Skip to content

Commit 574d605

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #50926 from my-git9/npa-1809
[zh-cn]sync kubelet-config.v1alpha1.md
2 parents 645e7fd + 9f77ed5 commit 574d605

File tree

1 file changed

+246
-4
lines changed

1 file changed

+246
-4
lines changed

‎content/zh-cn/docs/reference/config-api/kubelet-config.v1alpha1.md‎

Lines changed: 246 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,130 @@ providers is a list of credential provider plugins that will be enabled by the k
4343
Multiple providers may match against a single image, in which case credentials
4444
from all providers will be returned to the kubelet. If multiple providers are called
4545
for a single image, the results are combined. If providers return overlapping
46-
auth keys, the value from the provider earlier in this list is used.
46+
auth keys, the value from the provider earlier in this list is attempted first.
4747
-->
4848
<code>providers</code> 是一组凭据提供者插件，这些插件会被 kubelet 启用。
4949
多个提供者可以匹配到同一镜像上，这时，来自所有提供者的凭据信息都会返回给 kubelet。
5050
如果针对同一镜像调用了多个提供者，则结果会被组合起来。如果提供者返回的认证主键有重复，
51-
列表中先出现的提供者所返回的值将被使用。
51+
列表中先出现的提供者所返回的值将第一个被尝试使用。
52+
</td>
53+
</tr>
54+
</tbody>
55+
</table>
56+
57+
## `ImagePullIntent` {#kubelet-config-k8s-io-v1alpha1-ImagePullIntent}
58+
59+
<p>
60+
<!--
61+
ImagePullIntent is a record of the kubelet attempting to pull an image.
62+
-->
63+
ImagePullIntent 是 kubelet 尝试拉取镜像的记录。
64+
</p>
65+
66+
<table class="table">
67+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
68+
<tbody>
69+
70+
<tr><td><code>apiVersion</code><br/>string</td><td><code>kubelet.config.k8s.io/v1alpha1</code></td></tr>
71+
<tr><td><code>kind</code><br/>string</td><td><code>ImagePullIntent</code></td></tr>
72+
73+
<tr><td><code>image</code> <B><!--[Required]-->[必需]</B><br/>
74+
<code>string</code>
75+
</td>
76+
<td>
77+
<p>
78+
<!--
79+
Image is the image spec from a Container's <code>image</code> field.
80+
The filename is a SHA-256 hash of this value. This is to avoid filename-unsafe
81+
characters like ':' and '/'.
82+
-->
83+
image 是容器 <code>image</code> 字段中的镜像规约。
84+
文件名是此值的 SHA-256 哈希，这样做是为了避免文件名中不安全的字符，如 ':' 和 '/'。
85+
</p>
86+
</td>
87+
</tr>
88+
</tbody>
89+
</table>
90+
91+
## `ImagePulledRecord` {#kubelet-config-k8s-io-v1alpha1-ImagePulledRecord}
92+
93+
<p>
94+
<!--
95+
ImagePullRecord is a record of an image that was pulled by the kubelet.
96+
-->
97+
ImagePullRecord 是 kubelet 拉取的镜像的记录。
98+
</p>
99+
<p>
100+
<!--
101+
If there are no records in the <code>kubernetesSecrets</code> field and both <code>nodeWideCredentials</code>
102+
and <code>anonymous</code> are <code>false</code>, credentials must be re-checked the next time an
103+
image represented by this record is being requested.
104+
-->
105+
如果 <code>kubernetesSecrets</code> 字段中没有记录，且 <code>nodeWideCredentials</code>
106+
和 <code>anonymous</code> 均为 <code>false</code>，则当请求此记录表示的镜像时，必须重新检查凭据。
107+
</p>
108+
109+
<table class="table">
110+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr>
111+
<tbody>
112+
113+
<tr><td><code>apiVersion</code><br/>string</td><td><code>kubelet.config.k8s.io/v1alpha1</code></td></tr>
114+
<tr><td><code>kind</code><br/>string</td><td><code>ImagePulledRecord</code></td></tr>
115+
116+
<tr><td><code>lastUpdatedTime</code> <B><!--[Required]-->[必需]</B><br/>
117+
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#time-v1-meta"><code>meta/v1.Time</code></a>
118+
</td>
119+
<td>
120+
<p>
121+
<!--
122+
LastUpdatedTime is the time of the last update to this record
123+
-->
124+
lastUpdatedTime 是此记录上次更新的时间
125+
</p>
126+
</td>
127+
</tr>
128+
<tr><td><code>imageRef</code> <B><!--[Required]-->[必需]</B><br/>
129+
<code>string</code>
130+
</td>
131+
<td>
132+
<p>
133+
<!--
134+
ImageRef is a reference to the image represented by this file as received
135+
from the CRI.
136+
The filename is a SHA-256 hash of this value. This is to avoid filename-unsafe
137+
characters like ':' and '/'.
138+
-->
139+
imageRef 是从 CRI 接收到的此文件所代表的镜像的引用。
140+
文件名是此值的 SHA-256 哈希。这是为了避免文件名中不安全的字符，如 ':' 和 '/'。
141+
</p>
142+
</td>
143+
</tr>
144+
<tr><td><code>credentialMapping</code> <B><!--[Required]-->[必需]</B><br/>
145+
<a href="#kubelet-config-k8s-io-v1alpha1-ImagePullCredentials"><code>map[string]ImagePullCredentials</code></a>
146+
</td>
147+
<td>
148+
<p>
149+
<!--
150+
CredentialMapping maps <code>image</code> to the set of credentials that it was
151+
previously pulled with.
152+
<code>image</code> in this case is the content of a pod's container <code>image</code> field that's
153+
got its tag/digest removed.
154+
-->
155+
credentialMapping 将 <code>image</code> 映射到之前拉取它时使用的凭据集。
156+
这里的 <code>image</code> 是 Pod 的容器中 <code>image</code> 字段的内容，
157+
已去除其标签/摘要。
158+
</p>
159+
<p>
160+
<!--
161+
Example:
162+
Container requests the <code>hello-world:latest@sha256:91fb4b041da273d5a3273b6d587d62d518300a6ad268b28628f74997b93171b2</code> image:
163+
-->
164+
示例：
165+
容器请求 <code>hello-world:latest@sha256:91fb4b041da273d5a3273b6d587d62d518300a6ad268b28628f74997b93171b2</code> 镜像：
166+
&quot;credentialMapping&quot;: {
167+
&quot;hello-world&quot;: { &quot;nodePodsAccessible&quot;: true }
168+
}
169+
</p>
52170
</td>
53171
</tr>
54172
</tbody>
@@ -62,6 +180,8 @@ auth keys, the value from the provider earlier in this list is used.
62180
**出现在：**
63181

