Skip to content

Commit 326622b

Browse files
my-git9my-git9
committed
[zh-cn] sync best-practices/certificates.md
Signed-off-by: xin.li <[email protected]>
1 parent 0e5ef2d commit 326622b

File tree

1 file changed

+80
-30
lines changed

1 file changed

+80
-30
lines changed

‎content/zh-cn/docs/setup/best-practices/certificates.md

Lines changed: 80 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,9 @@ This page explains the certificates that your cluster requires.
2323
-->
2424
Kubernetes 需要 PKI 证书才能进行基于 TLS 的身份验证。如果你是使用
2525
[kubeadm](/zh-cn/docs/reference/setup-tools/kubeadm/) 安装的 Kubernetes，
26-
则会自动生成集群所需的证书。你还可以生成自己的证书。
27-
例如，不将私钥存储在 API 服务器上，可以让私钥更加安全。此页面说明了集群必需的证书。
26+
则会自动生成集群所需的证书。
27+
你也可以自己生成证书 --- 例如，不将私钥存储在 API 服务器上，
28+
可以让私钥更加安全。此页面说明了集群必需的证书。
2829

2930
<!-- body -->
3031

@@ -38,28 +39,76 @@ Kubernetes requires PKI for the following operations:
3839
Kubernetes 需要 PKI 才能执行以下操作：
3940

4041
<!--
41-
* Client certificates for the kubelet to authenticate to the API server
42-
* Kubelet [server certificates](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/#client-and-serving-certificates)
43-
for the API server to talk to the kubelets
42+
### Server certificates
43+
4444
* Server certificate for the API server endpoint
45-
* Client certificates for administrators of the cluster to authenticate to the API server
46-
* Client certificates for the API server to talk to the kubelets
47-
* Client certificate for the API server to talk to etcd
48-
* Client certificate/kubeconfig for the controller manager to talk to the API server
49-
* Client certificate/kubeconfig for the scheduler to talk to the API server.
50-
* Client and server certificates for the [front-proxy](/docs/tasks/extend-kubernetes/configure-aggregation-layer/)
51-
-->
52-
* Kubelet 的客户端证书，用于 API 服务器身份验证
53-
* Kubelet [服务端证书](/zh-cn/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/#client-and-serving-certificates)，
54-
用于 API 服务器与 Kubelet 的会话
45+
* Server certificate for the etcd server
46+
* [Server certificates](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/#client-and-serving-certificates)
47+
for each kubelet (every {{< glossary_tooltip text="node" term_id="node" >}} runs a kubelet)
48+
* Optional server certificate for the [front-proxy](/docs/tasks/extend-kubernetes/configure-aggregation-layer/)
49+
-->
50+
### 服务器证书
51+
5552
* API 服务器端点的证书
56-
* 集群管理员的客户端证书，用于 API 服务器身份认证
57-
* API 服务器的客户端证书，用于和 Kubelet 的会话
58-
* API 服务器的客户端证书，用于和 etcd 的会话
59-
* 控制器管理器的客户端证书或 kubeconfig，用于和 API 服务器的会话
60-
* 调度器的客户端证书或 kubeconfig，用于和 API 服务器的会话
53+
* etcd 服务器的服务器证书
54+
* 每个 kubelet 的服务器证书（每个 {{< glossary_tooltip text="节点" term_id="node" >}}运行一个 kubelet）
55+
* 可选的[前端代理](/zh-cn/docs/tasks/extend-kubernetes/configure-aggregation-layer/)的服务器证书
56+
57+
<!--
58+
### Client certificates
59+
-->
60+
### 客户端证书
61+
62+
<!--
63+
* Client certificates for each kubelet, used to authenticate to the API server as a client of
64+
the Kubernetes API
65+
* Client certificate for each API server, used to authenticate to etcd
66+
* Client certificate for the controller manager to securely communicate with the API server
67+
* Client certificate for the scheduler to securely communicate with the API server
68+
* Client certificates, one for each node, for kube-proxy to authenticate to the API server
69+
* Optional client certificates for administrators of the cluster to authenticate to the API server
70+
* Optional client certificate for the [front-proxy](/docs/tasks/extend-kubernetes/configure-aggregation-layer/)
71+
-->
72+
* 针对每个 kubelet 的客户端证书，用于 API 服务器作为 Kubernetes API 的客户端进行身份验证
73+
* 每个 API 服务器的客户端证书，用于向 etcd 进行身份验证
74+
* 控制器管理器与 API 服务器进行安全通信的客户端证书
75+
* 调度程序与 API 服务器进行安全通信的客户端证书
76+
* 客户端证书（每个节点一个），用于 kube-proxy 向 API 服务器进行身份验证
77+
* 集群管理员向 API 服务器进行身份验证的可选客户端证书
6178
* [前端代理](/zh-cn/docs/tasks/extend-kubernetes/configure-aggregation-layer/)的客户端及服务端证书
6279

