Skip to content

Commit b0bd0aa

Browse files
windsonseawindsonsea
committed
[zh] Add text to: service-accounts-admin.md
1 parent 7e97a36 commit b0bd0aa

File tree

2 files changed

+169
-4
lines changed

2 files changed

+169
-4
lines changed

‎content/zh-cn/docs/reference/access-authn-authz/service-accounts-admin.md

Lines changed: 151 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,15 @@ For an introduction to service accounts, read [configure service accounts](/docs
2929
3030
This task guide explains some of the concepts behind ServiceAccounts. The
3131
guide also explains how to obtain or revoke tokens that represent
32-
ServiceAccounts.
32+
ServiceAccounts, and how to (optionally) bind a ServiceAccount's validity to
33+
the lifetime of an API object.
3334
-->
3435
有关服务账号的介绍，
3536
请参阅[配置服务账号](/zh-cn/docs/tasks/configure-pod-container/configure-service-account/)。
3637

3738
本任务指南阐述有关 ServiceAccount 的几个概念。
38-
本指南还讲解如何获取或撤销代表 ServiceAccount 的令牌。
39+
本指南还讲解如何获取或撤销代表 ServiceAccount 的令牌，
40+
以及如何将 ServiceAccount 的有效期与某个 API 对象的生命期绑定（可选）。
3941

4042
<!-- body -->
4143

@@ -118,15 +120,15 @@ Supported object types are as follows:
118120
119121
* Pod (used for projected volume mounts, see below)
120122
* Secret (can be used to allow revoking a token by deleting the Secret)
121-
* Node (in v1.30, creating new node-bound tokens is alpha, using existing node-bound tokens is beta)
123+
* Node (in v1.32, creating new node-bound tokens is beta, using existing node-bound tokens is GA)
122124
-->
123125
ServiceAccount 令牌可以被绑定到 kube-apiserver 中存在的 API 对象。
124126
这可用于将令牌的有效性与另一个 API 对象的存在与否关联起来。
125127
支持的对象类型如下：
126128

127129
* Pod（用于投射卷的挂载，见下文）
128130
* Secret（可用于允许通过删除 Secret 来撤销令牌）
129-
* 节点（在 v1.30 中，创建新的节点绑定令牌是 Alpha 特性，使用现有的节点绑定特性是 Beta 特性）
131+
* 节点（在 v1.32 中，创建新的节点绑定令牌是 Beta 特性，使用现有的节点绑定令牌是 GA 特性）
130132

131133
<!--
132134
When a token is bound to an object, the object's `metadata.name` and `metadata.uid` are
@@ -264,6 +266,102 @@ kube-apiserver 实际上并不将 TokenReview 对象持久保存到 etcd 中。
264266
因此 `kubectl get tokenreview` 不是一个有效的命令。
265267
{{< /note >}}
266268

