Merge pull request #29369 from EricWvi/main

[zh] Concept files to sync for 1.22 - (8) Service

content/zh/docs/concepts/services-networking/dns-pod-service.md

@@ -92,10 +92,10 @@ options ndots:5
 
 <!--
 In summary, a pod in the _test_ namespace can successfully resolve either
-`data.prod` or `data.prod.cluster.local`.
+`data.prod` or `data.prod.svc.cluster.local`.
 -->
 概括起来，名字空间 `test` 中的 Pod 可以成功地解析 `data.prod` 或者
-`data.prod.cluster.local`。
+`data.prod.svc.cluster.local`。
 
 <!--
 ### DNS Records
@@ -336,11 +336,11 @@ record unless `publishNotReadyAddresses=True` is set on the Service.
 <!--
 ### Pod's setHostnameAsFQDN field {#pod-sethostnameasfqdn-field}
 
-{{< feature-state for_k8s_version="v1.20" state="beta" >}}
+{{< feature-state for_k8s_version="v1.22" state="stable" >}}
 -->
 ### Pod 的 setHostnameAsFQDN 字段  {#pod-sethostnameasfqdn-field}
 
-{{< feature-state for_k8s_version="v1.20" state="beta" >}}
+{{< feature-state for_k8s_version="v1.22" state="stable" >}}
 
 <!--
 When a Pod is configured to have fully qualified domain name (FQDN), its hostname is the short hostname. For example, if you have a Pod with the fully qualified domain name `busybox-1.default-subdomain.my-namespace.svc.cluster-domain.example`, then by default the `hostname` command inside that Pod returns `busybox-1` and  the `hostname -fqdn` command returns the FQDN.
@@ -454,6 +454,8 @@ spec:
 <!--
 ### Pod's DNS Config
 
+{{< feature-state for_k8s_version="v1.14" state="stable" >}}
+
 Pod's DNS Config allows users more control on the DNS settings for a Pod.
 
 The `dnsConfig` field is optional and it can work with any `dnsPolicy` settings.
@@ -464,6 +466,8 @@ Below are the properties a user can specify in the `dnsConfig` field:
 -->
 ### Pod 的 DNS 配置  {#pod-dns-config}
 
+{{< feature-state for_k8s_version="v1.14" state="stable" >}}
+
 Pod 的 DNS 配置可让用户对 Pod 的 DNS 设置进行更多控制。
 
