Skip to content

Commit 25b65c2

Browse files
my-git9my-git9
committed
[zh-cn] sync kubernetes-api/authentication-resources/*
Signed-off-by: xin.li <[email protected]>
1 parent 7af045c commit 25b65c2

5 files changed

Lines changed: 73 additions & 32 deletions

File tree

‎content/zh-cn/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1.md‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,6 @@ weight: 4
2121
auto_generated: true
2222
-->
2323

24-
<!--
25-
`apiVersion: certificates.k8s.io/v1`
26-
27-
`import "k8s.io/api/certificates/v1"`
28-
-->
2924
`apiVersion: certificates.k8s.io/v1`
3025

3126
`import "k8s.io/api/certificates/v1"`
@@ -44,7 +39,7 @@ Kubelets use this API to obtain:
4439
-->
4540
CertificateSigningRequest 对象提供了一种通过提交证书签名请求并异步批准和颁发 x509 证书的机制。
4641

47-
Kubelets 使用 CertificateSigningRequest API 来获取：
42+
kubelet 使用 CertificateSigningRequest API 来获取：
4843

4944
1. 向 kube-apiserver 进行身份认证的客户端证书（使用 “kubernetes.io/kube-apiserver-client-kubelet” signerName）。
5045
2. kube-apiserver 可以安全连接到 TLS 端点的服务证书（使用 “kubernetes.io/kubelet-serving” signerName）。
@@ -81,7 +76,7 @@ or to obtain certificates from custom non-Kubernetes signers.
8176
Other fields are derived by Kubernetes and cannot be modified by users.
8277
-->
8378
- **spec** (<a href="{{< ref "../authentication-resources/certificate-signing-request-v1#CertificateSigningRequestSpec" >}}">
84-
CertificateSigningRequestSpec</a>)，必需
79+
CertificateSigningRequestSpec</a>)，必需
8580

8681
spec 包含证书请求，并且在创建后是不可变的。
8782
只有 request、signerName、expirationSeconds 和 usages 字段可以在创建时设置。
@@ -109,6 +104,7 @@ CertificateSigningRequestSpec contains the certificate request.
109104
CertificateSigningRequestSpec 包含证书请求。
110105

111106
<hr>
107+
112108
<!--
113109
- **request** ([]byte), required
114110
@@ -220,7 +216,7 @@ CertificateSigningRequestSpec 包含证书请求。
220216
221217
The minimum valid value for expirationSeconds is 600, i.e. 10 minutes.
222218
-->
223-
由于各种原因，证书签名者可能忽略此字段:
219+
由于各种原因，证书签名者可能忽略此字段：
224220

225221
1. 不认识此字段的旧签名者(如 v1.22 版本之前的实现)
226222
2. 配置的最大持续时间小于请求持续时间的签名者
@@ -321,8 +317,6 @@ CertificateSigningRequestSpec 包含证书请求。
321317
322318
CertificateSigningRequestStatus contains conditions used to indicate approved/denied/failed status of the request,
323319
and the issued certificate.
324-
325-
<hr>
326320
-->
327321
## CertificateSigningRequestStatus {#CertificateSigningRequestStatus}
328322

@@ -358,7 +352,7 @@ CertificateSigningRequestStatus 包含用于指示请求的批准/拒绝/失败
358352
3. Non-PEM content may appear before or after the "CERTIFICATE" PEM blocks and is unvalidated,
359353
to allow for explanatory text as described in section 5.2 of RFC7468.
360354
-->
361-
验证要求:
355+
验证要求：
362356

363357
1. 证书必须包含一个或多个 PEM 块。
364358
2. 所有的 PEM 块必须有 “CERTIFICATE” 标签，不包含头和编码的数据，
@@ -387,7 +381,7 @@ CertificateSigningRequestStatus 包含用于指示请求的批准/拒绝/失败
387381
-->
388382
证书编码为 PEM 格式。
389383

390-
当序列化为 JSON 或 YAML 时，数据额外采用 base64 编码，它包括:
384+
当序列化为 JSON 或 YAML 时，数据额外采用 base64 编码，它包括：
391385

