Skip to content

Commit 635fe65

Browse files
committed
[zh] Remove reviewer for auth and kubectl
1 parent 6a89b98 commit 635fe65

File tree

3 files changed

+47
-50
lines changed

3 files changed

+47
-50
lines changed

content/zh/docs/reference/access-authn-authz/webhook.md

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,9 @@
11
---
2-
reviewers:
3-
- erictune
4-
- lavalamp
5-
- deads2k
6-
- liggitt
72
title: Webhook 模式
83
content_type: concept
94
weight: 95
105
---
116
<!--
12-
---
137
reviewers:
148
- erictune
159
- lavalamp
@@ -18,7 +12,6 @@ reviewers:
1812
title: Webhook Mode
1913
content_type: concept
2014
weight: 95
21-
---
2215
-->
2316

2417
<!-- overview -->
@@ -38,7 +31,7 @@ service when determining user privileges.
3831
<!--
3932
## Configuration File Format
4033
-->
41-
## 配置文件格式
34+
## 配置文件格式 {#configuration-file-format}
4235

4336
<!--
4437
Mode `Webhook` requires a file for HTTP configuration, specify by the
@@ -51,7 +44,8 @@ The configuration file uses the [kubeconfig](/docs/tasks/access-application-clus
5144
file format. Within the file "users" refers to the API Server webhook and
5245
"clusters" refers to the remote service.
5346
-->
54-
配置文件的格式使用 [kubeconfig](/zh/docs/tasks/access-application-cluster/configure-access-multiple-clusters/)。在文件中,"users" 代表着 API 服务器的 webhook,而 "cluster" 代表着远程服务。
47+
配置文件的格式使用 [kubeconfig](/zh/docs/tasks/access-application-cluster/configure-access-multiple-clusters/)
48+
在该文件中,“users” 代表着 API 服务器的 webhook,而 “cluster” 代表着远程服务。
5549

5650
<!--
5751
A configuration example which uses HTTPS client auth:
@@ -122,7 +116,7 @@ contexts:
122116
<!--
123117
## Request Payloads
124118
-->
125-
## 请求载荷
119+
## 请求载荷 {#request-payloads}
126120
127121
<!--
128122
When faced with an authorization decision, the API Server POSTs a JSON-
@@ -131,7 +125,8 @@ action. This object contains fields describing the user attempting to make the
131125
request, and either details about the resource being accessed or requests
132126
attributes.
133127
-->
134-
在做认证决策时,API 服务器会 POST 一个 JSON 序列化的 `authorization.k8s.io/v1beta1` `SubjectAccessReview` 对象来描述这个动作。这个对象包含了描述用户请求的字段,同时也包含了需要被访问资源或请求特征的具体信息。
128+
在做认证决策时,API 服务器会 POST 一个 JSON 序列化的 `authorization.k8s.io/v1beta1` `SubjectAccessReview`
129+
对象来描述这个动作。这个对象包含了描述用户请求的字段,同时也包含了需要被访问资源或请求特征的具体信息。
135130

136131
<!--
137132
Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/concepts/overview/kubernetes-api/)
@@ -140,7 +135,9 @@ compatibility promises for beta objects and check the "apiVersion" field of the
140135
request to ensure correct deserialization. Additionally, the API Server must
141136
enable the `authorization.k8s.io/v1beta1` API extensions group (`--runtime-config=authorization.k8s.io/v1beta1=true`).
142137
-->
143-
需要注意的是 webhook API 对象与其他 Kubernetes API 对象一样都同样都服从[版本兼容规则](/zh/docs/concepts/overview/kubernetes-api/)。实施人员应该了解 beta 对象的更宽松的兼容性承诺,同时确认请求的 "apiVersion" 字段能被正确地反序列化。此外,API 服务器还必须启用 `authorization.k8s.io/v1beta1` API 扩展组 (`--runtime-config=authorization.k8s.io/v1beta1=true`)。
138+
需要注意的是 webhook API 对象与其他 Kubernetes API 对象一样都同样都遵从[版本兼容规则](/zh/docs/concepts/overview/kubernetes-api/)。
139+
实施人员应该了解 beta 对象的更宽松的兼容性承诺,同时确认请求的 "apiVersion" 字段能被正确地反序列化。
140+
此外,API 服务器还必须启用 `authorization.k8s.io/v1beta1` API 扩展组 (`--runtime-config=authorization.k8s.io/v1beta1=true`)。
144141

