mirror of https://github.com/istio/istio.io.git
zh-translation: /docs/ops/configuration/mesh/secret-creation/index.md and validation sync (#6292)
* zh-translation: /docs/ops/configuration/mesh/secret-creation/index.md and validation sync * fix
This commit is contained in:
ilylia
Istio Automation
parent
6cf14daaf5
commit
4413ee15de
|
|
@ -1,55 +1,53 @@
|
|||
---
|
||||
title: Service Account Secret Creation
|
||||
description: Describes how Citadel determines whether to create service account secrets.
|
||||
title: 创建服务账号 Secret
|
||||
description: 描述 Citadel 如何确定是否创建服务账号 secret。
|
||||
weight: 30
|
||||
---
|
||||
|
||||
When a Citadel instance notices that a `ServiceAccount` is created in a namespace, it must decide whether
|
||||
it should generate an `istio.io/key-and-cert` secret for that `ServiceAccount`.
|
||||
In order to make that decision, Citadel considers three inputs (note: there can be multiple Citadel instances
|
||||
deployed in a single cluster, and the following targeting rules are applied to each instance):
|
||||
当 Citadel 实例注意到命名空间中创建了 `ServiceAccount` 时，它必须决定是否应该为该 `ServiceAccount` 生成 `istio.io/key-and-cert` secret。
|
||||
为了做出决定，Citadel 考虑三个输入（请注意：单个集群中可以部署多个 Citadel 实例，并且以下定位规则应用于每个实例）：
|
||||
|
||||
1. `ca.istio.io/env` namespace label: *string valued* label containing the namespace of the desired Citadel instance
|
||||
1. `ca.istio.io/env` 命名空间标签：*字符串值* 包含所需 Citadel 实例的命名空间的标签
|
||||
|
||||
1. `ca.istio.io/override` namespace label: *boolean valued* label which overrides all other configurations and forces all Citadel instances either to target or ignore a namespace
|
||||
1. `ca.istio.io/override` 命名空间标签：*布尔值* 覆盖所有其他配置，并强制所有 Citadel 实例定位或忽略命名空间的标签
|
||||
|
||||
1. [`enableNamespacesByDefault` security configuration](/zh/docs/reference/config/installation-options/#security-options): default behavior if no labels are found on the `ServiceAccount`'s namespace
|
||||
1. [`enableNamespacesByDefault` 安全配置](/zh/docs/reference/config/installation-options/#security-options)：如果在 `ServiceAccount` 的命名空间上找不到标签，则为默认行为
|
||||
|
||||
From these three values, the decision process mirrors that of the [`Sidecar Injection Webhook`](/zh/docs/ops/configuration/mesh/injection-concepts/). The detailed behavior is that:
|
||||
根据这三个值，其决策过程与 [`Sidecar Injection Webhook`](/zh/docs/ops/configuration/mesh/injection-concepts/) 的过程类似。具体行为是：
|
||||
|
||||
- If `ca.istio.io/override` exists and is `true`, generate key/cert secrets for workloads.
|
||||
- 如果 `ca.istio.io/override` 存在并且为 `true`，则为工作负载生成密钥/证书 secret。
|
||||
|
||||
- Otherwise, if `ca.istio.io/override` exists and is `false`, don't generate key/cert secrets for workloads.
|
||||
- 否则，如果 `ca.istio.io/override` 存在并且为 `false`，则不为工作负载生成密钥/证书 secret。
|
||||
|
||||
- Otherwise, if a `ca.istio.io/env: "ns-foo"` label is defined in the service account's namespace, the Citadel instance in namespace `ns-foo` will be used for generating key/cert secrets for workloads in the `ServiceAccount`'s namespace.
|
||||
- 否则，如果服务账号所在命名空间上定义了 `ca.istio.io/env: "ns-foo"` 标签，则命名空间 `ns-foo` 中的 Citadel 实例将被用于为 `ServiceAccount` 的命名空间中的工作负载生成密钥/证书 secret。
|
||||
|
||||
- Otherwise, set `enableNamespacesByDefault` to `true` during installation. If it is `true`, the default Citadel instance will be used for generating key/cert secrets for workloads in the `ServiceAccount`'s namespace.
|
||||
- 否则，就在安装时将 `enableNamespacesByDefault` 设置为 `true`。如果它是 `true`，默认的 Citadel 实例将被用于为 `ServiceAccount` 的命名空间中的工作负载生成密钥/证书 secret。
|
||||
|
||||
- Otherwise, no secrets are created for the `ServiceAccount`'s namespace.
