mirror of https://github.com/istio/istio.io.git
Cleanup .spelling (lower case istiod not allowed) (#6858)
* Cleanup .spelling * remove lower case istiod * add backticks * remove backticks * restore backticks
This commit is contained in:
parent
ef5a5b54ec
commit
8774229973
|
@ -332,12 +332,10 @@ istio-system
|
|||
istio.io
|
||||
istio.io.
|
||||
istioctl
|
||||
istiod
|
||||
Istiod
|
||||
Istiofied
|
||||
IstioMesh
|
||||
IstioOperator
|
||||
Istiod
|
||||
iter8
|
||||
jason
|
||||
Jog
|
||||
|
|
|
@ -101,7 +101,7 @@ maintenance effort, and issue diagnosis time while increasing responsiveness.
|
|||
Read more about Istiod in
|
||||
[this post from Christian Posta](https://blog.christianposta.com/microservices/istio-as-an-example-of-when-not-to-do-microservices/).
|
||||
|
||||
We are shipping istiod as the default for all profiles in 1.5.
|
||||
We are shipping Istiod as the default for all profiles in 1.5.
|
||||
|
||||
To reduce the per-node footprint, we are getting rid of the node-agent, used to
|
||||
distribute certificates, and moving its functionality to the istio-agent, which
|
||||
|
@ -118,7 +118,7 @@ to this...
|
|||
|
||||
{{< image width="75%"
|
||||
link="./architecture-post-istiod.svg"
|
||||
alt="Istio architecture with istiod"
|
||||
alt="Istio architecture with Istiod"
|
||||
caption="The Istio architecture in 2020"
|
||||
>}}
|
||||
|
||||
|
|
|
@ -79,7 +79,7 @@ following commands on a machine with cluster admin privileges:
|
|||
type. User can also deploy a separate ingress Gateway, with internal load balancer type for both mesh expansion and
|
||||
multicluster. The main requirement is for the exposed address to do TCP load balancing to the Istiod deployment,
|
||||
and for the DNS name associated with the assigned load balancer address to match the certificate provisioned
|
||||
into istiod deployment, defaulting to 'istiod.istio-system.svc'
|
||||
into Istiod deployment, defaulting to `istiod.istio-system.svc`.
|
||||
|
||||
1. Define the namespace the VM joins. This example uses the `SERVICE_NAMESPACE`
|
||||
environment variable to store the namespace. The value of this variable must
|
||||
|
|
|
@ -84,7 +84,7 @@ matching requests should flow through. If all requests continue to be denied, yo
|
|||
|
||||
1. Make sure there is no typo in your policy YAML file.
|
||||
|
||||
1. Avoid enabling authorization for istiod. Istio authorization policy is designed for authorizing access to workloads in Istio Mesh. Enabling it for istiod may cause unexpected behavior.
|
||||
1. Avoid enabling authorization for Istiod. Istio authorization policy is designed for authorizing access to workloads in Istio Mesh. Enabling it for Istiod may cause unexpected behavior.
|
||||
|
||||
1. Make sure that your authorization policies are in the right namespace (as specified in `metadata/namespace` field).
|
||||
|
||||
|
@ -106,9 +106,9 @@ successfully. To verify, follow these steps:
|
|||
1. Make sure there is no typo in your policy YAML file. Especially check to make sure the authorization policy is applied
|
||||
to the right workload and namespace.
|
||||
|
||||
1. Avoid enabling authorization for istiod. The Istio authorization features are designed for
|
||||
1. Avoid enabling authorization for Istiod. The Istio authorization features are designed for
|
||||
authorizing access to workloads in an Istio Mesh. Enabling the authorization
|
||||
features for istiod can cause unexpected behavior.
|
||||
features for Istiod can cause unexpected behavior.
|
||||
|
||||
## Ensure Istiod accepts the policies
|
||||
|
||||
|
|
|
@ -26,7 +26,7 @@ weight: 10
|
|||
- **Added** [deny semantics](/docs/tasks/security/authorization/authz-deny) and [exclusion matching](/docs/concepts/security/#exclusion-matching) to Authorization Policy.
