server is used.
|
||||
-->
|
||||
tls-server-name 是用来提供给服务器用作 SNI 解析的，客户端以此检查服务器的证书。
|
||||
如此字段为空，则使用链接服务器时使用的主机名。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>insecure-skip-tls-verify</code><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
InsecureSkipTLSVerify skips the validity check for the server's certificate.
|
||||
This will make your HTTPS connections insecure.
|
||||
-->
|
||||
设置此字段之后，会令客户端跳过对服务器端证书的合法性检查。
|
||||
这会使得你的 HTTPS 链接不再安全。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>certificate-authority-data</code><br/>
|
||||
<code>[]byte</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
CAData contains PEM-encoded certificate authority certificates.
|
||||
If empty, system roots should be used.
|
||||
-->
|
||||
此字段包含 PEM 编码的证书机构（CA）证书。
|
||||
如果为空，则使用系统的根证书。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>proxy-url</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--ProxyURL is the URL to the proxy to be used for all requests to this cluster.-->
|
||||
此字段用来设置向集群发送所有请求时要使用的代理服务器。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>config</code><br/>
|
||||
<a href="https://godoc.org/k8s.io/apimachinery/pkg/runtime/#RawExtension"><code>k8s.io/apimachinery/pkg/runtime.RawExtension</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
Config holds additional config data that is specific to the exec
|
||||
plugin with regards to the cluster being authenticated to.
|
||||
|
||||
This data is sourced from the clientcmd Cluster object's
|
||||
extensions[client.authentication.k8s.io/exec] field:
|
||||
-->
|
||||
<p>此字段包含一些额外的、特定于 exec 插件和所连接的集群的数据，</p>
|
||||
<p>此字段来自于 clientcmd 集群对象的 <code>extensions[client.authentication.k8s.io/exec]</code>
|
||||
字段：</p>
|
||||
<pre>
|
||||
clusters:
|
||||
- name: my-cluster
|
||||
cluster:
|
||||
...
|
||||
extensions:
|
||||
- name: client.authentication.k8s.io/exec # 针对每个集群 exec 配置所预留的扩展名称
|
||||
extension:
|
||||
audience: 06e3fbd18de8 # 任意配置信息
|
||||
</pre>
|
||||
<!--
|
||||
In some environments, the user config may be exactly the same across many clusters
|
||||
(i.e. call this exec plugin) minus some details that are specific to each cluster
|
||||
such as the audience. This field allows the per cluster config to be directly
|
||||
specified with the cluster info. Using this field to store secret data is not
|
||||
recommended as one of the prime benefits of exec plugins is that no secrets need
|
||||
to be stored directly in the kubeconfig.
|
||||
-->
|
||||
<p>在某些环境中，用户配置可能对很多集群而言都完全一样（即调用同一个 exec 插件），
|
||||
只是针对不同集群会有一些细节上的差异，例如 audience。
|
||||
此字段使得特定于集群的配置可以直接使用集群信息来设置。
|
||||
不建议使用此字段来保存 Secret 数据，因为 exec 插件的主要优势之一是不需要在
|
||||
kubeconfig 中保存 Secret 数据。</p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `ExecCredentialSpec` {#client-authentication-k8s-io-v1beta1-ExecCredentialSpec}
|
||||
|
||||
|
||||
|
||||
|
||||
<!-- **Appears in:** -->
|
||||
**出现在：**
|
||||
|
||||
- [ExecCredential](#client-authentication-k8s-io-v1beta1-ExecCredential)
|
||||
|
||||
|
||||
<!--
|
||||
ExecCredentialSpec holds request and runtime specific information provided by
|
||||
the transport.
|
||||
-->
|
||||
ExecCredentialSpec 保存传输组件所提供的特定于请求和运行时的信息。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>cluster</code><br/>
|
||||
<a href="#client-authentication-k8s-io-v1beta1-Cluster"><code>Cluster</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
Cluster contains information to allow an exec plugin to communicate with the
|
||||
kubernetes cluster being authenticated to. Note that Cluster is non-nil only
|
||||
when provideClusterInfo is set to true in the exec provider config (i.e.,
|
||||
ExecConfig.ProvideClusterInfo).
|
||||
-->
|
||||
此字段中包含的信息使得 exec 插件能够与要访问的 Kubernetes 集群通信。
|
||||
注意，cluster 字段只有在 exec 驱动的配置中 provideClusterInfo
|
||||
（即：ExecConfig.ProvideClusterInfo）被设置为 true 时才不能为空。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `ExecCredentialStatus` {#client-authentication-k8s-io-v1beta1-ExecCredentialStatus}
|
||||
|
||||
|
||||
|
||||
|
||||
<!-- **Appears in:** -->
|
||||
**出现在：**
|
||||
|
||||
- [ExecCredential](#client-authentication-k8s-io-v1beta1-ExecCredential)
|
||||
|
||||
|
||||
<!--
|
||||
ExecCredentialStatus holds credentials for the transport to use.
