rootsongjc
/
kubernetes-handbook
mirror of https://github.com/rootsongjc/kubernetes-handbook.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
kubernetes-handbook/guide/authentication.html

5241 lines
312 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters!

This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.

<!DOCTYPE HTML>
<html lang="zh-hans" >
<head>
<meta charset="UTF-8">
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>Kubernetes 中的用户与身份认证授权 · Kubernetes 中文指南——云原生应用架构实战手册</title>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="description" content="">
<meta name="generator" content="GitBook 3.2.3">
<meta name="author" content="宋净超（Jimmy Song）">
<link rel="stylesheet" href="../gitbook/style.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-splitter/splitter.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-page-toc-button/plugin.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-image-captions/image-captions.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-back-to-top-button/plugin.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-search-plus/search.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-tbfed-pagefooter/footer.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-prism/prism-ghcolors.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-lightbox/css/lightbox.min.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-expandable-chapters-small/expandable-chapters-small.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-insert-logo/plugin.css">
<link rel="stylesheet" href="../gitbook/gitbook-plugin-fontsettings/website.css">
<meta name="HandheldFriendly" content="true"/>
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="black">
<link rel="apple-touch-icon-precomposed" sizes="152x152" href="../gitbook/images/apple-touch-icon-precomposed-152.png">
<link rel="shortcut icon" href="../gitbook/images/favicon.ico" type="image/x-icon">
<link rel="next" href="kubernetes-security-best-practice.html" />
<link rel="prev" href="auth-with-kubeconfig-or-token.html" />
<link rel="shortcut icon" href='../favicon.ico' type="image/x-icon">
<link rel="bookmark" href='../favicon.ico' type="image/x-icon">
<style>
@media only screen and (max-width: 640px) {
.book-header .hidden-mobile {
display: none;
}
}
</style>
<script>
window["gitbook-plugin-github-buttons"] = {"repo":"rootsongjc/kubernetes-handbook","types":["star"],"size":"small"};
</script>
</head>
<body>
<div class="book">
<div class="book-summary">
<div id="book-search-input" role="search">
<input type="text" placeholder="输入并搜索" />
</div>
<nav role="navigation">
<ul class="summary">
<li>
<a href="https://jimmysong.io" target="_blank" class="custom-link">回到主页</a>
</li>
<li>
<a href="https://jimmysong.io/book/" target="_blank" class="custom-link">全部书籍</a>
</li>
<li>
<a href="https://jimmysong.io/awesome-cloud-native/" target="_blank" class="custom-link">云原生开源项目大全</a>
</li>
<li>
<a href="https://cloudnative.to" target="_blank" class="custom-link">云原生社区</a>
</li>
<li class="divider"></li>
<li class="header">前言</li>
<li class="chapter " data-level="1.1" data-path="../">
<a href="../">
<b>1.1.</b>
序言
</a>
</li>
<li class="header">云原生</li>
<li class="chapter " data-level="2.1" data-path="../cloud-native/cloud-native-definition.html">
<a href="../cloud-native/cloud-native-definition.html">
<b>2.1.</b>
云原生的定义
</a>
</li>
<li class="chapter " data-level="2.2" data-path="../cloud-native/cloud-native-philosophy.html">
<a href="../cloud-native/cloud-native-philosophy.html">
<b>2.2.</b>
云原生的设计哲学
</a>
</li>
<li class="chapter " data-level="2.3" data-path="../cloud-native/kubernetes-history.html">
<a href="../cloud-native/kubernetes-history.html">
<b>2.3.</b>
Kubernetes 的诞生
</a>
</li>
<li class="chapter " data-level="2.4" data-path="../cloud-native/kubernetes-and-cloud-native-app-overview.html">
<a href="../cloud-native/kubernetes-and-cloud-native-app-overview.html">
<b>2.4.</b>
Kubernetes 与云原生应用概览
</a>
</li>
<li class="chapter " data-level="2.5" data-path="../cloud-native/from-kubernetes-to-cloud-native.html">
<a href="../cloud-native/from-kubernetes-to-cloud-native.html">
<b>2.5.</b>
云原生应用之路 —— 从 Kubernetes 到云原生
</a>
</li>
<li class="chapter " data-level="2.6" data-path="../cloud-native/define-cloud-native-app.html">
<a href="../cloud-native/define-cloud-native-app.html">
<b>2.6.</b>
定义云原生应用
</a>
<ul class="articles">
<li class="chapter " data-level="2.6.1" data-path="../cloud-native/oam.html">
<a href="../cloud-native/oam.html">
<b>2.6.1.</b>
OAM
</a>
<ul class="articles">
<li class="chapter " data-level="2.6.1.1" data-path="../cloud-native/workload.html">
<a href="../cloud-native/workload.html">
<b>2.6.1.1.</b>
Workload
</a>
</li>
<li class="chapter " data-level="2.6.1.2" data-path="../cloud-native/component.html">
<a href="../cloud-native/component.html">
<b>2.6.1.2.</b>
Component
</a>
</li>
<li class="chapter " data-level="2.6.1.3" data-path="../cloud-native/trait.html">
<a href="../cloud-native/trait.html">
<b>2.6.1.3.</b>
Trait
</a>
</li>
<li class="chapter " data-level="2.6.1.4" data-path="../cloud-native/application-scope.html">
<a href="../cloud-native/application-scope.html">
<b>2.6.1.4.</b>
Application Scope
</a>
</li>
<li class="chapter " data-level="2.6.1.5" data-path="../cloud-native/application-configuration.html">
<a href="../cloud-native/application-configuration.html">
<b>2.6.1.5.</b>
Application Configuration
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="2.6.2" data-path="../cloud-native/crossplane.html">
<a href="../cloud-native/crossplane.html">
<b>2.6.2.</b>
Crossplane
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="2.7" data-path="../cloud-native/cloud-native-programming-languages.html">
<a href="../cloud-native/cloud-native-programming-languages.html">
<b>2.7.</b>
云原生平台配置语言
</a>
<ul class="articles">
<li class="chapter " data-level="2.7.1" data-path="../cloud-native/cloud-native-programming-language-ballerina.html">
<a href="../cloud-native/cloud-native-programming-language-ballerina.html">
<b>2.7.1.</b>
Ballerina
</a>
</li>
<li class="chapter " data-level="2.7.2" data-path="../cloud-native/cloud-native-programming-language-pulumi.html">
<a href="../cloud-native/cloud-native-programming-language-pulumi.html">
<b>2.7.2.</b>
Pulumi
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="2.8" data-path="../cloud-native/the-future-of-cloud-native.html">
<a href="../cloud-native/the-future-of-cloud-native.html">
<b>2.8.</b>
云原生的未来
</a>
</li>
<li class="header">快速入门</li>
<li class="chapter " data-level="3.1" data-path="../cloud-native/quick-start.html">
<a href="../cloud-native/quick-start.html">
<b>3.1.</b>
云原生新手入门指南
</a>
</li>
<li class="chapter " data-level="3.2" data-path="../cloud-native/play-with-kubernetes.html">
<a href="../cloud-native/play-with-kubernetes.html">
<b>3.2.</b>
Play with Kubernetes
</a>
</li>
<li class="chapter " data-level="3.3" data-path="../cloud-native/cloud-native-local-quick-start.html">
<a href="../cloud-native/cloud-native-local-quick-start.html">
<b>3.3.</b>
快速部署一个云原生本地实验环境
</a>
</li>
<li class="chapter " data-level="3.4" data-path="../cloud-native/setup-kubernetes-with-rancher-and-aliyun.html">
<a href="../cloud-native/setup-kubernetes-with-rancher-and-aliyun.html">
<b>3.4.</b>
使用 Rancher 在阿里云上部署 Kubenretes 集群
</a>
</li>
<li class="header">概念与原理</li>
<li class="chapter " data-level="4.1" data-path="../concepts/">
<a href="../concepts/">
<b>4.1.</b>
Kubernetes 架构
</a>
<ul class="articles">
<li class="chapter " data-level="4.1.1" data-path="../concepts/concepts.html">
