Skip to content

Commit b026c3a

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #33632 from fenggw-fnst/tasks-8
[zh] Sync for tasks-8: ip-masq-agent.md and nodelocaldns.md
2 parents 78a0303 + 4f5c259 commit b026c3a

File tree

2 files changed

+136
-74
lines changed

2 files changed

+136
-74
lines changed

‎content/zh/docs/tasks/administer-cluster/ip-masq-agent.md

Lines changed: 44 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ content_type: task
99

1010
<!-- overview -->
1111
<!--
12-
This page shows how to configure and enable the ip-masq-agent.
12+
This page shows how to configure and enable the `ip-masq-agent`.
1313
-->
14-
此页面展示如何配置和启用 ip-masq-agent。
14+
此页面展示如何配置和启用 `ip-masq-agent`。
1515

1616
## {{% heading "prerequisites" %}}
1717

@@ -24,9 +24,9 @@ This page shows how to configure and enable the ip-masq-agent.
2424
## IP Masquerade Agent 用户指南
2525

2626
<!--
27-
The ip-masq-agent configures iptables rules to hide a pod's IP address behind the cluster node's IP address. This is typically done when sending traffic to destinations outside the cluster's pod [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) range.
27+
The `ip-masq-agent` configures iptables rules to hide a pod's IP address behind the cluster node's IP address. This is typically done when sending traffic to destinations outside the cluster's pod [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) range.
2828
-->
29-
ip-masq-agent 配置 iptables 规则以隐藏位于集群节点 IP 地址后面的 Pod 的 IP 地址。
29+
`ip-masq-agent` 配置 iptables 规则以隐藏位于集群节点 IP 地址后面的 Pod 的 IP 地址。
3030
这通常在将流量发送到集群的 Pod
3131
[CIDR](https://zh.wikipedia.org/wiki/%E6%97%A0%E7%B1%BB%E5%88%AB%E5%9F%9F%E9%97%B4%E8%B7%AF%E7%94%B1)
3232
范围之外的目的地时使用。
@@ -96,23 +96,26 @@ The agent configuration file must be written in YAML or JSON syntax, and may con
9696
代理配置文件必须使用 YAML 或 JSON 语法编写，并且可能包含三个可选值：
9797

9898
<!--
99-
* **nonMasqueradeCIDRs:** A list of strings in [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation that specify the non-masquerade ranges.
99+
* `nonMasqueradeCIDRs`: A list of strings in
100+
[CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation that specify the non-masquerade ranges.
100101
-->
101-
* **nonMasqueradeCIDRs:**
102+
* `nonMasqueradeCIDRs`：
102103
[CIDR](https://zh.wikipedia.org/wiki/%E6%97%A0%E7%B1%BB%E5%88%AB%E5%9F%9F%E9%97%B4%E8%B7%AF%E7%94%B1)
103104
表示法中的字符串列表，用于指定不需伪装的地址范围。
104105

105106
<!--
106-
* **masqLinkLocal:** A Boolean (true / false) which indicates whether to masquerade traffic to the link local prefix 169.254.0.0/16. False by default.
107+
* `masqLinkLocal`: A Boolean (true/false) which indicates whether to masquerade traffic to the
108+
link local prefix `169.254.0.0/16`. False by default.
107109
-->
108-
* **masqLinkLocal:** 布尔值 (true / false)，表示是否将流量伪装到
109-
本地链路前缀 169.254.0.0/16。默认为 false。
110+
* `masqLinkLocal`：布尔值 (true/false)，表示是否为本地链路前缀 169.254.0.0/16 的流量提供伪装。
111+
默认为 false。
110112