|
||||
|
||||
Token and ClientKeyData are sensitive fields. This data should only be
|
||||
transmitted in-memory between client and exec plugin process. Exec plugin
|
||||
itself should at least be protected via file permissions.
|
||||
-->
|
||||
<p>ExecCredentialStatus 中包含传输组件要使用的凭据。</p>
|
||||
|
||||
<p>字段 token 和 clientKeyData 都是敏感字段。
|
||||
此数据只能在客户端与 exec 插件进程之间使用内存来传递。
|
||||
exec 插件本身至少应通过文件访问许可来实施保护。</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>expirationTimestamp</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#time-v1-meta"><code>meta/v1.Time</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!-- ExpirationTimestamp indicates a time when the provided credentials expire. -->
|
||||
给出所提供的凭据到期的时间。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>token</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!-- Token is a bearer token used by the client for request authentication. -->
|
||||
客户端用做请求身份认证的持有者令牌。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>clientCertificateData</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!-- PEM-encoded client TLS certificates (including intermediates, if any). -->
|
||||
PEM 编码的客户端 TLS 证书（如果有临时证书，也会包含）。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>clientKeyData</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!-- PEM-encoded private key for the above certificate. -->
|
||||
与上述证书对应的、PEM 编码的私钥。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,322 @@
|
||||
---
|
||||
title: Kubelet 配置 (v1alpha1)
|
||||
content_type: tool-reference
|
||||
package: kubelet.config.k8s.io/v1alpha1
|
||||
auto_generated: true
|
||||
---
|
||||
|
||||
<!--
|
||||
title: Kubelet Configuration (v1alpha1)
|
||||
content_type: tool-reference
|
||||
package: kubelet.config.k8s.io/v1alpha1
|
||||
auto_generated: true
|
||||
-->
|
||||
|
||||
<!--
|
||||
## Resource Types
|
||||
-->
|
||||
## 资源类型
|
||||
|
||||
- [CredentialProviderConfig](#kubelet-config-k8s-io-v1alpha1-CredentialProviderConfig)
|
||||
|
||||
## `FormatOptions` {#FormatOptions}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
<!--
|
||||
FormatOptions contains options for the different logging formats.
|
||||
-->
|
||||
FormatOptions 包含为不同类型日志格式提供的选项。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>json</code> <B>[必需]</B><br/>
|
||||
<a href="#JSONOptions"><code>JSONOptions</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--[Experimental] JSON contains options for logging format "json".-->
|
||||
[试验特性] <code>json</code> 中包含 "json" 日志格式的选项。
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `JSONOptions` {#JSONOptions}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [FormatOptions](#FormatOptions)
|
||||
|
||||
<!--
|
||||
JSONOptions contains options for logging format "json".
|
||||
-->
|
||||
JSONOptions 包含用于 "json" 日志格式的选项。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>splitStream</code> <B>[必需]</B><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--[Experimental] SplitStream redirects error messages to stderr while
|
||||
info messages go to stdout, with buffering. The default is to write
|
||||
both to stdout, without buffering.-->
|
||||
[试验特性] <code>splitStream</code> 将错误信息重定向到标准错误输出（stderr），
|
||||
将提示信息重定向到标准输出（stdout），并为二者提供缓存。默认配置是将两类信息都写出到标准输出，
|
||||
并且不提供缓存。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>infoBufferSize</code> <B>[必需]</B><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/api/resource#QuantityValue"><code>k8s.io/apimachinery/pkg/api/resource.QuantityValue</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--[Experimental] InfoBufferSize sets the size of the info stream when
|
||||
using split streams. The default is zero, which disables buffering.-->
|
||||
[试验特性] <code>infoBufferSize</code> 设置使用分离数据流时信息数据流的大小。
|
||||
默认值是 0，意味着禁止缓存。
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `VModuleConfiguration` {#VModuleConfiguration}
|
||||
|
||||
<!--
|
||||
(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`)
|
||||
-->
|
||||
（`[]k8s.io/component-base/config/v1alpha1.VModuleItem` 的别名）
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
<!--
|
||||
VModuleConfiguration is a collection of individual file names or patterns
|
||||
and the corresponding verbosity threshold.
|
||||
-->
|
||||
VModuleConfiguration 是一个集合，其中包含一个个的文件名（或者文件名模式）
|
||||
及对应的详细程度阈值。
|
||||
|
||||
## `CredentialProviderConfig` {#kubelet-config-k8s-io-v1alpha1-CredentialProviderConfig}
|
||||
|
||||
<!--
|
||||
CredentialProviderConfig is the configuration containing information about
|
||||
each exec credential provider. Kubelet reads this configuration from disk and enables
|
||||
each provider as specified by the CredentialProvider type.