145142
<!--
146143
An example request body:
@@ -173,6 +170,7 @@ the request and respond to either allow or disallow access. The response body's
173170
`spec` field is ignored and may be omitted. A permissive response would return:
174171
-->
175172
期待远程服务填充请求的 `status` 字段并响应允许或禁止访问。响应主体的 `spec` 字段被忽略,可以省略。允许的响应将返回:
173+
176174
```json
177175
{
178176
"apiVersion": "authorization.k8s.io/v1beta1",
@@ -195,7 +193,8 @@ authorizers are configured, they are given a chance to allow the request.
195193
If there are no other authorizers, or none of them allow the request, the
196194
request is forbidden. The webhook would return:
197195
-->
198-
在大多数情况下,第一种方法是首选方法,它指示授权 webhook 不允许或对请求"无意见",但是,如果配置了其他授权者,则可以给他们机会允许请求。如果没有其他授权者,或者没有一个授权者,则该请求被禁止。webhook 将返回:
196+
在大多数情况下,第一种方法是首选方法,它指示授权 webhook 不允许或对请求 “无意见”。
197+
但是,如果配置了其他授权者,则可以给他们机会允许请求。如果没有其他授权者,或者没有一个授权者,则该请求被禁止。webhook 将返回:
199198

200199
```json
201200
{
@@ -214,7 +213,7 @@ configured authorizers. This should only be used by webhooks that have
214213
detailed knowledge of the full authorizer configuration of the cluster.
215214
The webhook would return:
216215
-->
217-
第二种方法立即拒绝其他配置的授权者进行短路评估。仅应由对集群的完整授权者配置有详细了解的 webhook 使用。webhook 将返回:
216+
第二种方法立即拒绝其他配置的授权者进行短路评估。仅应由对集群的完整授权者配置有详细了解的 webhook 使用。webhook 将返回
218217

219218
```json
220219
{
@@ -252,16 +251,16 @@ Access to non-resource paths are sent as:
252251
```
253252

254253
<!--
255-
Non-resource paths include: `/api`, `/apis`, `/metrics`, `/resetMetrics`,
256-
`/logs`, `/debug`, `/healthz`, `/swagger-ui/`, `/swaggerapi/`, `/ui`, and
254+
Non-resource paths include: `/api`, `/apis`, `/metrics`,
255+
`/logs`, `/debug`, `/healthz`, `/livez`, `/openapi/v2`, `/readyz`, and
257256
`/version.` Clients require access to `/api`, `/api/*`, `/apis`, `/apis/*`,
258257
and `/version` to discover what resources and versions are present on the server.
259258
Access to other non-resource paths can be disallowed without restricting access
260259
to the REST api.
261260
-->
262-
非资源类的路径包括:`/api`, `/apis`, `/metrics`, `/resetMetrics`,
263-
`/logs`, `/debug`, `/healthz`, `/swagger-ui/`, `/swaggerapi/`, `/ui`, 和
264-
`/version`客户端需要访问 `/api`, `/api/*`, `/apis`, `/apis/*`, 和 `/version` 以便
261+
非资源类的路径包括:`/api``/apis``/metrics`、`/logs`、`/debug`、
262+
`/healthz`、`/livez`、`/openapi/v2`、`/readyz`、和 `/version`。
263+
客户端需要访问 `/api``/api/*``/apis``/apis/*` 和 `/version` 以便
265264
能发现服务器上有什么资源和版本。对于其他非资源类的路径访问在没有 REST API 访问限制的情况下拒绝。
266265

