Skip to content

Commit 1b605ea

Browse files
tengqmtengqm
committed
[zh] Translate client-authentication API reference
1 parent 1154e19 commit 1b605ea

File tree

1 file changed

+280
-0
lines changed

1 file changed

+280
-0
lines changed

‎content/zh/docs/reference/config-api/client-authentication.v1.md

Lines changed: 280 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,280 @@
1+
---
2+
title: 客户端身份认证（Client Authentication） (v1)
3+
content_type: tool-reference
4+
package: client.authentication.k8s.io/v1
5+
auto_generated: true
6+
---
7+
8+
<!--
9+
title: Client Authentication (v1)
10+
content_type: tool-reference
11+
package: client.authentication.k8s.io/v1
12+
auto_generated: true
13+
-->
14+
15+
<!--
16+
## Resource Types
17+
-->
18+
## 资源类型 {#resource-types}
19+
20+
- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential)
21+
22+
## `ExecCredential` {#client-authentication-k8s-io-v1-ExecCredential}
23+
24+
<!--
25+
ExecCredential is used by exec-based plugins to communicate credentials to
26+
HTTP transports.
27+
-->
28+
ExecCredential 由基于 exec 的插件使用，与 HTTP 传输组件沟通凭据信息。
29+
30+
<table class="table">
31+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
32+
<tbody>
33+
34+
<tr><td><code>apiVersion</code><br/>string</td><td><code>client.authentication.k8s.io/v1</code></td></tr>
35+
<tr><td><code>kind</code><br/>string</td><td><code>ExecCredential</code></td></tr>
36+
37+
<tr><td><code>spec</code> <B><!--[Required]-->[必需]</B><br/>
38+
<a href="#client-authentication-k8s-io-v1-ExecCredentialSpec"><code>ExecCredentialSpec</code></a>
39+
</td>
40+
<td>
41+
<!--Spec holds information passed to the plugin by the transport.-->
42+
字段 spec 包含由 HTTP 传输组件传递给插件的信息。
43+
</td>
44+
</tr>
45+
46+
<tr><td><code>status</code><br/>
47+
<a href="#client-authentication-k8s-io-v1-ExecCredentialStatus"><code>ExecCredentialStatus</code></a>
48+
</td>
49+
<td>
50+
<!--Status is filled in by the plugin and holds the credentials that the transport
51+
should use to contact the API.-->
52+
字段 status 由插件填充，包含传输组件与 API 服务器连接时需要提供的凭据。
53+
</td>
54+
</tr>
55+
</tbody>
56+
</table>
57+
58+
## `Cluster` {#client-authentication-k8s-io-v1-Cluster}
59+
60+
<!--
61+
**Appears in:**
62+
-->
63+
**出现在：**
64+
65+
- [ExecCredentialSpec](#client-authentication-k8s-io-v1-ExecCredentialSpec)
66+
67+
<!--
68+
Cluster contains information to allow an exec plugin to communicate
69+
with the kubernetes cluster being authenticated to.
70+
71+
To ensure that this struct contains everything someone would need to communicate
72+
with a kubernetes cluster (just like they would via a kubeconfig), the fields
73+
should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception
74+
of CertificateAuthority, since CA data will always be passed to the plugin as bytes.
75+
-->
76+
Cluster 中包含允许 exec 插件与 Kubernetes 集群进行通信身份认证时所需
77+
的信息。
78+
79+
<table class="table">
80+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
81+
<tbody>
82+
83+
<tr><td><code>server</code> <B><!--[Required]-->[必需]</B><br/>
84+
<code>string</code>
85+
</td>
86+
<td>
87+
<!--Server is the address of the kubernetes cluster (https://hostname:port).-->