392386
```
393387
base64(
@@ -1432,6 +1426,10 @@ DELETE /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}
14321426
14331427
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
14341428
1429+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (*in query*): boolean
1430+
1431+
<a href="{{< ref "../common-parameters/common-parameters#ignoreStoreReadErrorWithClusterBreakingPotential" >}}">ignoreStoreReadErrorWithClusterBreakingPotential</a>
1432+
14351433
- **pretty** (*in query*): string
14361434
14371435
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
@@ -1444,6 +1442,10 @@ DELETE /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}
14441442

14451443
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
14461444

1445+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (**查询参数**): boolean
1446+
1447+
<a href="{{< ref "../common-parameters/common-parameters#ignoreStoreReadErrorWithClusterBreakingPotential" >}}">ignoreStoreReadErrorWithClusterBreakingPotential</a>
1448+
14471449
- **pretty** (**查询参数**): string
14481450

14491451
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
@@ -1520,6 +1522,10 @@ DELETE /apis/certificates.k8s.io/v1/certificatesigningrequests
15201522
15211523
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
15221524
1525+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (*in query*): boolean
1526+
1527+
<a href="{{< ref "../common-parameters/common-parameters#ignoreStoreReadErrorWithClusterBreakingPotential" >}}">ignoreStoreReadErrorWithClusterBreakingPotential</a>
1528+
15231529
- **labelSelector** (*in query*): string
15241530
15251531
<a href="{{< ref "../common-parameters/common-parameters#labelSelector" >}}">labelSelector</a>
@@ -1536,6 +1542,10 @@ DELETE /apis/certificates.k8s.io/v1/certificatesigningrequests
15361542

15371543
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
15381544

1545+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (**查询参数**): boolean
1546+
1547+
<a href="{{< ref "../common-parameters/common-parameters#ignoreStoreReadErrorWithClusterBreakingPotential" >}}">ignoreStoreReadErrorWithClusterBreakingPotential</a>
1548+
15391549
- **labelSelector** (**查询参数**): string
15401550

15411551
<a href="{{< ref "../common-parameters/common-parameters#labelSelector" >}}">labelSelector</a>

‎content/zh-cn/docs/reference/kubernetes-api/authentication-resources/cluster-trust-bundle-v1alpha1.md‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,8 @@ ClusterTrustBundleSpec 包含签名程序和信任锚。
132132

133133
如果 signerName 为空，则 ClusterTrustBundle 对象的名称不能具有此类前缀。
134134

135-
针对 ClusterTrustBundles 的列举/监视请求可以使用 `spec.signerName=NAME` 字段选择算符针对此字段进行过滤。
135+
针对 ClusterTrustBundles 的列举/监视请求可以使用 `spec.signerName=NAME`
136+
字段选择算符针对此字段进行过滤。
136137

137138
## ClusterTrustBundleList {#ClusterTrustBundleList}
138139

@@ -489,6 +490,7 @@ DELETE /apis/certificates.k8s.io/v1alpha1/clustertrustbundles/{name}
489490
- **body**: <a href="{{< ref "../common-definitions/delete-options#DeleteOptions" >}}">DeleteOptions</a>
490491
- **dryRun** (*in query*): string
491492
- **gracePeriodSeconds** (*in query*): integer
493+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (*in query*): boolean
492494
- **pretty** (*in query*): string
493495
- **propagationPolicy** (*in query*): string
494496
-->
@@ -508,6 +510,10 @@ DELETE /apis/certificates.k8s.io/v1alpha1/clustertrustbundles/{name}
508510

509511
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
510512