 `dnsConfig` 字段是可选的，它可以与任何 `dnsPolicy` 设置一起使用。
@@ -541,6 +545,28 @@ search default.svc.cluster-domain.example svc.cluster-domain.example cluster-dom
 options ndots:5
 ```
 
+<!--
+#### Expanded DNS Configuration
+
+{{< feature-state for_k8s_version="1.22" state="alpha" >}}
+
+By default, for Pod's DNS Config, Kubernetes allows at most 6 search domains and
+a list of search domains of up to 256 characters.
+
+If the feature gate `ExpandedDNSConfig` is enabled for the kube-apiserver and
+the kubelet, it is allowed for Kubernetes to have at most 32 search domains and
+a list of search domains of up to 2048 characters.
+-->
+#### 扩展 DNS 配置  {#expanded-dns-configuration}
+
+{{< feature-state for_k8s_version="1.22" state="alpha" >}}
+
+对于 Pod DNS 配置，Kubernetes 默认允许最多 6 个 搜索域（ Search Domain） 
+以及一个最多 256 个字符的搜索域列表。
+
+如果启用 kube-apiserver 和 kubelet 的特性门控 `ExpandedDNSConfig`，Kubernetes 将可以有最多 32 个 
+搜索域以及一个最多 2048 个字符的搜索域列表。
+
 <!--
 ### Feature availability
 

content/zh/docs/concepts/services-networking/endpoint-slices.md

@@ -458,9 +458,7 @@ implementation in `kube-proxy`.
 ## {{% heading "whatsnext" %}}
 
 <!--
-* [Enabling Endpoint Slices](/docs/tasks/administer-cluster/enabling-endpoint-slices)
 * Read [Connecting Applications with Services](/docs/concepts/services-networking/connect-applications-service/)
 -->
-* 了解[启用 EndpointSlice](/zh/docs/tasks/administer-cluster/enabling-endpointslices)
 * 阅读[使用服务连接应用](/zh/docs/concepts/services-networking/connect-applications-service/)
 

content/zh/docs/concepts/services-networking/ingress.md

@@ -421,7 +421,7 @@ IngressClass 资源包含一个可选的 `parameters` 字段，可用于为该
 -->
 #### 名字空间域的参数
 
-{{< feature-state for_k8s_version="v1.21" state="alpha" >}}
+{{< feature-state for_k8s_version="v1.22" state="beta" >}}
 
 <!--
 `Parameters` field has a `scope` and `namespace` field that can be used to
@@ -429,6 +429,11 @@ reference a namespace-specific resource for configuration of an Ingress class.
 `Scope` field defaults to `Cluster`, meaning, the default is cluster-scoped
 resource. Setting `Scope` to `Namespace` and setting the `Namespace` field
 will reference a parameters resource in a specific namespace:
+
+Namespace-scoped parameters avoid the need for a cluster-scoped CustomResourceDefinition
+for a parameters resource. This further avoids RBAC-related resources
+that would otherwise be required to grant permissions to cluster-scoped
+resources.
 -->
 `parameters` 字段有一个 `scope` 和 `namespace` 字段，可用来引用特定
 于名字空间的资源，对 Ingress 类进行配置。
@@ -436,6 +441,9 @@ will reference a parameters resource in a specific namespace:
 将 `scope` 设置为 `Namespace` 并设置 `namespace` 字段就可以引用某特定
 名字空间中的参数资源。
 
+有了名字空间域的参数，就不再需要为一个参数资源配置集群范围的 CustomResourceDefinition。
+除此之外，之前对访问集群范围的资源进行授权，需要用到 RBAC 相关的资源，现在也不再需要了。
+
 {{< codenew file="service/networking/namespaced-params.yaml" >}}
 
 <!-- 

content/zh/docs/concepts/services-networking/network-policies.md

@@ -290,6 +290,7 @@ Pod 的连接，*或* 来自任何名字空间中标有 `user=alice` 的任何 P
 <!--
 When in doubt, use `kubectl describe` to see how Kubernetes has interpreted the policy.
 
+<a name="behavior-of-ipblock-selectors"></a>
 __ipBlock__: This selects particular IP CIDR ranges to allow as ingress sources or egress destinations. These should be cluster-external IPs, since Pod IPs are ephemeral and unpredictable.
 
 Cluster ingress and egress mechanisms often require rewriting the source or destination IP
@@ -415,13 +416,13 @@ This ensures that even pods that aren't selected by any other NetworkPolicy will
 -->
 ## SCTP 支持
 
-{{< feature-state for_k8s_version="v1.19" state="beta" >}}
+{{< feature-state for_k8s_version="v1.20" state="stable" >}}
 
 <!--
-As a beta feature, this is enabled by default. To disable SCTP at a cluster level, you (or your cluster administrator) will need to disable the `SCTPSupport` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) for the API server with `-feature-gates=SCTPSupport=false,...`.
+As a stable feature, this is enabled by default. To disable SCTP at a cluster level, you (or your cluster administrator) will need to disable the `SCTPSupport` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) for the API server with `--feature-gates=SCTPSupport=false,…`.
 When the feature gate is enabled, you can set the `protocol` field of a NetworkPolicy to `SCTP`.
 -->
-作为一个 Beta 特性，SCTP 支持默认是被启用的。
+作为一个稳定特性，SCTP 支持默认是被启用的。
 要在集群层面禁用 SCTP，你（或你的集群管理员）需要为 API 服务器指定
 `--feature-gates=SCTPSupport=false,...`
 来禁用 `SCTPSupport` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)。
@@ -439,7 +440,7 @@ You must be using a {{< glossary_tooltip text="CNI" term_id="cni" >}} plugin tha
 -->
 ## 针对某个端口范围   {#targeting-a-range-of-ports}
 
-{{< feature-state for_k8s_version="v1.21" state="alpha" >}}
+{{< feature-state for_k8s_version="v1.22" state="beta" >}}
 
 <!--
 When writing a NetworkPolicy, you can target a range of ports instead of a single port.
@@ -473,23 +474,25 @@ spec:
 ```
 
 <!--
-The above rule allows any Pod with label `db` on the namespace `default` to communicate with any IP within the range `10.0.0.0/24` over TCP, provided that the target port is between the range 32000 and 32768.
+The above rule allows any Pod with label `db` on the namespace `default` to communicate 
+with any IP within the range `10.0.0.0/24` over TCP, provided that the target 
+port is between the range 32000 and 32768.
 -->
 上面的规则允许名字空间 `default` 中所有带有标签 `db` 的 Pod 使用 TCP 协议
 与 `10.0.0.0/24` 范围内的 IP 通信，只要目标端口介于 32000 和 32768 之间就可以。
 
 <!--
 The following restrictions apply when using this field:
-* As an alpha feature, this is disabled by default. To enable the `endPort` field at a cluster level, you (or your cluster administrator) need to enable the `NetworkPolicyEndPort` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) for the API server with `-feature-gates=NetworkPolicyEndPort=true,…`.
+* As a beta feature, this is enabled by default. To disable the `endPort` field at a cluster level, you (or your cluster administrator) need to disable the `NetworkPolicyEndPort` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) for the API server with `-feature-gates=NetworkPolicyEndPort=false,…`.
 * The `endPort` field must be equal than or greater to the `port` field.
 * `endPort` can only be defined if `port` is also defined.
 * Both ports must be numeric.
 -->
 使用此字段时存在以下限制：
 
-* 作为一种 Alpha 阶段的特性，端口范围设定默认是被禁用的。要在整个集群
+* 作为一种 Beta 阶段的特性，端口范围设定默认是被启用的。要在整个集群
-  范围内允许使用 `endPort` 字段，你（或者你的集群管理员）需要为 API
+  范围内禁止使用 `endPort` 字段，你（或者你的集群管理员）需要为 API
-  服务器设置 `-feature-gates=NetworkPolicyEndPort=true,...` 以启用
+  服务器设置 `-feature-gates=NetworkPolicyEndPort=false,...` 以禁用
   `NetworkPolicyEndPort` 
   [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)。
 * `endPort` 字段必须等于或者大于 `port` 字段的值。
@@ -499,9 +502,15 @@ The following restrictions apply when using this field:
 <!--
 Your cluster must be using a {{< glossary_tooltip text="CNI" term_id="cni" >}} plugin that
 supports the `endPort` field in NetworkPolicy specifications.
+If your [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) 
+does not support the `endPort` field and you specify a NetworkPolicy with that,
+the policy will be applied only for the single `port` field.
 -->
 你的集群所使用的 {{< glossary_tooltip text="CNI" term_id="cni" >}} 插件
 必须支持在 NetworkPolicy 规约中使用 `endPort` 字段。
+如果你的[网络插件](/zh/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/)
+不支持 `endPort` 字段，而你指定了一个包含 `endPort` 字段的 NetworkPolicy，
+策略只对单个 `port` 字段生效。
 {{< /note >}}
 
 <!--

content/zh/docs/concepts/services-networking/service.md

@@ -127,7 +127,7 @@ A Service in Kubernetes is a REST object, similar to a Pod.  Like all of the
 REST objects, you can `POST` a Service definition to the API server to create
 a new instance.
 The name of a Service object must be a valid
-[DNS label name](/docs/concepts/overview/working-with-objects/names#dns-label-names).
+[RFC 1035 label name](/docs/concepts/overview/working-with-objects/names#rfc-1035-label-names).
 
 For example, suppose you have a set of Pods where each listens on TCP port 9376
 and contains a label `app=MyApp`:
@@ -138,7 +138,7 @@ and contains a label `app=MyApp`:
 Service 在 Kubernetes 中是一个 REST 对象，和 Pod 类似。
 像所有的 REST 对象一样，Service 定义可以基于 `POST` 方式，请求 API server 创建新的实例。
 Service 对象的名称必须是合法的
-[DNS 标签名称](/zh/docs/concepts/overview/working-with-objects/names#dns-label-names)。
+[RFC 1035 标签名称](/docs/concepts/overview/working-with-objects/names#rfc-1035-label-names).。
 
 例如，假定有一组 Pod，它们对外暴露了 9376 端口，同时还被打上 `app=MyApp` 标签：
 
@@ -315,16 +315,17 @@ ExternalName Service 是 Service 的特例，它没有选择算符，但是使
 <!--
 ### Over Capacity Endpoints
 
-If an Endpoints resource has more than 1000 endpoints then a Kubernetes v1.21 (or later)
+If an Endpoints resource has more than 1000 endpoints then a Kubernetes v1.22 (or later)
-cluster annotates that Endpoints with `endpoints.kubernetes.io/over-capacity: warning`.
+cluster annotates that Endpoints with `endpoints.kubernetes.io/over-capacity: truncated`.
-This annotation indicates that the affected Endpoints object is over capacity.
+This annotation indicates that the affected Endpoints object is over capacity and that
+the endpoints controller has truncated the number of endpoints to 1000.
 -->
 ### 超出容量的 Endpoints    {#over-capacity-endpoints}
 
