Zach Corleissen
abcee2dccd
* Update localization guidelines for language labels
Continuing work
Continuing work
Continuing work
More work in progress
Add local OWNERS folders
Add an OWNERS file to Chinese
Remove shortcode for repos
Add Japanese
Alphabetize languages, change weights accordingly
More updates
Add Korean in Korean
Add English to languageName
Feedback from gochist
Move Chinese content from cn/ to zh/
Move OWNERS from cn/ to zh/
Resolve merge conflicts by updating from master
Add files back in to prep for resolution
After rebase on upstream/master, remove files
Review and update localization guidelines
Feedback from gochist, tnir, cstoku
Add a trailing newline to content/ja/OWNERS
Add a trailing newline to content/zh/OWNERS
Drop requirement for GH repo project
Clarify language about forks/branches
Edits and typos
Remove a shortcode specific to a multi-repo language setup
Update aliases and owners
Add explicit OWNERS for content/en
Migrate content from Chinese repo, update regex in config.toml
Remove untranslated strings
Add trailing newline to content/en/OWNERS
Add trailing newlines to OWNERS files
add Jaguar project description (#10433)
* add Jaguar project description
[Jaguar](https://gitlab.com/sdnlab/jaguar) is an open source solution for Kubernetes's network based on OpenDaylight.
Jaguar provides overlay network using vxlan and Jaguar CNIPlugin provides one IP address per pod.
* Minor newline tweak
blog post for azure vmss (#10538)
Add microk8s to pick-right-solution.md (#10542)
* Add microk8s to pick-right-solution.md
Microk8s is a single-command installation of upstream Kubernetes on any Linux and should be included in the list of local-machine solutions.
* capitalized Istio
Add microk8s to foundational.md (#10543)
* Add microk8s to foundational.md
Adding microk8s as credible and stable alternative to get started with Kubernetes on a local machine. This is especially attractive for those not wanting to incur the overhead of running a VM for a local cluster.
* Update foundational.md
Thank you for your suggestions! LMK if this works now?
* Rewrote first paragraph
And included a bullet list of features of microk8s
* Copyedit
fix typo (#10545)
Fix the kubectl subcommands links. (#10550)
Signed-off-by: William Zhang <warmchang@outlook.com>
Fix command issue (#10515)
Signed-off-by: mooncake <xcoder@tenxcloud.com>
remove imported community files per issue 10184 (#10501)
networking.md: Markdown fix (#10498)
Fix front matter, federation command-line tools (#10500)
Clean up glossary entry (#10399)
update slack link (#10536)
typo in StatefulSet docs (#10558)
fix discription about horizontal pod autoscale (#10557)
Remove redundant symbols (#10556)
Fix issue #10520 (#10554)
Signed-off-by: William Zhang <warmchang@outlook.com>
Update api-concepts.md (#10534)
Revert "Fix command issue (#10515)"
This reverts commit c02a7fb9f9.
Update memory-constraint-namespace.md (#10530)
update memory request to 100MiB corresponding the yaml content
Blog: Introducing Volume Snapshot Alpha for Kubernetes (#10562)
* blog post for azure vmss
* snapshot blog post
Resolve merge conflicts in OWNERS*
Minor typo fix (#10567)
Not sure what's supposed to be here, proposing removing it.
* Feedback from gochist
Tweaks to feedback
* Feedback from ClaudiaJKang
69 lines
2.3 KiB
Markdown
69 lines
2.3 KiB
Markdown
---
|
|
title: 安全考虑
|
|
content_template: templates/task
|
|
---
|
|
<!--
|
|
---
|
|
title: Security Considerations
|
|
content_template: templates/task
|
|
---
|
|
-->
|
|
|
|
{{% capture overview %}}
|
|
<!--
|
|
By default all connections between every provided node are secured via TLS by easyrsa, including the etcd cluster.
|
|
|
|
This page explains the security considerations of a deployed cluster and production recommendations.
|
|
-->
|
|
默认情况下，所有提供的节点之间的所有连接（包括 etcd 集群）都通过 easyrsa 的 TLS 进行保护。
|
|
|
|
本文介绍已部署集群的安全注意事项和生产环境建议。
|
|
{{% /capture %}}
|
|
{{% capture prerequisites %}}
|
|
<!--
|
|
This page assumes you have a working Juju deployed cluster.
|
|
-->
|
|
本文假定您拥有一个使用 Juju 部署的正在运行的集群。
|
|
{{% /capture %}}
|
|
|
|
|
|
{{% capture steps %}}
|
|
<!--
|
|
## Implementation
|
|
|
|
The TLS and easyrsa implementations use the following [layers](https://jujucharms.com/docs/2.2/developer-layers).
|
|
|
|
[layer-tls-client](https://github.com/juju-solutions/layer-tls-client)
|
|
[layer-easyrsa](https://github.com/juju-solutions/layer-easyrsa)
|
|
-->
|
|
## 实现
|
|
|
|
TLS 和 easyrsa 的实现使用以下 [layers](https://jujucharms.com/docs/2.2/developer-layers)。
|
|
|
|
[layer-tls-client](https://github.com/juju-solutions/layer-tls-client)
|
|
[layer-easyrsa](https://github.com/juju-solutions/layer-easyrsa)
|
|
|
|
<!--
|
|
## Limiting ssh access
|
|
|
|
By default the administrator can ssh to any deployed node in a cluster. You can mass disable ssh access to the cluster nodes by issuing the following command.
|
|
|
|
juju model-config proxy-ssh=true
|
|
|
|
Note: The Juju controller node will still have open ssh access in your cloud, and will be used as a jump host in this case.
|
|
|
|
Refer to the [model management](https://jujucharms.com/docs/2.2/models) page in the Juju documentation for instructions on how to manage ssh keys.
|
|
-->
|
|
## 限制 ssh 访问
|
|
|
|
默认情况下，管理员可以 ssh 到集群中的任意已部署节点。您可以通过以下命令来批量禁用集群节点的 ssh 访问权限。
|
|
|
|
juju model-config proxy-ssh=true
|
|
|
|
注意：Juju 控制器节点在您的云中仍然有开放的 ssh 访问权限，并且在这种情况下将被用作跳板机。
|
|
|
|
有关如何管理 ssh 密钥的说明，请参阅 Juju 文档中的 [模型管理](https://jujucharms.com/docs/2.2/models) 页面。
|
|
{{% /capture %}}
|
|
|
|
|