64182
- [CredentialProviderConfig](#kubelet-config-k8s-io-v1alpha1-CredentialProviderConfig)
183+
- [ImagePullIntent](#kubelet-config-k8s-io-v1alpha1-ImagePullIntent)
184+
- [ImagePulledRecord](#kubelet-config-k8s-io-v1alpha1-ImagePulledRecord)
65185

66186
<!--
67187
CredentialProvider represents an exec plugin to be invoked by the kubelet. The plugin is only
@@ -78,13 +198,18 @@ CredentialProvider 代表的是要被 kubelet 调用的一个 exec 插件。
78198
<code>string</code>
79199
</td>
80200
<td>
81-
<!--name is the required name of the credential provider. It must match the name of the
201+
<p>
202+
<!--
203+
name is the required name of the credential provider. It must match the name of the
82204
provider executable as seen by the kubelet. The executable must be in the kubelet's
83-
bin directory (set by the --image-credential-provider-bin-dir flag).</td>
205+
bin directory (set by the --image-credential-provider-bin-dir flag).
206+
Required to be unique across all providers.
84207
-->
85208
<code>name</code> 是凭据提供者的名称（必需）。此名称必须与 kubelet
86209
所看到的提供者可执行文件的名称匹配。可执行文件必须位于 kubelet 的
87210
<code>bin</code> 目录（通过 <code>--image-credential-provider-bin-dir</code> 设置）下。
211+
必须在所有提供商之间保持唯一。
212+
<p>
88213
</td>
89214
</tr>
90215

@@ -229,3 +354,120 @@ ExecEnvVar 用来在执行基于 exec 的凭据插件时设置环境变量。
229354
</tbody>
230355
</table>
231356