|
||||
-->
|
||||
CredentialProviderConfig 包含有关每个 exec 凭据提供者的配置信息。
|
||||
Kubelet 从磁盘上读取这些配置信息，并根据 CredentialProvider 类型启用各个提供者。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>kubelet.config.k8s.io/v1alpha1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderConfig</code></td></tr>
|
||||
<tr><td><code>providers</code> <B>[必需]</B><br/>
|
||||
<a href="#kubelet-config-k8s-io-v1alpha1-CredentialProvider"><code>[]CredentialProvider</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
providers is a list of credential provider plugins that will be enabled by the kubelet.
|
||||
Multiple providers may match against a single image, in which case credentials
|
||||
from all providers will be returned to the kubelet. If multiple providers are called
|
||||
for a single image, the results are combined. If providers return overlapping
|
||||
auth keys, the value from the provider earlier in this list is used.
|
||||
-->
|
||||
<code>providers</code> 是一组凭据提供者插件，这些插件会被 kubelet 启用。
|
||||
多个提供者可以匹配到同一镜像上，这时，来自所有提供者的凭据信息都会返回给 kubelet。
|
||||
如果针对同一镜像调用了多个提供者，则结果会被组合起来。如果提供者返回的认证主键有重复，
|
||||
列表中先出现的提供者所返回的值将被使用。
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `CredentialProvider` {#kubelet-config-k8s-io-v1alpha1-CredentialProvider}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [CredentialProviderConfig](#kubelet-config-k8s-io-v1alpha1-CredentialProviderConfig)
|
||||
|
||||
<!--
|
||||
CredentialProvider represents an exec plugin to be invoked by the kubelet. The plugin is only
|
||||
invoked when an image being pulled matches the images handled by the plugin (see matchImages).
|
||||
-->
|
||||
CredentialProvider 代表的是要被 kubelet 调用的一个 exec 插件。
|
||||
这一插件只会在所拉取的镜像与该插件所处理的镜像匹配时才会被调用（参见 <code>matchImages</code>）。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>name</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--name is the required name of the credential provider. It must match the name of the
|
||||
provider executable as seen by the kubelet. The executable must be in the kubelet's
|
||||
bin directory (set by the --image-credential-provider-bin-dir flag).</td>
|
||||
-->
|
||||
<code>name</code> 是凭据提供者的名称（必需）。此名称必须与 kubelet
|
||||
所看到的提供者可执行文件的名称匹配。可执行文件必须位于 kubelet 的
|
||||
<code>bin</code> 目录（通过 <code>--image-credential-provider-bin-dir</code> 设置）下。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>matchImages</code> <B>[必需]</B><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--matchImages is a required list of strings used to match against images in order to
|
||||
determine if this provider should be invoked. If one of the strings matches the
|
||||
requested image from the kubelet, the plugin will be invoked and given a chance
|
||||
to provide credentials. Images are expected to contain the registry domain
|
||||
and URL path.
|
||||
Each entry in matchImages is a pattern which can optionally contain a port and a path.
|
||||
Globs can be used in the domain, but not in the port or the path. Globs are supported
|
||||
as subdomains like <code>*.k8s.io</code> or <code>k8s.*.io</code>, and top-level-domains such as <code>k8s.*</code>.
|
||||
Matching partial subdomains like <code>app*.k8s.io</code> is also supported. Each glob can only match
|
||||
a single subdomain segment, so <code>*.io</code> does not match <code>*.k8s.io</code>.
