kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[zh] sync endpoints-aggregated.yaml

This commit is contained in:
Michael 2022-10-21 07:52:22 +08:00 committed by windsonsea
parent fc4a48ee3c
commit d97b08d759
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
content/zh-cn/examples/access/endpoints-aggregated.yaml
View File

@ -3,12 +3,13 @@ kind: ClusterRole
metadata: metadata:
annotations: annotations:
kubernetes.io/description: |- kubernetes.io/description: |-
Add endpoints write permissions to the edit and admin roles. This was 将端点写入权限添加到 edit 和 admin 角色。此特性因 CVE-2021-25740 在 1.22
removed by default in 1.22 because of CVE-2021-25740. See 中默认被移除。请参阅 https://issue.k8s.io/103675
https://issue.k8s.io/103675. This can allow writers to direct LoadBalancer 这一设置将允许写者要求 LoadBalancer 或 Ingress 的实现向外暴露后端 IP 地址，
or Ingress implementations to expose backend IPs that would not otherwise 所暴露的 IP 地址无法通过其他方式访问，
be accessible, and can circumvent network policies or security controls 并且可以规避对这些后端访问进行预防/隔离的网络策略或安全控制机制。
intended to prevent/isolate access to those backends. EndpointSlice 从未包含在 edit 和 admin 角色中，
因此 EndpointSlice API 没有什么可恢复的。
labels: labels:
rbac.authorization.k8s.io/aggregate-to-edit: "true" rbac.authorization.k8s.io/aggregate-to-edit: "true"
name: custom:aggregate-to-edit:endpoints # 你可以随意愿更改这个 name name: custom:aggregate-to-edit:endpoints # 你可以随意愿更改这个 name