sync rbac

sync rbac

content/zh-cn/docs/reference/access-authn-authz/rbac.md

@@ -559,17 +559,19 @@ For example, `kubectl get configmaps --field-selector=metadata.name=my-configmap
 {{< /note >}}
 
 <!--
-Rather than referring to individual `resources` and `verbs`
+Rather than referring to individual `resources`、`apiGroups`, and `verbs`,
 you can use the wildcard `*` symbol to refer to all such objects. 
-For `nonResourceURLs` you can use the wildcard `*` symbol as a suffix glob match and
+For `nonResourceURLs`, you can use the wildcard `*` as a suffix glob match.
-for `apiGroups` and `resourceNames` an empty set means that everything is allowed.
+For `resourceNames`, an empty set means that everything is allowed.
 Here is an example that allows access to perform any current and future action on
-all current and future resources (note, this is similar to the built-in `cluster-admin` role).
+all current and future resources in the `example.com` API group.
+This is similar to the built-in `cluster-admin` role.
 -->
-使用通配符 `*` 可以批量引用所有的 `resources` 和 `verbs` 对象，无需逐一引用。
+你可愈使用通配符 `*` 可以批量引用所有的 `resources`、`apiGroups` 和 `verbs` 对象， 无需逐一引用。
-对于 `nonResourceURLs`，可以将通配符 `*` 作为后缀实现全局通配，
+对于 `nonResourceURLs`，你可以将通配符 `*` 作为后缀实现全局通配，
-对于 `apiGroups` 和 `resourceNames`，空集表示没有任何限制。
+对于 `resourceNames`，空集表示没有任何限制。
-下面的示例允许对所有当前和未来资源执行所有动作（注意，这类似于内置的 `cluster-admin`）。
+下面的示例对 `example.com` API 组中所有当前和未来资源执行所有动作。
+这类似于内置的 `cluster-admin`。
 
 ```yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -585,14 +587,13 @@ rules:
 
 {{< caution >}}
 <!--
-Using wildcards in resource and verb entries could result in 
+Using wildcards in resource and verb entries could result in overly permissive access being granted
-overly permissive access being granted to sensitive resources.
+to sensitive resources.
 For instance, if a new resource type is added, or a new subresource is added,
-or a new custom verb is checked, the wildcard entry automatically grants access,
+or a new custom verb is checked, the wildcard entry automatically grants access, which may be undesirable.
-which may be undesirable.
 The [principle of least privilege](/docs/concepts/security/rbac-good-practices/#least-privilege)
-should be employed, using specific resources and verbs to ensure
+should be employed, using specific resources and verbs to ensure only the permissions required for the
-only the permissions required for the workload to function correctly are applied.
+workload to function correctly are applied.
 -->
 在 resources 和 verbs 条目中使用通配符会为敏感资源授予过多的访问权限。
 例如，如果添加了新的资源类型、新的子资源或新的自定义动词，
@@ -1168,7 +1169,10 @@ Auto-reconciliation is enabled by default if the RBAC authorizer is active.
 <!--
 ### API discovery roles {#discovery-roles}
 
-Default role bindings authorize unauthenticated and authenticated users to read API information that is deemed safe to be publicly accessible (including CustomResourceDefinitions). To disable anonymous unauthenticated access, add `--anonymous-auth=false` to the API server configuration.
+Default role bindings authorize unauthenticated and authenticated users to read API information
+that is deemed safe to be publicly accessible (including CustomResourceDefinitions).
+To disable anonymous unauthenticated access, add `--anonymous-auth=false` to
+the API server configuration.
 
 To view the configuration of these roles via `kubectl` run:
 -->
@@ -1718,7 +1722,8 @@ You can only create/update a role if at least one of the following things is tru
 
 1. You already have all the permissions contained in the role, at the same scope as the object being modified
    (cluster-wide for a ClusterRole, within the same namespace or cluster-wide for a Role).
-2. You are granted explicit permission to perform the `escalate` verb on the `roles` or `clusterroles` resource in the `rbac.authorization.k8s.io` API group.
+2. You are granted explicit permission to perform the `escalate` verb on the `roles` or
+   `clusterroles` resource in the `rbac.authorization.k8s.io` API group.
 -->
 ### 对角色创建或更新的限制 {#restrictions-on-role-creation-or-update}
 
@@ -1735,8 +1740,11 @@ containing that permission. To allow a user to create/update roles:
 
 1. Grant them a role that allows them to create/update Role or ClusterRole objects, as desired.
 2. Grant them permission to include specific permissions in the roles they create/update:
-    * implicitly, by giving them those permissions (if they attempt to create or modify a Role or ClusterRole with permissions they themselves have not been granted, the API request will be forbidden)
+    * implicitly, by giving them those permissions (if they attempt to create or modify a Role or
-    * or explicitly allow specifying any permission in a `Role` or `ClusterRole` by giving them permission to perform the `escalate` verb on `roles` or `clusterroles` resources in the `rbac.authorization.k8s.io` API group
+     ClusterRole with permissions they themselves have not been granted, the API request will be forbidden)
+    * or explicitly allow specifying any permission in a `Role` or `ClusterRole` by giving them
+     permission to perform the `escalate` verb on `roles` or `clusterroles` resources in the
+     `rbac.authorization.k8s.io` API group
 -->
 例如，如果 `user-1` 没有列举集群范围所有 Secret 的权限，他将不能创建包含该权限的 ClusterRole。
 若要允许用户创建/更新角色：