mirror of https://github.com/istio/istio.io.git
zh-translation: update for ServiceMesher#1778-1785 (#6478)
* update: /docs/setup/platform-setup/ibm/index.md #1778 * update: /about/feature-stages/index.md #1780 * update: /docs/setup/install/multicluster/gateways/index.md #1782 * update: /blog/2019/trustworthy-jwt-sds/index.md #1784 * update: /docs/setup/install/multicluster/shared-gateways/index.md #1785
This commit is contained in:
parent
0eda5dd193
commit
b31b6fd756
|
@ -86,7 +86,7 @@ Below is our list of existing features and their current phases. This informatio
|
|||
|
||||
| Feature | Phase
|
||||
|-------------------|-------------------
|
||||
| [Standalone Operator](/zh/docs/setup/install/standalone-operator/) | Alpha
|
||||
| [Standalone Operator](/zh/docs/setup/install/standalone-operator/) | Beta
|
||||
| [Kubernetes: Envoy Installation and Traffic Interception](/zh/docs/setup/) | Stable
|
||||
| [Kubernetes: Istio Control Plane Installation](/zh/docs/setup/) | Stable
|
||||
| [Attribute Expression Language](/zh/docs/reference/config/policy-and-telemetry/expression-language/) | Stable
|
||||
|
|
|
@ -16,7 +16,7 @@ target_release: 1.2
|
|||
1. 令牌没有重要字段来限制其使用范围,例如 `aud` 或 `exp`。有关更多信息,请参见[绑定服务令牌](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/bound-service-account-tokens.md)。
|
||||
1.令牌安装在所有 pod 上,无法退出。请参见[服务帐户令牌数量](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/svcacct-token-volume-source.md)了解其机制。
|
||||
|
||||
Kubernetes 1.12 引入了 `可信任` JWT 来解决这些问题。但是,直到 [Kubernetes 1.13] 才支持 `aud` 字段与 API 服务器受众具有不同的值。为了更好地保护网格,Istio 1.3 仅支持 `可信任` JWT,并且在启用 SDS 时要求 `aud` 字段的值为 `istio-ca`。在启用 SDS 的情况下将 Istio 部署升级到 1.3 之前,请验证您是否使用了 Kubernetes 1.13 或更高版本。
|
||||
Kubernetes 1.12 引入了 `可信任` JWT 来解决这些问题。但是,直到 [Kubernetes 1.13](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.13.md) 才支持 `aud` 字段与 API 服务器受众具有不同的值。为了更好地保护网格,Istio 1.3 仅支持 `可信任` JWT,并且在启用 SDS 时要求 `aud` 字段的值为 `istio-ca`。在启用 SDS 的情况下将 Istio 部署升级到 1.3 之前,请验证您是否使用了 Kubernetes 1.13 或更高版本。
|
||||
|
||||
根据您选择的平台进行以下考虑:
|
||||
|
||||
|
|
|
@ -146,14 +146,51 @@ data:
|
|||
global:53 {
|
||||
errors
|
||||
cache 30
|
||||
proxy . $(kubectl get svc -n istio-system istiocoredns -o jsonpath={.spec.clusterIP})
|
||||
forward . $(kubectl get svc -n istio-system istiocoredns -o jsonpath={.spec.clusterIP}):53
|
||||
}
|
||||
EOF
|
||||
{{< /text >}}
|
||||
|
||||
{{< /tab >}}
|
||||
|
||||
{{< tab name="CoreDNS (>= 1.4.0)" category-value="coredns-after-1.4.0" >}}
|
||||
{{< tab name="CoreDNS (>= 1.4.0)" cookie-value="coredns-after-1.4.0" >}}
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f - <<EOF
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: coredns
|
||||
namespace: kube-system
|
||||
data:
|
||||
Corefile: |
|
||||
.:53 {
|
||||
errors
|
||||
health
|
||||
ready
|
||||
kubernetes cluster.local in-addr.arpa ip6.arpa {
|
||||
pods insecure
|
||||
upstream
|
||||
fallthrough in-addr.arpa ip6.arpa
|
||||
}
|
||||
prometheus :9153
|
||||
forward . /etc/resolv.conf
|
||||
cache 30
|
||||
loop
|
||||
reload
|
||||
loadbalance
|
||||
}
|
||||
global:53 {
|
||||
errors
|
||||
cache 30
|
||||
forward . $(kubectl get svc -n istio-system istiocoredns -o jsonpath={.spec.clusterIP}):53
|
||||
}
|
||||
EOF
|
||||
{{< /text >}}
|
||||
|
||||
{{< /tab >}}
|
||||
|
||||
{{< tab name="CoreDNS (== 1.4.0)" cookie-value="coredns-1.4.0" >}}
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f - <<EOF
|
||||
|
|
|
@ -418,6 +418,7 @@ $ istioctl manifest generate --context=$CTX_CLUSTER2 \
|
|||
--set values.global.network="network2" \
|
||||
--set autoInjection.enabled=true | kubectl --context=$CTX_CLUSTER2 delete -f -
|
||||
$ kubectl delete --context=$CTX_CLUSTER2 ns sample
|
||||
$ rm n2-k8s-config
|
||||
$ unset CTX_CLUSTER2 CLUSTER_NAME SERVER SECRET_NAME CA_DATA TOKEN INGRESS_HOST SECURE_INGRESS_PORT INGRESS_PORT LOCAL_GW_ADDR
|
||||
{{< /text >}}
|
||||
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
title: IBM Cloud 快速开始
|
||||
description: 在 IBM 公有云或私有云上快速搭建 Istio 服务。
|
||||
weight: 18
|
||||
weight: 16
|
||||
skip_seealso: true
|
||||
aliases:
|
||||
- /zh/docs/setup/kubernetes/prepare/platform-setup/ibm/
|
||||
|
|
Loading…
Reference in New Issue