You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The input to the authentication step is the entire HTTP request; however, it typically
79
-
just examines the headers and/or client certificate.
79
+
examines the headers and/or client certificate.
80
80
81
81
Authentication modules include client certificates, password, and plain tokens,
82
82
bootstrap tokens, and JSON Web Tokens (used for service accounts).
@@ -90,7 +90,7 @@ until one of them succeeds.
90
90
91
91
可以指定多个认证模块，在这种情况下，服务器依次尝试每个验证模块，直到其中一个成功。
92
92
93
-
<!--
93
+
<!--
94
94
If the request cannot be authenticated, it is rejected with HTTP status code 401.
95
95
Otherwise, the user is authenticated as a specific `username`, and the user name
96
96
is available to subsequent steps to use in their decisions. Some authenticators
@@ -99,7 +99,7 @@ do not.
99
99
100
100
While Kubernetes uses usernames for access control decisions and in request logging,
101
101
it does not have a `User` object nor does it store usernames or other information about
102
-
users in its API.
102
+
users in its API.
103
103
-->
104
104
如果请求认证不通过，服务器将以 HTTP 状态码 401 拒绝该请求。
105
105
反之，该用户被认证为特定的 `username`，并且该用户名可用于后续步骤以在其决策中使用。
@@ -108,7 +108,7 @@ users in its API.
108
108
<!-- ## Authorization -->
109
109
## 鉴权 {#authorization}
110
110
111
-
<!--
111
+
<!--
112
112
After the request is authenticated as coming from a specific user, the request must be authorized. This is shown as step **2** in the diagram.
113
113
114
114
A request must include the username of the requester, the requested action, and the object affected by the action. The request is authorized if an existing policy declares that the user has permissions to complete the requested action.
@@ -134,7 +134,7 @@ For example, if Bob has the policy below, then he can read pods only in the name
134
134
}
135
135
}
136
136
```
137
-
<!--
137
+
<!--
138
138
If Bob makes the following request, the request is authorized because he is allowed to read objects in the `projectCaribou` namespace:
139
139
-->
140
140
如果 Bob 执行以下请求，那么请求会被鉴权，因为允许他读取 `projectCaribou` 名称空间中的对象。
@@ -153,27 +153,27 @@ If Bob makes the following request, the request is authorized because he is allo
153
153
}
154
154
}
155
155
```
156
-
<!--
157
-
If Bob makes a request to write (`create` or `update`) to the objects in the `projectCaribou` namespace, his authorization is denied.
156
+
<!--
157
+
If Bob makes a request to write (`create` or `update`) to the objects in the `projectCaribou` namespace, his authorization is denied.
158
158
If Bob makes a request to read (`get`) objects in a different namespace such as `projectFish`, then his authorization is denied.
159
159
160
-
Kubernetes authorization requires that you use common REST attributes to interact with existing organization-wide or cloud-provider-wide access control systems.
160
+
Kubernetes authorization requires that you use common REST attributes to interact with existing organization-wide or cloud-provider-wide access control systems.
161
161
It is important to use REST formatting because these control systems might interact with other APIs besides the Kubernetes API.
162
162
-->
163
163
如果 Bob 在 `projectCaribou` 名字空间中请求写（`create` 或 `update`）对象，其鉴权请求将被拒绝。
164
164
如果 Bob 在诸如 `projectFish` 这类其它名字空间中请求读取（`get`）对象，其鉴权也会被拒绝。
On supported hosts, the 'runtime/default' AppArmor profile is applied by default. The default policy should prevent overriding or disabling the policy, or restrict overrides to an allowed set of profiles.<br>
207
+
On supported hosts, the 'runtime/default' AppArmor profile is applied by default.
208
+
The baseline policy should prevent overriding or disabling the default AppArmor
209
+
profile, or restrict overrides to an allowed set of profiles.<br>
0 commit comments