111113
<!--
112-
* **resyncInterval:** An interval at which the agent attempts to reload config from disk. e.g. '30s' where 's' is seconds, 'ms' is milliseconds etc...
114+
* `resyncInterval`: A time interval at which the agent attempts to reload config from disk.
115+
For example: '30s', where 's' means seconds, 'ms' means milliseconds.
113116
-->
114-
* **resyncInterval:** 代理尝试从磁盘重新加载配置的时间间隔。
115-
例如 '30s'，其中 's' 是秒，'ms' 是毫秒等...
117+
* `resyncInterval`：代理从磁盘重新加载配置的重试时间间隔。
118+
例如 '30s'，其中 's' 是秒，'ms' 是毫秒。
116119

117120
<!--
118121
Traffic to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16) ranges will NOT be masqueraded. Any other traffic (assumed to be internet) will be masqueraded. An example of a local destination from a pod could be its Node's IP address as well as another node's address or one of the IP addresses in Cluster's IP range. Any other traffic will be masqueraded by default. The below entries show the default set of rules that are applied by the ip-masq-agent:
@@ -122,8 +125,11 @@ Traffic to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16) ranges will NOT be masq
122125
Pod 访问本地目的地的例子，可以是其节点的 IP 地址、另一节点的地址或集群的 IP 地址范围内的一个 IP 地址。
123126
默认情况下，任何其他流量都将伪装。以下条目展示了 ip-masq-agent 的默认使用的规则：
124127

125-
```
128+
```shell
126129
iptables -t nat -L IP-MASQ-AGENT
130+
```
131+
132+
```none
127133
RETURN all -- anywhere 169.254.0.0/16 /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL
128134
RETURN all -- anywhere 10.0.0.0/8 /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL
129135
RETURN all -- anywhere 172.16.0.0/12 /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL
@@ -133,13 +139,17 @@ MASQUERADE all -- anywhere anywhere /* ip-masq-agent:
133139
```
134140

135141
<!--
136-
By default, in GCE/Google Kubernetes Engine starting with Kubernetes version 1.7.0, if network policy is enabled or you are using a cluster CIDR not in the 10.0.0.0/8 range, the ip-masq-agent will run in your cluster. If you are running in another environment, you can add the ip-masq-agent [DaemonSet](/docs/concepts/workloads/controllers/daemonset/) to your cluster:
142+
By default, in GCE/Google Kubernetes Engine, if network policy is enabled or
143+
you are using a cluster CIDR not in the 10.0.0.0/8 range, the `ip-masq-agent`
144+
will run in your cluster. If you are running in another environment,
145+
you can add the `ip-masq-agent` [DaemonSet](/docs/concepts/workloads/controllers/daemonset/)
146+
to your cluster.
137147
-->
138-
默认情况下，从 Kubernetes 1.7.0 版本开始的 GCE/Google Kubernetes Engine 中，
139-
如果启用了网络策略，或者你使用的集群 CIDR 不在 10.0.0.0/8 范围内，
140-
则 ip-masq-agent 将在你的集群中运行。
141-
如果你在其他环境中运行，则可以将 ip-masq-agent
142-
[DaemonSet](/zh/docs/concepts/workloads/controllers/daemonset/) 添加到你的集群：
148+
默认情况下，在 GCE/Google Kubernetes Engine 中，如果启用了网络策略，
149+
或者你使用的集群 CIDR 不在 10.0.0.0/8 范围内，
150+
则 `ip-masq-agent` 将在你的集群中运行。
151+
如果你在其他环境中运行，可以将 `ip-masq-agent`
152+
[DaemonSet](/zh/docs/concepts/workloads/controllers/daemonset/) 添加到你的集群中。
143153

144154
<!-- steps -->
145155

@@ -172,20 +182,20 @@ More information can be found in the ip-masq-agent documentation [here](https://
172182
<!--
173183
In most cases, the default set of rules should be sufficient; however, if this is not the case for your cluster, you can create and apply a [ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap/) to customize the IP ranges that are affected. For example, to allow only 10.0.0.0/8 to be considered by the ip-masq-agent, you can create the following [ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap/) in a file called "config".
174184
-->
175-
在大多数情况下，默认的规则集应该足够；但是，如果你的群集不是这种情况，则可以创建并应用
185+
在大多数情况下，默认的规则集应该足够；但是，如果你的集群不是这种情况，则可以创建并应用
176186
[ConfigMap](/zh/docs/tasks/configure-pod-container/configure-pod-configmap/)
177187
来自定义受影响的 IP 范围。
178188
例如，要允许 ip-masq-agent 仅作用于 10.0.0.0/8，你可以在一个名为 “config” 的文件中创建以下
179189
[ConfigMap](/zh/docs/tasks/configure-pod-container/configure-pod-configmap/) 。
180190

181191
{{< note >}}
182192
<!--
183-
It is important that the file is called config since, by default, that will be used as the key for lookup by the ip-masq-agent:
193+
It is important that the file is called config since, by default, that will be used as the key for lookup by the `ip-masq-agent`:
184194
-->
185195
重要的是，该文件之所以被称为 config，因为默认情况下，该文件将被用作
186-
ip-masq-agent 查找的主键：
196+
`ip-masq-agent` 查找的主键：
187197

188-
```
198+
```yaml
189199
nonMasqueradeCIDRs:
190200
- 10.0.0.0/8
191201
resyncInterval: 60s
@@ -195,22 +205,25 @@ resyncInterval: 60s
195205
<!--
196206
Run the following command to add the config map to your cluster:
197207
-->
198-
运行以下命令将配置映射添加到你的集群：
208+
运行以下命令将 ConfigMap 添加到你的集群：
199209
200-
```
210+
```shell
201211
kubectl create configmap ip-masq-agent --from-file=config --namespace=kube-system
202212
```
203213