|
||||
A match exists between an image and a matchImage when all of the below are true:
|
||||
<ul>
|
||||
<li>Both contain the same number of domain parts and each part matches.</li>
|
||||
<li>The URL path of an imageMatch must be a prefix of the target image URL path.</li>
|
||||
<li>If the imageMatch contains a port, then the port must match in the image as well.</li>
|
||||
</ul>
|
||||
Example values of matchImages:
|
||||
- 123456789.dkr.ecr.us-east-1.amazonaws.com
|
||||
- ∗.azurecr.io
|
||||
- gcr.io
|
||||
- ∗.∗.registry.io
|
||||
- registry.io:8080/path
|
||||
-->
|
||||
<p><code>matchImages</code> 是一个必须设置的字符串列表，用来匹配镜像以便确定是否要调用此提供者。
|
||||
如果字符串之一与 kubelet 所请求的镜像匹配，则此插件会被调用并给予提供凭证的机会。
|
||||
镜像应该包含镜像库域名和 URL 路径。</p>
|
||||
<p><code>matchImages</code> 中的每个条目都是一个模式字符串，其中可以包含端口号和路径。
|
||||
域名部分可以包含统配符，但端口或路径部分不可以。通配符可以用作子域名，例如
|
||||
<code>*.k8s.io</code> 或 <code>k8s.*.io</code>，以及顶级域名，如 <code>k8s.*</code>。</p>
|
||||
<p>对类似 <code>app*.k8s.io</code> 这类部分子域名的匹配也是支持的。
|
||||
每个通配符只能用来匹配一个子域名段，所以 <code>*.io</code> 不会匹配 <code>*.k8s.io</code>。</p>
|
||||
<p>镜像与 <code>matchImages</code> 之间存在匹配时，以下条件都要满足：</p>
|
||||
<ul>
|
||||
<li>二者均包含相同个数的域名部分，并且每个域名部分都对应匹配；</li>
|
||||
<li><code>matchImages</code> 条目中的 URL 路径部分必须是目标镜像的 URL 路径的前缀；</li>
|
||||
<li>如果 <code>matchImages</code> 条目中包含端口号，则端口号也必须与镜像端口号匹配。</li>
|
||||
</ul>
|
||||
<p><code>matchImages</code> 的一些示例如下：</p>
|
||||
<ul>
|
||||
<li><code>123456789.dkr.ecr.us-east-1.amazonaws.com</code></li>
|
||||
<li><code>*.azurecr.io</code></li>
|
||||
<li><code>gcr.io</code></li>
|
||||
<li><code>*.*.registry.io</code></li>
|
||||
<li><code>registry.io:8080/path</code></li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>defaultCacheDuration</code> <B>[必需]</B><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--defaultCacheDuration is the default duration the plugin will cache credentials in-memory
|
||||
if a cache duration is not provided in the plugin response. This field is required.-->
|
||||
<code>defaultCacheDuration</code> 是插件在内存中缓存凭据的默认时长，
|
||||
在插件响应中没有给出缓存时长时，使用这里设置的值。此字段是必需的。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>apiVersion</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--Required input version of the exec CredentialProviderRequest. The returned CredentialProviderResponse
|
||||
MUST use the same encoding version as the input. Current supported values are:
|
||||
- credentialprovider.kubelet.k8s.io/v1alpha1-->
|
||||
<p>要求 exec 插件 CredentialProviderRequest 请求的输入版本。
|
||||
所返回的 CredentialProviderResponse 必须使用与输入相同的编码版本。当前支持的值有：</p>
|
||||
<ul>
|
||||
<li><code>credentialprovider.kubelet.k8s.io/v1alpha1</code></li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>args</code><br/>
|
||||
<code>[]string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--Arguments to pass to the command when executing it.-->
|
||||
在执行插件可执行文件时要传递给命令的参数。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>env</code><br/>
|
||||
<a href="#kubelet-config-k8s-io-v1alpha1-ExecEnvVar"><code>[]ExecEnvVar</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--Env defines additional environment variables to expose to the process. These
|
||||
are unioned with the host's environment, as well as variables client-go uses
|
||||
to pass argument to the plugin.-->
|
||||
<code>env</code> 定义要提供给插件进程的额外的环境变量。
|
||||
这些环境变量会与主机上的其他环境变量以及 client-go 所使用的环境变量组合起来，
|
||||
一起传递给插件。
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `ExecEnvVar` {#kubelet-config-k8s-io-v1alpha1-ExecEnvVar}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [CredentialProvider](#kubelet-config-k8s-io-v1alpha1-CredentialProvider)
|
||||
|
||||
<!--
|
||||
ExecEnvVar is used for setting environment variables when executing an exec-based
|
||||
credential plugin.
|
||||
-->
|
||||
ExecEnvVar 用来在执行基于 exec 的凭据插件时设置环境变量。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>name</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!-- span class="text-muted">No description provided.</span -->
|
||||
环境变量名称。
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<tr><td><code>value</code> <B>[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!-- span class="text-muted">No description provided.</span-->
|
||||
环境变量取值。
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,253 @@
|
||||
---
|
||||
title: Kubelet CredentialProvider (v1alpha1)
|
||||
content_type: tool-reference
|
||||
package: credentialprovider.kubelet.k8s.io/v1alpha1
|
||||
---
|
||||
<!--
|
||||
title: Kubelet CredentialProvider (v1alpha1)
|
||||
content_type: tool-reference
|
||||
package: credentialprovider.kubelet.k8s.io/v1alpha1
|
||||
auto_generated: true
|
||||
-->
|
||||
|
||||
<!--
|
||||
## Resource Types
|
||||
-->
|
||||
## 资源类型 {#resource-types}
|
||||
|
||||
- [CredentialProviderRequest](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderRequest)
|
||||
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse)
|
||||
|
||||
## `CredentialProviderRequest` {#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderRequest}
|
||||
|
||||
<!--
|
||||
CredentialProviderRequest includes the image that the kubelet requires authentication for.
|
||||
Kubelet will pass this request object to the plugin via stdin. In general, plugins should
|
||||
prefer responding with the same apiVersion they were sent.