-如果某个 Endpoints 资源中包含的端点个数超过 1000，则 Kubernetes v1.21 版本
+如果某个 Endpoints 资源中包含的端点个数超过 1000，则 Kubernetes v1.22 版本
 （及更新版本）的集群会将为该 Endpoints 添加注解
-`endpoints.kubernetes.io/over-capacity: warning`。
+`endpoints.kubernetes.io/over-capacity: truncated`。
-这一注解表明所影响到的 Endpoints 对象已经超出容量。
+这一注解表明所影响到的 Endpoints 对象已经超出容量，此外 Endpoints 控制器还会将 Endpoints 对象数量截断到 1000。
 
 <!--
 ### EndpointSlices
@@ -660,6 +661,82 @@ server will return a 422 HTTP status code to indicate that there's a problem.
 这对 API 服务器来说是通过一个标识来指定的。
 如果 IP 地址不合法，API 服务器会返回 HTTP 状态码 422，表示值不合法。
 
+<!--
+## Traffic policies
+-->
+## 流量策略  {#traffic-policies}
+
+<!--
+### External traffic policy
+-->
+### 外部流量策略    {#external-traffic-policy}
+
+<!--
+You can set the `spec.externalTrafficPolicy` field to control how traffic from external sources is routed.
+Valid values are `Cluster` and `Local`. Set the field to `Cluster` to route external traffic to all ready endpoints
+and `Local` to only route to ready node-local endpoints. If the traffic policy is `Local` and there are are no node-local
+endpoints, the kube-proxy does not forward any traffic for the relevant Service.
+-->
+
+你可以通过设置 `spec.externalTrafficPolicy` 字段来控制来自于外部的流量是如何路由的。
+可选值有 `Cluster` 和 `Local`。字段设为 `Cluster` 会将外部流量路由到所有就绪的端点，
+设为 `Local` 会只路由到当前节点上就绪的端点。
+如果流量策略设置为 `Local`，而且当前节点上没有就绪的端点，kube-proxy 不会转发请求相关服务的任何流量。
+
+{{< note >}}
+{{< feature-state for_k8s_version="v1.22" state="alpha" >}}
+
+<!--
+If you enable the `ProxyTerminatingEndpoints`
+[feature gate](/docs/reference/command-line-tools-reference/feature-gates/)
+`ProxyTerminatingEndpoints` for the kube-proxy, the kube-proxy checks if the node
+has local endpoints and whether or not all the local endpoints are marked as terminating.
+-->
+
+如果你启用了 kube-proxy 的 `ProxyTerminatingEndpoints`
+[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)，
+kube-proxy 会检查节点是否有本地的端点，以及是否所有的本地端点都被标记为终止中。
+
+<!--
+If there are local endpoints and **all** of those are terminating, then the kube-proxy ignores
+any external traffic policy of `Local`. Instead, whilst the node-local endpoints remain as all
+terminating, the kube-proxy forwards traffic for that Service to healthy endpoints elsewhere,
+as if the external traffic policy were set to `Cluster`.
+-->
+
+如果本地有端点，而且所有端点处于终止中的状态，那么 kube-proxy 会忽略任何设为 `Local` 的外部流量策略。
+在所有本地端点处于终止中的状态的同时，kube-proxy 将请求指定服务的流量转发到位于其它节点的
+状态健康的端点，如同外部流量策略设为 `Cluster`。
+
+<!--
+This forwarding behavior for terminating endpoints exists to allow external load balancers to
+gracefully drain connections that are backed by `NodePort` Services, even when the health check
+node port starts to fail. Otherwise, traffic can be lost between the time a node is still in the node pool of a load
+balancer and traffic is being dropped during the termination period of a pod.
+-->
+针对处于正被终止状态的端点这一转发行为使得外部负载均衡器可以优雅地排出由
+`NodePort` 服务支持的连接，就算是健康检查节点端口开始失败也是如此。
+否则，当节点还在负载均衡器的节点池内，在 Pod 终止过程中的流量会被丢掉，这些流量可能会丢失。
+
+{{< /note >}}
+
+<!--
+### Internal traffic policy
+-->
+### 内部流量策略    {#internal-traffic-policy}
+
+{{< feature-state for_k8s_version="v1.22" state="beta" >}}
+
+<!--
+You can set the `spec.internalTrafficPolicy` field to control how traffic from internal sources is routed.
+Valid values are `Cluster` and `Local`. Set the field to `Cluster` to route internal traffic to all ready endpoints
+and `Local` to only route to ready node-local endpoints. If the traffic policy is `Local` and there are no node-local
+endpoints, traffic is dropped by kube-proxy.
+-->
+你可以设置 `spec.internalTrafficPolicy` 字段来控制内部来源的流量是如何转发的。可设置的值有 `Cluster` 和 `Local`。
+将字段设置为 `Cluster` 会将内部流量路由到所有就绪端点，设置为 `Local` 只会路由到当前节点上就绪的端点。
+如果流量策略是 `Local`，而且当前节点上没有就绪的端点，那么 kube-proxy 会丢弃流量。
+
 <!--
 ## Discovering services
 