80+
<!--
81+
### Kubelet's server and client certificates
82+
83+
To establish a secure connection and authenticate itself to the kubelet, the API Server
84+
requires a client certificate and key pair.
85+
-->
86+
### kubelet 的服务器和客户端证书
87+
88+
为了建立安全连接并向 kubelet 进行身份验证，API 服务器需要客户端证书和密钥对。
89+
90+
<!--
91+
In this scenario, there are two approaches for certificate usage:
92+
using shared certificates or separate certificates;
93+
94+
* Shared Certificates: The kube-apiserver can utilize the same certificate and key pair it uses to authenticate its clients.
95+
This means that the existing certificates, such as `apiserver.crt` and `apiserver.key`,
96+
can be used for communicating with the kubelet servers.
97+
98+
* Separate Certificates: Alternatively, the kube-apiserver can generate a new client certificate
99+
and key pair to authenticate its communication with the kubelet servers.
100+
In this case, a distinct certificate named `kubelet-client.crt` and its corresponding private key,
101+
`kubelet-client.key` are created.
102+
-->
103+
在此场景中，证书的使用有两种方法：
104+
使用共享证书或单独证书；
105+
106+
* 共享证书：kube-apiserver 可以使用与验证其客户端相同的证书和密钥对。
107+
这意味着现有证书（例如 `apiserver.crt` 和 `apiserver.key`）可用于与 kubelet 服务器进行通信。
108+
109+
* 单独的证书：或者，kube-apiserver 可以生成新的客户端证书和密钥对，以验证其与 kubelet 服务器的通信。
110+
在这种情况下，将创建一个名为 `kubelet-client.crt` 的不同证书及其对应的私钥 `kubelet-client.key`。
111+
63112
{{< note >}}
64113
<!--
65114
`front-proxy` certificates are required only if you run kube-proxy to support
@@ -129,9 +178,9 @@ management, `sa.key` and `sa.pub`.
129178

130179
| 路径 | 默认 CN | 描述 |
131180
|------------------------|---------------------------|----------------------------------|
132-
| ca.crt,key | kubernetes-ca | Kubernetes 通用 CA |
133-
| etcd/ca.crt,key | etcd-ca | 与 etcd 相关的所有功能 |
134-
| front-proxy-ca.crt,key | kubernetes-front-proxy-ca | 用于[前端代理](/zh-cn/docs/tasks/extend-kubernetes/configure-aggregation-layer/) |
181+
| ca.crt、key | kubernetes-ca | Kubernetes 通用 CA |
182+
| etcd/ca.crt、key | etcd-ca | 与 etcd 相关的所有功能 |
183+
| front-proxy-ca.crt、key | kubernetes-front-proxy-ca | 用于[前端代理](/zh-cn/docs/tasks/extend-kubernetes/configure-aggregation-layer/) |
135184

136185
上面的 CA 之外，还需要获取用于服务账号管理的密钥对，也就是 `sa.key` 和 `sa.pub`。
137186

@@ -173,13 +222,13 @@ Required certificates:
173222
| kube-apiserver-kubelet-client | kubernetes-ca | system:masters | client | |
174223
| front-proxy-client | kubernetes-front-proxy-ca | | client | |
175224
-->
176-
| 默认 CN | 父级 CA |O（位于 Subject 中）| kind | 主机 (SAN) |
225+
| 默认 CN | 父级 CA |O（位于 Subject 中）| kind | 主机（SAN） |
177226
|-------------------------------|---------------------------|-------------------|------------------|-----------------------------------------------------|
178-
| kube-etcd | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
179-
| kube-etcd-peer | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
227+
| kube-etcd | etcd-ca | | server、client | `<hostname>`、`<Host_IP>`、`localhost`、`127.0.0.1` |
228+
| kube-etcd-peer | etcd-ca | | server、client | `<hostname>`、`<Host_IP>`、`localhost`、`127.0.0.1` |
180229
| kube-etcd-healthcheck-client | etcd-ca | | client | |
181230
| kube-apiserver-etcd-client | etcd-ca | | client | |
182-
| kube-apiserver | kubernetes-ca | | server | `<hostname>`, `<Host_IP>`, `<advertise_IP>`, `[1]` |
231+
| kube-apiserver | kubernetes-ca | | server | `<hostname>`、`<Host_IP>`、`<advertise_IP>`、`[1]` |
183232
| kube-apiserver-kubelet-client | kubernetes-ca | system:masters | client | |
184233
| front-proxy-client | kubernetes-front-proxy-ca | | client | |
185234

@@ -375,7 +424,7 @@ The value of `<nodeName>` for `kubelet.conf` **must** match precisely the value
375424
provided by the kubelet as it registers with the apiserver. For further details, read the
376425
[Node Authorization](/docs/reference/access-authn-authz/node/).
377426
-->
378-
`kubelet.conf` 中 `<nodeName>` 的值 **必须** 与 kubelet 向 apiserver 注册时提供的节点名称的值完全匹配。
427+
`kubelet.conf` 中 `<nodeName>` 的值**必须**与 kubelet 向 apiserver 注册时提供的节点名称的值完全匹配。
379428
有关更多详细信息，请阅读[节点授权](/zh-cn/docs/reference/access-authn-authz/node/)。
380429
{{< /note >}}
381430

@@ -399,7 +448,8 @@ One is in `admin.conf` and has `Subject: O = kubeadm:cluster-admins, CN = kubern
399448
This file is generated on all kubeadm managed control plane machines.
400449
-->
401450
kubeadm 在 kubeconfig 文件中生成两个单独的管理员证书。
402-
一个是在 `admin.conf` 中，带有 `Subject: O = kubeadm:cluster-admins, CN = kubernetes-admin`。`kubeadm:cluster-admins` 是绑定到 `cluster-admin` ClusterRole 的自定义组。
451+
一个是在 `admin.conf` 中，带有 `Subject: O = kubeadm:cluster-admins, CN = kubernetes-admin`。
452+
`kubeadm:cluster-admins` 是绑定到 `cluster-admin` ClusterRole 的自定义组。
403453
这个文件在所有由 kubeadm 管理的控制平面机器上生成。
404454

405455
<!--
@@ -419,7 +469,7 @@ This file is generated only on the node where `kubeadm init` was called.
419469

420470
1. 为每个配置运行下面的 `kubectl` 命令：
421471

422-
```
472+
```bash
423473
KUBECONFIG=<filename> kubectl config set-cluster default-cluster --server=https://<host ip>:6443 --certificate-authority <path-to-kubernetes-ca> --embed-certs
424474
KUBECONFIG=<filename> kubectl config set-credentials <credential-name> --client-key <path-to-key>.pem --client-certificate <path-to-cert>.pem --embed-certs
425475
KUBECONFIG=<filename> kubectl config set-context default-system --cluster default-cluster --user <credential-name>

0 commit comments

Comments
 (0)