Skip to content

Commit f652ea8

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #33827 from nameYULI/yl31
[zh]Sync reference-12
2 parents b644fa9 + 1194831 commit f652ea8

File tree

2 files changed

+146
-140
lines changed

2 files changed

+146
-140
lines changed

‎content/zh/docs/reference/access-authn-authz/admission-controllers.md

Lines changed: 48 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ In the current version, the default ones are:
167167
在目前版本中，它们是：
168168

169169
```shell
170-
CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, LimitRanger, MutatingAdmissionWebhook, NamespaceLifecycle, PersistentVolumeClaimResize, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionWebhook
170+
CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, LimitRanger, MutatingAdmissionWebhook, NamespaceLifecycle, PersistentVolumeClaimResize, PodSecurity, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionWebhook
171171
```
172172

173173
<!--
@@ -437,8 +437,7 @@ plugins:
437437
path: eventconfig.yaml
438438
...
439439
```
440-
{{% /tab %}}
441-
{{% tab name="apiserver.k8s.io/v1alpha1" %}}
440+
442441
```yaml
443442
# Deprecated in v1.17 in favor of apiserver.config.k8s.io/v1
444443
apiVersion: apiserver.k8s.io/v1alpha1
@@ -448,8 +447,6 @@ plugins:
448447
path: eventconfig.yaml
449448
...
450449
```
451-
{{% /tab %}}
452-
{{< /tabs >}}
453450

454451
<!--
455452
There are four types of limits that can be specified in the configuration:
@@ -487,11 +484,11 @@ limits:
487484
```
488485
489486
<!--
490-
See the [EventRateLimit proposal](https://git.k8s.io/community/contributors/design-proposals/api-machinery/admission_control_event_rate_limit.md)
487+
See the [EventRateLimit Config API (v1alpha1)](/docs/reference/config-api/apiserver-eventratelimit.v1alpha1/)
491488
for more details.
492489
-->
493490
详情请参见
494-
[事件速率限制提案](https://git.k8s.io/community/contributors/design-proposals/api-machinery/admission_control_event_rate_limit.md)。
491+
[EventRateLimit 配置文档（v1alpha1）](/zh/docs/reference/config-api/apiserver-eventratelimit.v1alpha1/)。
495492
496493
### ExtendedResourceToleration {#extendedresourcetoleration}
497494
@@ -548,8 +545,6 @@ Reference the ImagePolicyWebhook configuration file from the file provided to th
548545
从文件中引用 ImagePolicyWebhook 的配置文件，并将其提供给 API 服务器命令标志
549546
`--admission-control-config-file`：
550547

551-
{{< tabs name="imagepolicywebhook_example1" >}}
552-
{{% tab name="apiserver.config.k8s.io/v1" %}}
553548
```yaml
554549
apiVersion: apiserver.config.k8s.io/v1
555550
kind: AdmissionConfiguration
@@ -558,27 +553,12 @@ plugins:
558553
path: imagepolicyconfig.yaml
559554
...
560555
```
561-
{{% /tab %}}
562-
{{% tab name="apiserver.k8s.io/v1alpha1" %}}
563-
```yaml
564-
# v1.17 中已废弃以鼓励使用 apiserver.config.k8s.io/v1
565-
apiVersion: apiserver.k8s.io/v1alpha1
566-
kind: AdmissionConfiguration
567-
plugins:
568-
- name: ImagePolicyWebhook
569-
path: imagepolicyconfig.yaml
570-
...
571-
```
572-
{{% /tab %}}
573-
{{< /tabs >}}
574556

575557
<!--
576558
Alternatively, you can embed the configuration directly in the file:
577559
-->
578560
或者，你也可以直接将配置嵌入到文件中：
579561

580-
{{< tabs name="imagepolicywebhook_example2" >}}
581-
{{% tab name="apiserver.config.k8s.io/v1" %}}
582562
```yaml
583563
apiVersion: apiserver.config.k8s.io/v1
584564
kind: AdmissionConfiguration
@@ -592,24 +572,6 @@ plugins:
592572
retryBackoff: 500
593573
defaultAllow: true
594574
```
595-
{{% /tab %}}
596-
{{% tab name="apiserver.k8s.io/v1alpha1" %}}
597-
```yaml
598-
# v1.17 中已废弃以鼓励使用 apiserver.config.k8s.io/v1
599-
apiVersion: apiserver.k8s.io/v1alpha1
600-
kind: AdmissionConfiguration
601-
plugins:
602-
- name: ImagePolicyWebhook
603-
configuration:
604-
imagePolicy:
605-
kubeConfigFile: <kubeconfig 文件路径>
606-
allowTTL: 50
607-
denyTTL: 50
608-
retryBackoff: 500
609-
defaultAllow: true
610-
```
611-
{{% /tab %}}
612-
{{< /tabs >}}
613575