267266
<!--

content/zh/docs/reference/kubectl/conventions.md

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,12 @@
11
---
22
title: kubectl 的用法约定
3-
reviewers:
4-
- janetkuo
53
content_type: concept
64
---
7-
85
<!--
9-
---
106
title: kubectl Usage Conventions
117
reviewers:
128
- janetkuo
139
content_type: concept
14-
---
1510
-->
1611

1712
<!-- overview -->
@@ -26,7 +21,7 @@ Recommended usage conventions for `kubectl`.
2621
<!--
2722
## Using `kubectl` in Reusable Scripts
2823
-->
29-
## 在可重用脚本中使用 `kubectl`
24+
## 在可重用脚本中使用 `kubectl` {#using-kubectl-in-reusable-scripts}
3025

3126
<!--
3227
For a stable output in a script:
@@ -58,14 +53,14 @@ reconciled by a controller to a different value.
5853
-->
5954

6055
* 你可以将 `--subresource` alpha 标志用于 kubectl 命令,例如 `get``patch``edit``replace`
61-
来获取和更新所有支持子资源的资源的子资源。 目前,仅支持 `status``scale` 子资源。
62-
* 针对子资源的 API 协定与完整资源相同。在更新`status` 子资源为一个新值时,请记住,
56+
来获取和更新所有支持子资源的资源的子资源。目前,仅支持 `status``scale` 子资源。
57+
* 针对子资源的 API 协定与完整资源相同。在更新 `status` 子资源为一个新值时,请记住,
6358
子资源可能是潜在的由控制器调和为不同的值。
6459

6560
<!--
6661
## Best Practices
6762
-->
68-
## 最佳实践
63+
## 最佳实践 {#best-practices}
6964

7065
### `kubectl run`
7166

@@ -80,7 +75,8 @@ For `kubectl run` to satisfy infrastructure as code:
8075
* Switch to configuration files checked into source control for features that are needed, but not expressible via `kubectl run` flags.
8176
-->
8277

83-
* 使用特定版本的标签标记镜像,不要将该标签移动到新版本。例如,使用 `:v1234``v1.2.3``r03062016-1-4`,而不是 `:latest`(有关详细信息,请参阅[配置的最佳实践](/zh/docs/concepts/configuration/overview/#container-images))。
78+
* 使用特定版本的标签标记镜像,不要将该标签改为新版本。例如使用 `:v1234``v1.2.3``r03062016-1-4`
79+
而不是 `:latest`(有关详细信息,请参阅[配置的最佳实践](/zh/docs/concepts/configuration/overview/#container-images))。
8480
* 使用基于版本控制的脚本来运行包含大量参数的镜像。
8581
* 对于无法通过 `kubectl run` 参数来表示的功能特性,使用基于源码控制的配置文件,以记录要使用的功能特性。
8682

content/zh/docs/reference/kubectl/docker-cli-to-kubectl.md

Lines changed: 23 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,18 @@
11
---
22
title: 适用于 Docker 用户的 kubectl
33
content_type: concept
4-
reviewers:
5-
- brendandburns
6-
- thockin
74
---
85
<!--
9-
---
106
title: kubectl for Docker Users
117
content_type: concept
128
reviewers:
139
- brendandburns
1410
- thockin
15-
---
1611
-->
1712