|
||||
-->
|
||||
<p>
|
||||
CredentialProviderRequest 包含 kubelet 需要进行身份验证的镜像。
|
||||
Kubelet 会通过标准输入将此请求对象传递给插件。一般来说，插件倾向于用它们所收到的相同的 apiVersion 来响应。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1alpha1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderRequest</code></td></tr>
|
||||
|
||||
|
||||
<tr><td><code>image</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
image is the container image that is being pulled as part of the
|
||||
credential provider plugin request. Plugins may optionally parse the image
|
||||
to extract any information required to fetch credentials.
|
||||
-->
|
||||
<p>
|
||||
<code>image</code> 是容器镜像，作为凭据提供程序插件请求的一部分。
|
||||
插件可以有选择地解析镜像以提取获取凭据所需的任何信息。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `CredentialProviderResponse` {#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse}
|
||||
|
||||
<!--
|
||||
CredentialProviderResponse holds credentials that the kubelet should use for the specified
|
||||
image provided in the original request. Kubelet will read the response from the plugin via stdout.
|
||||
This response should be set to the same apiVersion as CredentialProviderRequest.
|
||||
-->
|
||||
<p>
|
||||
CredentialProviderResponse 持有 kubelet 应用于原始请求中提供的指定镜像的凭据。
|
||||
kubelet 将通过标准输出读取插件的响应。此响应的 apiVersion 值应设置为与 CredentialProviderRequest 中 apiVersion 值相同。
|
||||
</p>
|
||||
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1alpha1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderResponse</code></td></tr>
|
||||
|
||||
|
||||
<tr><td><code>cacheKeyType</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="#credentialprovider-kubelet-k8s-io-v1alpha1-PluginCacheKeyType"><code>PluginCacheKeyType</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
cacheKeyType indiciates the type of caching key to use based on the image provided
|
||||
in the request. There are three valid values for the cache key type: Image, Registry, and
|
||||
Global. If an invalid value is specified, the response will NOT be used by the kubelet.
|
||||
-->
|
||||
<p>
|
||||
<code>cacheKeyType</code> 表明基于请求中所给镜像而要使用的缓存键类型。缓存键类型有三个有效值：
|
||||
Image、Registry 和 Global。如果指定了无效值，则 kubelet 不会使用该响应。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>cacheDuration</code><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
cacheDuration indicates the duration the provided credentials should be cached for.
|
||||
The kubelet will use this field to set the in-memory cache duration for credentials
|
||||
in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in
|
||||
CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.
|
||||
-->
|
||||
<p>
|
||||
<code>cacheDuration</code> 表示所提供的凭据应该被缓存的时间。kubelet 使用这个字段为
|
||||
<code>auth</code> 中的凭据设置内存中数据的缓存时间。如果为空，kubelet 将使用 CredentialProviderConfig
|
||||
中提供的 defaultCacheDuration。如果设置为 0，kubelet 将不会缓存所提供的 <code>auth</code> 数据。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>auth</code><br/>
|
||||
<a href="#credentialprovider-kubelet-k8s-io-v1alpha1-AuthConfig"><code>map[string]k8s.io/kubelet/pkg/apis/credentialprovider/v1alpha1.AuthConfig</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
auth is a map containing authentication information passed into the kubelet.
|
||||
Each key is a match image string (more on this below). The corresponding authConfig value
|
||||
should be valid for all images that match against this key. A plugin should set
|
||||
this field to null if no valid credentials can be returned for the requested image.
|
||||
-->
|
||||
<p>
|
||||
<code>auth</code> 是一个映射，其中包含传递到 kubelet 的身份验证信息。
|
||||
每个键都是一个匹配镜像字符串（下面将对此进行详细介绍）。相应的 authConfig 值应该对所有与此键匹配的镜像有效。
|
||||
如果不能为请求的镜像返回有效的凭据，插件应将此字段设置为 null。
|
||||
</p>
|
||||
<!--
|
||||
Each key in the map is a pattern which can optionally contain a port and a path.
|
||||
Globs can be used in the domain, but not in the port or the path. Globs are supported
|
||||
as subdomains like '<em>.k8s.io' or 'k8s.</em>.io', and top-level-domains such as 'k8s.<em>'.
|
||||
Matching partial subdomains like 'app</em>.k8s.io' is also supported. Each glob can only match
|
||||
a single subdomain segment, so *.io does not match *.k8s.io.