614576
<!--
615577
The ImagePolicyWebhook config file must reference a
@@ -623,9 +585,9 @@ ImagePolicyWebhook 的配置文件必须引用
623585
要求后端使用 TLS 进行通信。
624586

625587
<!--
626-
The kubeconfig file's cluster field must point to the remote service, and the user field must contain the returned authorizer.
588+
The kubeconfig file's `cluster` field must point to the remote service, and the `user` field must contain the returned authorizer.
627589
-->
628-
kubeconfig 文件的 cluster 字段需要指向远端服务，user 字段需要包含已返回的授权者。
590+
kubeconfig 文件的 `cluster` 字段需要指向远端服务，user 字段需要包含已返回的授权者。
629591

630592
<!--
631593
```yaml
@@ -683,7 +645,7 @@ When faced with an admission decision, the API Server POSTs a JSON serialized `i
683645
Pod 注解。
684646

685647
<!--
686-
Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for alpha objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the imagepolicy.k8s.io/v1alpha1 API extensions group (`--runtime-config=imagepolicy.k8s.io/v1alpha1=true`).
648+
Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for alpha objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the `imagepolicy.k8s.io/v1alpha1` API extensions group (`--runtime-config=imagepolicy.k8s.io/v1alpha1=true`).
687649
-->
688650
注意，Webhook API 对象与其他 Kubernetes API 对象一样受制于相同的版本控制兼容性规则。
689651
实现者应该知道对 alpha 对象的更宽松的兼容性，并检查请求的 "apiVersion" 字段，
@@ -718,10 +680,10 @@ An example request body:
718680
```
719681

720682
<!--
721-
The remote service is expected to fill the `ImageReviewStatus` field of the request and respond to either allow or disallow access. The response body's "spec" field is ignored and may be omitted. A permissive response would return:
683+
The remote service is expected to fill the `ImageReviewStatus` field of the request and respond to either allow or disallow access. The response body's `spec` field is ignored and may be omitted. A permissive response would return:
722684
-->
723685
远程服务将填充请求的 `ImageReviewStatus` 字段，并返回允许或不允许访问的响应。
724-
响应体的 "spec" 字段会被忽略，并且可以省略。一个允许访问应答会返回：
686+
响应体的 `spec` 字段会被忽略，并且可以省略。一个允许访问应答会返回：
725687

726688
```json
727689
{
@@ -782,10 +744,9 @@ Examples of information you might put here are:
782744
* 向策略服务器提供一个提示，用于提供镜像的 imageID，以方便它进行查找。
783745

784746
<!--
785-
In any case, the annotations are provided by the user and are not validated by Kubernetes in any way. In the future, if an annotation is determined to be widely useful, it may be promoted to a named field of `ImageReviewSpec`.
747+
In any case, the annotations are provided by the user and are not validated by Kubernetes in any way.
786748
-->
787749
在任何情况下，注解都是由用户提供的，并不会被 Kubernetes 以任何方式进行验证。
788-
在将来，如果一个注解确定将被广泛使用，它可能会被提升为 ImageReviewSpec 的一个命名字段。
789750

790751
### LimitPodHardAntiAffinityTopology {#limitpodhardantiaffinitytopology}
791752

@@ -800,11 +761,12 @@ This admission controller denies any pod that defines `AntiAffinity` topology ke
800761
### LimitRanger {#limitranger}
801762

802763
<!--
803-
This admission controller will observe the incoming request and ensure that it does not violate any of the constraints
804-
enumerated in the `LimitRange` object in a `Namespace`. If you are using `LimitRange` objects in
805-
your Kubernetes deployment, you MUST use this admission controller to enforce those constraints. LimitRanger can also
806-
be used to apply default resource requests to Pods that don't specify any; currently, the default LimitRanger
807-
applies a 0.1 CPU requirement to all Pods in the `default` namespace.
764+
This admission controller will observe the incoming request and ensure that it does not violate
765+
any of the constraints enumerated in the `LimitRange` object in a `Namespace`. If you are using
766+
`LimitRange` objects in your Kubernetes deployment, you MUST use this admission controller to
767+
enforce those constraints. LimitRanger can also be used to apply default resource requests to Pods
768+
that don't specify any; currently, the default LimitRanger applies a 0.1 CPU requirement to all
769+
Pods in the `default` namespace.
808770
-->
809771
该准入控制器会观察传入的请求，并确保它不会违反 `Namespace` 中 `LimitRange`
810772
对象枚举的任何约束。
@@ -815,11 +777,12 @@ LimitRanger 还可以用于将默认资源请求应用到没有指定任何内
815777
0.1 CPU 的需求。
816778

817779
<!--
818-
See the [limitRange design doc](https://git.k8s.io/community/contributors/design-proposals/resource-management/admission_control_limit_range.md)
819-
and the [example of Limit Range](/docs/tasks/configure-pod-container/limit-range/) for more details.
780+
See the [LimitRange API reference](/docs/reference/kubernetes-api/policy-resources/limit-range-v1/)
781+
and the [example of LimitRange](/docs/tasks/administer-cluster/manage-resources/memory-default-namespace/)
782+
for more details.
820783
-->
821784
请查看
822-
[limitRange 设计文档](https://git.k8s.io/community/contributors/design-proposals/resource-management/admission_control_limit_range.md)
785+
[limitRange 设计文档](/zh/docs/reference/kubernetes-api/policy-resources/limit-range-v1/)
823786
和 [LimitRange 例子](/zh/docs/tasks/administer-cluster/manage-resources/memory-default-namespace/)
824787
以了解更多细节。
825788

@@ -903,18 +866,20 @@ If the namespace referenced from a request doesn't exist, the request is rejecte
903866
### NamespaceLifecycle {#namespacelifecycle}
904867

905868
<!--
906-
This admission controller enforces that a `Namespace` that is undergoing termination cannot have new objects created in it,
907-
and ensures that requests in a non-existent `Namespace` are rejected. This admission controller also prevents deletion of
908-
three system reserved namespaces `default`, `kube-system`, `kube-public`.
869+
This admission controller enforces that a `Namespace` that is undergoing termination cannot have
870+
new objects created in it, and ensures that requests in a non-existent `Namespace` are rejected.
871+
This admission controller also prevents deletion of three system reserved namespaces `default`,
872+
`kube-system`, `kube-public`.
909873
-->
910874
该准入控制器禁止在一个正在被终止的 `Namespace` 中创建新对象，并确保
911875
使用不存在的 `Namespace` 的请求被拒绝。
912876
该准入控制器还会禁止删除三个系统保留的名字空间，即 `default`、
913877
`kube-system` 和 `kube-public`。
914878

915879
<!--
916-
A `Namespace` deletion kicks off a sequence of operations that remove all objects (pods, services, etc.) in that
917-
namespace. In order to enforce integrity of that process, we strongly recommend running this admission controller.
880+
A `Namespace` deletion kicks off a sequence of operations that remove all objects (pods, services,
881+
etc.) in that namespace. In order to enforce integrity of that process, we strongly recommend
882+
running this admission controller.
918883
-->
919884
删除 `Namespace` 会触发删除该名字空间中所有对象（Pod、Service 等）的一系列操作。
920885
为了确保这个过程的完整性，我们强烈建议启用这个准入控制器。
@@ -932,16 +897,15 @@ Such kubelets will only be allowed to modify their own `Node` API object, and on
932897
这样，kubelet 只可修改自己的 `Node` API 对象，只能修改绑定到节点本身的 Pod 对象。
933898

934899
<!--
935-
In Kubernetes 1.11+, kubelets are not allowed to update or remove taints from their `Node` API object.
900+
kubelets are not allowed to update or remove taints from their `Node` API object.
936901

937-
In Kubernetes 1.13+, the `NodeRestriction` admission plugin prevents kubelets from deleting their `Node` API object,
902+
The `NodeRestriction` admission plugin prevents kubelets from deleting their `Node` API object,
938903
and enforces kubelet modification of labels under the `kubernetes.io/` or `k8s.io/` prefixes as follows:
939904
-->
940-
在 Kubernetes 1.11+ 的版本中，不允许 kubelet 从 `Node` API 对象中更新或删除污点。
905+
不允许 kubelet 在 `Node` API 对象上更新或删除污点。
941906

942-
在 Kubernetes 1.13+ 的版本中，`NodeRestriction` 准入插件可防止 kubelet 删除
943-
`Node` API 对象，并对 `kubernetes.io/` 或 `k8s.io/` 前缀标签的 kubelet
944-
强制进行如下修改：
907+
`NodeRestriction` 准入插件可防止 kubelet 删除`Node` API 对象，
908+
并对 `kubernetes.io/` 或 `k8s.io/` 前缀标签的 kubelet 强制进行如下修改：
945909

946910
<!--
947911
* **Prevents** kubelets from adding/removing/updating labels with a `node-restriction.kubernetes.io/` prefix.
@@ -992,30 +956,20 @@ subresource of the referenced *owner* can change it.
992956

993957
### PersistentVolumeClaimResize {#persistentvolumeclaimresize}
994958

959+
{{< feature-state for_k8s_version="v1.24" state="stable" >}}
960+
995961
<!--
996962
This admission controller implements additional validations for checking incoming `PersistentVolumeClaim` resize requests.
997963
-->
998964
该准入控制器检查传入的 `PersistentVolumeClaim` 调整大小请求，对其执行额外的验证操作。
999965

1000-
{{< note >}}
1001-
<!--
1002-
Support for volume resizing is available as a beta feature. As a cluster administrator,
1003-
you must ensure that the feature gate `ExpandPersistentVolumes` is set
1004-
to `true` to enable resizing.
1005-
-->
1006-
对调整卷大小的支持是一种 Beta 特性。作为集群管理员，你必须确保特性门控 `ExpandPersistentVolumes`
1007-
设置为 `true` 才能启用调整大小。
1008-
{{< /note >}}
1009-
1010966
<!--
1011-
After enabling the `ExpandPersistentVolumes` feature gate, enabling the `PersistentVolumeClaimResize` admission
1012-
controller is recommended, too. This admission controller prevents resizing of all claims by default unless a claim's `StorageClass`
967+
Enabling the `PersistentVolumeClaimResize` admission controller is recommended. This admission controller prevents resizing of all claims by default unless a claim's `StorageClass`
1013968
explicitly enables resizing by setting `allowVolumeExpansion` to `true`.
1014969

1015970
For example: all `PersistentVolumeClaim`s created from the following `StorageClass` support volume expansion:
1016971
-->
1017-
启用 `ExpandPersistentVolumes` 特性门控之后，建议将 `PersistentVolumeClaimResize`
1018-
准入控制器也启用。除非 PVC 的 `StorageClass` 明确地将 `allowVolumeExpansion` 设置为
972+
建议启用 `PersistentVolumeClaimResize` 准入控制器。除非 PVC 的 `StorageClass` 明确地将 `allowVolumeExpansion` 设置为
1019973
`true` 来显式启用调整大小。否则，默认情况下该准入控制器会阻止所有对 PVC 大小的调整。
1020974

1021975
例如：由以下 `StorageClass` 创建的所有 `PersistentVolumeClaim` 都支持卷容量扩充：
@@ -1099,8 +1053,6 @@ Reference the `PodNodeSelector` configuration file from the file provided to the
10991053
基于提供给 API 服务器命令行标志 `--admission-control-config-file` 的文件名，
11001054
从文件中引用 `PodNodeSelector` 配置文件：
11011055

1102-
{{< tabs name="podnodeselector_example1" >}}
1103-
{{% tab name="apiserver.config.k8s.io/v1" %}}
11041056
```yaml
11051057
apiVersion: apiserver.config.k8s.io/v1
11061058
kind: AdmissionConfiguration
@@ -1109,19 +1061,6 @@ plugins:
11091061
path: podnodeselector.yaml
11101062
...
11111063
```
1112-
{{% /tab %}}
1113-
{{% tab name="apiserver.k8s.io/v1alpha1" %}}
1114-
```yaml
1115-
# 在 v1.17 中废弃，以鼓励使用 apiserver.config.k8s.io/v1
1116-
apiVersion: apiserver.k8s.io/v1alpha1
1117-
kind: AdmissionConfiguration
1118-
plugins:
1119-
- name: PodNodeSelector
1120-
path: podnodeselector.yaml
1121-
...
1122-
```
1123-
{{% /tab %}}
1124-
{{< /tabs >}}
11251064

11261065
<!--
11271066
#### Configuration Annotation Format
@@ -1283,21 +1222,26 @@ objects in your Kubernetes deployment, you MUST use this admission controller to
12831222
执行配额限制。
12841223

12851224
<!--
1286-
See the [resourceQuota design doc](https://git.k8s.io/community/contributors/design-proposals/resource-management/admission_control_resource_quota.md) and the [example of Resource Quota](/docs/concepts/policy/resource-quotas/) for more details.
1225+
See the [ResourceQuota API reference](/docs/reference/kubernetes-api/policy-resources/resource-quota-v1/)
1226+
and the [example of Resource Quota](/docs/concepts/policy/resource-quotas/) for more details.
12871227
-->
12881228
请查看
1289-
[resourceQuota 设计文档](https://git.k8s.io/community/contributors/design-proposals/admission_control_resource_quota.md)和 [Resource Quota 例子](/zh/docs/concepts/policy/resource-quotas/)
1290-
了解更多细节。
1229+
[resourceQuota API 参考](/zh/docs/reference/kubernetes-api/policy-resources/resource-quota-v1/)
1230+
和 [Resource Quota 例子](/zh/docs/concepts/policy/resource-quotas/)了解更多细节。
12911231

12921232

12931233
<!--
12941234
### RuntimeClass {#runtimeclass}
12951235

12961236
{{< feature-state for_k8s_version="v1.20" state="stable" >}}
12971237

1298-
If you enable the `PodOverhead` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/), and define a RuntimeClass with [Pod overhead](/docs/concepts/scheduling-eviction/pod-overhead/) configured, this admission controller checks incoming
1299-
Pods. When enabled, this admission controller rejects any Pod create requests that have the overhead already set.
1300-
For Pods that have a RuntimeClass is configured and selected in their `.spec`, this admission controller sets `.spec.overhead` in the Pod based on the value defined in the corresponding RuntimeClass.
1238+
If you define a RuntimeClass with [Pod overhead](/docs/concepts/scheduling-eviction/pod-overhead/)
1239+
configured, this admission controller checks incoming Pods.
1240+
When enabled, this admission controller rejects any Pod create requests
1241+
that have the overhead already set.
1242+
For Pods that have a RuntimeClass configured and selected in their `.spec`,
1243+
this admission controller sets `.spec.overhead` in the Pod based on the value
1244+
defined in the corresponding RuntimeClass.
13011245

13021246
{{< note >}}
13031247
The `.spec.overhead` field for Pod and the `.overhead` field for RuntimeClass are both in beta. If you do not enable the `PodOverhead` feature gate, all Pods are treated as if `.spec.overhead` is unset.
@@ -1310,9 +1254,7 @@ for more information.
13101254

13111255
+{{< feature-state for_k8s_version="v1.20" state="stable" >}}
13121256

1313-
如果你开启 `PodOverhead`
1314-
[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/),
1315-
并且通过 [Pod 开销](/zh/docs/concepts/scheduling-eviction/pod-overhead/)
1257+
如果你通过 [Pod 开销](/zh/docs/concepts/scheduling-eviction/pod-overhead/)
13161258
配置来定义一个 RuntimeClass，这个准入控制器会检查新的 Pod。
13171259
当启用的时候，这个准入控制器会拒绝任何 overhead 字段已经设置的 Pod。
13181260
对于配置了 RuntimeClass 并在其 `.spec` 中选定 RuntimeClass 的 Pod，
@@ -1438,11 +1380,3 @@ Yes. The recommended admission controllers are enabled by default (shown [here](
14381380
（请查看[这里](/zh/docs/reference/command-line-tools-reference/kube-apiserver/#options)）。
14391381
因此，你无需显式指定它们。
14401382
你可以使用 `--enable-admission-plugins` 标志（ **顺序不重要** ）来启用默认设置以外的其他准入控制器。
1441-
1442-
{{< note >}}
1443-
<!--
1444-
`--admission-control` was deprecated in 1.10 and replaced with `--enable-admission-plugins`.
1445-
-->
1446-
`--admission-control` 在 1.10 中已废弃，由 `--enable-admission-plugins` 取代。
1447-
{{< /note >}}
1448-

0 commit comments

Comments
 (0)