88+
字段 server 是 Kubernetes 集群的地址（https://hostname:port）。
89+
</td>
90+
</tr>
91+
92+
<tr><td><code>tls-server-name</code><br/>
93+
<code>string</code>
94+
</td>
95+
<td>
96+
<!--TLSServerName is passed to the server for SNI and is used in the client to
97+
check server certificates against. If ServerName is empty, the hostname
98+
used to contact the server is used.-->
99+
tls-server-name 是用来提供给服务器用作 SNI 解析的，客户端以此检查服务器的证书。
100+
如此字段为空，则使用链接服务器时使用的主机名。
101+
</td>
102+
</tr>
103+
104+
<tr><td><code>insecure-skip-tls-verify</code><br/>
105+
<code>bool</code>
106+
</td>
107+
<td>
108+
<!--InsecureSkipTLSVerify skips the validity check for the server's certificate.
109+
This will make your HTTPS connections insecure.-->
110+
设置此字段之后，会令客户端跳过对服务器端证书的合法性检查。
111+
这会使得你的 HTTPS 链接不再安全。
112+
</td>
113+
</tr>
114+
115+
<tr><td><code>certificate-authority-data</code><br/>
116+
<code>[]byte</code>
117+
</td>
118+
<td>
119+
<!--CAData contains PEM-encoded certificate authority certificates.
120+
If empty, system roots should be used.-->
121+
此字段包含 PEM 编码的证书机构（CA）证书。
122+
如果为空，则使用系统的根证书。
123+
</td>
124+
</tr>
125+
126+
<tr><td><code>proxy-url</code><br/>
127+
<code>string</code>
128+
</td>
129+
<td>
130+
<!--ProxyURL is the URL to the proxy to be used for all requests to this
131+
cluster.-->
132+
此字段用来设置向集群发送所有请求时要使用的代理服务器。
133+
</td>
134+
</tr>
135+
136+
<tr><td><code>config</code><br/>
137+
<a href="https://godoc.org/k8s.io/apimachinery/pkg/runtime/#RawExtension"><code>k8s.io/apimachinery/pkg/runtime.RawExtension</code></a>
138+
</td>
139+
<td>
140+
<!--Config holds additional config data that is specific to the exec
141+
plugin with regards to the cluster being authenticated to.
142+
143+
This data is sourced from the clientcmd Cluster object's
144+
extensions[client.authentication.k8s.io/exec] field:
145+
-->
146+
<p>此字段包含一些额外的、特定于 exec 插件和所连接的集群的数据，</p>
147+
<p>此字段来自于 clientcmd 集群对象的 <code>extensions[client.authentication.k8s.io/exec]</code>
148+
字段：</p>
149+
<pre>
150+
clusters:
151+
- name: my-cluster
152+
cluster:
153+
...
154+
extensions:
155+
- name: client.authentication.k8s.io/exec # 针对每个集群 exec 配置所预留的扩展名称
156+
extension:
157+
audience: 06e3fbd18de8 # 任意配置信息
158+
</pre>
159+
160+
<!--In some environments, the user config may be exactly the same across many clusters
161+
(i.e. call this exec plugin) minus some details that are specific to each cluster
162+
such as the audience. This field allows the per cluster config to be directly
163+
specified with the cluster info. Using this field to store secret data is not
164+
recommended as one of the prime benefits of exec plugins is that no secrets need
165+
to be stored directly in the kubeconfig.-->
166+
<p>在某些环境中，用户配置可能对很多集群而言都完全一样（即调用同一个 exec 插件），
167+
只是针对不同集群会有一些细节上的差异，例如 audience。
168+
此字段使得特定于集群的配置可以直接使用集群信息来设置。
169+
不建议使用此字段来保存 Secret 数据，因为 exec 插件的主要优势之一是不需要在
170+
kubeconfig 中保存 Secret 数据。
171+
</td>
172+
</tr>
173+
</tbody>
174+
</table>
175+
176+
## `ExecCredentialSpec` {#client-authentication-k8s-io-v1-ExecCredentialSpec}
177+
178+
<!--
179+
**Appears in:**
180+
-->
181+
**出现在：**
182+
183+
- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential)
184+
185+
<!--
186+
ExecCredentialSpec holds request and runtime specific information provided by
187+
the transport.
188+
-->
189+
ExecCredentialSpec 保存传输组件所提供的特定于请求和运行时的信息。
190+
191+
<table class="table">
192+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
193+
<tbody>
194+
195+
<tr><td><code>cluster</code><br/>
196+
<a href="#client-authentication-k8s-io-v1-Cluster"><code>Cluster</code></a>
197+
</td>
198+
<td>
199+
<!--Cluster contains information to allow an exec plugin to communicate with the
200+
kubernetes cluster being authenticated to. Note that Cluster is non-nil only
201+
when provideClusterInfo is set to true in the exec provider config (i.e.,
202+
ExecConfig.ProvideClusterInfo).-->
203+
此字段中包含的信息使得 exec 插件能够与要访问的 Kubernetes 集群通信。
204+
注意，cluster 字段只有在 exec 驱动的配置中 provideClusterInfo
205+
（即：ExecConfig.ProvideClusterInfo）被设置为 true 时才不能为空。
206+
</td>
207+
</tr>
208+
209+
<tr><td><code>interactive</code> <B><!--[Required]-->[必需]</B><br/>
210+
<code>bool</code>
211+
</td>
212+
<td>
213+
<!--Interactive declares whether stdin has been passed to this exec plugin.-->
214+
此字段用来标明标准输出信息是否已传递给 exec 插件。
215+
</td>
216+
</tr>
217+
</tbody>
218+
</table>
219+
220+
## `ExecCredentialStatus` {#client-authentication-k8s-io-v1-ExecCredentialStatus}
221+
222+
<!--
223+
**Appears in:**
224+
-->
225+
226+
- [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential)
227+
228+
<!--
229+
ExecCredentialStatus holds credentials for the transport to use.
230+
231+
Token and ClientKeyData are sensitive fields. This data should only be
232+
transmitted in-memory between client and exec plugin process. Exec plugin
233+
itself should at least be protected via file permissions.
234+
-->
235+
<p>ExecCredentialStatus 中包含传输组件要使用的凭据。</p>
236+
<p>字段 token 和 clientKeyData 都是敏感字段。此数据只能在
237+
客户端与 exec 插件进程之间使用内存来传递。exec 插件本身至少
238+
应通过文件访问许可来实施保护。</p>》
239+
240+
<table class="table">
241+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
242+
<tbody>
243+
<tr><td><code>expirationTimestamp</code><br/>
244+
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#time-v1-meta"><code>meta/v1.Time</code></a>
245+
</td>
246+
<td>
247+
<!--ExpirationTimestamp indicates a time when the provided credentials expire.-->
248+
给出所提供的凭据到期的时间。
249+
</td>
250+
</tr>
251+
252+
<tr><td><code>token</code> <B><!--[Required]-->[必需]</B><br/>
253+
<code>string</code>
254+
</td>
255+
<td>
256+
<!--Token is a bearer token used by the client for request authentication.-->
257+
客户端用做请求身份认证的持有者令牌。
258+
</td>
259+
</tr>
260+
261+
<tr><td><code>clientCertificateData</code> <B><!--[Required]-->[必需]</B><br/>
262+
<code>string</code>
263+
</td>
264+
<td>
265+
<!--PEM-encoded client TLS certificates (including intermediates, if any).-->
266+
PEM 编码的客户端 TLS 证书（如果有临时证书，也会包含）。
267+
</td>
268+
</tr>
269+
270+
<tr><td><code>clientKeyData</code> <B><!--[Required]-->[必需]</B><br/>
271+
<code>string</code>
272+
</td>
273+
<td>
274+
<!--PEM-encoded private key for the above certificate.-->
275+
与上述证书对应的、PEM 编码的私钥。
276+
</td>
277+
</tr>
278+
</tbody>
279+
</table>
280+

0 commit comments

Comments
 (0)