357+
## `ImagePullCredentials` {#kubelet-config-k8s-io-v1alpha1-ImagePullCredentials}
358+
359+
<!--
360+
**Appears in:**
361+
-->
362+
**出现在：**
363+
364+
- [ImagePulledRecord](#kubelet-config-k8s-io-v1alpha1-ImagePulledRecord)
365+
366+
367+
<p>
368+
<!--
369+
ImagePullCredentials describe credentials that can be used to pull an image.
370+
-->
371+
ImagePullCredentials 描述了可以用于拉取镜像的凭据。
372+
</p>
373+
374+
375+
<table class="table">
376+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
377+
<tbody>
378+
379+
380+
<tr><td><code>kubernetesSecrets</code><br/>
381+
<a href="#kubelet-config-k8s-io-v1alpha1-ImagePullSecret"><code>[]ImagePullSecret</code></a>
382+
</td>
383+
<td>
384+
<p>
385+
<!--
386+
KuberneteSecretCoordinates is an index of coordinates of all the kubernetes
387+
secrets that were used to pull the image.
388+
-->
389+
kuberneteSecretCoordinates 是用于拉取镜像的所有 Kubernetes
390+
Secret 的坐标索引。
391+
</p>
392+
</td>
393+
</tr>
394+
<tr><td><code>nodePodsAccessible</code><br/>
395+
<code>bool</code>
396+
</td>
397+
<td>
398+
<p>
399+
<!--
400+
NodePodsAccessible is a flag denoting the pull credentials are accessible
401+
by all the pods on the node, or that no credentials are needed for the pull.
402+
-->
403+
nodePodsAccessible 是一个标志，表示节点上的所有 Pod 都可以访问拉取凭据，
404+
或者拉取不需要凭据。
405+
</p>
406+
<p>
407+
<!--
408+
If true, it is mutually exclusive with the <code>kubernetesSecrets</code> field.
409+
-->
410+
如果为 true，则与 <code>kubernetesSecrets</code> 字段互斥。
411+
</p>
412+
</td>
413+
</tr>
414+
</tbody>
415+
</table>
416+
417+
## `ImagePullSecret` {#kubelet-config-k8s-io-v1alpha1-ImagePullSecret}
418+
419+
<!--
420+
**Appears in:**
421+
-->
422+
**出现在：**
423+
424+
- [ImagePullCredentials](#kubelet-config-k8s-io-v1alpha1-ImagePullCredentials)
425+
426+
<p>
427+
<!--
428+
ImagePullSecret is a representation of a Kubernetes secret object coordinates along
429+
with a credential hash of the pull secret credentials this object contains.
430+
-->
431+
ImagePullSecret 是 Kubernetes Secret 对象坐标的表示，
432+
以及此对象包含的拉取 Secret 凭据的哈希值。
433+
</p>
434+
435+
<table class="table">
436+
<thead><tr><th width="30%"><!--Field-->字段</th><th><!--Description-->描述</th></tr></thead>
437+
<tbody>
438+
439+
<tr><td><code>uid</code> <B><!--[Required]-->[必需]</B><br/>
440+
<code>string</code>
441+
</td>
442+
<td>
443+
<span class="text-muted"><!--No description provided.-->没有提供描述。</span></td>
444+
</tr>
445+
<tr><td><code>namespace</code> <B><!--[Required]-->[必需]</B><br/>
446+
<code>string</code>
447+
</td>
448+
<td>
449+
<span class="text-muted"><!--No description provided.-->没有提供描述。</span></td>
450+
</tr>
451+
<tr><td><code>name</code> <B><!--[Required]-->[必需]</B><br/>
452+
<code>string</code>
453+
</td>
454+
<td>
455+
<span class="text-muted"><!--No description provided.-->没有提供描述。</span></td>
456+
</tr>
457+
<tr><td><code>credentialHash</code> <B><!--[Required]-->[必需]</B><br/>
458+
<code>string</code>
459+
</td>
460+
<td>
461+
<p>
462+
<!--
463+
CredentialHash is a SHA-256 retrieved by hashing the image pull credentials
464+
content of the secret specified by the UID/Namespace/Name coordinates.
465+
-->
466+
credentialHash 是通过对镜像拉取凭据的内容进行哈希计算获得的 SHA-256 值，
467+
这些凭据由 UID/命名空间/名称坐标指定的 Secret 提供。
468+
</p>
469+
</td>
470+
</tr>
471+
</tbody>
472+
</table>
473+

0 commit comments

Comments
 (0)