<a href="../concepts/concepts.html">
<b>4.1.1.</b>
Kubernetes 的设计理念
</a>
</li>
<li class="chapter " data-level="4.1.2" data-path="../concepts/etcd.html">
<a href="../concepts/etcd.html">
<b>4.1.2.</b>
Etcd 解析
</a>
</li>
<li class="chapter " data-level="4.1.3" data-path="../concepts/open-interfaces.html">
<a href="../concepts/open-interfaces.html">
<b>4.1.3.</b>
开放接口
</a>
<ul class="articles">
<li class="chapter " data-level="4.1.3.1" data-path="../concepts/cri.html">
<a href="../concepts/cri.html">
<b>4.1.3.1.</b>
容器运行时接口（CRI）
</a>
</li>
<li class="chapter " data-level="4.1.3.2" data-path="../concepts/cni.html">
<a href="../concepts/cni.html">
<b>4.1.3.2.</b>
容器网络接口（CNI）
</a>
</li>
<li class="chapter " data-level="4.1.3.3" data-path="../concepts/csi.html">
<a href="../concepts/csi.html">
<b>4.1.3.3.</b>
容器存储接口（CSI）
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.1.4" data-path="../concepts/objects.html">
<a href="../concepts/objects.html">
<b>4.1.4.</b>
Kubernetes 中的资源对象
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.2" data-path="../concepts/pod-state-and-lifecycle.html">
<a href="../concepts/pod-state-and-lifecycle.html">
<b>4.2.</b>
Pod 状态与生命周期管理
</a>
<ul class="articles">
<li class="chapter " data-level="4.2.1" data-path="../concepts/pod-overview.html">
<a href="../concepts/pod-overview.html">
<b>4.2.1.</b>
Pod 概览
</a>
</li>
<li class="chapter " data-level="4.2.2" data-path="../concepts/pod.html">
<a href="../concepts/pod.html">
<b>4.2.2.</b>
Pod 解析
</a>
</li>
<li class="chapter " data-level="4.2.3" data-path="../concepts/init-containers.html">
<a href="../concepts/init-containers.html">
<b>4.2.3.</b>
Init 容器
</a>
</li>
<li class="chapter " data-level="4.2.4" data-path="../concepts/pause-container.html">
<a href="../concepts/pause-container.html">
<b>4.2.4.</b>
Pause 容器
</a>
</li>
<li class="chapter " data-level="4.2.5" data-path="../concepts/pod-security-policy.html">
<a href="../concepts/pod-security-policy.html">
<b>4.2.5.</b>
Pod 安全策略
</a>
</li>
<li class="chapter " data-level="4.2.6" data-path="../concepts/pod-lifecycle.html">
<a href="../concepts/pod-lifecycle.html">
<b>4.2.6.</b>
Pod 的生命周期
</a>
</li>
<li class="chapter " data-level="4.2.7" data-path="../concepts/pod-hook.html">
<a href="../concepts/pod-hook.html">
<b>4.2.7.</b>
Pod Hook
</a>
</li>
<li class="chapter " data-level="4.2.8" data-path="../concepts/pod-preset.html">
<a href="../concepts/pod-preset.html">
<b>4.2.8.</b>
Pod Preset
</a>
</li>
<li class="chapter " data-level="4.2.9" data-path="../concepts/pod-disruption-budget.html">
<a href="../concepts/pod-disruption-budget.html">
<b>4.2.9.</b>
Pod 中断与 PDB（Pod 中断预算）
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.3" data-path="../concepts/cluster.html">
<a href="../concepts/cluster.html">
<b>4.3.</b>
集群资源管理
</a>
<ul class="articles">
<li class="chapter " data-level="4.3.1" data-path="../concepts/node.html">
<a href="../concepts/node.html">
<b>4.3.1.</b>
Node
</a>
</li>
<li class="chapter " data-level="4.3.2" data-path="../concepts/namespace.html">
<a href="../concepts/namespace.html">
<b>4.3.2.</b>
Namespace
</a>
</li>
<li class="chapter " data-level="4.3.3" data-path="../concepts/label.html">
<a href="../concepts/label.html">
<b>4.3.3.</b>
Label
</a>
</li>
<li class="chapter " data-level="4.3.4" data-path="../concepts/annotation.html">
<a href="../concepts/annotation.html">
<b>4.3.4.</b>
Annotation
</a>
</li>
<li class="chapter " data-level="4.3.5" data-path="../concepts/taint-and-toleration.html">
<a href="../concepts/taint-and-toleration.html">
<b>4.3.5.</b>
Taint 和 Toleration（污点和容忍）
</a>
</li>
<li class="chapter " data-level="4.3.6" data-path="../concepts/garbage-collection.html">
<a href="../concepts/garbage-collection.html">
<b>4.3.6.</b>
垃圾收集
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.4" data-path="../concepts/controllers.html">
<a href="../concepts/controllers.html">
<b>4.4.</b>
控制器
</a>
<ul class="articles">
<li class="chapter " data-level="4.4.1" data-path="../concepts/deployment.html">
<a href="../concepts/deployment.html">
<b>4.4.1.</b>
Deployment
</a>
</li>
<li class="chapter " data-level="4.4.2" data-path="../concepts/statefulset.html">
<a href="../concepts/statefulset.html">
<b>4.4.2.</b>
StatefulSet
</a>
</li>
<li class="chapter " data-level="4.4.3" data-path="../concepts/daemonset.html">
<a href="../concepts/daemonset.html">
<b>4.4.3.</b>
DaemonSet
</a>
</li>
<li class="chapter " data-level="4.4.4" data-path="../concepts/replicaset.html">
<a href="../concepts/replicaset.html">
<b>4.4.4.</b>
ReplicationController 和 ReplicaSet
</a>
</li>
<li class="chapter " data-level="4.4.5" data-path="../concepts/job.html">
<a href="../concepts/job.html">
<b>4.4.5.</b>
Job
</a>
</li>
<li class="chapter " data-level="4.4.6" data-path="../concepts/cronjob.html">
<a href="../concepts/cronjob.html">
<b>4.4.6.</b>
CronJob
</a>
</li>
<li class="chapter " data-level="4.4.7" data-path="../concepts/horizontal-pod-autoscaling.html">
<a href="../concepts/horizontal-pod-autoscaling.html">
<b>4.4.7.</b>
Horizontal Pod Autoscaling
</a>
<ul class="articles">
<li class="chapter " data-level="4.4.7.1" data-path="../concepts/custom-metrics-hpa.html">
<a href="../concepts/custom-metrics-hpa.html">
<b>4.4.7.1.</b>
自定义指标 HPA
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.4.8" data-path="../concepts/admission-controller.html">
<a href="../concepts/admission-controller.html">
<b>4.4.8.</b>
准入控制器（Admission Controller）
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.5" data-path="../concepts/service-discovery.html">
<a href="../concepts/service-discovery.html">
<b>4.5.</b>
服务发现与路由
</a>
<ul class="articles">
<li class="chapter " data-level="4.5.1" data-path="../concepts/service.html">
<a href="../concepts/service.html">
<b>4.5.1.</b>
Service
</a>
</li>
<li class="chapter " data-level="4.5.2" data-path="../concepts/topology-aware-routing.html">
<a href="../concepts/topology-aware-routing.html">
<b>4.5.2.</b>
拓扑感知路由
</a>
</li>
<li class="chapter " data-level="4.5.3" data-path="../concepts/ingress.html">
<a href="../concepts/ingress.html">
<b>4.5.3.</b>
Ingress
</a>
<ul class="articles">
<li class="chapter " data-level="4.5.3.1" data-path="../concepts/traefik-ingress-controller.html">
<a href="../concepts/traefik-ingress-controller.html">
<b>4.5.3.1.</b>
Traefik Ingress Controller
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.5.4" data-path="../concepts/gateway.html">
<a href="../concepts/gateway.html">
<b>4.5.4.</b>
Gateway
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.6" data-path="../concepts/authentication-and-permission.html">
<a href="../concepts/authentication-and-permission.html">
<b>4.6.</b>
身份与权限控制
</a>
<ul class="articles">
<li class="chapter " data-level="4.6.1" data-path="../concepts/serviceaccount.html">
<a href="../concepts/serviceaccount.html">
<b>4.6.1.</b>
ServiceAccount
</a>
</li>
<li class="chapter " data-level="4.6.2" data-path="../concepts/rbac.html">
<a href="../concepts/rbac.html">
<b>4.6.2.</b>
基于角色的访问控制（RBAC）
</a>
</li>
<li class="chapter " data-level="4.6.3" data-path="../concepts/network-policy.html">
<a href="../concepts/network-policy.html">
<b>4.6.3.</b>
NetworkPolicy
</a>
</li>
<li class="chapter " data-level="4.6.4" data-path="../concepts/spiffe.html">
<a href="../concepts/spiffe.html">
<b>4.6.4.</b>
SPIFFE
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.7" data-path="../concepts/networking.html">
<a href="../concepts/networking.html">
<b>4.7.</b>
网络
</a>
<ul class="articles">