|
||||
-->
|
||||
<p>
|
||||
映射中每个键值都是一个正则表达式，可以选择包含端口和路径。
|
||||
域名部分可以包含通配符，但在端口或路径中不能使用通配符。
|
||||
支持通配符作为子域，如 <code>*.k8s.io</code> 或 <code>k8s.*.io</code>，以及顶级域，如 <code>k8s.*</code>。
|
||||
还支持匹配部分子域，如 <code>app*.k8s.io</code>。每个通配符只能匹配一个子域段，
|
||||
因此 <code>*.io</code> 不匹配 <code>*.k8s.io</code>。
|
||||
</p>
|
||||
<!--
|
||||
<p>The kubelet will match images against the key when all of the below are true:</p>
|
||||
<ul>
|
||||
<li>Both contain the same number of domain parts and each part matches.</li>
|
||||
<li>The URL path of an imageMatch must be a prefix of the target image URL path.</li>
|
||||
<li>If the imageMatch contains a port, then the port must match in the image as well.</li>
|
||||
</ul>
|
||||
-->
|
||||
<p>
|
||||
当满足以下所有条件时，kubelet 会将镜像与键值匹配：
|
||||
</p>
|
||||
<ul>
|
||||
<li>两者都包含相同数量的域部分，并且每个部分都匹配。</li>
|
||||
<li><code>imageMatch</code> 的 URL 路径必须是目标镜像的 URL 路径的前缀。</li>
|
||||
<li>如果 <code>imageMatch</code> 包含端口，则该端口也必须在镜像中匹配。</li>
|
||||
</ul>
|
||||
<!--
|
||||
<p>When multiple keys are returned, the kubelet will traverse all keys in reverse order so that:</p>
|
||||
<ul>
|
||||
<li>longer keys come before shorter keys with the same prefix</li>
|
||||
<li>non-wildcard keys come before wildcard keys with the same prefix.</li>
|
||||
</ul>
|
||||
-->
|
||||
<p>
|
||||
当返回多个键（key）时，kubelet 会倒序遍历所有键，这样：
|
||||
</p>
|
||||
<ul>
|
||||
<li>具有相同前缀的较长键位于较短键之前</li>
|
||||
<li>具有相同前缀的非通配符键位于通配符键之前。</li>
|
||||
</ul>
|
||||
<!--
|
||||
<p>For any given match, the kubelet will attempt an image pull with the provided credentials,
|
||||
stopping after the first successfully authenticated pull.</p>
|
||||
<p>Example keys:</p>
|
||||
-->
|
||||
<p>
|
||||
对于任何给定的匹配，kubelet 将尝试使用提供的凭据进行镜像拉取，并在第一次成功验证后停止拉取。
|
||||
</p>
|
||||
<p>键值示例：</p>
|
||||
<ul>
|
||||
<li>123456789.dkr.ecr.us-east-1.amazonaws.com</li>
|
||||
<li>*.azurecr.io</li>
|
||||
<li>gcr.io</li>
|
||||
<li><em>.</em>.registry.io</li>
|
||||
<li>registry.io:8080/path</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `AuthConfig` {#credentialprovider-kubelet-k8s-io-v1alpha1-AuthConfig}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse)
|
||||
|
||||
<!--
|
||||
<p>AuthConfig contains authentication information for a container registry.
|
||||
Only username/password based authentication is supported today, but more authentication
|
||||
mechanisms may be added in the future.</p>
|
||||
-->
|
||||
AuthConfig 包含容器仓库的身份验证信息。目前仅支持基于用户名/密码的身份验证，但未来可能会添加更多身份验证机制。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
<tr><td><code>username</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
<p>username is the username used for authenticating to the container registry
|
||||
An empty username is valid.</p>
|
||||
-->
|
||||
<p>
|
||||
<code>username</code> 是用于向容器仓库进行身份验证的用户名。空的用户名是合法的。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>password</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
<p>password is the password used for authenticating to the container registry
|
||||
An empty password is valid.</p>
|
||||
-->
|
||||
<p>
|
||||
<code>password</code> 是用于向容器仓库进行身份验证的密码。空密码是合法的。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `PluginCacheKeyType` {#credentialprovider-kubelet-k8s-io-v1alpha1-PluginCacheKeyType}
|
||||
|
||||
<!--
|
||||
(Alias of `string`)
|
||||
|
||||
**Appears in:**
|
||||
-->
|
||||
（<code>string</code> 数据类型的别名）
|
||||
|
||||
**出现在：**
|
||||
|
||||
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse)
|
||||
@@ -0,0 +1,253 @@
|
||||
---
|
||||
title: Kubelet CredentialProvider (v1beta1)
|
||||
content_type: tool-reference
|
||||
package: credentialprovider.kubelet.k8s.io/v1beta1
|
||||
---
|
||||
<!--
|
||||
title: Kubelet CredentialProvider (v1beta1)
|
||||
content_type: tool-reference
|
||||
package: credentialprovider.kubelet.k8s.io/v1beta1
|
||||
auto_generated: true
|
||||
-->
|
||||
|
||||
<!--
|
||||
## Resource Types
|
||||
-->
|
||||
## 资源类型 {#resource-types}
|
||||
|
||||
- [CredentialProviderRequest](#credentialprovider-kubelet-k8s-io-v1beta1-CredentialProviderRequest)
|
||||
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1beta1-CredentialProviderResponse)
|
||||
|
||||
## `CredentialProviderRequest` {#credentialprovider-kubelet-k8s-io-v1beta1-CredentialProviderRequest}
|
||||
|
||||
<!--
|
||||
CredentialProviderRequest includes the image that the kubelet requires authentication for.