513+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (**查询参数**): boolean
514+
515+
<a href="{{< ref "../common-parameters/common-parameters#ignoreStoreReadErrorWithClusterBreakingPotential" >}}">ignoreStoreReadErrorWithClusterBreakingPotential</a>
516+
511517
- **pretty**（**查询参数**）：string
512518

513519
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
@@ -546,6 +552,7 @@ DELETE /apis/certificates.k8s.io/v1alpha1/clustertrustbundles
546552
- **dryRun** (*in query*): string
547553
- **fieldSelector** (*in query*): string
548554
- **gracePeriodSeconds** (*in query*): integer
555+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (*in query*): boolean
549556
- **labelSelector** (*in query*): string
550557
- **limit** (*in query*): integer
551558
- **pretty** (*in query*): string
@@ -575,6 +582,10 @@ DELETE /apis/certificates.k8s.io/v1alpha1/clustertrustbundles
575582

576583
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
577584

585+
- **ignoreStoreReadErrorWithClusterBreakingPotential**（**查询参数**）：boolean
586+
587+
<a href="{{< ref "../common-parameters/common-parameters#ignoreStoreReadErrorWithClusterBreakingPotential" >}}">ignoreStoreReadErrorWithClusterBreakingPotential</a>
588+
578589
- **labelSelector**（**查询参数**）：string
579590

580591
<a href="{{< ref "../common-parameters/common-parameters#labelSelector" >}}">labelSelector</a>

‎content/zh-cn/docs/reference/kubernetes-api/authentication-resources/service-account-v1.md‎

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -78,22 +78,25 @@ ServiceAccount 将以下内容绑定在一起：
7878
7979
*Map: unique values on key name will be kept during a merge*
8080
81-
Secrets is a list of the secrets in the same namespace that pods running using this ServiceAccount are allowed to use. Pods are only limited to this list if this service account has a "kubernetes.io/enforce-mountable-secrets" annotation set to "true". This field should not be used to find auto-generated service account token secrets for use outside of pods. Instead, tokens can be requested directly using the TokenRequest API, or service account token secrets can be manually created. More info: https://kubernetes.io/docs/concepts/configuration/secret
82-
Secrets is a list of the secrets in the same namespace that pods running using this ServiceAccount are allowed to use
83-
Pods are only limited to this list if this service account has a "kubernetes.io/enforce-mountabl
84-
-secrets" annotation set to "true". This field should not be used to find auto-generated service accoun
85-
token secrets for use outside of pods. Instead, tokens can be requested directly using the TokenRequest API, or servic
86-
account token secrets can be manually created. More info: https://kubernetes.io/docs/concepts/configuration/secret
81+
Secrets is a list of the secrets in the same namespace that pods running using this ServiceAccount are allowed to use.
82+
Pods are only limited to this list if this service account has a "kubernetes.io/enforce-mountable-secrets" annotation set to "true".
83+
The "kubernetes.io/enforce-mountable-secrets" annotation is deprecated since v1.32.
84+
Prefer separate namespaces to isolate access to mounted secrets.
85+
This field should not be used to find auto-generated service account token secrets for use outside of pods.
86+
Instead, tokens can be requested directly using the TokenRequest API, or service account token secrets can be manually created.
87+
More info: https://kubernetes.io/docs/concepts/configuration/secret