<li class="chapter " data-level="4.7.1" data-path="../concepts/flannel.html">
<a href="../concepts/flannel.html">
<b>4.7.1.</b>
扁平网络 Flannel
</a>
</li>
<li class="chapter " data-level="4.7.2" data-path="../concepts/calico.html">
<a href="../concepts/calico.html">
<b>4.7.2.</b>
非 Overlay 扁平网络 Calico
</a>
</li>
<li class="chapter " data-level="4.7.3" data-path="../concepts/cilium.html">
<a href="../concepts/cilium.html">
<b>4.7.3.</b>
基于 eBPF 的网络 Cilium
</a>
<ul class="articles">
<li class="chapter " data-level="4.7.3.1" data-path="../concepts/cilium-concepts.html">
<a href="../concepts/cilium-concepts.html">
<b>4.7.3.1.</b>
Cilium 架构设计与概念解析
</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="chapter " data-level="4.8" data-path="../concepts/storage.html">
<a href="../concepts/storage.html">
<b>4.8.</b>
存储
</a>
<ul class="articles">
<li class="chapter " data-level="4.8.1" data-path="../concepts/secret.html">
<a href="../concepts/secret.html">
<b>4.8.1.</b>
Secret
</a>
</li>
<li class="chapter " data-level="4.8.2" data-path="../concepts/configmap.html">
<a href="../concepts/configmap.html">
<b>4.8.2.</b>
ConfigMap
</a>
<ul class="articles">
<li class="chapter " data-level="4.8.2.1" data-path="../concepts/configmap-hot-update.html">
<a href="../concepts/configmap-hot-update.html">
<b>4.8.2.1.</b>
ConfigMap 的热更新
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.8.3" data-path="../concepts/volume.html">
<a href="../concepts/volume.html">
<b>4.8.3.</b>
Volume
</a>
</li>
<li class="chapter " data-level="4.8.4" data-path="../concepts/persistent-volume.html">
<a href="../concepts/persistent-volume.html">
<b>4.8.4.</b>
持久化卷（Persistent Volume）
</a>
</li>
<li class="chapter " data-level="4.8.5" data-path="../concepts/storageclass.html">
<a href="../concepts/storageclass.html">
<b>4.8.5.</b>
Storage Class
</a>
</li>
<li class="chapter " data-level="4.8.6" data-path="../concepts/local-persistent-storage.html">
<a href="../concepts/local-persistent-storage.html">
<b>4.8.6.</b>
本地持久化存储
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.9" data-path="../concepts/extension.html">
<a href="../concepts/extension.html">
<b>4.9.</b>
集群扩展
</a>
<ul class="articles">
<li class="chapter " data-level="4.9.1" data-path="../concepts/custom-resource.html">
<a href="../concepts/custom-resource.html">
<b>4.9.1.</b>
使用自定义资源扩展 API
</a>
</li>
<li class="chapter " data-level="4.9.2" data-path="../concepts/crd.html">
<a href="../concepts/crd.html">
<b>4.9.2.</b>
使用 CRD 扩展 Kubernetes API
</a>
</li>
<li class="chapter " data-level="4.9.3" data-path="../concepts/aggregated-api-server.html">
<a href="../concepts/aggregated-api-server.html">
<b>4.9.3.</b>
Aggregated API Server
</a>
</li>
<li class="chapter " data-level="4.9.4" data-path="../concepts/apiservice.html">
<a href="../concepts/apiservice.html">
<b>4.9.4.</b>
APIService
</a>
</li>
<li class="chapter " data-level="4.9.5" data-path="../concepts/service-catalog.html">
<a href="../concepts/service-catalog.html">
<b>4.9.5.</b>
服务目录（Service Catalog）
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.10" data-path="../concepts/multicluster.html">
<a href="../concepts/multicluster.html">
<b>4.10.</b>
多集群管理
</a>
<ul class="articles">
<li class="chapter " data-level="4.10.1" data-path="../concepts/multi-cluster-services-api.html">
<a href="../concepts/multi-cluster-services-api.html">
<b>4.10.1.</b>
多集群服务 API（Multi-Cluster Services API）
</a>
</li>
<li class="chapter " data-level="4.10.2" data-path="../practice/federation.html">
<a href="../practice/federation.html">
<b>4.10.2.</b>
集群联邦（Cluster Federation）
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="4.11" data-path="../concepts/scheduling.html">
<a href="../concepts/scheduling.html">
<b>4.11.</b>
资源调度
</a>
<ul class="articles">
<li class="chapter " data-level="4.11.1" data-path="../concepts/qos.html">
<a href="../concepts/qos.html">
<b>4.11.1.</b>
服务质量等级（QoS）
</a>
</li>
</ul>
</li>
<li class="header">用户指南</li>
<li class="chapter " data-level="5.1" data-path="./">
<a href="./">
<b>5.1.</b>
用户指南概览
</a>
</li>
<li class="chapter " data-level="5.2" data-path="resource-configuration.html">
<a href="resource-configuration.html">
<b>5.2.</b>
资源对象配置
</a>
<ul class="articles">
<li class="chapter " data-level="5.2.1" data-path="configure-liveness-readiness-probes.html">
<a href="configure-liveness-readiness-probes.html">
<b>5.2.1.</b>
配置 Pod 的 liveness 和 readiness 探针
</a>
</li>
<li class="chapter " data-level="5.2.2" data-path="configure-pod-service-account.html">
<a href="configure-pod-service-account.html">
<b>5.2.2.</b>
配置 Pod 的 Service Account
</a>
</li>
<li class="chapter " data-level="5.2.3" data-path="secret-configuration.html">
<a href="secret-configuration.html">
<b>5.2.3.</b>
Secret 配置
</a>
</li>
<li class="chapter " data-level="5.2.4" data-path="resource-quota-management.html">
<a href="resource-quota-management.html">
<b>5.2.4.</b>
管理 namespace 中的资源配额
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="5.3" data-path="command-usage.html">
<a href="command-usage.html">
<b>5.3.</b>
命令使用
</a>
<ul class="articles">
<li class="chapter " data-level="5.3.1" data-path="docker-cli-to-kubectl.html">
<a href="docker-cli-to-kubectl.html">
<b>5.3.1.</b>
Docker 用户过渡到 kubectl 命令行指南
</a>
</li>
<li class="chapter " data-level="5.3.2" data-path="using-kubectl.html">
<a href="using-kubectl.html">
<b>5.3.2.</b>
kubectl 命令概览
</a>
</li>
<li class="chapter " data-level="5.3.3" data-path="kubectl-cheatsheet.html">
<a href="kubectl-cheatsheet.html">
<b>5.3.3.</b>
kubectl 命令技巧大全
</a>
</li>
<li class="chapter " data-level="5.3.4" data-path="using-etcdctl-to-access-kubernetes-data.html">
<a href="using-etcdctl-to-access-kubernetes-data.html">
<b>5.3.4.</b>
使用 etcdctl 访问 Kubernetes 数据
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="5.4" data-path="cluster-security-management.html">
<a href="cluster-security-management.html">
<b>5.4.</b>
集群安全性管理
</a>
<ul class="articles">
<li class="chapter " data-level="5.4.1" data-path="managing-tls-in-a-cluster.html">
<a href="managing-tls-in-a-cluster.html">
<b>5.4.1.</b>
管理集群中的 TLS
</a>
</li>
<li class="chapter " data-level="5.4.2" data-path="kubelet-authentication-authorization.html">
<a href="kubelet-authentication-authorization.html">
<b>5.4.2.</b>
kubelet 的认证授权
</a>
</li>
<li class="chapter " data-level="5.4.3" data-path="tls-bootstrapping.html">
<a href="tls-bootstrapping.html">
<b>5.4.3.</b>
TLS Bootstrap
</a>
</li>
<li class="chapter " data-level="5.4.4" data-path="kubectl-user-authentication-authorization.html">
<a href="kubectl-user-authentication-authorization.html">
<b>5.4.4.</b>
创建用户认证授权的 kubeconfig 文件
</a>
</li>
<li class="chapter " data-level="5.4.5" data-path="ip-masq-agent.html">
<a href="ip-masq-agent.html">
<b>5.4.5.</b>
IP 伪装代理
</a>
</li>
<li class="chapter " data-level="5.4.6" data-path="auth-with-kubeconfig-or-token.html">
<a href="auth-with-kubeconfig-or-token.html">
<b>5.4.6.</b>
使用 kubeconfig 或 token 进行用户身份认证
</a>
</li>
<li class="chapter active" data-level="5.4.7" data-path="authentication.html">
<a href="authentication.html">
<b>5.4.7.</b>
Kubernetes 中的用户与身份认证授权
</a>
</li>
<li class="chapter " data-level="5.4.8" data-path="kubernetes-security-best-practice.html">
<a href="kubernetes-security-best-practice.html">
<b>5.4.8.</b>
Kubernetes 集群安全性配置最佳实践
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="5.5" data-path="access-kubernetes-cluster.html">
<a href="access-kubernetes-cluster.html">
<b>5.5.</b>
访问 Kubernetes 集群
</a>
<ul class="articles">
<li class="chapter " data-level="5.5.1" data-path="access-cluster.html">