@@ -1124,13 +1201,13 @@ LoadBalancer 类型的服务继续分配节点端口。
 -->
 #### 设置负载均衡器实现的类别 {#load-balancer-class}
 
-{{< feature-state for_k8s_version="v1.21" state="alpha" >}}
+{{< feature-state for_k8s_version="v1.22" state="beta" >}}
 
 <!--
-Starting in v1.21, you can optionally specify the class of a load balancer implementation for
+`spec.loadBalancerClass` enables you to use a load balancer implementation other than the cloud provider default. This feature is available from v1.21, you must enable the `ServiceLoadBalancerClass` feature gate to use this field in v1.21, and the feature gate is enabled by default from v1.22 onwards.
-`LoadBalancer` type of Service by setting the field `spec.loadBalancerClass`.
 By default, `spec.loadBalancerClass` is `nil` and a `LoadBalancer` type of Service uses
-the cloud provider's default load balancer implementation. 
+the cloud provider's default load balancer implementation if the cluster is configured with
+a cloud provider using the `--cloud-provider` component flag. 
 If `spec.loadBalancerClass` is specified, it is assumed that a load balancer
 implementation that matches the specified class is watching for Services.
 Any default load balancer implementation (for example, the one provided by
@@ -1138,10 +1215,11 @@ the cloud provider) will ignore Services that have this field set.
 `spec.loadBalancerClass` can be set on a Service of type `LoadBalancer` only.
 Once set, it cannot be changed. 
 -->
-从 v1.21 开始，你可以有选择地为 `LoadBalancer` 类型的服务设置字段
+`spec.loadBalancerClass` 允许你不使用云提供商的默认负载均衡器实现，转而使用指定的负载均衡器实现。
-`.spec.loadBalancerClass`，以指定其负载均衡器实现的类别。
+这个特性从 v1.21 版本开始可以使用，你在 v1.21 版本中使用这个字段必须启用 `ServiceLoadBalancerClass` 
-默认情况下，`.spec.loadBalancerClass` 的取值是 `nil`，`LoadBalancer` 类型
+特性门控，这个特性门控从 v1.22 版本及以后默认打开。
-服务会使用云提供商的默认负载均衡器实现。
+默认情况下，`.spec.loadBalancerClass` 的取值是 `nil`，如果集群使用 `--cloud-provider` 配置了云提供商，
+`LoadBalancer` 类型服务会使用云提供商的默认负载均衡器实现。
 如果设置了 `.spec.loadBalancerClass`，则假定存在某个与所指定的类相匹配的
 负载均衡器实现在监视服务变化。
 所有默认的负载均衡器实现（例如，由云提供商所提供的）都会忽略设置了此字段
@@ -1152,12 +1230,10 @@ Once set, it cannot be changed.
 The value of `spec.loadBalancerClass` must be a label-style identifier,
 with an optional prefix such as "`internal-vip`" or "`example.com/internal-vip`".
 Unprefixed names are reserved for end-users.
-You must enable the `ServiceLoadBalancerClass` feature gate to use this field.
 -->
 `.spec.loadBalancerClass` 的值必须是一个标签风格的标识符，
 可以有选择地带有类似 "`internal-vip`" 或 "`example.com/internal-vip`" 这类
 前缀。没有前缀的名字是保留给最终用户的。
-你必须启用 `ServiceLoadBalancerClass` 特性门控才能使用此字段。
 
 <!--
 #### Internal load balancer