Skip to content

Commit 5fef464

Browse files
author
nameYULI
authored
[zh]Add content/zh/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md (#33445)
[zh]Add content/zh/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md [zh]Add content/zh/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md [zh]Add content/zh/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md [zh]Add content/zh/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md
1 parent d1e65de commit 5fef464

File tree

1 file changed

+246
-0
lines changed

1 file changed

+246
-0
lines changed

‎content/zh/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md

Lines changed: 246 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
---
2+
title: 使用 SOCKS5 代理访问 Kubernetes API
3+
content_type: task
4+
weight: 42
5+
min-kubernetes-server-version: v1.24
6+
---
7+
<!-- overview -->
8+
9+
{{< feature-state for_k8s_version="v1.24" state="stable" >}}
10+
11+
<!--
12+
This page shows how to use a SOCKS5 proxy to access the API of a remote Kubernetes cluster.
13+
This is useful when the cluster you want to access does not expose its API directly on the public internet.
14+
-->
15+
本文展示了如何使用 SOCKS5 代理访问远程 Kubernetes 集群的 API。
16+
当你要访问的集群不直接在公共 Internet 上公开其 API 时，这很有用。
17+
18+
## {{% heading "prerequisites" %}}
19+
20+
{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
21+
22+
<!--
23+
You need SSH client software (the `ssh` tool), and an SSH service running on the remote server.
24+
You must be able to log in to the SSH service on the remote server.
25+
-->
26+
你需要 SSH 客户端软件（`ssh` 工具），并在远程服务器上运行 SSH 服务。
27+
你必须能够登录到远程服务器上的 SSH 服务。
28+
29+
<!-- steps -->
30+
31+
<!--
32+
## Task context
33+
-->
34+
## 任务上下文
35+
36+
<!--
37+
This example tunnels traffic using SSH, with the SSH client and server acting as a SOCKS proxy.
38+
You can instead use any other kind of [SOCKS5](https://en.wikipedia.org/wiki/SOCKS#SOCKS5) proxies.
39+
-->
40+
{{< note >}}
41+
此示例使用 SSH 隧道传输流量，SSH 客户端和服务器充当 SOCKS 代理。
42+
你可以使用其他任意类型的 [SOCKS5](https://zh.wikipedia.org/wiki/SOCKS#SOCKS5) 代理代替。
43+
{{</ note >}}
44+
45+
<!--
46+
Figure 1 represents what you're going to achieve in this task.
47+
48+
* You have a client computer, referred to as local in the steps ahead, from where you're going to create requests to talk to the Kubernetes API.
49+
* The Kubernetes server/API is hosted on a remote server.
50+
* You will use SSH client and server software to create a secure SOCKS5 tunnel between the local and
51+
the remote server. The HTTPS traffic between the client and the Kubernetes API will flow over the SOCKS5
52+
tunnel, which is itself tunnelled over SSH.
53+
-->
54+
图 1 表示你将在此任务中实现的目标。
55+
56+
* 你有一台在后面的步骤中被称为本地计算机的客户端计算机，你将在这台计算机上创建与 Kubernetes API 对话的请求。
57+
* Kubernetes 服务器/API 托管在远程服务器上。
58+
* 你将使用 SSH 客户端和服务器软件在本地和远程服务器之间创建安全的 SOCKS5 隧道。
59+
客户端和 Kubernetes API 之间的 HTTPS 流量将流经 SOCKS5 隧道，该隧道本身通过 SSH 进行隧道传输。
60+
61+
62+
<!--
63+
graph LR;
64+
65+
subgraph local[Local client machine]
66+
client([client])-- local <br> traffic .-> local_ssh[Local SSH <br> SOCKS5 proxy];
67+
end
68+
local_ssh[SSH <br>SOCKS5 <br> proxy]-- SSH Tunnel --\>sshd
69+
70+
subgraph remote[Remote server]
71+
sshd[SSH <br> server]-- local traffic --\>service1;
72+
end
73+
client([client])-. proxied HTTPs traffic <br> going through the proxy .->service1[Kubernetes API];
74+
75+
classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000;
76+
classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff;
77+
classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5;
78+
class ingress,service1,service2,pod1,pod2,pod3,pod4 k8s;
79+
class client plain;
80+
class cluster cluster;
81+
82+
-->
83+
84+
{{< mermaid >}}
85+
graph LR;
86+
87+
subgraph local[本地客户端机器]
88+
client([客户端])-- 本地 <br> 流量.-> local_ssh[本地 SSH <br> SOCKS5 代理];
89+
end
90+
ocal_ssh[SSH <br>SOCKS5 <br> 代理]-- SSH 隧道 -->sshd
91+
92+
subgraph remote[远程服务器]
93+
sshd[SSH <br> 服务器]-- 本地流量 -->service1;
94+
end
95+
client([客户端])-. 通过代理传递的 <br> HTTPS 流量 .->service1[Kubernetes API];
96+
97+
classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000;
98+
classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff;
99+
classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5;
100+
class ingress,service1,service2,pod1,pod2,pod3,pod4 k8s;
101+
class client plain;
102+
class cluster cluster;
103+
{{</ mermaid >}}
104+
<!--
105+
Figure 1. SOCKS5 tutorial components
106+
-->
107+