<a href="access-cluster.html">
<b>5.5.1.</b>
访问集群
</a>
</li>
<li class="chapter " data-level="5.5.2" data-path="authenticate-across-clusters-kubeconfig.html">
<a href="authenticate-across-clusters-kubeconfig.html">
<b>5.5.2.</b>
使用 kubeconfig 文件配置跨集群认证
</a>
</li>
<li class="chapter " data-level="5.5.3" data-path="connecting-to-applications-port-forward.html">
<a href="connecting-to-applications-port-forward.html">
<b>5.5.3.</b>
通过端口转发访问集群中的应用程序
</a>
</li>
<li class="chapter " data-level="5.5.4" data-path="service-access-application-cluster.html">
<a href="service-access-application-cluster.html">
<b>5.5.4.</b>
使用 service 访问群集中的应用程序
</a>
</li>
<li class="chapter " data-level="5.5.5" data-path="accessing-kubernetes-pods-from-outside-of-the-cluster.html">
<a href="accessing-kubernetes-pods-from-outside-of-the-cluster.html">
<b>5.5.5.</b>
从外部访问 Kubernetes 中的 Pod
</a>
</li>
<li class="chapter " data-level="5.5.6" data-path="kubernetes-desktop-client.html">
<a href="kubernetes-desktop-client.html">
<b>5.5.6.</b>
Lens - Kubernetes IDE
</a>
</li>
<li class="chapter " data-level="5.5.7" data-path="kubernator-kubernetes-ui.html">
<a href="kubernator-kubernetes-ui.html">
<b>5.5.7.</b>
Kubernator - 更底层的 Kubernetes UI
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="5.6" data-path="application-development-deployment-flow.html">
<a href="application-development-deployment-flow.html">
<b>5.6.</b>
在 Kubernetes 中开发部署应用
</a>
<ul class="articles">
<li class="chapter " data-level="5.6.1" data-path="deploy-applications-in-kubernetes.html">
<a href="deploy-applications-in-kubernetes.html">
<b>5.6.1.</b>
适用于 Kubernetes 的应用开发部署流程
</a>
</li>
<li class="chapter " data-level="5.6.2" data-path="migrating-hadoop-yarn-to-kubernetes.html">
<a href="migrating-hadoop-yarn-to-kubernetes.html">
<b>5.6.2.</b>
迁移传统应用到 Kubernetes 中 —— 以 Hadoop YARN 为例
</a>
</li>
<li class="chapter " data-level="5.6.3" data-path="using-statefulset.html">
<a href="using-statefulset.html">
<b>5.6.3.</b>
使用 StatefulSet 部署用状态应用
</a>
</li>
</ul>
</li>
<li class="header">最佳实践</li>
<li class="chapter " data-level="6.1" data-path="../practice/">
<a href="../practice/">
<b>6.1.</b>
最佳实践概览
</a>
</li>
<li class="chapter " data-level="6.2" data-path="../practice/install-kubernetes-on-centos.html">
<a href="../practice/install-kubernetes-on-centos.html">
<b>6.2.</b>
在 CentOS 上部署 Kubernetes 集群
</a>
<ul class="articles">
<li class="chapter " data-level="6.2.1" data-path="../practice/create-tls-and-secret-key.html">
<a href="../practice/create-tls-and-secret-key.html">
<b>6.2.1.</b>
创建 TLS 证书和秘钥
</a>
</li>
<li class="chapter " data-level="6.2.2" data-path="../practice/create-kubeconfig.html">
<a href="../practice/create-kubeconfig.html">
<b>6.2.2.</b>
创建 kubeconfig 文件
</a>
</li>
<li class="chapter " data-level="6.2.3" data-path="../practice/etcd-cluster-installation.html">
<a href="../practice/etcd-cluster-installation.html">
<b>6.2.3.</b>
创建高可用 etcd 集群
</a>
</li>
<li class="chapter " data-level="6.2.4" data-path="../practice/kubectl-installation.html">
<a href="../practice/kubectl-installation.html">
<b>6.2.4.</b>
安装 kubectl 命令行工具
</a>
</li>
<li class="chapter " data-level="6.2.5" data-path="../practice/master-installation.html">
<a href="../practice/master-installation.html">
<b>6.2.5.</b>
部署 master 节点
</a>
</li>
<li class="chapter " data-level="6.2.6" data-path="../practice/flannel-installation.html">
<a href="../practice/flannel-installation.html">
<b>6.2.6.</b>
安装 flannel 网络插件
</a>
</li>
<li class="chapter " data-level="6.2.7" data-path="../practice/node-installation.html">
<a href="../practice/node-installation.html">
<b>6.2.7.</b>
部署 node 节点
</a>
</li>
<li class="chapter " data-level="6.2.8" data-path="../practice/kubedns-addon-installation.html">
<a href="../practice/kubedns-addon-installation.html">
<b>6.2.8.</b>
安装 kubedns 插件
</a>
</li>
<li class="chapter " data-level="6.2.9" data-path="../practice/dashboard-addon-installation.html">
<a href="../practice/dashboard-addon-installation.html">
<b>6.2.9.</b>
安装 dashboard 插件
</a>
</li>
<li class="chapter " data-level="6.2.10" data-path="../practice/heapster-addon-installation.html">
<a href="../practice/heapster-addon-installation.html">
<b>6.2.10.</b>
安装 heapster 插件
</a>
</li>
<li class="chapter " data-level="6.2.11" data-path="../practice/efk-addon-installation.html">
<a href="../practice/efk-addon-installation.html">
<b>6.2.11.</b>
安装 EFK 插件
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.3" data-path="../practice/install-kubernetes-with-kubeadm.html">
<a href="../practice/install-kubernetes-with-kubeadm.html">
<b>6.3.</b>
生产级的 Kubernetes 简化管理工具 kubeadm
</a>
<ul class="articles">
<li class="chapter " data-level="6.3.1" data-path="../practice/install-kubernetes-on-ubuntu-server-16.04-with-kubeadm.html">
<a href="../practice/install-kubernetes-on-ubuntu-server-16.04-with-kubeadm.html">
<b>6.3.1.</b>
使用 kubeadm 在 Ubuntu Server 16.04 上快速构建测试集群
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.4" data-path="../practice/service-discovery-and-loadbalancing.html">
<a href="../practice/service-discovery-and-loadbalancing.html">
<b>6.4.</b>
服务发现与负载均衡
</a>
<ul class="articles">
<li class="chapter " data-level="6.4.1" data-path="../practice/traefik-ingress-installation.html">
<a href="../practice/traefik-ingress-installation.html">
<b>6.4.1.</b>
安装 Traefik ingress
</a>
</li>
<li class="chapter " data-level="6.4.2" data-path="../practice/distributed-load-test.html">
<a href="../practice/distributed-load-test.html">
<b>6.4.2.</b>
分布式负载测试
</a>
</li>
<li class="chapter " data-level="6.4.3" data-path="../practice/network-and-cluster-perfermance-test.html">
<a href="../practice/network-and-cluster-perfermance-test.html">
<b>6.4.3.</b>
网络和集群性能测试
</a>
</li>
<li class="chapter " data-level="6.4.4" data-path="../practice/edge-node-configuration.html">
<a href="../practice/edge-node-configuration.html">
<b>6.4.4.</b>
边缘节点配置
</a>
</li>
<li class="chapter " data-level="6.4.5" data-path="../practice/nginx-ingress-installation.html">
<a href="../practice/nginx-ingress-installation.html">
<b>6.4.5.</b>
安装 Nginx ingress
</a>
</li>
<li class="chapter " data-level="6.4.6" data-path="../practice/dns-installation.html">
<a href="../practice/dns-installation.html">
<b>6.4.6.</b>
安装配置 DNS
</a>
<ul class="articles">
<li class="chapter " data-level="6.4.6.1" data-path="../practice/configuring-dns.html">
<a href="../practice/configuring-dns.html">
<b>6.4.6.1.</b>
安装配置 Kube-dns
</a>
</li>
<li class="chapter " data-level="6.4.6.2" data-path="../practice/coredns.html">
<a href="../practice/coredns.html">
<b>6.4.6.2.</b>
安装配置 CoreDNS
</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="chapter " data-level="6.5" data-path="../practice/operation.html">
<a href="../practice/operation.html">
<b>6.5.</b>
运维管理
</a>
<ul class="articles">
<li class="chapter " data-level="6.5.1" data-path="../practice/master-ha.html">
<a href="../practice/master-ha.html">
<b>6.5.1.</b>
Master 节点高可用
</a>
</li>
<li class="chapter " data-level="6.5.2" data-path="../practice/service-rolling-update.html">
<a href="../practice/service-rolling-update.html">
<b>6.5.2.</b>
服务滚动升级
</a>
</li>
<li class="chapter " data-level="6.5.3" data-path="../practice/app-log-collection.html">
<a href="../practice/app-log-collection.html">
<b>6.5.3.</b>
应用日志收集
</a>
</li>
<li class="chapter " data-level="6.5.4" data-path="../practice/configuration-best-practice.html">
<a href="../practice/configuration-best-practice.html">
<b>6.5.4.</b>
配置最佳实践
</a>
</li>
