Skip to content

Commit b2d0e24

Browse files
windsonseawindsonsea
committed
[zh] sync /networking/service-protocols.md
1 parent 55c54a6 commit b2d0e24

File tree

1 file changed

+226
-0
lines changed

1 file changed

+226
-0
lines changed

‎content/zh-cn/docs/reference/networking/service-protocols.md

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,226 @@
1+
---
2+
title: Service 所用的协议
3+
content_type: reference
4+
weight: 10
5+
---
6+
<!--
7+
title: Protocols for Services
8+
content_type: reference
9+
weight: 10
10+
-->
11+
12+
<!-- overview -->
13+
<!--
14+
If you configure a {{< glossary_tooltip text="Service" term_id="service" >}},
15+
you can select from any network protocol that Kubernetes supports.
16+
17+
Kubernetes supports the following protocols with Services:
18+
19+
- [`SCTP`](#protocol-sctp)
20+
- [`TCP`](#protocol-tcp) _(the default)_
21+
- [`UDP`](#protocol-udp)
22+
-->
23+
如果你配置 {{< glossary_tooltip text="Service" term_id="service" >}}，
24+
你可以从 Kubernetes 支持的任何网络协议中选择一个协议。
25+
26+
Kubernetes 支持以下协议用于 Service：
27+
28+
- [`SCTP`](#protocol-sctp)
29+
- [`TCP`](#protocol-tcp) **（默认值）**
30+
- [`UDP`](#protocol-udp)
31+
32+
<!--
33+
When you define a Service, you can also specify the
34+
[application protocol](/docs/concepts/services-networking/service/#application-protocol)
35+
that it uses.
36+
37+
This document details some special cases, all of them typically using TCP
38+
as a transport protocol:
39+
40+
- [HTTP](#protocol-http-special) and [HTTPS](#protocol-http-special)
41+
- [PROXY protocol](#protocol-proxy-special)
42+
- [TLS](#protocol-tls-special) termination at the load balancer
43+
-->
44+
当你定义 Service 时，
45+
你还可以指定其使用的[应用协议](/zh-cn/docs/concepts/services-networking/service/#application-protocol)。
46+
47+
本文详细说明了一些特殊场景，这些场景通常均使用 TCP 作为传输协议：
48+
49+
- [HTTP](#protocol-http-special) 和 [HTTPS](#protocol-http-special)
50+
- [PROXY 协议](#protocol-proxy-special)
51+
- [TLS](#protocol-tls-special) 终止于负载均衡器处
52+
53+
<!-- body -->
54+
<!--
55+
## Supported protocols {#protocol-support}
56+
57+
There are 3 valid values for the `protocol` of a port for a Service:
58+
-->
59+
## 支持的协议 {#protocol-support}
60+
61+
Service 端口的 `protocol` 有 3 个有效值：
62+
63+
### `SCTP` {#protocol-sctp}
64+
65+
{{< feature-state for_k8s_version="v1.20" state="stable" >}}
66+
67+
<!--
68+
When using a network plugin that supports SCTP traffic, you can use SCTP for
69+
most Services. For `type: LoadBalancer` Services, SCTP support depends on the cloud
70+
provider offering this facility. (Most do not).
71+
72+
SCTP is not supported on nodes that run Windows.
73+
-->
74+
当使用支持 SCTP 流量的网络插件时，你可以为大多数 Service 使用 SCTP。
75+
对于 `type: LoadBalancer` Service，对 SCTP 的支持情况取决于提供此项设施的云供应商（大部分不支持）。
76+
77+
运行 Windows 的节点不支持 SCTP。
78+
79+
<!--
80+
#### Support for multihomed SCTP associations {#caveat-sctp-multihomed}
81+
82+
The support of multihomed SCTP associations requires that the CNI plugin can support the assignment of multiple interfaces and IP addresses to a Pod.
83+
84+
NAT for multihomed SCTP associations requires special logic in the corresponding kernel modules.
85+
-->
86+
#### 支持多宿主 SCTP 关联 {#caveat-sctp-multihomed}
87+
88+
对多宿主 SCTP 关联的支持要求 CNI 插件可以支持为 Pod 分配多个接口和 IP 地址。
89+
90+
针对多宿主 SCTP 关联的 NAT 需要在对应的内核模块具有特殊的逻辑。
91+
92+
{{< note >}}
93+
<!--
94+
The kube-proxy does not support the management of SCTP associations when it is in userspace mode.
95+
-->
96+
当 kube-proxy 处于 userspace 模式时不支持管理 SCTP 关联。
97+
{{< /note >}}
98+
99+
### `TCP` {#protocol-tcp}
100+
101+
<!--
102+
You can use TCP for any kind of Service, and it's the default network protocol.
103+
-->
104+
你可以将 TCP 用于任何类别的 Service，这是默认的网络协议。
105+
106+
### `UDP` {#protocol-udp}
107+
108+
<!--
109+
You can use UDP for most Services. For `type: LoadBalancer` Services,
110+
UDP support depends on the cloud provider offering this facility.
111+
-->
112+
你可以将 UDP 用于大多数 Service。对于 `type: LoadBalancer` Service，
113+
UDP 的支持与否取决于提供此项设施的云供应商。
114+
115+
<!--
116+
## Special cases
117+
-->
118+
## 特殊场景 {#special-cases}
119+
120+
### HTTP {#protocol-http-special}
121+
122+
<!--
123+
If your cloud provider supports it, you can use a Service in LoadBalancer mode to
124+
configure a load balancer outside of your Kubernetes cluster, in a special mode
125+
where your cloud provider's load balancer implements HTTP / HTTPS reverse proxying,
126+
with traffic forwarded to the backend endpoints for that Service.
127+
-->
