mirror of https://github.com/istio/istio.io.git
zh-translation: update for ServiceMesher#1778-1785 (#6478)
* update: /docs/setup/platform-setup/ibm/index.md #1778 * update: /about/feature-stages/index.md #1780 * update: /docs/setup/install/multicluster/gateways/index.md #1782 * update: /blog/2019/trustworthy-jwt-sds/index.md #1784 * update: /docs/setup/install/multicluster/shared-gateways/index.md #1785
This commit is contained in:
parent
0eda5dd193
commit
b31b6fd756
|
@ -86,7 +86,7 @@ Below is our list of existing features and their current phases. This informatio
|
||||||
|
|
||||||
| Feature | Phase
|
| Feature | Phase
|
||||||
|-------------------|-------------------
|
|-------------------|-------------------
|
||||||
| [Standalone Operator](/zh/docs/setup/install/standalone-operator/) | Alpha
|
| [Standalone Operator](/zh/docs/setup/install/standalone-operator/) | Beta
|
||||||
| [Kubernetes: Envoy Installation and Traffic Interception](/zh/docs/setup/) | Stable
|
| [Kubernetes: Envoy Installation and Traffic Interception](/zh/docs/setup/) | Stable
|
||||||
| [Kubernetes: Istio Control Plane Installation](/zh/docs/setup/) | Stable
|
| [Kubernetes: Istio Control Plane Installation](/zh/docs/setup/) | Stable
|
||||||
| [Attribute Expression Language](/zh/docs/reference/config/policy-and-telemetry/expression-language/) | Stable
|
| [Attribute Expression Language](/zh/docs/reference/config/policy-and-telemetry/expression-language/) | Stable
|
||||||
|
|
|
@ -16,7 +16,7 @@ target_release: 1.2
|
||||||
1. 令牌没有重要字段来限制其使用范围,例如 `aud` 或 `exp`。有关更多信息,请参见[绑定服务令牌](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/bound-service-account-tokens.md)。
|
1. 令牌没有重要字段来限制其使用范围,例如 `aud` 或 `exp`。有关更多信息,请参见[绑定服务令牌](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/bound-service-account-tokens.md)。
|
||||||
1.令牌安装在所有 pod 上,无法退出。请参见[服务帐户令牌数量](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/svcacct-token-volume-source.md)了解其机制。
|
1.令牌安装在所有 pod 上,无法退出。请参见[服务帐户令牌数量](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/svcacct-token-volume-source.md)了解其机制。
|
||||||
|
|
||||||
Kubernetes 1.12 引入了 `可信任` JWT 来解决这些问题。但是,直到 [Kubernetes 1.13] 才支持 `aud` 字段与 API 服务器受众具有不同的值。为了更好地保护网格,Istio 1.3 仅支持 `可信任` JWT,并且在启用 SDS 时要求 `aud` 字段的值为 `istio-ca`。在启用 SDS 的情况下将 Istio 部署升级到 1.3 之前,请验证您是否使用了 Kubernetes 1.13 或更高版本。
|
Kubernetes 1.12 引入了 `可信任` JWT 来解决这些问题。但是,直到 [Kubernetes 1.13](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.13.md) 才支持 `aud` 字段与 API 服务器受众具有不同的值。为了更好地保护网格,Istio 1.3 仅支持 `可信任` JWT,并且在启用 SDS 时要求 `aud` 字段的值为 `istio-ca`。在启用 SDS 的情况下将 Istio 部署升级到 1.3 之前,请验证您是否使用了 Kubernetes 1.13 或更高版本。
|
||||||
|
|
||||||
根据您选择的平台进行以下考虑:
|
根据您选择的平台进行以下考虑:
|
||||||
|
|
||||||
|
|
|
@ -146,14 +146,51 @@ data:
|
||||||
global:53 {
|
global:53 {
|
||||||
errors
|
errors
|
||||||
cache 30
|
cache 30
|
||||||
