Skip to content

Commit f51c49a

Browse files
windsonseawindsonsea
committed
[zh] Add translations to /storage/projected-volumes.md
1 parent 751ec13 commit f51c49a

File tree

3 files changed

+92
-8
lines changed

3 files changed

+92
-8
lines changed

‎content/zh-cn/docs/concepts/storage/projected-volumes.md

Lines changed: 62 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ title: 投射卷
33
content_type: concept
44
weight: 21 # 跟在持久卷之后
55
---
6-
76
<!--
87
reviewers:
98
- marosset
@@ -35,6 +34,7 @@ Currently, the following types of volume sources can be projected:
3534
* [`downwardAPI`](/docs/concepts/storage/volumes/#downwardapi)
3635
* [`configMap`](/docs/concepts/storage/volumes/#configmap)
3736
* [`serviceAccountToken`](#serviceaccounttoken)
37+
* [`clusterTrustBundle`](#clustertrustbundle)
3838
-->
3939
## 介绍 {#introduction}
4040

@@ -46,6 +46,7 @@ Currently, the following types of volume sources can be projected:
4646
* [`downwardAPI`](/zh-cn/docs/concepts/storage/volumes/#downwardapi)
4747
* [`configMap`](/zh-cn/docs/concepts/storage/volumes/#configmap)
4848
* [`serviceAccountToken`](#serviceaccounttoken)
49+
* [`clusterTrustBundle`](#clustertrustbundle)
4950

5051
<!--
5152
All sources are required to be in the same namespace as the Pod. For more details,
@@ -133,6 +134,66 @@ volume mount will not receive updates for those volume sources.
133134
形式使用投射卷源的容器无法收到对应卷源的更新。
134135
{{< /note >}}
135136

137+
<!--
138+
## clusterTrustBundle projected volumes {#clustertrustbundle}
139+
-->
140+
## clusterTrustBundle 投射卷 {#clustertrustbundle}
141+
142+
{{<feature-state for_k8s_version="v1.29" state="alpha" >}}
143+
144+
{{< note >}}
145+
<!--
146+
To use this feature in Kubernetes {{< skew currentVersion >}}, you must enable support for ClusterTrustBundle objects with the `ClusterTrustBundle` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) and `--runtime-config=certificates.k8s.io/v1alpha1/clustertrustbundles=true` kube-apiserver flag, then enable the `ClusterTrustBundleProjection` feature gate.
147+
-->
148+
要在 Kubernetes {{< skew currentVersion >}} 中使用此特性，你必须通过 `ClusterTrustBundle`
149+
[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/)和
150+
`--runtime-config=certificates.k8s.io/v1alpha1/clustertrustbundles=true` kube-apiserver
151+
标志启用对 ClusterTrustBundle 对象的支持，然后才能启用 `ClusterTrustBundleProjection` 特性门控。
152+
{{< /note >}}
153+
154+
<!--
155+
The `clusterTrustBundle` projected volume source injects the contents of one or more [ClusterTrustBundle](/docs/reference/access-authn-authz/certificate-signing-requests#cluster-trust-bundles) objects as an automatically-updating file in the container filesystem.
156+
-->
157+
`clusterTrustBundle` 投射卷源将一个或多个
158+
[ClusterTrustBundle](/zh-cn/docs/reference/access-authn-authz/certificate-signing-requests#cluster-trust-bundles)
159+
对象的内容作为一个自动更新的文件注入到容器文件系统中。
160+
161+
<!--
162+
ClusterTrustBundles can be selected either by [name](/docs/reference/access-authn-authz/certificate-signing-requests#ctb-signer-unlinked) or by [signer name](/docs/reference/access-authn-authz/certificate-signing-requests#ctb-signer-linked).
163+
-->
164+
ClusterTrustBundle 可以通过[名称](/zh-cn/docs/reference/access-authn-authz/certificate-signing-requests#ctb-signer-unlinked)
165+
或[签名者名称](/zh-cn/docs/reference/access-authn-authz/certificate-signing-requests#ctb-signer-linked)被选中。
166+
167+
<!--
168+
To select by name, use the `name` field to designate a single ClusterTrustBundle object.
169+
170+
To select by signer name, use the `signerName` field (and optionally the
171+
`labelSelector` field) to designate a set of ClusterTrustBundle objects that use
172+
the given signer name. If `labelSelector` is not present, then all
173+
ClusterTrustBundles for that signer are selected.
174+
-->
175+
要按名称选择，可以使用 `name` 字段指定单个 ClusterTrustBundle 对象。
176+
177+
要按签名者名称选择，可以使用 `signerName` 字段（也可选用 `labelSelector` 字段）
178+
指定一组使用给定签名者名称的 ClusterTrustBundle 对象。
179+
如果 `labelSelector` 不存在，则针对该签名者的所有 ClusterTrustBundles 将被选中。
180+
181+
<!--
182+
The kubelet deduplicates the certificates in the selected ClusterTrustBundle objects, normalizes the PEM representations (discarding comments and headers), reorders the certificates, and writes them into the file named by `path`. As the set of selected ClusterTrustBundles or their content changes, kubelet keeps the file up-to-date.
183+
-->
184+
kubelet 会对所选 ClusterTrustBundle 对象中的证书进行去重，规范化 PEM 表示（丢弃注释和头部），
185+
重新排序证书，并将这些证书写入由 `path` 指定的文件中。
186+
随着所选 ClusterTrustBundles 的集合或其内容发生变化，kubelet 会保持更新此文件。
187+
188+
<!--
189+
By default, the kubelet will prevent the pod from starting if the named ClusterTrustBundle is not found, or if `signerName` / `labelSelector` do not match any ClusterTrustBundles. If this behavior is not what you want, then set the `optional` field to `true`, and the pod will start up with an empty file at `path`.
190+
-->
191+
默认情况下，如果找不到指定的 ClusterTrustBundle，或者 `signerName` / `labelSelector`
192+
与所有 ClusterTrustBundle 都不匹配，kubelet 将阻止 Pod 启动。如果这不是你想要的行为，
193+
可以将 `optional` 字段设置为 `true`，Pod 将使用 `path` 处的空白文件启动。
194+
195+
{{% code_sample file="pods/storage/projected-clustertrustbundle.yaml" %}}
196+
136197
<!--
137198
## SecurityContext interactions
138199
-->
@@ -257,4 +318,3 @@ the Linux only `RunAsUser` option with Windows Pods.
257318
Pod 会一直阻塞在 `ContainerCreating` 状态。因此，建议不要在 Windows
258319
节点上使用仅针对 Linux 的 `RunAsUser` 选项。
259320
{{< /note >}}
260-