|
||||
- **Graduated** [auto mutual TLS](/docs/tasks/security/authentication/authn-policy/#auto-mutual-tls) from alpha to beta. This feature is now enabled by default.
|
||||
- **Improved** [SDS security](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret) by merging Node Agent with Pilot Agent as Istio Agent and removing cross-pod UDS, which no longer requires users to deploy Kubernetes pod security policies for UDS connections.
|
||||
- **Improved** Istio by including certificate provisioning functionality within istiod.
|
||||
- **Improved** Istio by including certificate provisioning functionality within Istiod.
|
||||
- **Added** Support Kubernetes [`first-party-jwt`](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens) as a fallback token for CSR authentication in clusters where [`third-party-jwt`](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection) is not supported.
|
||||
- **Added** Support Istio CA and Kubernetes CA to provision certificates for the control plane, configurable via `values.global.pilotCertProvider`.
|
||||
- **Added** Istio Agent provisions a key and certificates for Prometheus.
|
||||
|
|
|
@ -40,7 +40,7 @@ Istio 的[认证](/zh/docs/concepts/security/#authentication-policies)和[授权
|
|||
我们还将简化其余控制平面的 deployment。为此,我们将几个控制平面组件合并为一个组件:Istiod。该二进制文件包括 Pilot、Citadel、Galley 和 Sidecar 注入器的功能。这种方法从许多方面改善了 Istio 的安装和管理,降低了安装和配置的复杂性、维护工作量以及问题诊断时间,同时提高了响应速度。
|
||||
关于 Istiod 的更多内容请查看 [Christian Posta 的这篇博客](https://blog.christianposta.com/microservices/istio-as-an-example-of-when-not-to-do-microservices/)。
|
||||
|
||||
我们将 istiod 作为 1.5 中所有配置文件的默认配置。
|
||||
我们将 Istiod 作为 1.5 中所有配置文件的默认配置。
|
||||
|
||||
为了减少每个节点的占用空间,我们放弃了用于分发证书的节点代理,并将其功能迁移至已经在每个 Pod 中运行的 istio-agent 中。从图片来看,我们正在从这里:
|
||||
|
||||
|
@ -54,7 +54,7 @@ Istio 的[认证](/zh/docs/concepts/security/#authentication-policies)和[授权
|
|||
|
||||
{{< image width="75%"
|
||||
link="./architecture-post-istiod.svg"
|
||||
alt="基于 istiod 的 Istio 架构"
|
||||
alt="基于 Istiod 的 Istio 架构"
|
||||
caption="Istio 2020 年的架构"
|
||||
>}}
|
||||
|
||||
|
|
|
@ -141,7 +141,7 @@ find ./content/zh -type f \( -name '*.html' -o -name '*.md' \) -print0 | while I
|
|||
done
|
||||
|
||||
if [[ ${SKIP_LINK_CHECK:-} == "" ]]; then
|
||||
if ! htmlproofer ./public --assume-extension --http-status-ignore "0" --check-html --check-external-hash --check-opengraph --timeframe 2d --storage-dir .htmlproofer --url-ignore "/archive.istio.io/,/localhost/,/github.com/istio/istio.io/edit/,/github.com/istio/istio/issues/new/choose/,/groups.google.com/forum/,/www.trulia.com/,/apporbit.com/,/www.mysql.com/,/www.oreilly.com/"; then
|
||||
if ! htmlproofer ./public --assume-extension --http-status-ignore "0" --check-html --check-external-hash --check-opengraph --timeframe 2d --storage-dir .htmlproofer --url-ignore "/archive.istio.io/,/localhost/,/github.com/istio/istio.io/edit/,/github.com/istio/istio/issues/new/choose/,/groups.google.com/forum/,/www.trulia.com/,/apporbit.com/,/www.mysql.com/,/www.oreilly.com/,/docs.okd.io/"; then
|
||||
FAILED=1
|
||||
fi
|
||||
fi
|
||||
|
|
Loading…
Reference in New Issue