proxy . $(kubectl get svc -n istio-system istiocoredns -o jsonpath={.spec.clusterIP})
|
forward . $(kubectl get svc -n istio-system istiocoredns -o jsonpath={.spec.clusterIP}):53
|
||||||
}
|
}
|
||||||
EOF
|
EOF
|
||||||
{{< /text >}}
|
{{< /text >}}
|
||||||
|
|
||||||
{{< /tab >}}
|
{{< /tab >}}
|
||||||
|
|
||||||
{{< tab name="CoreDNS (>= 1.4.0)" category-value="coredns-after-1.4.0" >}}
|
{{< tab name="CoreDNS (>= 1.4.0)" cookie-value="coredns-after-1.4.0" >}}
|
||||||
|
|
||||||
|
{{< text bash >}}
|
||||||
|
$ kubectl apply -f - <<EOF
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: coredns
|
||||||
|
namespace: kube-system
|
||||||
|
data:
|
||||||
|
Corefile: |
|
||||||
|
.:53 {
|
||||||
|
errors
|
||||||
|
health
|
||||||
|
ready
|
||||||
|
kubernetes cluster.local in-addr.arpa ip6.arpa {
|
||||||
|
pods insecure
|
||||||
|
upstream
|
||||||
|
fallthrough in-addr.arpa ip6.arpa
|
||||||
|
}
|
||||||
|
prometheus :9153
|
||||||
|
forward . /etc/resolv.conf
|
||||||
|
cache 30
|
||||||
|
loop
|
||||||
|
reload
|
||||||
|
loadbalance
|
||||||
|
}
|
||||||
|
global:53 {
|
||||||
|
errors
|
||||||
|
cache 30
|
||||||
|
forward . $(kubectl get svc -n istio-system istiocoredns -o jsonpath={.spec.clusterIP}):53
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
{{< /text >}}
|
||||||
|
|
||||||
|
{{< /tab >}}
|
||||||
|
|
||||||
|
{{< tab name="CoreDNS (== 1.4.0)" cookie-value="coredns-1.4.0" >}}
|
||||||
|
|
||||||
{{< text bash >}}
|
{{< text bash >}}
|
||||||
$ kubectl apply -f - <<EOF
|
$ kubectl apply -f - <<EOF
|
||||||
|
|
|
@ -418,6 +418,7 @@ $ istioctl manifest generate --context=$CTX_CLUSTER2 \
|
||||||
--set values.global.network="network2" \
|
--set values.global.network="network2" \
|
||||||
--set autoInjection.enabled=true | kubectl --context=$CTX_CLUSTER2 delete -f -
|
--set autoInjection.enabled=true | kubectl --context=$CTX_CLUSTER2 delete -f -
|
||||||
$ kubectl delete --context=$CTX_CLUSTER2 ns sample
|
$ kubectl delete --context=$CTX_CLUSTER2 ns sample
|
||||||
|
$ rm n2-k8s-config
|
||||||
$ unset CTX_CLUSTER2 CLUSTER_NAME SERVER SECRET_NAME CA_DATA TOKEN INGRESS_HOST SECURE_INGRESS_PORT INGRESS_PORT LOCAL_GW_ADDR
|
$ unset CTX_CLUSTER2 CLUSTER_NAME SERVER SECRET_NAME CA_DATA TOKEN INGRESS_HOST SECURE_INGRESS_PORT INGRESS_PORT LOCAL_GW_ADDR
|
||||||
{{< /text >}}
|
{{< /text >}}
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
---
|
---
|
||||||
title: IBM Cloud 快速开始
|
title: IBM Cloud 快速开始
|
||||||
description: 在 IBM 公有云或私有云上快速搭建 Istio 服务。
|
description: 在 IBM 公有云或私有云上快速搭建 Istio 服务。
|
||||||
weight: 18
|
weight: 16
|
||||||
skip_seealso: true
|
skip_seealso: true
|
||||||
aliases:
|
aliases:
|
||||||
- /zh/docs/setup/kubernetes/prepare/platform-setup/ibm/
|
- /zh/docs/setup/kubernetes/prepare/platform-setup/ibm/
|
||||||
|
|
Loading…
Reference in New Issue