zh_trans: content/zh/docs/tasks/access-kubernetes-api/configure-aggregation-layer.md (#11176)

* configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md
2018-11-24 23:27:37 +08:00
parent 4518d20365
commit f98ccebdf2
2 changed files with 106 additions and 0 deletions
@@ -0,0 +1,99 @@
+---
+title: 配置聚合层
+reviewers:
+- lavalamp
+- cheftako
+- chenopis
+content_template: templates/task
+weight: 10
+---
+<!--
+---
+title: Configure the Aggregation Layer
+reviewers:
+- lavalamp
+- cheftako
+- chenopis
+content_template: templates/task
+weight: 10
+---
+-->
+
+{{% capture overview %}}
+
+配置[聚合层](/docs/concepts/api-extension/apiserver-aggregation/)允许 Kubernetes apiserver 使用其它 API 进行扩展，这些 API 不是核心 Kubernetes API 的一部分。
+<!--
+Configuring the [aggregation layer](/docs/concepts/api-extension/apiserver-aggregation/) allows the Kubernetes apiserver to be extended with additional APIs, which are not part of the core Kubernetes APIs.
+-->
+
+{{% /capture %}}
+
+{{% capture prerequisites %}}
+
+{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
+
+{{< note >}}
+**注意:** 为了在您的环境中启用聚合层时，如需要支持代理和扩展 apiserver 之间的双向 TLS 身份验证，需要满足一些设置要求。Kubernetes 和 kube-apiserver 都有多个 CA，因此确保代理的证书由聚合层 CA 签署，而不是由其它 CA （如主 CA）来签署。
+{{< /note >}}
+<!--
+{{< note >}}
+**Note:** There are a few setup requirements for getting the aggregation layer working in your environment to support mutual TLS auth between the proxy and extension apiservers. Kubernetes and the kube-apiserver have multiple CAs, so make sure that the proxy is signed by the aggregation layer CA and not by something else, like the master CA.
+{{< /note >}}
+-->
+
+{{% /capture %}}
+
+{{% capture steps %}}
+
+## 启用 apiserver 参数
+
+通过以下 kube-apiserver 参数启用聚合层。这一操作可能已由您的供应商完成。
+
+    --requestheader-client-ca-file=<path to aggregator CA cert>
+    --requestheader-allowed-names=front-proxy-client
+    --requestheader-extra-headers-prefix=X-Remote-Extra-
+    --requestheader-group-headers=X-Remote-Group
+    --requestheader-username-headers=X-Remote-User
+    --proxy-client-cert-file=<path to aggregator proxy cert>
+    --proxy-client-key-file=<path to aggregator proxy key>
+
+**警告**：除非您了解 CA 的风险和保护 CA 使用的机制，否则**不要**在不同的场合重复使用同一 CA。
+
+如果您未在运行 API 服务器的主机上运行 kube-proxy ，则必须确保配置了以下 apiserver 参数：
+
+    --enable-aggregator-routing=true
+<!--
+## Enable apiserver flags
+
+Enable the aggregation layer via the following kube-apiserver flags. They may have already been taken care of by your provider.
+
+    --requestheader-client-ca-file=<path to aggregator CA cert>
+    --requestheader-allowed-names=front-proxy-client
+    --requestheader-extra-headers-prefix=X-Remote-Extra-
+    --requestheader-group-headers=X-Remote-Group
+    --requestheader-username-headers=X-Remote-User
+    --proxy-client-cert-file=<path to aggregator proxy cert>
+    --proxy-client-key-file=<path to aggregator proxy key>
+
+WARNING: do **not** reuse a CA that is used in a different context unless you understand the risks and the mechanisms to protect the CA's usage.
+
+If you are not running kube-proxy on a host running the API server, then you must make sure that the system is enabled with the following apiserver flag:
+
+    --enable-aggregator-routing=true
+-->
+
+{{% /capture %}}
+
+{{% capture whatsnext %}}
+
+* [设置一个扩展的 api-server ](/docs/tasks/access-kubernetes-api/setup-extension-api-server/) 以使用聚合层。
+* 有关高级概述，请参阅[使用聚合层扩展 Kubernetes API ](/docs/concepts/api-extension/apiserver-aggregation/)。
+* 了解如何[使用自定义资源扩展 Kubernetes API ](/docs/tasks/access-kubernetes-api/extend-api-custom-resource-definitions/)。
+
+<!--
+* [Setup an extension api-server](/docs/tasks/access-kubernetes-api/setup-extension-api-server/) to work with the aggregation layer.
+* For a high level overview, see [Extending the Kubernetes API with the aggregation layer](/docs/concepts/api-extension/apiserver-aggregation/).
+* Learn how to [Extend the Kubernetes API Using Custom Resource Definitions](/docs/tasks/access-kubernetes-api/extend-api-custom-resource-definitions/).
+-->
+
+{{% /capture %}}
@@ -1,3 +1,9 @@
+您必须拥有一个 Kubernetes 集群，并且必须使用 kubectl 命令行工具与你的集群进行通信。如果您还没有一个集群，您可以通过 [Minikube](/docs/getting-started-guides/minikube) 创建一个集群，或者使用这些 Kubernetes playground ：
+
+* [Katacoda](https://www.katacoda.com/courses/kubernetes/playground)
+* [Play with Kubernetes](http://labs.play-with-k8s.com/)
+
+<!--
 You need to have a Kubernetes cluster, and the kubectl command-line tool must
 be configured to communicate with your cluster. If you do not already have a
 cluster, you can create one by using
@@ -6,3 +12,4 @@ or you can use one of these Kubernetes playgrounds:

 * [Katacoda](https://www.katacoda.com/courses/kubernetes/playground)
 * [Play with Kubernetes](http://labs.play-with-k8s.com/)
+-->