|
||||
Kubelet will pass this request object to the plugin via stdin. In general, plugins should
|
||||
prefer responding with the same apiVersion they were sent.
|
||||
-->
|
||||
<p>
|
||||
CredentialProviderRequest 包含 kubelet 需要进行身份验证的镜像。
|
||||
Kubelet 会通过标准输入将此请求对象传递给插件。一般来说，插件倾向于用它们所收到的相同的 apiVersion 来响应。
|
||||
</p>
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1beta1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderRequest</code></td></tr>
|
||||
|
||||
|
||||
<tr><td><code>image</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
image is the container image that is being pulled as part of the
|
||||
credential provider plugin request. Plugins may optionally parse the image
|
||||
to extract any information required to fetch credentials.
|
||||
-->
|
||||
<p>
|
||||
<code>image</code> 是容器镜像，作为凭据提供程序插件请求的一部分。
|
||||
插件可以有选择地解析镜像以提取获取凭据所需的任何信息。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `CredentialProviderResponse` {#credentialprovider-kubelet-k8s-io-v1beta1-CredentialProviderResponse}
|
||||
|
||||
<!--
|
||||
CredentialProviderResponse holds credentials that the kubelet should use for the specified
|
||||
image provided in the original request. Kubelet will read the response from the plugin via stdout.
|
||||
This response should be set to the same apiVersion as CredentialProviderRequest.
|
||||
-->
|
||||
<p>
|
||||
CredentialProviderResponse 持有 kubelet 应用于原始请求中提供的指定镜像的凭据。
|
||||
kubelet 将通过标准输出读取插件的响应。此响应的 apiVersion 值应设置为与 CredentialProviderRequest 中 apiVersion 值相同。
|
||||
</p>
|
||||
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1beta1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderResponse</code></td></tr>
|
||||
|
||||
|
||||
<tr><td><code>cacheKeyType</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<a href="#credentialprovider-kubelet-k8s-io-v1beta1-PluginCacheKeyType"><code>PluginCacheKeyType</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
cacheKeyType indiciates the type of caching key to use based on the image provided
|
||||
in the request. There are three valid values for the cache key type: Image, Registry, and
|
||||
Global. If an invalid value is specified, the response will NOT be used by the kubelet.
|
||||
-->
|
||||
<p>
|
||||
<code>cacheKeyType</code> 表明基于请求中所给镜像而要使用的缓存键类型。缓存键类型有三个有效值：
|
||||
Image、Registry 和 Global。如果指定了无效值，则 kubelet 不会使用该响应。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>cacheDuration</code><br/>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
cacheDuration indicates the duration the provided credentials should be cached for.
|
||||
The kubelet will use this field to set the in-memory cache duration for credentials
|
||||
in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in
|
||||
CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.
|
||||
-->
|
||||
<p>
|
||||
<code>cacheDuration</code> 表示所提供的凭据应该被缓存的时间。kubelet 使用这个字段为
|
||||
<code>auth</code> 中的凭据设置内存中数据的缓存时间。如果为空，kubelet 将使用 CredentialProviderConfig
|
||||
中提供的 defaultCacheDuration。如果设置为 0，kubelet 将不会缓存所提供的 <code>auth</code> 数据。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>auth</code><br/>
|
||||
<a href="#credentialprovider-kubelet-k8s-io-v1beta1-AuthConfig"><code>map[string]k8s.io/kubelet/pkg/apis/credentialprovider/v1beta1.AuthConfig</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
auth is a map containing authentication information passed into the kubelet.
|
||||
Each key is a match image string (more on this below). The corresponding authConfig value
|
||||
should be valid for all images that match against this key. A plugin should set
|
||||
this field to null if no valid credentials can be returned for the requested image.
|
||||
-->
|
||||
<p>
|
||||
<code>auth</code> 是一个映射，其中包含传递到 kubelet 的身份验证信息。
|
||||
每个键都是一个匹配镜像字符串（下面将对此进行详细介绍）。相应的 authConfig 值应该对所有与此键匹配的镜像有效。
|
||||
如果不能为请求的镜像返回有效的凭据，插件应将此字段设置为 null。
|
||||
</p>
|
||||
<!--
|
||||
Each key in the map is a pattern which can optionally contain a port and a path.
|
||||
Globs can be used in the domain, but not in the port or the path. Globs are supported
|
||||
as subdomains like '<em>.k8s.io' or 'k8s.</em>.io', and top-level-domains such as 'k8s.<em>'.
|
||||
Matching partial subdomains like 'app</em>.k8s.io' is also supported. Each glob can only match
|
||||
a single subdomain segment, so *.io does not match *.k8s.io.