<li class="chapter " data-level="6.5.5" data-path="../practice/monitor.html">
<a href="../practice/monitor.html">
<b>6.5.5.</b>
集群及应用监控
</a>
</li>
<li class="chapter " data-level="6.5.6" data-path="../practice/data-persistence-problem.html">
<a href="../practice/data-persistence-problem.html">
<b>6.5.6.</b>
数据持久化问题
</a>
</li>
<li class="chapter " data-level="6.5.7" data-path="../practice/manage-compute-resources-container.html">
<a href="../practice/manage-compute-resources-container.html">
<b>6.5.7.</b>
管理容器的计算资源
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.6" data-path="../practice/storage.html">
<a href="../practice/storage.html">
<b>6.6.</b>
存储管理
</a>
<ul class="articles">
<li class="chapter " data-level="6.6.1" data-path="../practice/glusterfs.html">
<a href="../practice/glusterfs.html">
<b>6.6.1.</b>
GlusterFS
</a>
<ul class="articles">
<li class="chapter " data-level="6.6.1.1" data-path="../practice/using-glusterfs-for-persistent-storage.html">
<a href="../practice/using-glusterfs-for-persistent-storage.html">
<b>6.6.1.1.</b>
使用 GlusterFS 做持久化存储
</a>
</li>
<li class="chapter " data-level="6.6.1.2" data-path="../practice/using-heketi-gluster-for-persistent-storage.html">
<a href="../practice/using-heketi-gluster-for-persistent-storage.html">
<b>6.6.1.2.</b>
使用 Heketi 作为 Kubernetes 的持久存储 GlusterFS 的 external provisioner
</a>
</li>
<li class="chapter " data-level="6.6.1.3" data-path="../practice/storage-for-containers-using-glusterfs-with-openshift.html">
<a href="../practice/storage-for-containers-using-glusterfs-with-openshift.html">
<b>6.6.1.3.</b>
在 OpenShift 中使用 GlusterFS 做持久化存储
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.6.2" data-path="../practice/glusterd-2.0.html">
<a href="../practice/glusterd-2.0.html">
<b>6.6.2.</b>
GlusterD-2.0
</a>
</li>
<li class="chapter " data-level="6.6.3" data-path="../practice/ceph.html">
<a href="../practice/ceph.html">
<b>6.6.3.</b>
Ceph
</a>
<ul class="articles">
<li class="chapter " data-level="6.6.3.1" data-path="../practice/ceph-helm-install-guide-zh.html">
<a href="../practice/ceph-helm-install-guide-zh.html">
<b>6.6.3.1.</b>
用 Helm 托管安装 Ceph 集群并提供后端存储
</a>
</li>
<li class="chapter " data-level="6.6.3.2" data-path="../practice/using-ceph-for-persistent-storage.html">
<a href="../practice/using-ceph-for-persistent-storage.html">
<b>6.6.3.2.</b>
使用 Ceph 做持久化存储
</a>
</li>
<li class="chapter " data-level="6.6.3.3" data-path="../practice/rbd-provisioner.html">
<a href="../practice/rbd-provisioner.html">
<b>6.6.3.3.</b>
使用 rbd-provisioner 提供 rbd 持久化存储
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.6.4" data-path="../practice/openebs.html">
<a href="../practice/openebs.html">
<b>6.6.4.</b>
OpenEBS
</a>
<ul class="articles">
<li class="chapter " data-level="6.6.4.1" data-path="../practice/using-openebs-for-persistent-storage.html">
<a href="../practice/using-openebs-for-persistent-storage.html">
<b>6.6.4.1.</b>
使用 OpenEBS 做持久化存储
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.6.5" data-path="../practice/rook.html">
<a href="../practice/rook.html">
<b>6.6.5.</b>
Rook
</a>
</li>
<li class="chapter " data-level="6.6.6" data-path="../practice/nfs.html">
<a href="../practice/nfs.html">
<b>6.6.6.</b>
NFS
</a>
<ul class="articles">
<li class="chapter " data-level="6.6.6.1" data-path="../practice/using-nfs-for-persistent-storage.html">
<a href="../practice/using-nfs-for-persistent-storage.html">
<b>6.6.6.1.</b>
利用 NFS 动态提供 Kubernetes 后端存储卷
</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="chapter " data-level="6.7" data-path="../practice/monitoring.html">
<a href="../practice/monitoring.html">
<b>6.7.</b>
集群与应用监控
</a>
<ul class="articles">
<li class="chapter " data-level="6.7.1" data-path="../practice/heapster.html">
<a href="../practice/heapster.html">
<b>6.7.1.</b>
Heapster
</a>
<ul class="articles">
<li class="chapter " data-level="6.7.1.1" data-path="../practice/using-heapster-to-get-object-metrics.html">
<a href="../practice/using-heapster-to-get-object-metrics.html">
<b>6.7.1.1.</b>
使用 Heapster 获取集群和对象的 metric 数据
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.7.2" data-path="../practice/prometheus.html">
<a href="../practice/prometheus.html">
<b>6.7.2.</b>
Prometheus
</a>
<ul class="articles">
<li class="chapter " data-level="6.7.2.1" data-path="../practice/using-prometheus-to-monitor-kuberentes-cluster.html">
<a href="../practice/using-prometheus-to-monitor-kuberentes-cluster.html">
<b>6.7.2.1.</b>
使用 Prometheus 监控 Kubernetes 集群
</a>
</li>
<li class="chapter " data-level="6.7.2.2" data-path="../practice/promql.html">
<a href="../practice/promql.html">
<b>6.7.2.2.</b>
Prometheus 查询语言 PromQL 使用说明
</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="chapter " data-level="6.8" data-path="../practice/distributed-tracing.html">
<a href="../practice/distributed-tracing.html">
<b>6.8.</b>
分布式追踪
</a>
<ul class="articles">
<li class="chapter " data-level="6.8.1" data-path="../practice/opentracing.html">
<a href="../practice/opentracing.html">
<b>6.8.1.</b>
OpenTracing
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.9" data-path="../practice/services-management-tool.html">
<a href="../practice/services-management-tool.html">
<b>6.9.</b>
服务编排管理
</a>
<ul class="articles">
<li class="chapter " data-level="6.9.1" data-path="../practice/helm.html">
<a href="../practice/helm.html">
<b>6.9.1.</b>
使用 Helm 管理 Kubernetes 应用
</a>
</li>
<li class="chapter " data-level="6.9.2" data-path="../practice/create-private-charts-repo.html">
<a href="../practice/create-private-charts-repo.html">
<b>6.9.2.</b>
构建私有 Chart 仓库
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.10" data-path="../practice/ci-cd.html">
<a href="../practice/ci-cd.html">
<b>6.10.</b>
持续集成与发布（CI/CD）
</a>
<ul class="articles">
<li class="chapter " data-level="6.10.1" data-path="../practice/jenkins-ci-cd.html">
<a href="../practice/jenkins-ci-cd.html">
<b>6.10.1.</b>
使用 Jenkins 进行持续集成与发布
</a>
</li>
<li class="chapter " data-level="6.10.2" data-path="../practice/drone-ci-cd.html">
<a href="../practice/drone-ci-cd.html">
<b>6.10.2.</b>
使用 Drone 进行持续集成与发布
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.11" data-path="../practice/update-and-upgrade.html">
<a href="../practice/update-and-upgrade.html">
<b>6.11.</b>
更新与升级
</a>
<ul class="articles">
<li class="chapter " data-level="6.11.1" data-path="../practice/manually-upgrade.html">
<a href="../practice/manually-upgrade.html">
<b>6.11.1.</b>
手动升级 Kubernetes 集群
</a>
</li>
<li class="chapter " data-level="6.11.2" data-path="../practice/dashboard-upgrade.html">
<a href="../practice/dashboard-upgrade.html">
<b>6.11.2.</b>
升级 dashboard
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="6.12" data-path="../practice/controller-extended.html">
<a href="../practice/controller-extended.html">
<b>6.12.</b>
扩展控制器
</a>
<ul class="articles">
<li class="chapter " data-level="6.12.1" data-path="../practice/openkruise.html">
<a href="../practice/openkruise.html">
<b>6.12.1.</b>
OpenKruise
</a>
<ul class="articles">
<li class="chapter " data-level="6.12.1.1" data-path="../practice/in-place-update.html">
<a href="../practice/in-place-update.html">
<b>6.12.1.1.</b>
原地升级
</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="chapter " data-level="6.13" data-path="../practice/security-policy.html">
<a href="../practice/security-policy.html">
<b>6.13.</b>
安全策略
</a>
<ul class="articles">
<li class="chapter " data-level="6.13.1" data-path="../practice/open-policy-agent.html">
<a href="../practice/open-policy-agent.html">
<b>6.13.1.</b>
开放策略代理（OPA）
</a>