|
||||
- 否则，将不会为 `ServiceAccount` 的命名空间创建 secret。
|
||||
|
||||
This logic is captured in the truth table below:
|
||||
下面的真值表体现了该逻辑：
|
||||
|
||||
| `ca.istio.io/override` value | `ca.istio.io/env` match | `enableNamespacesByDefault` configuration | Workload secret created |
|
||||
| `ca.istio.io/override` 值 | `ca.istio.io/env` 匹配 | `enableNamespacesByDefault` 配置 | 是否为工作负载创建 secret |
|
||||
|------------------------------|-------------------------|-------------------------------------------|-------------------------|
|
||||
|`true`|yes|`true`|yes|
|
||||
|`true`|yes|`false`|yes|
|
||||
|`true`|no|`true`|yes|
|
||||
|`true`|no|`false`|yes|
|
||||
|`true`|unset|`true`|yes|
|
||||
|`true`|unset|`false`|yes|
|
||||
|`false`|yes|`true`|no|
|
||||
|`false`|yes|`false`|no|
|
||||
|`false`|no|`true`|no|
|
||||
|`false`|no|`false`|no|
|
||||
|`false`|unset|`true`|no|
|
||||
|`false`|unset|`false`|no|
|
||||
|unset|yes|`true`|yes|
|
||||
|unset|yes|`false`|yes|
|
||||
|unset|no|`true`|no|
|
||||
|unset|no|`false`|no|
|
||||
|unset|unset|`true`|yes|
|
||||
|unset|unset|`false`|no|
|
||||
|`true` | yes | `true` | yes |
|
||||
|`true` | yes | `false` | yes |
|
||||
|`true` | no | `true` | yes |
|
||||
|`true` | no | `false` | yes |
|
||||
|`true` | 未设置 | `true` | yes |
|
||||
|`true` | 未设置 | `false` | yes |
|
||||
|`false` | yes | `true` | no |
|
||||
|`false` | yes | `false` | no |
|
||||
|`false` | no | `true` | no |
|
||||
|`false` | no | `false` | no |
|
||||
|`false` | 未设置 | `true` | no |
|
||||
|`false` | 未设置 | `false` | no |
|
||||
|未设置| yes | `true` | yes |
|
||||
|未设置| yes | `false` | yes |
|
||||
|未设置| no | `true` | no |
|
||||
|未设置| no | `false` | no |
|
||||
|未设置| 未设置 | `true` | yes |
|
||||
|未设置| 未设置 | `false` | no |
|
||||
|
||||
{{< idea >}}
|
||||
When a namespace transitions from _disabled_ to _enabled_, Citadel will retroactively generate secrets for all `ServiceAccounts` in that namespace. When transitioning from _enabled_ to _disabled_, however, Citadel will not delete the namespace's generated secrets until the root certificate is renewed.
|
||||
当命名空间从 *禁用* 过渡到 *启用* 时，Citadel 将为该命名空间中的所有 `ServiceAccounts` 生成 secret。而从 *启用* 过渡到 *禁用* 时，Citadel 却不会删除命名空间中已经生成的 secret，直到更新了根证书为止。
|
||||
{{< /idea >}}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Configuration Validation Webhook
|
||||
description: 描述 Istio 使用 Kubernetes webhook 来进行服务端配置。
|
||||
title: 配置验证 Webhook
|
||||
description: 描述 Istio 如何使用 Kubernetes webhook 来进行服务端配置验证。
|
||||
weight: 40
|
||||
aliases:
|
||||
- /zh/help/ops/setup/validation
|
||||
|
|
@ -14,4 +14,3 @@ Galley 的配置验证可确保用户编写的 Istio 配置在语法和语义上
|
|||
* `mixer.validation.istio.io` - 它通过 `/admitmixer` 路径提供服务，并负责验证 Mixer 使用的配置。
|
||||
|
||||
这两个 webhook 都经 `istio-galley` 在 443 端口提供服务， 每个 webhook 都有自己的 `clientConfig`、`namespaceSelector` 和 `rules` 部分，作用于所有命名空间，其中 `namespaceSelector` 应该为空， 所有 `rules` 都适用于 Istio Custom Resource Definitions (CRD)。
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue