@@ -98,13 +98,13 @@ API 对象不同。
98
98
<!--
99
99
The audit logging feature increases the memory consumption of the API server
100
100
because some context required for auditing is stored for each request.
101
- Additionally, memory consumption depends on the audit logging configuration.
101
+ Memory consumption depends on the audit logging configuration.
102
102
-->
103
103
审计日志记录功能会增加 API server 的内存消耗,因为需要为每个请求存储审计所需的某些上下文。
104
- 此外, 内存消耗取决于审计日志记录的配置。
104
+ 内存消耗取决于审计日志记录的配置。
105
105
106
106
<!--
107
- ## Audit Policy
107
+ ## Audit policy
108
108
109
109
Audit policy defines rules about what events should be recorded and what data
110
110
they should include. The audit policy object structure is defined in the
@@ -169,7 +169,7 @@ rules:
169
169
<!--
170
170
If you're crafting your own audit profile, you can use the audit profile for Google Container-Optimized OS as a starting point. You can check the
171
171
[configure-helper.sh](https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh)
172
- script, which generates the audit policy file. You can see most of the audit policy file by looking directly at the script.
172
+ script, which generates an audit policy file. You can see most of the audit policy file by looking directly at the script.
173
173
174
174
You can also refer to the [` Policy` configuration reference](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Policy)
175
175
for details about the fields defined.
@@ -266,13 +266,14 @@ to the location of the policy file and log file, so that audit records are persi
266
266
卷来访问策略文件和日志文件所在的目录,这样审计记录才会持久保存下来。例如:
267
267
268
268
` ` ` shell
269
- --audit-policy-file=/etc/kubernetes/audit-policy.yaml
270
- --audit-log-path=/var/log/kubernetes/audit/audit.log
269
+ --audit-policy-file=/etc/kubernetes/audit-policy.yaml \
270
+ --audit-log-path=/var/log/kubernetes/audit/audit.log
271
271
` ` `
272
272
273
273
接下来挂载数据卷:
274
274
275
275
` ` ` yaml
276
+ ...
276
277
volumeMounts:
277
278
- mountPath: /etc/kubernetes/audit-policy.yaml
278
279
name: audit
@@ -359,7 +360,7 @@ throttling is enabled in `webhook` and disabled in `log`.
359
360
失败时,整个 API 服务请求会失效。
360
361
361
362
<!--
362
- The following flags are used only in the `batch` mode.
363
+ The following flags are used only in the `batch` mode :
363
364
364
365
- ` --audit-webhook-batch-buffer-size` defines the number of events to buffer before batching.
365
366
If the rate of incoming events overflows the buffer, events are dropped.
@@ -371,7 +372,7 @@ The following flags are used only in the `batch` mode.
371
372
- ` --audit-webhook-batch-throttle-burst` defines the maximum number of batches generated at the same
372
373
moment if the allowed QPS was underutilized previously.
373
374
-->
374
- 以下参数仅用于 `batch` 模式。
375
+ 以下参数仅用于 `batch` 模式:
375
376
376
377
- ` --audit-webhook-batch-buffer-size` 定义 batch 之前要缓存的事件数。
377
378
如果传入事件的速率溢出缓存区,则会丢弃事件。
@@ -444,9 +445,15 @@ By default truncate is disabled in both `webhook` and `log`, a cluster administr
444
445
默认情况下,截断操作在 `webhook` 和 `log` 后端都是被禁用的,集群管理员需要设置
445
446
` audit-log-truncate-enabled` 或 `audit-webhook-truncate-enabled` 标志来启用此操作。
446
447
447
- # # {{% heading "whatsnext " %}}
448
+ # # {{% heading "接下来 " %}}
448
449
449
450
<!--
450
451
* Learn about [Mutating webhook auditing annotations](/docs/reference/access-authn-authz/extensible-admission-controllers/#mutating-webhook-auditing-annotations).
452
+ * Learn more about [`Event`](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Event)
453
+ and the [`Policy`](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Policy)
454
+ resource types by reading the Audit configuration reference.
451
455
-->
452
- * 了解 [Mutating webhook 审计注解](/zh-cn/docs/reference/access-authn-authz/extensible-admission-controllers/#mutating-webhook-auditing-annotations)。
456
+ * 进一步了解 [Mutating webhook 审计注解](/zh-cn/docs/reference/access-authn-authz/extensible-admission-controllers/#mutating-webhook-auditing-annotations)。
457
+ * 通过阅读审计配置参考,进一步了解
458
+ [`Event`](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Event)
459
+ 和 [`Policy`](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Policy) 资源的信息。
0 commit comments