269+
<!--
270+
#### Schema for service account private claims
271+
272+
The schema for the Kubernetes-specific claims within JWT tokens is not currently documented,
273+
however the relevant code area can be found in
274+
[the serviceaccount package](https://github.com/kubernetes/kubernetes/blob/d8919343526597e0788a1efe133c70d9a0c07f69/pkg/serviceaccount/claims.go#L56-L68)
275+
in the Kubernetes codebase.
276+
-->
277+
#### 服务账号私有声明的模式
278+
279+
目前在 JWT 令牌中特定于 Kubernetes 的声明模式尚未文档化，但相关代码段可以在 Kubernetes 代码库的
280+
[serviceaccount 包](https://github.com/kubernetes/kubernetes/blob/d8919343526597e0788a1efe133c70d9a0c07f69/pkg/serviceaccount/claims.go#L56-L68)中找到。
281+
282+
<!--
283+
You can inspect a JWT using standard JWT decoding tool. Below is an example of a JWT for the
284+
`my-serviceaccount` ServiceAccount, bound to a Pod object named `my-pod` which is scheduled
285+
to the Node `my-node`, in the `my-namespace` namespace:
286+
-->
287+
你可以使用标准的 JWT 解码工具检查 JWT。
288+
下面是一个关于 `my-serviceaccount` 服务账号的 JWT 示例，
289+
该服务账号绑定到了一个被调度到 `my-node` 节点、位于 `my-namespace` 命名空间中且名为 `my-pod` 的 Pod 对象：
290+
291+
```json
292+
{
293+
"aud": [
294+
"https://my-audience.example.com"
295+
],
296+
"exp": 1729605240,
297+
"iat": 1729601640,
298+
"iss": "https://my-cluster.example.com",
299+
"jti": "aed34954-b33a-4142-b1ec-389d6bbb4936",
300+
"kubernetes.io": {
301+
"namespace": "my-namespace",
302+
"node": {
303+
"name": "my-node",
304+
"uid": "646e7c5e-32d6-4d42-9dbd-e504e6cbe6b1"
305+
},
306+
"pod": {
307+
"name": "my-pod",
308+
"uid": "5e0bd49b-f040-43b0-99b7-22765a53f7f3"
309+
},
310+
"serviceaccount": {
311+
"name": "my-serviceaccount",
312+
"uid": "14ee3fa4-a7e2-420f-9f9a-dbc4507c3798"
313+
}
314+
},
315+
"nbf": 1729601640,
316+
"sub": "system:serviceaccount:my-namespace:my-serviceaccount"
317+
}
318+
```
319+
320+
{{< note >}}
321+
<!--
322+
The `aud` and `iss` fields in this JWT may differ between different Kubernetes clusters depending
323+
on your configuration.
324+
325+
The presence of both the `pod` and `node` claim implies that this token is bound
326+
to a *Pod* object. When verifying Pod bound ServiceAccount tokens, the API server **does not**
327+
verify the existence of the referenced Node object.
328+
-->
329+
此 JWT 中的 `aud` 和 `iss` 字段可能因你的配置而在不同的 Kubernetes 集群之间有所差异。
330+
331+
同时存在 `pod` 和 `node` 声明意味着此令牌被绑定到了 **Pod** 对象。
332+
在验证 Pod 绑定的服务账号令牌时，API 服务器**不**验证所引用的 Node 对象是否存在。
333+
{{< /note >}}
334+
335+
<!--
336+
Services that run outside of Kubernetes and want to perform offline validation of JWTs may
337+
use this schema, along with a compliant JWT validator configured with OpenID Discovery information
338+
from the API server, to verify presented JWTs without requiring use of the TokenReview API.
339+
-->
340+
在 Kubernetes 外部运行且想要对 JWT 进行离线校验的服务可以使用此模式，
341+
结合以 API 服务器的 OpenID Discovery 信息所配置的合规 JWT 校验器，
342+
可以在不需要使用 TokenReview API 的情况下验证呈现的 JWT。
343+
344+
<!--
345+
Services that verify JWTs in this way **do not verify** the claims embedded in the JWT token to be
346+
current and still valid.
347+
This means if the token is bound to an object, and that object no longer exists, the token will still
348+
be considered valid (until the configured token expires).
349+
-->
350+
以这种方式验证 JWT 的服务**不验证**嵌入在 JWT 令牌中的声明是否当前正使用且仍然有效。
351+
这意味着如果令牌被绑定到某个对象，且该对象不再存在，此令牌仍将被视为有效（直到配置的令牌过期）。
352+
353+
<!--
354+
Clients that require assurance that a token's bound claims are still valid **MUST** use the TokenReview
355+
API to present the token to the `kube-apiserver` for it to verify and expand the embedded claims, using
356+
similar steps to the [Verifying and inspecting private claims](#verifying-and-inspecting-private-claims)
357+
section above, but with a [supported client library](/docs/reference/using-api/client-libraries/).
358+
For more information on JWTs and their structure, see the [JSON Web Token RFC](https://datatracker.ietf.org/doc/html/rfc7519).
359+
-->
360+
需要确保令牌的绑定声明仍然有效的客户端**必须**使用 TokenReview API 将令牌呈现给 `kube-apiserver`，
361+
以便其验证并扩展嵌入的声明，具体步骤类似于上文所述的[验证和检查私有声明](#verifying-and-inspecting-private-claims)，
362+
但会使用[支持的客户端库](/zh-cn/docs/reference/using-api/client-libraries/)。
363+
有关 JWT 及其结构的细节，参见 [JSON Web Token RFC](https://datatracker.ietf.org/doc/html/rfc7519)。
364+
267365
<!--
268366
## Bound service account token volume mechanism {#bound-service-account-token-volume}
269367
-->
@@ -566,6 +664,18 @@ verify the tokens during authentication.
566664
`--service-account-key-file` 标志将对应的公钥通知给
567665
kube-apiserver。公钥用于在身份认证过程中校验令牌。
568666

667+
{{< feature-state feature_gate_name="ExternalServiceAccountTokenSigner" >}}
668+
669+
<!--
670+
An alternate setup to setting `--service-account-private-key-file` and `--service-account-key-file` flags is
671+
to configure an external JWT signer for [external ServiceAccount token signing and key management](#external-serviceaccount-token-signing-and-key-management).
672+
Note that these setups are mutually exclusive and cannot be configured together.
673+
-->
674+
设置 `--service-account-private-key-file` 和 `--service-account-key-file`
675+
标志的替代方案是配置一个外部 JWT 签名程序，
676+
用于[外部服务账户令牌签名和密钥管理](#external-serviceaccount-token-signing-and-key-management)。
677+
请注意，这些设置是互斥的，不能同时配置。
678+
569679
<!--
570680
### ServiceAccount admission controller
571681