</li>
<li class="chapter " data-level="6.13.2" data-path="../practice/cloud-native-security.html">
<a href="../practice/cloud-native-security.html">
<b>6.13.2.</b>
云原生安全
</a>
</li>
</ul>
</li>
<li class="header">服务网格</li>
<li class="chapter " data-level="7.1" data-path="../usecases/service-mesh.html">
<a href="../usecases/service-mesh.html">
<b>7.1.</b>
服务网格（Service Mesh）
</a>
</li>
<li class="chapter " data-level="7.2" data-path="../usecases/the-enterprise-path-to-service-mesh-architectures.html">
<a href="../usecases/the-enterprise-path-to-service-mesh-architectures.html">
<b>7.2.</b>
企业级服务网格架构
</a>
<ul class="articles">
<li class="chapter " data-level="7.2.1" data-path="../usecases/service-mesh-fundamental.html">
<a href="../usecases/service-mesh-fundamental.html">
<b>7.2.1.</b>
服务网格基础
</a>
</li>
<li class="chapter " data-level="7.2.2" data-path="../usecases/comparing-service-mesh-technologies.html">
<a href="../usecases/comparing-service-mesh-technologies.html">
<b>7.2.2.</b>
服务网格技术对比
</a>
</li>
<li class="chapter " data-level="7.2.3" data-path="../usecases/service-mesh-vs-api-gateway.html">
<a href="../usecases/service-mesh-vs-api-gateway.html">
<b>7.2.3.</b>
服务网格对比 API 网关
</a>
</li>
<li class="chapter " data-level="7.2.4" data-path="../usecases/service-mesh-adoption-and-evolution.html">
<a href="../usecases/service-mesh-adoption-and-evolution.html">
<b>7.2.4.</b>
采纳和演进
</a>
</li>
<li class="chapter " data-level="7.2.5" data-path="../usecases/service-mesh-customization-and-integration.html">
<a href="../usecases/service-mesh-customization-and-integration.html">
<b>7.2.5.</b>
定制和集成
</a>
</li>
<li class="chapter " data-level="7.2.6" data-path="../usecases/service-mesh-conclusion.html">
<a href="../usecases/service-mesh-conclusion.html">
<b>7.2.6.</b>
总结
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="7.3" data-path="../usecases/istio.html">
<a href="../usecases/istio.html">
<b>7.3.</b>
Istio
</a>
<ul class="articles">
<li class="chapter " data-level="7.3.1" data-path="../usecases/before-using-istio.html">
<a href="../usecases/before-using-istio.html">
<b>7.3.1.</b>
使用 Istio 前需要考虑的问题
</a>
</li>
<li class="chapter " data-level="7.3.2" data-path="../usecases/sidecar-spec-in-istio.html">
<a href="../usecases/sidecar-spec-in-istio.html">
<b>7.3.2.</b>
Istio 中 sidecar 的注入规范及示例
</a>
</li>
<li class="chapter " data-level="7.3.3" data-path="../usecases/istio-community-tips.html">
<a href="../usecases/istio-community-tips.html">
<b>7.3.3.</b>
如何参与 Istio 社区及注意事项
</a>
</li>
<li class="chapter " data-level="7.3.4" data-path="../usecases/understand-sidecar-injection-and-traffic-hijack-in-istio-service-mesh.html">
<a href="../usecases/understand-sidecar-injection-and-traffic-hijack-in-istio-service-mesh.html">
<b>7.3.4.</b>
Sidecar 的注入与流量劫持
</a>
</li>
<li class="chapter " data-level="7.3.5" data-path="../usecases/how-to-integrate-istio-with-vm.html">
<a href="../usecases/how-to-integrate-istio-with-vm.html">
<b>7.3.5.</b>
Istio 如何支持虚拟机
</a>
</li>
<li class="chapter " data-level="7.3.6" data-path="../usecases/istio-vm-support.html">
<a href="../usecases/istio-vm-support.html">
<b>7.3.6.</b>
Istio 支持虚拟机的历史
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="7.4" data-path="../usecases/envoy.html">
<a href="../usecases/envoy.html">
<b>7.4.</b>
Envoy
</a>
<ul class="articles">
<li class="chapter " data-level="7.4.1" data-path="../usecases/envoy-terminology.html">
<a href="../usecases/envoy-terminology.html">
<b>7.4.1.</b>
Envoy 的架构与基本术语
</a>
</li>
<li class="chapter " data-level="7.4.2" data-path="../usecases/envoy-front-proxy.html">
<a href="../usecases/envoy-front-proxy.html">
<b>7.4.2.</b>
Envoy 作为前端代理
</a>
</li>
<li class="chapter " data-level="7.4.3" data-path="../usecases/envoy-mesh-in-kubernetes-tutorial.html">
<a href="../usecases/envoy-mesh-in-kubernetes-tutorial.html">
<b>7.4.3.</b>
Envoy mesh 教程
</a>
</li>
</ul>
</li>
<li class="header">领域应用</li>
<li class="chapter " data-level="8.1" data-path="../usecases/">
<a href="../usecases/">
<b>8.1.</b>
领域应用概览
</a>
</li>
<li class="chapter " data-level="8.2" data-path="../usecases/microservices.html">
<a href="../usecases/microservices.html">
<b>8.2.</b>
微服务架构
</a>
<ul class="articles">
<li class="chapter " data-level="8.2.1" data-path="../usecases/service-discovery-in-microservices.html">
<a href="../usecases/service-discovery-in-microservices.html">
<b>8.2.1.</b>
微服务中的服务发现
</a>
</li>
<li class="chapter " data-level="8.2.2" data-path="../usecases/microservices-for-java-developers.html">
<a href="../usecases/microservices-for-java-developers.html">
<b>8.2.2.</b>
使用 Java 构建微服务并发布到 Kubernetes 平台
</a>
<ul class="articles">
<li class="chapter " data-level="8.2.2.1" data-path="../usecases/spring-boot-quick-start-guide.html">
<a href="../usecases/spring-boot-quick-start-guide.html">
<b>8.2.2.1.</b>
Spring Boot 快速开始指南
</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="chapter " data-level="8.3" data-path="../usecases/big-data.html">
<a href="../usecases/big-data.html">
<b>8.3.</b>
大数据
</a>
<ul class="articles">
<li class="chapter " data-level="8.3.1" data-path="../usecases/spark-on-kubernetes.html">
<a href="../usecases/spark-on-kubernetes.html">
<b>8.3.1.</b>
Spark 与 Kubernetes
</a>
<ul class="articles">
<li class="chapter " data-level="8.3.1.1" data-path="../usecases/spark-standalone-on-kubernetes.html">
<a href="../usecases/spark-standalone-on-kubernetes.html">
<b>8.3.1.1.</b>
Spark standalone on Kubernetes
</a>
</li>
<li class="chapter " data-level="8.3.1.2" data-path="../usecases/running-spark-with-kubernetes-native-scheduler.html">
<a href="../usecases/running-spark-with-kubernetes-native-scheduler.html">
<b>8.3.1.2.</b>
运行支持 Kubernetes 原生调度的 Spark 程序
</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="chapter " data-level="8.4" data-path="../usecases/serverless.html">
<a href="../usecases/serverless.html">
<b>8.4.</b>
Serverless 架构
</a>
<ul class="articles">
<li class="chapter " data-level="8.4.1" data-path="../usecases/understanding-serverless.html">
<a href="../usecases/understanding-serverless.html">
<b>8.4.1.</b>
理解 Serverless
</a>
</li>
<li class="chapter " data-level="8.4.2" data-path="../usecases/faas.html">
<a href="../usecases/faas.html">
<b>8.4.2.</b>
FaaS（函数即服务）
</a>
<ul class="articles">
<li class="chapter " data-level="8.4.2.1" data-path="../usecases/openfaas-quick-start.html">
<a href="../usecases/openfaas-quick-start.html">
<b>8.4.2.1.</b>
OpenFaaS 快速入门指南
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="8.4.3" data-path="../usecases/knative.html">
<a href="../usecases/knative.html">
<b>8.4.3.</b>
Knative
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="8.5" data-path="../usecases/edge-computing.html">
<a href="../usecases/edge-computing.html">
<b>8.5.</b>
边缘计算
</a>
</li>
<li class="chapter " data-level="8.6" data-path="../usecases/ai.html">
<a href="../usecases/ai.html">
<b>8.6.</b>
人工智能
</a>
</li>
<li class="chapter " data-level="8.7" data-path="../usecases/observability.html">
<a href="../usecases/observability.html">
<b>8.7.</b>
可观察性
</a>
</li>
<li class="header">开发指南</li>
<li class="chapter " data-level="9.1" data-path="../develop/">
<a href="../develop/">
<b>9.1.</b>
开发指南概览
</a>
</li>
<li class="chapter " data-level="9.2" data-path="../develop/sigs-and-working-group.html">
<a href="../develop/sigs-and-working-group.html">
<b>9.2.</b>
SIG 和工作组
</a>
</li>
<li class="chapter " data-level="9.3" data-path="../develop/developing-environment.html">
<a href="../develop/developing-environment.html">
<b>9.3.</b>
开发环境搭建
</a>
<ul class="articles">
<li class="chapter " data-level="9.3.1" data-path="../develop/using-vagrant-and-virtualbox-for-development.html">
<a href="../develop/using-vagrant-and-virtualbox-for-development.html">
<b>9.3.1.</b>
本地分布式开发环境搭建（使用 Vagrant 和 Virtualbox）
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="9.4" data-path="../develop/testing.html">
<a href="../develop/testing.html">
<b>9.4.</b>
单元测试和集成测试
</a>
</li>
<li class="chapter " data-level="9.5" data-path="../develop/client-go-sample.html">
<a href="../develop/client-go-sample.html">
<b>9.5.</b>
client-go 示例
</a>
<ul class="articles">
<li class="chapter " data-level="9.5.1" data-path="../develop/client-go-informer-sourcecode-analyse.html">
<a href="../develop/client-go-informer-sourcecode-analyse.html">
<b>9.5.1.</b>
client-go 中的 informer 源码分析
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="9.6" data-path="../develop/operator.html">
<a href="../develop/operator.html">
<b>9.6.</b>
Operator
</a>
<ul class="articles">
<li class="chapter " data-level="9.6.1" data-path="../develop/operator-sdk.html">
<a href="../develop/operator-sdk.html">
<b>9.6.1.</b>
operator-sdk
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="9.7" data-path="../develop/kubebuilder.html">
<a href="../develop/kubebuilder.html">
<b>9.7.</b>
kubebuilder
</a>
<ul class="articles">
<li class="chapter " data-level="9.7.1" data-path="../develop/kubebuilder-example.html">
<a href="../develop/kubebuilder-example.html">
<b>9.7.1.</b>
使用 kubebuilder 创建 operator 示例
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="9.8" data-path="../develop/advance-developer.html">
<a href="../develop/advance-developer.html">
<b>9.8.</b>
高级开发指南
</a>
</li>
<li class="chapter " data-level="9.9" data-path="../develop/contribute.html">
<a href="../develop/contribute.html">
<b>9.9.</b>
社区贡献
</a>
</li>
<li class="chapter " data-level="9.10" data-path="../develop/minikube.html">
<a href="../develop/minikube.html">
<b>9.10.</b>
Minikube
</a>
</li>
<li class="header">社区及生态</li>
<li class="chapter " data-level="10.1" data-path="../cloud-native/cncf.html">
<a href="../cloud-native/cncf.html">
<b>10.1.</b>
云原生计算基金会（CNCF）
</a>
<ul class="articles">
<li class="chapter " data-level="10.1.1" data-path="../cloud-native/cncf-charter.html">
<a href="../cloud-native/cncf-charter.html">
<b>10.1.1.</b>
CNCF 章程
</a>
</li>
<li class="chapter " data-level="10.1.2" data-path="../cloud-native/cncf-sig.html">
<a href="../cloud-native/cncf-sig.html">
<b>10.1.2.</b>
CNCF 特别兴趣小组（SIG）说明
</a>
</li>
<li class="chapter " data-level="10.1.3" data-path="../cloud-native/cncf-sandbox-criteria.html">
<a href="../cloud-native/cncf-sandbox-criteria.html">
<b>10.1.3.</b>
开源项目加入 CNCF Sandbox 的要求
</a>
</li>
<li class="chapter " data-level="10.1.4" data-path="../cloud-native/cncf-project-governing.html">
<a href="../cloud-native/cncf-project-governing.html">
<b>10.1.4.</b>
CNCF 中的项目治理
</a>
</li>
<li class="chapter " data-level="10.1.5" data-path="../cloud-native/cncf-ambassador.html">
<a href="../cloud-native/cncf-ambassador.html">
<b>10.1.5.</b>
CNCF Ambassador
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="10.2" data-path="../cloud-native/certification.html">
<a href="../cloud-native/certification.html">
<b>10.2.</b>
认证及培训
</a>
<ul class="articles">
<li class="chapter " data-level="10.2.1" data-path="../appendix/about-kcsp.html">
<a href="../appendix/about-kcsp.html">
<b>10.2.1.</b>
认证 Kubernetes 服务提供商（KCSP）说明
</a>
</li>
<li class="chapter " data-level="10.2.2" data-path="../appendix/about-cka-candidate.html">
<a href="../appendix/about-cka-candidate.html">
<b>10.2.2.</b>
认证 Kubernetes 管理员（CKA）说明
</a>
</li>
</ul>
</li>
<li class="header">附录</li>
<li class="chapter " data-level="11.1" data-path="../appendix/">
<a href="../appendix/">
<b>11.1.</b>
附录说明
</a>
</li>
<li class="chapter " data-level="11.2" data-path="../appendix/debug-kubernetes-services.html">
<a href="../appendix/debug-kubernetes-services.html">
<b>11.2.</b>
Kubernetes 中的应用故障排查
</a>
</li>
<li class="chapter " data-level="11.3" data-path="../appendix/material-share.html">
<a href="../appendix/material-share.html">
<b>11.3.</b>
Kubernetes 参考资源
</a>
</li>
<li class="chapter " data-level="11.4" data-path="../appendix/tricks.html">
<a href="../appendix/tricks.html">
<b>11.4.</b>
Kubernetes 使用技巧
</a>
</li>
<li class="chapter " data-level="11.5" data-path="../appendix/issues.html">
<a href="../appendix/issues.html">
<b>11.5.</b>
Kubernetes 相关问题记录
</a>
</li>
<li class="chapter " data-level="11.6" data-path="../appendix/summary-and-outlook.html">
<a href="../appendix/summary-and-outlook.html">
<b>11.6.</b>
Kubernetes 及云原生年度总结及展望
</a>
<ul class="articles">
<li class="chapter " data-level="11.6.1" data-path="../appendix/kubernetes-and-cloud-native-summary-in-2017-and-outlook-for-2018.html">
<a href="../appendix/kubernetes-and-cloud-native-summary-in-2017-and-outlook-for-2018.html">
<b>11.6.1.</b>
Kubernetes 与云原生 2017 年年终总结及 2018 年展望
</a>
</li>
<li class="chapter " data-level="11.6.2" data-path="../appendix/kubernetes-and-cloud-native-summary-in-2018-and-outlook-for-2019.html">
<a href="../appendix/kubernetes-and-cloud-native-summary-in-2018-and-outlook-for-2019.html">
<b>11.6.2.</b>
Kubernetes 与云原生 2018 年年终总结及 2019 年展望
</a>
</li>
</ul>
</li>
<li class="chapter " data-level="11.7" data-path="../appendix/cncf-annual-report.html">
<a href="../appendix/cncf-annual-report.html">
<b>11.7.</b>
CNCF 年度报告解读
</a>
<ul class="articles">
<li class="chapter " data-level="11.7.1" data-path="../appendix/cncf-annual-report-2018.html">
<a href="../appendix/cncf-annual-report-2018.html">
<b>11.7.1.</b>
CNCF 2018 年年度报告解读
</a>
</li>
<li class="chapter " data-level="11.7.2" data-path="../appendix/cncf-annual-report-2020.html">
<a href="../appendix/cncf-annual-report-2020.html">
<b>11.7.2.</b>
CNCF 2020 年年度报告解读
</a>
</li>
</ul>
</li>
<li class="divider"></li>
<li>
<a href="https://www.gitbook.com" target="blank" class="gitbook-link">
本书使用 GitBook 发布
</a>
</li>
</ul>
</nav>
</div>
<div class="book-body">
<div class="body-inner">
<div class="book-header" role="navigation">
<!-- Title -->
<h1>
<i class="fa fa-circle-o-notch fa-spin"></i>
<a href=".." >Kubernetes 中的用户与身份认证授权</a>
</h1>
</div>
<div class="page-wrapper" tabindex="-1" role="main">
<div class="page-inner">
<div class="search-plus" id="book-search-results">
<div class="search-noresults">
<section class="normal markdown-section">
<h1 id="kubernetes-&#x4E2D;&#x7684;&#x7528;&#x6237;&#x4E0E;&#x8EAB;&#x4EFD;&#x8BA4;&#x8BC1;&#x6388;&#x6743;">Kubernetes &#x4E2D;&#x7684;&#x7528;&#x6237;&#x4E0E;&#x8EAB;&#x4EFD;&#x8BA4;&#x8BC1;&#x6388;&#x6743;</h1>
<p>&#x5728;&#x5B89;&#x88C5;&#x96C6;&#x7FA4;&#x7684;&#x65F6;&#x5019;&#x6211;&#x4EEC;&#x5728; master &#x8282;&#x70B9;&#x4E0A;&#x751F;&#x6210;&#x4E86;&#x4E00;&#x5806;&#x8BC1;&#x4E66;&#x3001;token&#xFF0C;&#x8FD8;&#x5728; kubelet &#x7684;&#x914D;&#x7F6E;&#x4E2D;&#x7528;&#x5230;&#x4E86; bootstrap token&#xFF0C;&#x5B89;&#x88C5;&#x5404;&#x79CD;&#x5E94;&#x7528;&#x65F6;&#xFF0C;&#x4E3A;&#x4E86;&#x80FD;&#x591F;&#x4E0E; API server &#x901A;&#x4FE1;&#x521B;&#x5EFA;&#x4E86;&#x5404;&#x79CD; service account&#xFF0C;&#x5728; Dashboard &#x4E2D;&#x4F7F;&#x7528;&#x4E86; kubeconfig &#x6216; token &#x767B;&#x9646;&#xFF0C;&#x90A3;&#x4E48;&#x8FD9;&#x4E9B;&#x90FD;&#x5C5E;&#x4E8E;&#x4EC0;&#x4E48;&#x8BA4;&#x8BC1;&#x65B9;&#x5F0F;&#xFF1F;&#x5982;&#x4F55;&#x533A;&#x5206;&#x7528;&#x6237;&#x7684;&#xFF1F;&#x6211;&#x7279;&#x5730;&#x7FFB;&#x8BD1;&#x4E86;&#x4E0B;&#x8FD9;&#x7BC7;&#x5B98;&#x65B9;&#x6587;&#x6863;&#xFF0C;&#x60F3;&#x4F60;&#x770B;&#x4E86;&#x4E4B;&#x540E;&#x4F60;&#x5C06;&#x627E;&#x5230;&#x7B54;&#x6848;&#x3002;</p>