‎content/zh-cn/docs/concepts/storage/storage-classes.md

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,29 +27,25 @@ with [volumes](/docs/concepts/storage/volumes/) and
2727
<!-- body -->
2828

2929
<!--
30-
## Introduction
31-
3230
A StorageClass provides a way for administrators to describe the "classes" of
3331
storage they offer. Different classes might map to quality-of-service levels,
3432
or to backup policies, or to arbitrary policies determined by the cluster
3533
administrators. Kubernetes itself is unopinionated about what classes
3634
represent. This concept is sometimes called "profiles" in other storage
3735
systems.
3836
-->
39-
## 介绍 {#introduction}
40-
4137
StorageClass 为管理员提供了描述存储"类"的方法。
4238
不同的类型可能会映射到不同的服务质量等级或备份策略，或是由集群管理员制定的任意策略。
4339
Kubernetes 本身并不清楚各种类代表的什么。这个类的概念在其他存储系统中有时被称为"配置文件"。
4440

4541
<!--
46-
## The StorageClass Resource
42+
## The StorageClass API
4743
4844
Each StorageClass contains the fields `provisioner`, `parameters`, and
4945
`reclaimPolicy`, which are used when a PersistentVolume belonging to the
5046
class needs to be dynamically provisioned.
5147
-->
52-
## StorageClass 资源 {#the-storageclass-resource}
48+
## StorageClass API {#the-storageclass-api}
5349

5450
每个 StorageClass 都包含 `provisioner`、`parameters` 和 `reclaimPolicy` 字段，
5551
这些字段会在 StorageClass 需要动态制备 PersistentVolume 时会使用到。

‎content/zh-cn/examples/pods/storage/projected-clustertrustbundle.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: sa-ctb-name-test
5+
spec:
6+
containers:
7+
- name: container-test
8+
image: busybox
9+
command: ["sleep", "3600"]
10+
volumeMounts:
11+
- name: token-vol
12+
mountPath: "/root-certificates"
13+
readOnly: true
14+
serviceAccountName: default
15+
volumes:
16+
- name: root-certificates-vol
17+
projected:
18+
sources:
19+
- clusterTrustBundle:
20+
name: example
21+
path: example-roots.pem
22+
- clusterTrustBundle:
23+
signerName: "example.com/mysigner"
24+
labelSelector:
25+
matchLabels:
26+
version: live
27+
path: mysigner-roots.pem
28+
optional: true

0 commit comments

Comments
 (0)