1813
<!-- overview -->
1914
<!--
20-
You can use the Kubernetes command line tool `kubectl` to interact with the API Server. Using kubectl is straightforward if you are familiar with the Docker command line tool. However, there are a few differences between the docker commands and the kubectl commands. The following sections show a Docker sub-command and describe the equivalent `kubectl` command.
15+
You can use the Kubernetes command line tool `kubectl` to interact with the API Server. Using kubectl is straightforward if you are familiar with the Docker command line tool. However, there are a few differences between the Docker commands and the kubectl commands. The following sections show a Docker sub-command and describe the equivalent `kubectl` command.
2116
-->
2217
你可以使用 Kubernetes 命令行工具 `kubectl` 与 API 服务器进行交互。如果你熟悉 Docker 命令行工具,
2318
则使用 kubectl 非常简单。但是,Docker 命令和 kubectl 命令之间有一些区别。以下显示了 Docker 子命令,
@@ -30,8 +25,12 @@ You can use the Kubernetes command line tool `kubectl` to interact with the API
3025
<!--
3126
To run an nginx Deployment and expose the Deployment, see [kubectl create deployment](/docs/reference/generated/kubectl/kubectl-commands#-em-deployment-em-).
3227
-->
33-
要运行 nginx 部署并将其暴露,请参见[kubectl create deployment](/docs/reference/generated/kubectl/kubectl-commands#-em-deployment-em-)
28+
要运行 nginx 部署并将其暴露,请参见 [kubectl create deployment](/docs/reference/generated/kubectl/kubectl-commands#-em-deployment-em-)
29+
30+
<!--
3431
docker:
32+
-->
33+
使用 docker 命令:
3534

3635
```shell
3736
docker run -d --restart=always -e DOMAIN=cluster --name nginx-app -p 80:80 nginx
@@ -48,7 +47,10 @@ CONTAINER ID IMAGE COMMAND CREATED
4847
55c103fa1296 nginx "nginx -g 'daemon of…" 9 seconds ago Up 9 seconds 0.0.0.0:80->80/tcp nginx-app
4948
```
5049

50+
<!--
5151
kubectl:
52+
-->
53+
使用 kubectl 命令:
5254

5355
<!--
5456
```shell
@@ -97,7 +99,7 @@ service "nginx-http" exposed
9799
By using kubectl, you can create a [Deployment](/docs/concepts/workloads/controllers/deployment/) to ensure that N pods are running nginx, where N is the number of replicas stated in the spec and defaults to 1. You can also create a [service](/docs/concepts/services-networking/service/) with a selector that matches the pod labels. For more information, see [Use a Service to Access an Application in a Cluster](/docs/tasks/access-application-cluster/service-access-application-cluster).
98100
-->
99101
在 kubectl 命令中,我们创建了一个 [Deployment](/zh/docs/concepts/workloads/controllers/deployment/)
100-
这将保证有 N 个运行 nginx 的 Pod(N 代表 spec 中声明的 replica 数,默认为 1)
102+
这将保证有 N 个运行 nginx 的 PodN 代表 spec 中声明的 replica 数,默认为 1
101103
我们还创建了一个 [service](/zh/docs/concepts/services-networking/service/),其选择器与容器标签匹配。
102104
查看[使用服务访问集群中的应用程序](/zh/docs/tasks/access-application-cluster/service-access-application-cluster) 获取更多信息。
103105

@@ -115,15 +117,15 @@ kubectl run [-i] [--tty] --attach <name> --image=<image>
115117
Unlike `docker run ...`, if you specify `--attach`, then you attach `stdin`, `stdout` and `stderr`. You cannot control which streams are attached (`docker -a ...`).
116118
To detach from the container, you can type the escape sequence Ctrl+P followed by Ctrl+Q.
117119
-->
118-
`docker run ...` 不同的是,如果指定了 `--attach` ,我们将连接到 `stdin``stdout``stderr`
120+
`docker run ...` 不同的是,如果指定了 `--attach`,我们将连接到 `stdin``stdout``stderr`
119121
而不能控制具体连接到哪个输出流(`docker -a ...`)。要从容器中退出,可以输入 Ctrl + P,然后按 Ctrl + Q。
120122

121123
<!--
122124
Because the kubectl run command starts a Deployment for the container, the Deployment restarts if you terminate the attached process by using Ctrl+C, unlike `docker run -it`.
123125
To destroy the Deployment and its pods you need to run `kubectl delete deployment <name>`.
124126
-->
125127
因为我们使用 Deployment 启动了容器,如果你终止连接到的进程(例如 `ctrl-c`),容器将会重启,
126-
这跟 `docker run -it` 不同。 如果想销毁该 Deployment(和它的 Pod),
128+
这跟 `docker run -it` 不同。如果想销毁该 Deployment(和它的 Pod),
127129
你需要运行 `kubectl delete deployment <name>`
128130

129131
## docker ps
@@ -271,7 +273,7 @@ docker exec -ti 55c103fa1296 /bin/sh
271273
kubectl:
272274

273275
```shell
274-
kubectl exec -ti nginx-app-5jyvm -- /bin/sh
276+
kubectl exec -ti nginx-app-5jyvm -- /bin/sh
275277
# exit
276278
```
277279

@@ -318,9 +320,9 @@ kubectl logs -f nginx-app-zibvs
318320
There is a slight difference between pods and containers; by default pods do not terminate if their processes exit. Instead the pods restart the process. This is similar to the docker run option `--restart=always` with one major difference. In docker, the output for each invocation of the process is concatenated, but for Kubernetes, each invocation is separate. To see the output from a previous run in Kubernetes, do this:
319321
-->
320322
现在是时候提一下 Pod 和容器之间的细微差别了;默认情况下如果 Pod 中的进程退出 Pod 也不会终止,
321-
相反它将会重启该进程。这类似于 docker run 时的 `--restart=always` 选项, 这是主要差别。
322-
在 docker 中,进程的每个调用的输出都是被连接起来的,但是对于 kubernetes,每个调用都是分开的。
323-
要查看以前在 kubernetes 中执行的输出,请执行以下操作:
323+
相反它将会重启该进程。这类似于 docker run 时的 `--restart=always` 选项,这是主要差别。
324+
在 docker 中,进程的每个调用的输出都是被连接起来的,但是对于 Kubernetes,每个调用都是分开的。
325+
要查看以前在 Kubernetes 中执行的输出,请执行以下操作:
324326

325327
```shell
326328
kubectl logs --previous nginx-app-zibvs
@@ -403,7 +405,7 @@ kubectl get po -l app=nginx-app
403405

