Skip to content

Commit 5703a3b

Browse files
windsonseawindsonsea
committed
[zh] Sync configure-pod-container/security-context.md
1 parent a2076df commit 5703a3b

1 file changed

Lines changed: 122 additions & 13 deletions

File tree

‎content/zh-cn/docs/tasks/configure-pod-container/security-context.md‎

Lines changed: 122 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -922,11 +922,8 @@ Valid options for `type` include `RuntimeDefault`, `Unconfined`, and
922922
indicates the path of the pre-configured profile on the node, relative to the
923923
kubelet's configured Seccomp profile location (configured with the `--root-dir`
924924
flag).
925-
926-
Here is an example that sets the Seccomp profile to the node's container runtime
927-
default profile:
928925
-->
929-
## 为容器设置 Seccomp 配置
926+
## 为容器设置 Seccomp 配置
930927

931928
若要为容器设置 Seccomp 配置（Profile），可在你的 Pod 或 Container 清单的
932929
`securityContext` 节中包含 `seccompProfile` 字段。该字段是一个
@@ -937,6 +934,10 @@ default profile:
937934
该字段标明节点上预先设定的配置的路径，路径是相对于 kubelet 所配置的
938935
Seccomp 配置路径（使用 `--root-dir` 设置）而言的。
939936

937+
<!--
938+
Here is an example that sets the Seccomp profile to the node's container runtime
939+
default profile:
940+
-->
940941
下面是一个例子，设置容器使用节点上容器运行时的默认配置作为 Seccomp 配置：
941942