图 1. SOCKS5 教程组件
108+
109+
<!--
110+
## Using ssh to create a SOCKS5 proxy
111+
-->
112+
## 使用 ssh 创建 SOCKS5 代理
113+
114+
<!--
115+
This command starts a SOCKS5 proxy between your client machine and the remote server.
116+
The SOCKS5 proxy lets you connect to your cluster's API server.
117+
-->
118+
此命令在你的客户端计算机和远程服务器之间启动一个 SOCKS5 代理。
119+
SOCKS5 代理允许你连接到集群的 API 服务器。
120+
121+
```shell
122+
# 运行此命令后，SSH 隧道继续在前台运行
123+
ssh -D 1080 -q -N [email protected]
124+
```
125+
126+
<!--
127+
* `-D 1080`: opens a SOCKS proxy on local port :1080.
128+
* `-q`: quiet mode. Causes most warning and diagnostic messages to be suppressed.
129+
* `-N`: Do not execute a remote command. Useful for just forwarding ports.
130+
* `[email protected]`: the remote SSH server where the Kubernetes cluster is running.
131+
-->
132+
* `-D 1080`: 在本地端口 1080 上打开一个 SOCKS 代理。
133+
* `-q`: 静音模式。导致大多数警告和诊断消息被抑制。
134+
* `-N`: 不执行远程命令。仅用于转发端口。
135+
* `[email protected]`: 运行 Kubernetes 集群的远程 SSH 服务器。
136+
137+
<!--
138+
## Client configuration
139+
-->
140+
## 客户端配置
141+
142+
<!--
143+
To explore the Kubernetes API you'll first need to instruct your clients to send their queries through
144+
the SOCKS5 proxy we created earlier.
145+
146+
For command-line tools, set the `https_proxy` environment variable and pass it to commands that you run.
147+
-->
148+
要探索 Kubernetes API，你首先需要指示你的客户端通过我们之前创建的 SOCKS5 代理发送他们的查询。
149+
对于命令行工具，设置 `https_proxy` 环境变量并将其传递给你运行的命令。
150+
151+
```shell
152+
export https_proxy=socks5h://localhost:1080
153+
```
154+
155+
<!--
156+
When you set the `https_proxy` variable, tools such as `curl` route HTTPS traffic through the proxy
157+
you configured. For this to work, the tool must support SOCKS5 proxying.
158+
159+
{{< note >}}
160+
In the URL https://localhost/api, `localhost` does not refer to your local client computer.
161+
Instead, it refers to the endpoint on the remote server knows as `localhost`.
162+
The `curl` tool sends the hostname from the HTTPS URL over SOCKS, and the remote server
163+
resolves that locally (to an address that belongs to its loopback interface).
164+
{{</ note >}}
165+
-->
166+
当你设置 `https_proxy` 变量时，`curl` 等工具会通过你配置的代理路由 HTTPS 流量。
167+
为此，该工具必须支持 SOCKS5 代理。
168+
169+
{{< note >}}
170+
在 URL https://localhost/api 中，`localhost` 不是指你的本地客户端计算机。
171+
它指的是远程服务器上称为 “localhost” 的端点。
172+
`curl` 工具通过 SOCKS 从 HTTPS URL 发送主机名，远程服务器在本地解析（到属于其环回接口的地址）。
173+
{{</ note >}}
174+
175+
```shell
176+
curl -k -v https://localhost/api
177+
```
178+
179+
<!--
180+
To use the official Kubernetes client `kubectl` with a proxy, set the `proxy-url` element
181+
for the relevant `cluster` entry within your `~/.kube/config` file. For example:
182+
-->
183+
要将官方 Kubernetes 客户端 `kubectl` 与代理一起使用，请在 `~/.kube/config` 文件中为相关的
184+
`cluster` 条目设置 `proxy-url` 元素。 例如：
185+
186+
```yaml
187+
apiVersion: v1
188+
clusters:
189+
- cluster:
190+
certificate-authority-data: LRMEMMW2 # 为了便于阅读缩短
191+
server: https://localhost # 上图中的“Kubernetes API”
192+
proxy-url: socks5://localhost:1080 # 上图中的“SSH SOCKS5代理”（内置DNS解析）
193+
name: default
194+
contexts:
195+
- context:
196+
cluster: default
197+
user: default
198+
name: default
199+
current-context: default
200+
kind: Config
201+
preferences: {}
202+
users:
203+
- name: default
204+
user:
205+
client-certificate-data: LS0tLS1CR== # 为了便于阅读缩短
206+
client-key-data: LS0tLS1CRUdJT= # 为了便于阅读缩短
207+
```
208+
209+
<!--
210+
If the tunnel is operating and you use `kubectl` with a context that uses this cluster, you can interact with your cluster through that proxy. For example:
211+
-->
212+
如果隧道能够正常工作，并且你调用 `kubectl` 时使用此集群的上下文，
213+
则可以通过该代理与你的集群交互。 例如：
214+
215+
```shell
216+
kubectl get pods
217+
```
218+
219+
```console
220+
NAMESPACE NAME READY STATUS RESTARTS AGE
221+
kube-system coredns-85cb69466-klwq8 1/1 Running 0 5m46s
222+
```
223+
224+
<!--
225+
## Clean up
226+
-->
227+
## 清理
228+
229+
<!--
230+
Stop the ssh port-forwarding process by pressing `CTRL+C` on the terminal where it is running.
231+
232+
Type `unset https_proxy` in a terminal to stop forwarding http traffic through the proxy.
233+
-->
234+
通过在运行它的终端上按“CTRL+C”来停止 ssh 端口转发进程。
235+
236+
在终端中键入 `unset https_proxy` 以停止通过代理转发 http 流量。
237+
238+
<!--
239+
## Further reading
240+
-->
241+
## 进一步阅读
242+
243+
<!--
244+
* [OpenSSH remote login client](https://man.openbsd.org/ssh)
245+
-->
246+
* [OpenSSH远程登录客户端](https://man.openbsd.org/ssh)

0 commit comments

Comments
 (0)