128+
如果你的云供应商支持负载均衡，而且尤其是该云供应商的负载均衡器实现了 HTTP/HTTPS 反向代理，
129+
可将流量转发到该 Service 的后端端点，那么你就可以使用 LoadBalancer 模式的 Service 以便在
130+
Kubernetes 集群外部配置负载均衡器。
131+
132+
<!--
133+
Typically, you set the protocol for the Service to `TCP` and add an
134+
{{< glossary_tooltip text="annotation" term_id="annotation" >}}
135+
(usually specific to your cloud provider) that configures the load balancer
136+
to handle traffic at the HTTP level.
137+
This configuration might also include serving HTTPS (HTTP over TLS) and
138+
reverse-proxying plain HTTP to your workload.
139+
-->
140+
通常，你将 Service 协议设置为 `TCP`，
141+
并添加一个{{< glossary_tooltip text="注解" term_id="annotation" >}}
142+
（一般取决于你的云供应商）配置负载均衡器，以便在 HTTP 级别处理流量。
143+
此配置也可能包括为你的工作负载提供 HTTPS（基于 TLS 的 HTTP）并反向代理纯 HTTP。
144+
145+
{{< note >}}
146+
<!--
147+
You can also use an {{< glossary_tooltip term_id="ingress" >}} to expose
148+
HTTP/HTTPS Services.
149+
-->
150+
你也可以使用 {{< glossary_tooltip term_id="ingress" >}} 来暴露 HTTP/HTTPS Service。
151+
{{< /note >}}
152+
153+
<!--
154+
You might additionally want to specify that the
155+
[application protocol](/docs/concepts/services-networking/service/#application-protocol)
156+
of the connection is `http` or `https`. Use `http` if the session from the
157+
load balancer to your workload is HTTP without TLS, and use `https` if the
158+
session from the load balancer to your workload uses TLS encryption.
159+
-->
160+
你可能还想指定连接的[应用协议](/zh-cn/docs/concepts/services-networking/service/#application-protocol)是
161+
`http` 还是 `https`。如果从负载均衡器到工作负载的会话是不带 TLS 的 HTTP，请使用 `http`；
162+
如果从负载均衡器到工作负载的会话使用 TLS 加密，请使用 `https`。
163+
164+
<!--
165+
### PROXY protocol {#protocol-proxy-special}
166+
167+
If your cloud provider supports it, you can use a Service set to `type: LoadBalancer`
168+
to configure a load balancer outside of Kubernetes itself, that will forward connections
169+
wrapped with the
170+
[PROXY protocol](https://www.haproxy.org/download/2.5/doc/proxy-protocol.txt).
171+
172+
The load balancer then sends an initial series of octets describing the
173+
incoming connection, similar to this example (PROXY protocol v1):
174+
-->
175+
### PROXY 协议 {#protocol-proxy-special}
176+
177+
如果你的云供应商支持此协议，你可以使用设置为 `type: LoadBalancer` 的 Service，
178+
在 Kubernetes 本身的外部配置负载均衡器，以转发用
179+
[PROXY 协议](https://www.haproxy.org/download/2.5/doc/proxy-protocol.txt)封装的连接。
180+
181+
负载均衡器然后发送一个初始的八位元组系列来描述传入的连接，这类似于以下示例（PROXY 协议 v1）：
182+
183+
```
184+
PROXY TCP4 192.0.2.202 10.0.42.7 12345 7\r\n
185+
```
186+
187+
<!--
188+
The data after the proxy protocol preamble are the original
189+
data from the client. When either side closes the connection,
190+
the load balancer also triggers a connection close and sends
191+
any remaining data where feasible.
192+
193+
Typically, you define a Service with the protocol to `TCP`.
194+
You also set an annotation, specific to your
195+
cloud provider, that configures the load balancer to wrap each incoming connection in the PROXY protocol.
196+
-->
197+
代理协议前导码之后的数据是来自客户端的原始数据。
198+
当任何一侧关闭连接时，负载均衡器也会触发连接关闭并在可行的情况下发送所有残留数据。
199+
200+
通常，你会将 Service 协议定义为 `TCP`。
201+
你还会设置一个特定于云供应商的注解，将负载均衡器配置为以 PROXY 协议封装所有传入的连接。
202+
203+
### TLS {#protocol-tls-special}
204+
205+
<!--
206+
If your cloud provider supports it, you can use a Service set to `type: LoadBalancer` as
207+
a way to set up external reverse proxying, where the connection from client to load
208+
balancer is TLS encrypted and the load balancer is the TLS server peer.
209+
The connection from the load balancer to your workload can also be TLS,
210+
or might be plain text. The exact options available to you depend on your
211+
cloud provider or custom Service implementation.
212+
213+
Typically, you set the protocol to `TCP` and set an annotation
214+
(usually specific to your cloud provider) that configures the load balancer
215+
to act as a TLS server. You would configure the TLS identity (as server,
216+
and possibly also as a client that connects to your workload) using
217+
mechanisms that are specific to your cloud provider.
218+
-->
219+
如果你的云供应商支持 TLS，你可以使用设置为 `type: LoadBalancer` 的 Service
220+
作为设置外部反向代理的一种方式，其中从客户端到负载均衡器的连接是 TLS 加密的且该负载均衡器是
221+
TLS 对等服务器。从负载均衡器到工作负载的连接可以是 TLS，或可能是纯文本。
222+
你可以使用的确切选项取决于你的云供应商或自定义 Service 实现。
223+
224+
通常，你会将协议设置为 `TCP` 并设置一个注解（通常特定于你的云供应商），
225+
将负载均衡器配置为充当一个 TLS 服务器。你将使用特定于云供应商的机制来配置 TLS 身份
226+
（作为服务器，也可能作为连接到工作负载的客户端）。

0 commit comments

Comments
 (0)