942943
```yaml
@@ -1088,17 +1089,16 @@ Kubernetes v1.27 引入了此行为的早期受限形式，仅适用于使用 `R
10881089
访问模式的卷（和 PersistentVolumeClaim）。
10891090

10901091
<!--
1091-
As an alpha feature, you can enable the `SELinuxMount`
1092-
[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) to widen that
1092+
As an alpha feature, you can enable the `SELinuxMount` and `SELinuxChangePolicy`
1093+
[feature gates](/docs/reference/command-line-tools-reference/feature-gates/) to widen that
10931094
performance improvement to other kinds of PersistentVolumeClaims, as explained in detail
10941095
below.
10951096
-->
1096-
作为一项 Alpha 特性，你可以启用 `SELinuxMount`
1097+
作为一项 Alpha 特性，你可以启用 `SELinuxMount` 和 `SELinuxChangePolicy`
10971098
[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/)，
10981099
将性能改进扩展到其他类型的 PersistentVolumeClaim，如下文详细解释。
10991100
{{< /note >}}
11001101

1101-
11021102
<!--
11031103
By default, the container runtime recursively assigns SELinux label to all
11041104
files on all Pod volumes. To speed up this process, Kubernetes can change the
@@ -1123,12 +1123,16 @@ To benefit from this speedup, all these conditions must be met:
11231123
<!--
11241124
* Pod must use PersistentVolumeClaim with applicable `accessModes` and [feature gates](/docs/reference/command-line-tools-reference/feature-gates/):
11251125
* Either the volume has `accessModes: ["ReadWriteOncePod"]`, and feature gate `SELinuxMountReadWriteOncePod` is enabled.
1126-
* Or the volume can use any other access modes and both feature gates `SELinuxMountReadWriteOncePod` and `SELinuxMount` must be enabled.
1126+
* Or the volume can use any other access modes and both feature gates
1127+
`SELinuxMountReadWriteOncePod`, `SELinuxChangePolicy` and `SELinuxMount` must be enabled
1128+
and the Pod has `spec.securityContext.seLinuxChangePolicy` either nil (default) or `MountOption`.
11271129
-->
11281130
* Pod 必须使用带有对应的 `accessModes` 和[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/)
11291131
的 PersistentVolumeClaim。
11301132
* 卷具有 `accessModes: ["ReadWriteOncePod"]`，并且 `SELinuxMountReadWriteOncePod` 特性门控已启用。
1131-
* 或者卷可以使用任何其他访问模式，并且必须启用 `SELinuxMountReadWriteOncePod` 和 `SELinuxMount` 特性门控。
1133+
* 或者卷可以使用任何其他访问模式，并且必须启用 `SELinuxMountReadWriteOncePod`、`SELinuxChangePolicy`
1134+
和 `SELinuxMount` 特性门控，且 Pod 已将 `spec.securityContext.seLinuxChangePolicy` 设置为
1135+
nil（默认值）或 `MountOption`。
11321136

11331137
<!--
11341138
* Pod (or all its Containers that use the PersistentVolumeClaim) must
@@ -1152,19 +1156,124 @@ To benefit from this speedup, all these conditions must be met:
11521156
-->
11531157
* 对应的 PersistentVolume 必须是：
11541158
* 使用传统树内（In-Tree） `iscsi`、`rbd` 或 `fs` 卷类型的卷。
1155-
* 或者是使用 {< glossary_tooltip text="CSI" term_id="csi" >}} 驱动程序的卷
1159+
* 或者是使用 {{< glossary_tooltip text="CSI" term_id="csi" >}} 驱动程序的卷
11561160
CSI 驱动程序必须能够通过在 CSIDriver 实例中设置 `spec.seLinuxMount: true`
11571161
以支持 `-o context` 挂载。
11581162

11591163
<!--
11601164
For any other volume types, SELinux relabelling happens another way: the container
11611165
runtime recursively changes the SELinux label for all inodes (files and directories)
11621166
in the volume.
1163-
The more files and directories in the volume, the longer that relabelling takes.
11641167
-->
11651168
对于所有其他卷类型，重打 SELinux 标签的方式有所不同：
11661169
容器运行时为卷中的所有节点（文件和目录）递归地修改 SELinux 标签。
1167-
卷中的文件和目录越多，重打标签需要耗费的时间就越长。
1170+
1171+
{{< feature-state feature_gate_name="SELinuxChangePolicy" >}}
1172+
1173+
<!--
1174+
For Pods that want to opt-out from relabeling using mount options, they can set
1175+
`spec.securityContext.seLinuxChangePolicy` to `Recursive`. This is required
1176+
when multiple pods share a single volume on the same node, but they run with
1177+
different SELinux labels that allows simultaneous access to the volume. For example, a privileged pod
1178+
running with label `spc_t` and an unprivileged pod running with the default label `container_file_t`.
1179+
With unset `spec.securityContext.seLinuxChangePolicy` (or with the default value `MountOption`),
1180+
only one of such pods is able to run on a node, the other one gets ContainerCreating with error
1181+
`conflicting SELinux labels of volume <name of the volume>: <label of the running pod> and <label of the pod that can't start>`.
1182+
-->
1183+
对于不希望使用挂载选项来重新打标签的 Pod，可以将
1184+
`spec.securityContext.seLinuxChangePolicy` 设置为 `Recursive`。
1185+
当多个 Pod 共享同一节点上的单个卷，但使用不同的 SELinux 标签以允许同时访问此卷时，
1186+
此配置是必需的。例如，一个特权 Pod 运行时使用 `spc_t` 标签，
1187+
而一个非特权 Pod 运行时使用默认标签 `container_file_t`。
1188+
在不设置 `spec.securityContext.seLinuxChangePolicy`（或使用默认值 `MountOption`）的情况下，
1189+
这样的多个 Pod 中只能有一个在节点上运行，其他 Pod 会在 ContainerCreating 时报错
1190+
`conflicting SELinux labels of volume <卷名称>: <正运行的 Pod 的标签> and <未启动的 Pod 的标签>`。
1191+
1192+
<!--
1193+
#### SELinuxWarningController
1194+
To make it easier to identify Pods that are affected by the change in SELinux volume relabeling,
1195+
a new controller called `SELinuxWarningController` has been introduced in kube-controller-manager.