204214
<!--
205-
This will update a file located at */etc/config/ip-masq-agent* which is periodically checked every *resyncInterval* and applied to the cluster node.
215+
This will update a file located at `/etc/config/ip-masq-agent` which is periodically checked every `resyncInterval` and applied to the cluster node.
206216
After the resync interval has expired, you should see the iptables rules reflect your changes:
207217
-->
208-
这将更新位于 */etc/config/ip-masq-agent* 的一个文件，该文件以 *resyncInterval*
218+
这将更新位于 `/etc/config/ip-masq-agent` 的一个文件，该文件以 `resyncInterval`
209219
为周期定期检查并应用于集群节点。
210220
重新同步间隔到期后，你应该看到你的更改在 iptables 规则中体现：
211221

212-
```
222+
```shell
213223
iptables -t nat -L IP-MASQ-AGENT
224+
```
225+
226+
```none
214227
Chain IP-MASQ-AGENT (1 references)
215228
target prot opt source destination
216229
RETURN all -- anywhere 169.254.0.0/16 /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL
@@ -219,13 +232,13 @@ MASQUERADE all -- anywhere anywhere /* ip-masq-agent:
219232
```
220233

221234
<!--
222-
By default, the link local range (169.254.0.0/16) is also handled by the ip-masq agent, which sets up the appropriate iptables rules. To have the ip-masq-agent ignore link local, you can set *masqLinkLocal* to true in the config map.
235+
By default, the link local range (169.254.0.0/16) is also handled by the ip-masq agent, which sets up the appropriate iptables rules. To have the ip-masq-agent ignore link local, you can set `masqLinkLocal` to true in the ConfigMap.
223236
-->
224237
默认情况下，本地链路范围 (169.254.0.0/16) 也由 ip-masq agent 处理，
225238
该代理设置适当的 iptables 规则。 要使 ip-masq-agent 忽略本地链路，
226-
可以在配置映射中将 *masqLinkLocal* 设置为 true。
239+
可以在 ConfigMap 中将 `masqLinkLocal` 设置为 true。
227240

228-
```
241+
```yaml
229242
nonMasqueradeCIDRs:
230243
- 10.0.0.0/8
231244
resyncInterval: 60s

0 commit comments

Comments
 (0)