8788
-->
8889
**补丁策略：基于键 `name` 合并**
8990

9091
**映射：键 `name` 的唯一值将在合并过程中保留**
9192

9293
secrets 是允许使用此 ServiceAccount 运行的 Pod 使用的同一命名空间中的秘密列表。
9394
仅当此服务帐户的 “kubernetes.io/enforce-mountable-secrets” 注释设置为 “true” 时，Pod 才限于此列表。
95+
**已弃用：**自 v1.32 起，`kubernetes.io/enforce-mountable-secrets` 注解已被弃用。
96+
建议使用单独的命名空间来隔离对挂载密钥的访问。
9497
此字段不应用于查找自动生成的服务帐户令牌机密以在 Pod 之外使用。
9598
相反，可以使用 TokenRequest API 直接请求令牌，或者可以手动创建服务帐户令牌 Secret。
96-
更多信息： https://kubernetes.io/zh-cn/docs/concepts/configuration/secret
99+
更多信息：https://kubernetes.io/zh-cn/docs/concepts/configuration/secret
97100

98101
## ServiceAccountList {#ServiceAccountList}
99102

@@ -155,7 +158,7 @@ GET /api/v1/namespaces/{namespace}/serviceaccounts/{name}
155158
156159
name of the ServiceAccount
157160
-->
158-
- **name** (**路径参数**): string, 必需
161+
- **name** (**路径参数**): string，必需
159162

160163
ServiceAccount 的名称。
161164

@@ -226,7 +229,6 @@ GET /api/v1/namespaces/{namespace}/serviceaccounts
226229

227230
<a href="{{< ref "../common-parameters/common-parameters#fieldSelector" >}}">fieldSelector</a>
228231

229-
230232
<!--
231233
- **labelSelector** (*in query*): string
232234
-->
@@ -288,7 +290,6 @@ GET /api/v1/namespaces/{namespace}/serviceaccounts
288290
-->
289291
#### 响应
290292

291-
292293
200 (<a href="{{< ref "../authentication-resources/service-account-v1#ServiceAccountList" >}}">ServiceAccountList</a>): OK
293294

294295
401: Unauthorized
@@ -370,7 +371,7 @@ GET /api/v1/serviceaccounts
370371
-->
371372
- **sendInitialEvents** (**查询参数**): boolean
372373

373-
<a href="{{< ref "../common-parameters/common-parameters#sendInitialEvents" >}}">sendInitialEvents</a>
374+
<a href="{{< ref "../common-parameters/common-parameters#sendInitialEvents" >}}">sendInitialEvents</a>
374375

375376
<!--
376377
- **timeoutSeconds** (*in query*): integer
@@ -572,7 +573,6 @@ PATCH /api/v1/namespaces/{namespace}/serviceaccounts/{name}
572573

573574
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
574575

575-
576576
- **body**: <a href="{{< ref "../common-definitions/patch#Patch" >}}">Patch</a>, required
577577

578578
<!--
@@ -669,6 +669,13 @@ DELETE /api/v1/namespaces/{namespace}/serviceaccounts/{name}
669669

670670
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
671671

672+
<!--
673+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (*in query*): boolean
674+
-->
675+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (**查询参数**): boolean
676+
677+
<a href="{{< ref "../common-parameters/common-parameters#ignoreStoreReadErrorWithClusterBreakingPotential" >}}">ignoreStoreReadErrorWithClusterBreakingPotential</a>
678+
672679
<!--
673680
- **pretty** (*in query*): string
674681
-->
@@ -744,6 +751,13 @@ DELETE /api/v1/namespaces/{namespace}/serviceaccounts
744751

745752
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
746753

754+
<!--
755+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (*in query*): boolean
756+
-->
757+
- **ignoreStoreReadErrorWithClusterBreakingPotential** (**查询参数**): boolean
758+
759+
<a href="{{< ref "../common-parameters/common-parameters#ignoreStoreReadErrorWithClusterBreakingPotential" >}}">ignoreStoreReadErrorWithClusterBreakingPotential</a>
760+
747761
<!--
748762
- **labelSelector** (*in query*): string
749763
-->

‎content/zh-cn/docs/reference/kubernetes-api/authentication-resources/token-request-v1.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ auto_generated: true
2525
`import "k8s.io/api/authentication/v1"`