1196+
It is disabled by default and can be enabled by either setting the `--controllers=*,selinux-warning-controller`
1197+
[command line flag](/docs/reference/command-line-tools-reference/kube-controller-manager/),
1198+
or by setting `genericControllerManagerConfiguration.controllers`
1199+
[field in KubeControllerManagerConfiguration](/docs/reference/config-api/kube-controller-manager-config.v1alpha1/#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration).
1200+
This controller requires `SELinuxChangePolicy` feature gate to be enabled.
1201+
-->
1202+
#### SELinuxWarningController
1203+
1204+
为了更容易识别受 SELinux 卷重新打标签的变化所影响的 Pod，一个名为
1205+
`SELinuxWarningController` 的新控制器已被添加到 kube-controller-manager 中。
1206+
这个控制器默认是被禁用的，你可以通过设置 `--controllers=*,selinux-warning-controller`
1207+
[命令行标志](/zh-cn/docs/reference/command-line-tools-reference/kube-controller-manager/)或通过在
1208+
[KubeControllerManagerConfiguration 中设置 `genericControllerManagerConfiguration.controllers` 字段](/zh-cn/docs/reference/config-api/kube-controller-manager-config.v1alpha1/#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration)来启用。
1209+
此控制器需要启用 `SELinuxChangePolicy` 特性门控。
1210+
1211+
<!--
1212+
When enabled, the controller observes running Pods and when it detects that two Pods use the same volume
1213+
with different SELinux labels:
1214+
1. It emits an event to both of the Pods. `kubectl describe pod <pod-name>` the shows
1215+
`SELinuxLabel "<label on the pod>" conflicts with pod <the other pod name> that uses the same volume as this pod
1216+
with SELinuxLabel "<the other pod label>". If both pods land on the same node, only one of them may access the volume`.
1217+
2. Raise `selinux_warning_controller_selinux_volume_conflict` metric. The metric has both pod
1218+
names + namespaces as labels to identify the affected pods easily.
1219+
-->
1220+
当此控制器被启用时，它会观察运行中的 Pod。
1221+
当控制器检测到两个 Pod 使用相同的卷但具有不同的 SELinux 标签时：
1222+
1223+
1. 它会向这两个 Pod 发出一个事件。通过 `kubectl describe pod <Pod 名称>` 可以看到：
1224+
1225+
```
1226+
SELinuxLabel "<Pod 上的标签>" conflicts with pod <另一个 Pod 名称> that uses the same volume as this pod with SELinuxLabel "<另一个 Pod 标签>". If both pods land on the same node, only one of them may access the volume.
1227+
```
1228+
1229+
2. 增加 `selinux_warning_controller_selinux_volume_conflict` 指标值。
1230+
此指标将两个 Pod 的名称 + 命名空间作为标签，以便轻松识别受影响的 Pod。
1231+
1232+
<!--
1233+
A cluster admin can use this information to identify pods affected by the planning change and
1234+
proactively opt-out Pods from the optimization (i.e. set `spec.securityContext.seLinuxChangePolicy: Recursive`).
1235+
-->
1236+
集群管理员可以使用此信息识别受规划变更所影响的 Pod，并主动筛选出不需优化的 Pod
1237+
（即设置 `spec.securityContext.seLinuxChangePolicy: Recursive`）。
1238+
1239+
<!--
1240+
#### Feature gates
1241+
1242+
The following feature gates control the behavior of SELinux volume relabeling:
1243+
1244+
* `SELinuxMountReadWriteOncePod`: enables the optimization for volumes with `accessModes: ["ReadWriteOncePod"]`.
1245+
This is a very safe feature gate to enable, as it cannot happen that two pods can share one single volume with
1246+
this access mode. This feature gate is enabled by default sine v1.28.
1247+
-->
1248+
#### 特性门控
1249+
1250+
以下特性门控可以控制 SELinux 卷重新打标签的行为：
1251+
1252+
* `SELinuxMountReadWriteOncePod`：为具有 `accessModes: ["ReadWriteOncePod"]` 的卷启用优化。
1253+
启用此特性门控是非常安全的，因为在这种访问模式下，不会出现两个 Pod 共享同一卷的情况。
1254+
此特性门控自 v1.28 起默认被启用。
1255+
1256+
<!--
1257+
* `SELinuxChangePolicy`: enables `spec.securityContext.seLinuxChangePolicy` field in Pod and related SELinuxWarningController
1258+
in kube-controller-manager. This feature can be used before enabling `SELinuxMount` to check Pods running on a cluster,
1259+
and to pro-actively opt-out Pods from the optimization.
1260+
This feature gate requires `SELinuxMountReadWriteOncePod` enabled. It is alpha and disabled by default in 1.32.
1261+
-->
1262+
* `SELinuxChangePolicy`：在 Pod 中启用 `spec.securityContext.seLinuxChangePolicy` 字段，
1263+
并在 kube-controller-manager 中启用相关的 SELinuxWarningController。
1264+
你可以在启用 `SELinuxMount` 之前使用此特性来检查集群中正在运行的 Pod，并主动筛选出不需优化的 Pod。
1265+
此特性门控需要启用 `SELinuxMountReadWriteOncePod`。它在 1.32 中是 Alpha 阶段，并默认被禁用。
1266+
1267+
<!--
1268+
* `SELinuxMount` enables the optimization for all eligible volumes. Since it can break existing workloads, we recommend
1269+
enabling `SELinuxChangePolicy` feature gate + SELinuxWarningController first to check the impact of the change.
1270+
This feature gate requires `SELinuxMountReadWriteOncePod` and `SELinuxChangePolicy` enabled. It is alpha and disabled
1271+
by default in 1.32.
1272+
-->
1273+
* `SELinuxMount`：为所有符合条件的卷启用优化。由于可能会破坏现有的工作负载，所以我们建议先启用
1274+
`SELinuxChangePolicy` 特性门控和 SELinuxWarningController，以检查这种更改的影响。
1275+
此特性门控要求启用 `SELinuxMountReadWriteOncePod` 和 `SELinuxChangePolicy`。
1276+
它在 1.32 中是 Alpha 阶段，并默认被禁用。
11681277
11691278
<!--
11701279
## Managing access to the `/proc` filesystem {#proc-access}

0 commit comments

Comments
 (0)