404406
{{< note >}}
405407
<!--
406-
When you use kubectl, you don't delete the pod directly.You have to first delete the Deployment that owns the pod. If you delete the pod directly, the Deployment recreates the pod.
408+
When you use kubectl, you don't delete the pod directly. You have to first delete the Deployment that owns the pod. If you delete the pod directly, the Deployment recreates the pod.
407409
-->
408410
请注意,我们不直接删除 Pod。使用 kubectl 命令,我们要删除拥有该 Pod 的 Deployment。
409411
如果我们直接删除 Pod,Deployment 将会重新创建该 Pod。
@@ -501,10 +503,10 @@ kubectl:
501503
kubectl cluster-info
502504
```
503505
```
504-
Kubernetes master is running at https://108.59.85.141
505-
KubeDNS is running at https://108.59.85.141/api/v1/namespaces/kube-system/services/kube-dns/proxy
506-
kubernetes-dashboard is running at https://108.59.85.141/api/v1/namespaces/kube-system/services/kubernetes-dashboard/proxy
507-
Grafana is running at https://108.59.85.141/api/v1/namespaces/kube-system/services/monitoring-grafana/proxy
508-
Heapster is running at https://108.59.85.141/api/v1/namespaces/kube-system/services/monitoring-heapster/proxy
509-
InfluxDB is running at https://108.59.85.141/api/v1/namespaces/kube-system/services/monitoring-influxdb/proxy
506+
Kubernetes master is running at https://203.0.113.141
507+
KubeDNS is running at https://203.0.113.141/api/v1/namespaces/kube-system/services/kube-dns/proxy
508+
kubernetes-dashboard is running at https://203.0.113.141/api/v1/namespaces/kube-system/services/kubernetes-dashboard/proxy
509+
Grafana is running at https://203.0.113.141/api/v1/namespaces/kube-system/services/monitoring-grafana/proxy
510+
Heapster is running at https://203.0.113.141/api/v1/namespaces/kube-system/services/monitoring-heapster/proxy
511+
InfluxDB is running at https://203.0.113.141/api/v1/namespaces/kube-system/services/monitoring-influxdb/proxy
510512
```

0 commit comments

Comments
 (0)