Skip to content

Commit 0851730

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #40387 from windsonsea/crepro
[zh] sync kubelet-credentialprovider.v1.md
2 parents effd79d + 0468cb7 commit 0851730

File tree

1 file changed

+270
-0
lines changed

1 file changed

+270
-0
lines changed

‎content/zh-cn/docs/reference/config-api/kubelet-credentialprovider.v1.md

Lines changed: 270 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,270 @@
1+
---
2+
title: Kubelet CredentialProvider (v1)
3+
content_type: tool-reference
4+
package: credentialprovider.kubelet.k8s.io/v1
5+
---
6+
<!--
7+
title: Kubelet CredentialProvider (v1)
8+
content_type: tool-reference
9+
package: credentialprovider.kubelet.k8s.io/v1
10+
auto_generated: true
11+
-->
12+
13+
<!--
14+
## Resource Types
15+
-->
16+
## 资源类型 {#resource-types}
17+
18+
- [CredentialProviderRequest](#credentialprovider-kubelet-k8s-io-v1-CredentialProviderRequest)
19+
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1-CredentialProviderResponse)
20+
21+
## `CredentialProviderRequest` {#credentialprovider-kubelet-k8s-io-v1-CredentialProviderRequest}
22+
23+
<!--
24+
CredentialProviderRequest includes the image that the kubelet requires authentication for.
25+
Kubelet will pass this request object to the plugin via stdin. In general, plugins should
26+
prefer responding with the same apiVersion they were sent.
27+
-->
28+
<p>
29+
CredentialProviderRequest 包含 kubelet 需要通过身份验证才能访问的镜像。
30+
kubelet 将此请求对象通过 stdin 传递到插件。
31+
通常，插件应优先使用所收到的 apiVersion 作出响应。
32+
</p>
33+
34+
<table class="table">
35+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
36+
<tbody>
37+
38+
<tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1</code></td></tr>
39+
<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderRequest</code></td></tr>
40+
41+
42+
<tr><td><code>image</code> <B><!--[Required]-->[必需]</B><br/>
43+
<code>string</code>
44+
</td>
45+
<td>
46+
<!--
47+
image is the container image that is being pulled as part of the
48+
credential provider plugin request. Plugins may optionally parse the image
49+
to extract any information required to fetch credentials.
50+
-->
51+
<p>
52+
image 是作为凭据提供程序插件请求的一部分所拉取的容器镜像。
53+
这些插件可以选择解析镜像以提取获取凭据所需的任何信息。
54+
</p>
55+
56+
</td>
57+
</tr>
58+
</tbody>
59+
</table>
60+
61+
## `CredentialProviderResponse` {#credentialprovider-kubelet-k8s-io-v1-CredentialProviderResponse}
62+
63+
<!--
64+
CredentialProviderResponse holds credentials that the kubelet should use for the specified
65+
image provided in the original request. Kubelet will read the response from the plugin via stdout.
66+
This response should be set to the same apiVersion as CredentialProviderRequest.
67+
-->
68+
<p>
69+
CredentialProviderResponse 中包含 kubelet 应针对原始请求中所给镜像来使用的凭据。
70+
kubelet 将通过 stdout 读取来自插件的响应。
71+
此响应应被设置为与 CredentialProviderRequest 相同的 apiVersion。
72+
</p>
73+
74+
<table class="table">
75+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
76+
<tbody>
77+
78+
<tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1</code></td></tr>
79+
<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderResponse</code></td></tr>
80+
81+
82+
<tr><td><code>cacheKeyType</code> <B><!--[Required]-->[必需]</B><br/>
83+
<a href="#credentialprovider-kubelet-k8s-io-v1-PluginCacheKeyType"><code>PluginCacheKeyType</code></a>
84+
</td>
85+
<td>
86+
<!--
87+
cacheKeyType indiciates the type of caching key to use based on the image provided
88+
in the request. There are three valid values for the cache key type: Image, Registry, and
89+
Global. If an invalid value is specified, the response will NOT be used by the kubelet.
90+
-->
91+
<p>
92+
cacheKeyType 标示了基于请求中提供的镜像要使用的缓存键的类型。
93+
缓存键类型有三个有效值：Image、Registry 和 Global。
94+
如果所指定的值无效，则此响应不会被 kubelet 使用。
95+
</p>
96+
</td>
97+
</tr>
98+
<tr><td><code>cacheDuration</code><br/>
99+
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
100+
</td>
101+
<td>
102+
<!--
103+
cacheDuration indicates the duration the provided credentials should be cached for.
104+
The kubelet will use this field to set the in-memory cache duration for credentials
105+
in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in
106+
CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.
107+
-->
108+
<p>
109+
cacheDuration 标示所提供的凭据可被缓存的持续期。
110+
kubelet 将使用此字段为 AuthConfig 中的凭据设置内存中缓存持续期。
111+
如果为空，kubelet 将使用 CredentialProviderConfig 中提供的 defaultCacheDuration。
112+
如果设置为 0，kubelet 将不再缓存提供的 AuthConfig。
113+
</p>
114+
</td>
115+
</tr>
116+
<tr><td><code>auth</code><br/>
117+
<a href="#credentialprovider-kubelet-k8s-io-v1-AuthConfig"><code>map[string]k8s.io/kubelet/pkg/apis/credentialprovider/v1.AuthConfig</code></a>
118+
</td>
119+
<td>
120+
<!--
121+
auth is a map containing authentication information passed into the kubelet.
122+
Each key is a match image string (more on this below). The corresponding authConfig value
123+
should be valid for all images that match against this key. A plugin should set
124+
this field to null if no valid credentials can be returned for the requested image.
125+
-->
126+
<p>
127+
auth 是一个映射，包含传递给 kubelet 的身份验证信息。
128+
映射中每个键都是一个匹配镜像字符串（更多内容见下文）。
129+
相应的 authConfig 值应该对匹配此键的所有镜像有效。
130+
如果无法为请求的镜像返回有效凭据，则插件应将此字段设置为空。
131+
</p>
132+
<!--
133+
Each key in the map is a pattern which can optionally contain a port and a path.
134+
Globs can be used in the domain, but not in the port or the path. Globs are supported
135+
as subdomains like '<em>.k8s.io' or 'k8s.</em>.io', and top-level-domains such as 'k8s.<em>'.
136+
Matching partial subdomains like 'app</em>.k8s.io' is also supported. Each glob can only match
137+
a single subdomain segment, so *.io does not match *.k8s.io.
138+
-->
139+
<p>
140+
映射中的每个主键都可以包含端口和路径。
141+
域名中可以使用 Glob 通配，但不能在端口或路径中使用 Glob。
142+
Glob 支持类似 “\*.k8s.io” 或 “k8s.\*.io” 这类子域以及 “k8s.\*” 这类顶级域。
143+
也支持匹配的部分子域，例如 “app\*.k8s.io”。
144+
每个 Glob 只能匹配一个子域段，因此 *.io 与 *.k8s.io 不匹配。
145+
</p>
146+
<!--
147+
The kubelet will match images against the key when all of the below are true:
148+
-->
149+
<p>
150+
当满足以下所有条件时，kubelet 将根据主键来匹配镜像：
151+
</p>
152+
<ul>
153+
<!--
154+
Both contain the same number of domain parts and each part matches.
155+
-->
156+
<li>两者都包含相同数量的域名部分，并且每个部分都匹配。</li>
157+
<!--
158+
The URL path of an imageMatch must be a prefix of the target image URL path.
159+
-->
160+
<li>imageMatch 的 URL 路径必须是目标镜像 URL 路径的前缀。</li>
161+
<!--
162+
If the imageMatch contains a port, then the port must match in the image as well.
163+
-->
164+
<li>如果 imageMatch 包含端口，则此端口也必须在镜像中匹配。</li>
165+
</ul>
166+
<!--
167+
When multiple keys are returned, the kubelet will traverse all keys in reverse order so that:
168+
-->
169+
<p>
170+
当返回多个主键时，kubelet 将以相反的顺序遍历所有主键，以便：
171+
</p>
172+
<ul>
173+
<!--
174+
longer keys come before shorter keys with the same prefix
175+
-->
176+
<li>较长键出现在具有相同前缀的较短键前面。</li>
177+
<!--
178+
non-wildcard keys come before wildcard keys with the same prefix.
179+
-->
180+
<li>非通配符键出现在具有相同前缀的通配符键之前。</li>
181+
</ul>
182+
<!--
183+
For any given match, the kubelet will attempt an image pull with the provided credentials,
184+
stopping after the first successfully authenticated pull.
185+
-->
186+
<p>对于任一给定的匹配项，kubelet 将尝试用提供的凭据拉取镜像，并在第一次成功通过身份验证的拉取之后停止。</p>
187+
<!--
188+
Example keys:
189+
-->
190+
<p>示例键：</p>
191+
<ul>
192+
<li>123456789.dkr.ecr.us-east-1.amazonaws.com</li>
193+
<li>*.azurecr.io</li>
194+
<li>gcr.io</li>
195+
<li>*.registry.io</li>
196+
<li>registry.io:8080/path</li>
197+
</ul>
198+
</td>
199+
</tr>
200+
</tbody>
201+
</table>
202+
203+
## `AuthConfig` {#credentialprovider-kubelet-k8s-io-v1-AuthConfig}
204+
205+
<!--
206+
**Appears in:**
207+
-->
208+
**出现在：**
209+
210+
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1-CredentialProviderResponse)
211+
212+
<!--
213+
AuthConfig contains authentication information for a container registry.
214+
Only username/password based authentication is supported today, but more authentication
215+
mechanisms may be added in the future.
216+
-->
217+
<p>
218+
AuthConfig 包含针对容器镜像仓库的身份验证信息。
219+
目前仅支持基于用户名/密码的身份验证，但未来可能添加更多的身份验证机制。
220+
</p>
221+
222+
<table class="table">
223+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
224+
<tbody>
225+
226+
<tr><td><code>username</code> <B><!--[Required]-->[必需]</B><br/>
227+
<code>string</code>
228+
</td>
229+
<td>
230+
<!--
231+
username is the username used for authenticating to the container registry
232+
An empty username is valid.
233+
-->
234+
<p>
235+
username 是对容器镜像仓库身份验证所用的用户名。
236+
空白用户名是有效的。
237+
</p>
238+
</td>
239+
</tr>
240+
<tr><td><code>password</code> <B><!--[Required]-->[必需]</B><br/>
241+
<code>string</code>
242+
</td>
243+
<td>
244+
<!--
245+
password is the password used for authenticating to the container registry
246+
An empty password is valid.
247+
-->
248+
<p>
249+
password 是对容器镜像仓库身份验证所用的密码。
250+
空白密码是有效的。
251+
</p>
252+
</td>
253+
</tr>
254+
</tbody>
255+
</table>
256+
257+
## `PluginCacheKeyType` {#credentialprovider-kubelet-k8s-io-v1-PluginCacheKeyType}
258+
259+
<!--
260+
(Alias of `string`)
261+
-->
262+
（`string` 的别名）
263+
264+
<!--
265+
**Appears in:**
266+
-->
267+
**出现在：**
268+
269+
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1-CredentialProviderResponse)
270+

0 commit comments

Comments
 (0)