|
||||
-->
|
||||
<p>
|
||||
映射中每个键值都是一个正则表达式，可以选择包含端口和路径。
|
||||
域名部分可以包含通配符，但在端口或路径中不能使用通配符。
|
||||
支持通配符作为子域，如 <code>*.k8s.io</code> 或 <code>k8s.*.io</code>，以及顶级域，如 <code>k8s.*</code>。
|
||||
还支持匹配部分子域，如 <code>app*.k8s.io</code>。每个通配符只能匹配一个子域段，
|
||||
因此 <code>*.io</code> 不匹配 <code>*.k8s.io</code>。
|
||||
</p>
|
||||
<!--
|
||||
<p>The kubelet will match images against the key when all of the below are true:</p>
|
||||
<ul>
|
||||
<li>Both contain the same number of domain parts and each part matches.</li>
|
||||
<li>The URL path of an imageMatch must be a prefix of the target image URL path.</li>
|
||||
<li>If the imageMatch contains a port, then the port must match in the image as well.</li>
|
||||
</ul>
|
||||
-->
|
||||
<p>
|
||||
当满足以下所有条件时，kubelet 会将镜像与键值匹配：
|
||||
</p>
|
||||
<ul>
|
||||
<li>两者都包含相同数量的域部分，并且每个部分都匹配。</li>
|
||||
<li><code>imageMatch</code> 的 URL 路径必须是目标镜像的 URL 路径的前缀。</li>
|
||||
<li>如果 <code>imageMatch</code> 包含端口，则该端口也必须在镜像中匹配。</li>
|
||||
</ul>
|
||||
<!--
|
||||
<p>When multiple keys are returned, the kubelet will traverse all keys in reverse order so that:</p>
|
||||
<ul>
|
||||
<li>longer keys come before shorter keys with the same prefix</li>
|
||||
<li>non-wildcard keys come before wildcard keys with the same prefix.</li>
|
||||
</ul>
|
||||
-->
|
||||
<p>
|
||||
当返回多个键（key）时，kubelet 会倒序遍历所有键，这样：
|
||||
</p>
|
||||
<ul>
|
||||
<li>具有相同前缀的较长键位于较短键之前</li>
|
||||
<li>具有相同前缀的非通配符键位于通配符键之前。</li>
|
||||
</ul>
|
||||
<!--
|
||||
<p>For any given match, the kubelet will attempt an image pull with the provided credentials,
|
||||
stopping after the first successfully authenticated pull.</p>
|
||||
<p>Example keys:</p>
|
||||
-->
|
||||
<p>
|
||||
对于任何给定的匹配，kubelet 将尝试使用提供的凭据进行镜像拉取，并在第一次成功验证后停止拉取。
|
||||
</p>
|
||||
<p>键值示例：</p>
|
||||
<ul>
|
||||
<li>123456789.dkr.ecr.us-east-1.amazonaws.com</li>
|
||||
<li>*.azurecr.io</li>
|
||||
<li>gcr.io</li>
|
||||
<li><em>.</em>.registry.io</li>
|
||||
<li>registry.io:8080/path</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `AuthConfig` {#credentialprovider-kubelet-k8s-io-v1beta1-AuthConfig}
|
||||
|
||||
<!--
|
||||
**Appears in:**
|
||||
-->
|
||||
**出现在：**
|
||||
|
||||
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1beta1-CredentialProviderResponse)
|
||||
|
||||
<!--
|
||||
<p>AuthConfig contains authentication information for a container registry.
|
||||
Only username/password based authentication is supported today, but more authentication
|
||||
mechanisms may be added in the future.</p>
|
||||
-->
|
||||
AuthConfig 包含容器仓库的身份验证信息。目前仅支持基于用户名/密码的身份验证，但未来可能会添加更多身份验证机制。
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
<tr><td><code>username</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
<p>username is the username used for authenticating to the container registry
|
||||
An empty username is valid.</p>
|
||||
-->
|
||||
<p>
|
||||
<code>username</code> 是用于向容器仓库进行身份验证的用户名。空的用户名是合法的。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr><td><code>password</code> <B><!--[Required]-->[必需]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
<!--
|
||||
<p>password is the password used for authenticating to the container registry
|
||||
An empty password is valid.</p>
|
||||
-->
|
||||
<p>
|
||||
<code>password</code> 是用于向容器仓库进行身份验证的密码。空密码是合法的。
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `PluginCacheKeyType` {#credentialprovider-kubelet-k8s-io-v1beta1-PluginCacheKeyType}
|
||||
|
||||
<!--
|
||||
(Alias of `string`)
|
||||
|
||||
**Appears in:**
|
||||
-->
|
||||
（<code>string</code> 数据类型的别名）
|
||||
|
||||
**出现在：**
|
||||
|
||||
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1beta1-CredentialProviderResponse)
|
||||
Reference in New Issue
Block a user