@@ -940,6 +1050,43 @@ Then, delete the Secret you now know the name of:
9401050
kubectl -n examplens delete secret/example-automated-thing-token-zyxwv
9411051
```
9421052

1053+
<!--
1054+
## External ServiceAccount token signing and key management
1055+
-->
1056+
## 外部 ServiceAccount 令牌签名和密钥管理 {#external-serviceaccount-token-signing-and-key-management}
1057+
1058+
{{< feature-state feature_gate_name="ExternalServiceAccountTokenSigner" >}}
1059+
1060+
<!--
1061+
The kube-apiserver can be configured to use external signer for token signing and token verifying key management.
1062+
This feature enables kubernetes distributions to integrate with key management solutions of their choice (eg: HSMs, cloud KMSes) for service account credential signing and verification.
1063+
To configure kube-apiserver to use external-jwt-signer set the `--service-account-signing-endpoint` flag to the location of a Unix domain socket (UDS) on a filesystem, or be prefixed with an @ symbol and name a UDS in the abstract socket namespace.
1064+
At the configured UDS, shall be an RPC server which implements [ExternalJWTSigner](https://github.com/kubernetes/kubernetes/blob/release-1.32/staging/src/k8s.io/externaljwt/apis/v1alpha1/api.proto).
1065+
The external-jwt-signer must be healthy and be ready to serve supported service account keys for the kube-apiserver to start.
1066+
-->
1067+
kube-apiserver 可以被配置为使用外部签名程序进行令牌签名和令牌验证密钥管理。
1068+
此特性允许各种 Kubernetes 发行版集成自己选择的密钥管理解决方案（例如 HSM、云上 KMS）来进行服务账户凭证签名和验证。
1069+
要配置 kube-apiserver 使用 external-jwt-signer，将 `--service-account-signing-endpoint`
1070+
标志设置为文件系统上 Unix 域套接字 (UDS) 所在的位置，或者以 @ 符号开头并在抽象套接字命名空间中命名 UDS。
1071+
在配置的 UDS 上，需要有一个实现
1072+
[ExternalJWTSigner](https://github.com/kubernetes/kubernetes/blob/release-1.32/staging/src/k8s.io/externaljwt/apis/v1alpha1/api.proto)
1073+
的 RPC 服务器。external-jwt-signer 必须处于健康状态，并准备好为 kube-apiserver 启动提供支持的服务账户密钥。
1074+
1075+
<!--
1076+
Check out [KEP-740](https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/740-service-account-external-signing) for more details on ExternalJWTSigner.
1077+
-->
1078+
有关 ExternalJWTSigner 的细节，查阅
1079+
[KEP-740](https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/740-service-account-external-signing)。
1080+
1081+
{{< note >}}
1082+
<!--
1083+
The kube-apiserver flags `--service-account-key-file` and `--service-account-signing-key-file` will continue to be used for reading from files unless `--service-account-signing-endpoint` is set; they are mutually exclusive ways of supporting JWT signing and authentication.
1084+
-->
1085+
kube-apiserver 的 `--service-account-key-file` 和 `--service-account-signing-key-file`
1086+
标志将继续被用于从文件中读取，除非设置了 `--service-account-signing-endpoint`；
1087+
它们在支持 JWT 签名和身份验证方面是互斥的。
1088+
{{< /note >}}
1089+
9431090
<!--
9441091
## Clean up
9451092

‎content/zh-cn/docs/reference/command-line-tools-reference/feature-gates/external-service-account-token-signer.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
title: ExternalServiceAccountTokenSigner
3+
content_type: feature_gate
4+
_build:
5+
list: never
6+
render: false
7+
8+
stages:
9+
- stage: alpha
10+
defaultValue: false
11+
fromVersion: "1.32"
12+
---
13+
14+
<!--
15+
Enable setting `--service-account-signing-endpoint` to make the kube-apiserver use [external signer](/docs/reference/access-authn-authz/service-account-admin#external-serviceaccount-token-signing-and-key-management) for token signing and token verifying key management.
16+
-->
17+
允许设置 `--service-account-signing-endpoint` 让 kube-apiserver
18+
使用[外部签名程序](/zh-cn/docs/reference/access-authn-authz/service-account-admin#external-serviceaccount-token-signing-and-key-management)进行令牌签名和令牌验证密钥管理。

0 commit comments

Comments
 (0)