zh-translation: update for ServiceMesher#1778-1785 (#6478)

* update: /docs/setup/platform-setup/ibm/index.md #1778

* update: /about/feature-stages/index.md #1780

* update: /docs/setup/install/multicluster/gateways/index.md #1782

* update: /blog/2019/trustworthy-jwt-sds/index.md #1784

* update: /docs/setup/install/multicluster/shared-gateways/index.md #1785
This commit is contained in:
2BFL 2020-02-16 13:50:39 +08:00 committed by GitHub
parent 0eda5dd193
commit b31b6fd756
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 43 additions and 5 deletions

View File

@ -86,7 +86,7 @@ Below is our list of existing features and their current phases. This informatio
| Feature | Phase
|-------------------|-------------------
| [Standalone Operator](/zh/docs/setup/install/standalone-operator/) | Alpha
| [Standalone Operator](/zh/docs/setup/install/standalone-operator/) | Beta
| [Kubernetes: Envoy Installation and Traffic Interception](/zh/docs/setup/) | Stable
| [Kubernetes: Istio Control Plane Installation](/zh/docs/setup/) | Stable
| [Attribute Expression Language](/zh/docs/reference/config/policy-and-telemetry/expression-language/) | Stable

View File

@ -16,7 +16,7 @@ target_release: 1.2
1. 令牌没有重要字段来限制其使用范围,例如 `aud``exp`。有关更多信息,请参见[绑定服务令牌](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/bound-service-account-tokens.md)。
1.令牌安装在所有 pod 上,无法退出。请参见[服务帐户令牌数量](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/svcacct-token-volume-source.md)了解其机制。
Kubernetes 1.12 引入了 `可信任` JWT 来解决这些问题。但是,直到 [Kubernetes 1.13] 才支持 `aud` 字段与 API 服务器受众具有不同的值。为了更好地保护网格Istio 1.3 仅支持 `可信任` JWT并且在启用 SDS 时要求 `aud` 字段的值为 `istio-ca`。在启用 SDS 的情况下将 Istio 部署升级到 1.3 之前,请验证您是否使用了 Kubernetes 1.13 或更高版本。
Kubernetes 1.12 引入了 `可信任` JWT 来解决这些问题。但是,直到 [Kubernetes 1.13](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.13.md) 才支持 `aud` 字段与 API 服务器受众具有不同的值。为了更好地保护网格Istio 1.3 仅支持 `可信任` JWT并且在启用 SDS 时要求 `aud` 字段的值为 `istio-ca`。在启用 SDS 的情况下将 Istio 部署升级到 1.3 之前,请验证您是否使用了 Kubernetes 1.13 或更高版本。
根据您选择的平台进行以下考虑:

View File

@ -146,14 +146,51 @@ data:
global:53 {
errors
cache 30
proxy . $(kubectl get svc -n istio-system istiocoredns -o jsonpath={.spec.clusterIP})
forward . $(kubectl get svc -n istio-system istiocoredns -o jsonpath={.spec.clusterIP}):53
}
EOF
{{< /text >}}
{{< /tab >}}
{{< tab name="CoreDNS (>= 1.4.0)" category-value="coredns-after-1.4.0" >}}
{{< tab name="CoreDNS (>= 1.4.0)" cookie-value="coredns-after-1.4.0" >}}
{{< text bash >}}
$ kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
data:
Corefile: |
.:53 {
errors
health
ready
kubernetes cluster.local in-addr.arpa ip6.arpa {
pods insecure
upstream
fallthrough in-addr.arpa ip6.arpa
}
prometheus :9153
forward . /etc/resolv.conf
cache 30
loop
reload
loadbalance
}
global:53 {
errors
cache 30
forward . $(kubectl get svc -n istio-system istiocoredns -o jsonpath={.spec.clusterIP}):53
}
EOF
{{< /text >}}
{{< /tab >}}
{{< tab name="CoreDNS (== 1.4.0)" cookie-value="coredns-1.4.0" >}}
{{< text bash >}}
$ kubectl apply -f - <<EOF

View File

@ -418,6 +418,7 @@ $ istioctl manifest generate --context=$CTX_CLUSTER2 \
--set values.global.network="network2" \
--set autoInjection.enabled=true | kubectl --context=$CTX_CLUSTER2 delete -f -
$ kubectl delete --context=$CTX_CLUSTER2 ns sample
$ rm n2-k8s-config
$ unset CTX_CLUSTER2 CLUSTER_NAME SERVER SECRET_NAME CA_DATA TOKEN INGRESS_HOST SECURE_INGRESS_PORT INGRESS_PORT LOCAL_GW_ADDR
{{< /text >}}

View File

@ -1,7 +1,7 @@
---
title: IBM Cloud 快速开始
description: 在 IBM 公有云或私有云上快速搭建 Istio 服务。
weight: 18
weight: 16
skip_seealso: true
aliases:
- /zh/docs/setup/kubernetes/prepare/platform-setup/ibm/