2626

2727
## TokenRequest {#TokenRequest}
28+
2829
<!--
2930
TokenRequest requests a token for a given service account.
3031
-->
@@ -60,6 +61,7 @@ TokenRequest 为给定的服务账号请求一个令牌。
6061
status 由服务器填充，表示该令牌是否可用于身份认证。
6162

6263
## TokenRequestSpec {#TokenRequestSpec}
64+
6365
<!--
6466
TokenRequestSpec contains client provided parameters of a token request.
6567
-->
@@ -110,6 +112,7 @@ TokenRequestSpec 包含客户端提供的令牌请求参数。
110112
- **boundObjectRef.uid** (string)
111113
UID of the referent.
112114
-->
115+
113116
- **boundObjectRef.apiVersion** (string)
114117

115118
引用对象的 API 版本。
@@ -136,6 +139,7 @@ TokenRequestSpec 包含客户端提供的令牌请求参数。
136139
令牌签发方可能返回一个生效期不同的令牌，因此客户端需要检查响应中的 “expiration” 字段。
137140

138141
## TokenRequestStatus {#TokenRequestStatus}
142+
139143
<!--
140144
TokenRequestStatus is the result of a token request.
141145
-->
@@ -171,10 +175,13 @@ TokenRequestStatus 是一个令牌请求的结果。
171175
#### HTTP Request
172176
-->
173177
## 操作 {#Operations}
178+
174179
<hr>
175180

176181
### `create` 创建 ServiceAccount 的令牌
182+
177183
#### HTTP 请求
184+
178185
POST /api/v1/namespaces/{namespace}/serviceaccounts/{name}/token
179186

180187
<!--
@@ -189,6 +196,7 @@ POST /api/v1/namespaces/{namespace}/serviceaccounts/{name}/token
189196
- **pretty** (*in query*): string
190197
-->
191198
#### 参数
199+
192200
- **name** (**路径参数**): string，必需
193201

194202
TokenRequest 的名称
@@ -219,11 +227,11 @@ POST /api/v1/namespaces/{namespace}/serviceaccounts/{name}/token
219227
#### Response
220228
-->
221229
#### 响应
230+
222231
200 (<a href="{{< ref "../authentication-resources/token-request-v1#TokenRequest" >}}">TokenRequest</a>): OK
223232

224233
201 (<a href="{{< ref "../authentication-resources/token-request-v1#TokenRequest" >}}">TokenRequest</a>): Created
225234

226235
202 (<a href="{{< ref "../authentication-resources/token-request-v1#TokenRequest" >}}">TokenRequest</a>): Accepted
227236

228237
401: Unauthorized
229-

‎content/zh-cn/docs/reference/kubernetes-api/authentication-resources/token-review-v1.md‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ TokenReview attempts to authenticate a token to a known user. Note: TokenReview
3333
## TokenReview {#TokenReview}
3434

3535
TokenReview 尝试通过验证令牌来确认已知用户。
36-
注意：TokenReview 请求可能会被 kube-apiserver 中的 webhook 令牌验证器插件缓存。
36+
注意：TokenReview 请求可能会被 kube-apiserver 中的 Webhook 令牌验证器插件缓存。
3737

3838
<hr>
3939

@@ -64,7 +64,6 @@ TokenReview 尝试通过验证令牌来确认已知用户。
6464
-->
6565
status 由服务器填写，指示请求是否可以通过身份验证。
6666

67-
6867
## TokenReviewSpec {#TokenReviewSpec}
6968

7069
<!--
@@ -151,7 +150,7 @@ TokenReviewStatus 是令牌认证请求的结果。
151150
<!--
152151
Any additional information provided by the authenticator.
153152
-->
154-
验证者提供的任何附加信息。
153+
验证者提供的任何附加信息。
155154

156155
- **user.groups** ([]string)
157156

@@ -171,14 +170,14 @@ TokenReviewStatus 是令牌认证请求的结果。
171170
<!--
172171
A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.
173172
-->
174-
跨时间标识此用户的唯一值。如果删除此用户并添加另一个同名用户，他们将拥有不同的 UID。
173+
跨时间标识此用户的唯一值。如果删除此用户并添加另一个同名用户，他们将拥有不同的 UID。
175174

176175
- **user.username** (string)
177176

178177
<!--
179178
The name that uniquely identifies this user among all active users.
180179
-->
181-
在所有活跃用户中唯一标识此用户的名称。
180+
在所有活跃用户中唯一标识此用户的名称。
182181

183182
<!--
184183
## Operations {#Operations}
@@ -234,4 +233,3 @@ POST /apis/authentication.k8s.io/v1/tokenreviews
234233
202 (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>): Accepted
235234

236235
401: Unauthorized
237-

0 commit comments

Comments
 (0)