<p>&#x91CD;&#x70B9;&#x67E5;&#x770B; bearer token &#x548C; HTTP &#x8BA4;&#x8BC1;&#x4E2D;&#x7684; token &#x4F7F;&#x7528;&#xFF0C;&#x6211;&#x4EEC;&#x5DF2;&#x7ECF;&#x6709;&#x6240;&#x5E94;&#x7528;&#xFF0C;&#x5982; <a href="auth-with-kubeconfig-or-token.html">&#x4F7F;&#x7528;kubeconfig&#x6216;token&#x8FDB;&#x884C;&#x7528;&#x6237;&#x8EAB;&#x4EFD;&#x8BA4;&#x8BC1;</a>&#x3002;</p>
<h2 id="&#x8BA4;&#x8BC6;-kubernetes-&#x4E2D;&#x7684;&#x7528;&#x6237;">&#x8BA4;&#x8BC6; Kubernetes &#x4E2D;&#x7684;&#x7528;&#x6237;</h2>
<p>Kubernetes &#x96C6;&#x7FA4;&#x4E2D;&#x5305;&#x542B;&#x4E24;&#x7C7B;&#x7528;&#x6237;&#xFF1A;&#x4E00;&#x7C7B;&#x662F;&#x7531; Kubernetes &#x7BA1;&#x7406;&#x7684; service account&#xFF0C;&#x53E6;&#x4E00;&#x7C7B;&#x662F;&#x666E;&#x901A;&#x7528;&#x6237;&#x3002;</p>
<p>&#x666E;&#x901A;&#x7528;&#x6237;&#x88AB;&#x5047;&#x5B9A;&#x4E3A;&#x7531;&#x5916;&#x90E8;&#x72EC;&#x7ACB;&#x670D;&#x52A1;&#x7BA1;&#x7406;&#x3002;&#x7BA1;&#x7406;&#x5458;&#x5206;&#x53D1;&#x79C1;&#x94A5;&#xFF0C;&#x7528;&#x6237;&#x5B58;&#x50A8;&#xFF08;&#x5982; Keystone &#x6216; Google &#x5E10;&#x6237;&#xFF09;&#xFF0C;&#x751A;&#x81F3;&#x5305;&#x542B;&#x7528;&#x6237;&#x540D;&#x548C;&#x5BC6;&#x7801;&#x5217;&#x8868;&#x7684;&#x6587;&#x4EF6;&#x3002;&#x5728;&#x8FD9;&#x65B9;&#x9762;&#xFF0C;<em>Kubernetes &#x6CA1;&#x6709;&#x4EE3;&#x8868;&#x666E;&#x901A;&#x7528;&#x6237;&#x5E10;&#x6237;&#x7684;&#x5BF9;&#x8C61;</em>&#x3002;&#x65E0;&#x6CD5;&#x901A;&#x8FC7; API &#x8C03;&#x7528;&#x7684;&#x65B9;&#x5F0F;&#x5411;&#x96C6;&#x7FA4;&#x4E2D;&#x6DFB;&#x52A0;&#x666E;&#x901A;&#x7528;&#x6237;&#x3002;</p>
<p>&#x76F8;&#x5BF9;&#x7684;&#xFF0C;service account &#x662F;&#x7531; Kubernetes API &#x7BA1;&#x7406;&#x7684;&#x5E10;&#x6237;&#x3002;&#x5B83;&#x4EEC;&#x90FD;&#x7ED1;&#x5B9A;&#x5230;&#x4E86;&#x7279;&#x5B9A;&#x7684; namespace&#xFF0C;&#x5E76;&#x7531; API server &#x81EA;&#x52A8;&#x521B;&#x5EFA;&#xFF0C;&#x6216;&#x8005;&#x901A;&#x8FC7; API &#x8C03;&#x7528;&#x624B;&#x52A8;&#x521B;&#x5EFA;&#x3002;Service account &#x5173;&#x8054;&#x4E86;&#x4E00;&#x5957;&#x51ED;&#x8BC1;&#xFF0C;&#x5B58;&#x50A8;&#x5728; <code>Secret</code>&#xFF0C;&#x8FD9;&#x4E9B;&#x51ED;&#x8BC1;&#x540C;&#x65F6;&#x88AB;&#x6302;&#x8F7D;&#x5230; pod &#x4E2D;&#xFF0C;&#x4ECE;&#x800C;&#x5141;&#x8BB8; pod &#x4E0E; kubernetes API &#x4E4B;&#x95F4;&#x7684;&#x8C03;&#x7528;&#x3002;</p>
<p>API &#x8BF7;&#x6C42;&#x88AB;&#x7ED1;&#x5B9A;&#x5230;&#x666E;&#x901A;&#x7528;&#x6237;&#x6216; serivce account &#x4E0A;&#xFF0C;&#x6216;&#x8005;&#x4F5C;&#x4E3A;&#x533F;&#x540D;&#x8BF7;&#x6C42;&#x5BF9;&#x5F85;&#x3002;&#x8FD9;&#x610F;&#x5473;&#x7740;&#x96C6;&#x7FA4;&#x5185;&#x90E8;&#x6216;&#x5916;&#x90E8;&#x7684;&#x6BCF;&#x4E2A;&#x8FDB;&#x7A0B;&#xFF0C;&#x65E0;&#x8BBA;&#x4ECE;&#x5728;&#x5DE5;&#x4F5C;&#x7AD9;&#x4E0A;&#x8F93;&#x5165; <code>kubectl</code> &#x7684;&#x4EBA;&#x7C7B;&#x7528;&#x6237;&#x5230;&#x8282;&#x70B9;&#x4E0A;&#x7684; <code>kubelet</code>&#xFF0C;&#x5230;&#x63A7;&#x5236;&#x5E73;&#x9762;&#x7684;&#x6210;&#x5458;&#xFF0C;&#x90FD;&#x5FC5;&#x987B;&#x5728;&#x5411; API Server &#x53D1;&#x51FA;&#x8BF7;&#x6C42;&#x65F6;&#x8FDB;&#x884C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#xFF0C;&#x6216;&#x8005;&#x88AB;&#x89C6;&#x4E3A;&#x533F;&#x540D;&#x7528;&#x6237;&#x3002;</p>
<h2 id="&#x8BA4;&#x8BC1;&#x7B56;&#x7565;">&#x8BA4;&#x8BC1;&#x7B56;&#x7565;</h2>
<p>Kubernetes &#x4F7F;&#x7528;&#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;&#x3001;bearer token&#x3001;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x4EE3;&#x7406;&#x6216;&#x8005; HTTP &#x57FA;&#x672C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x7B49;&#x8EAB;&#x4EFD;&#x8BA4;&#x8BC1;&#x63D2;&#x4EF6;&#x6765;&#x5BF9; API &#x8BF7;&#x6C42;&#x8FDB;&#x884C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x3002;&#x5F53;&#x6709; HTTP &#x8BF7;&#x6C42;&#x53D1;&#x9001;&#x5230; API server &#x65F6;&#xFF0C;&#x63D2;&#x4EF6;&#x4F1A;&#x5C1D;&#x8BD5;&#x5C06;&#x4EE5;&#x4E0B;&#x5C5E;&#x6027;&#x5173;&#x8054;&#x5230;&#x8BF7;&#x6C42;&#x4E0A;&#xFF1A;</p>
<ul>
<li>&#x7528;&#x6237;&#x540D;&#xFF1A;&#x6807;&#x8BC6;&#x6700;&#x7EC8;&#x7528;&#x6237;&#x7684;&#x5B57;&#x7B26;&#x4E32;&#x3002;&#x5E38;&#x7528;&#x503C;&#x53EF;&#x80FD;&#x662F; <code>kube-admin</code> &#x6216; <code>jane@example.com</code>&#x3002;</li>
<li>UID&#xFF1A;&#x6807;&#x8BC6;&#x6700;&#x7EC8;&#x7528;&#x6237;&#x7684;&#x5B57;&#x7B26;&#x4E32;&#xFF0C;&#x6BD4;&#x7528;&#x6237;&#x540D;&#x66F4;&#x52A0;&#x4E00;&#x81F4;&#x4E14;&#x552F;&#x4E00;&#x3002;</li>
<li>&#x7EC4;&#xFF1A;&#x4E00;&#x7EC4;&#x5C06;&#x7528;&#x6237;&#x548C;&#x5E38;&#x89C4;&#x7528;&#x6237;&#x7EC4;&#x76F8;&#x5173;&#x8054;&#x7684;&#x5B57;&#x7B26;&#x4E32;&#x3002;</li>
<li>&#x989D;&#x5916;&#x5B57;&#x6BB5;&#xFF1A;&#x5305;&#x542B;&#x5176;&#x4ED6;&#x6709;&#x7528;&#x8BA4;&#x8BC1;&#x4FE1;&#x606F;&#x7684;&#x5B57;&#x7B26;&#x4E32;&#x5217;&#x8868;&#x7684;&#x6620;&#x5C04;&#x3002;</li>
</ul>
<p>&#x6240;&#x6709;&#x7684;&#x503C;&#x5BF9;&#x4E8E;&#x8BA4;&#x8BC1;&#x7CFB;&#x7EDF;&#x90FD;&#x662F;&#x4E0D;&#x900F;&#x660E;&#x7684;&#xFF0C;&#x53EA;&#x6709; <a href="https://kubernetes.io/docs/admin/authorization/" target="_blank">&#x6388;&#x6743;&#x4EBA;</a> &#x624D;&#x80FD;&#x89E3;&#x91CA;&#x8FD9;&#x4E9B;&#x503C;&#x7684;&#x91CD;&#x8981;&#x542B;&#x4E49;&#x3002;</p>
<p>&#x60A8;&#x53EF;&#x4EE5;&#x4E00;&#x6B21;&#x6027;&#x542F;&#x7528;&#x591A;&#x79CD;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x65B9;&#x5F0F;&#x3002;&#x901A;&#x5E38;&#x4F7F;&#x7528;&#x81F3;&#x5C11;&#x4EE5;&#x4E0B;&#x4E24;&#x79CD;&#x8BA4;&#x8BC1;&#x65B9;&#x5F0F;&#xFF1A;</p>
<ul>
<li>&#x670D;&#x52A1;&#x5E10;&#x6237;&#x7684; service account token</li>
<li>&#x81F3;&#x5C11;&#x4E00;&#x79CD;&#x5176;&#x4ED6;&#x7684;&#x7528;&#x6237;&#x8BA4;&#x8BC1;&#x7684;&#x65B9;&#x5F0F;</li>
</ul>
<p>&#x5F53;&#x542F;&#x7528;&#x4E86;&#x591A;&#x4E2A;&#x8BA4;&#x8BC1;&#x6A21;&#x5757;&#x65F6;&#xFF0C;&#x7B2C;&#x4E00;&#x4E2A;&#x8BA4;&#x8BC1;&#x6A21;&#x5757;&#x6210;&#x529F;&#x8BA4;&#x8BC1;&#x540E;&#x5C06;&#x77ED;&#x8DEF;&#x8BF7;&#x6C42;&#xFF0C;&#x4E0D;&#x4F1A;&#x8FDB;&#x884C;&#x7B2C;&#x4E8C;&#x4E2A;&#x6A21;&#x5757;&#x7684;&#x8BA4;&#x8BC1;&#x3002;API server &#x4E0D;&#x4F1A;&#x4FDD;&#x8BC1;&#x8BA4;&#x8BC1;&#x7684;&#x987A;&#x5E8F;&#x3002;</p>
<p><code>system:authenticated</code> &#x7EC4;&#x5305;&#x542B;&#x5728;&#x6240;&#x6709;&#x5DF2;&#x9A8C;&#x8BC1;&#x7528;&#x6237;&#x7684;&#x7EC4;&#x5217;&#x8868;&#x4E2D;&#x3002;</p>
<p>&#x4E0E;&#x5176;&#x4ED6;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x534F;&#x8BAE;&#xFF08;LDAP&#x3001;SAML&#x3001;Kerberos&#x3001;x509 &#x65B9;&#x6848;&#x7B49;&#xFF09;&#x7684;&#x96C6;&#x6210;&#x53EF;&#x4EE5;&#x4F7F;&#x7528;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x4EE3;&#x7406;&#x6216;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1; webhook&#x6765;&#x5B9E;&#x73B0;&#x3002;</p>
<h3 id="x509-&#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;">X509 &#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;</h3>
<p>&#x901A;&#x8FC7;&#x5C06; <code>--client-ca-file=SOMEFILE</code> &#x9009;&#x9879;&#x4F20;&#x9012;&#x7ED9; API server &#x6765;&#x542F;&#x7528;&#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;&#x8BA4;&#x8BC1;&#x3002;&#x5F15;&#x7528;&#x7684;&#x6587;&#x4EF6;&#x5FC5;&#x987B;&#x5305;&#x542B;&#x4E00;&#x4E2A;&#x6216;&#x591A;&#x4E2A;&#x8BC1;&#x4E66;&#x9881;&#x53D1;&#x673A;&#x6784;&#xFF0C;&#x7528;&#x4E8E;&#x9A8C;&#x8BC1;&#x63D0;&#x4EA4;&#x7ED9; API server &#x7684;&#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;&#x3002;&#x5982;&#x679C;&#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;&#x5DF2;&#x63D0;&#x4EA4;&#x5E76;&#x9A8C;&#x8BC1;&#xFF0C;&#x5219;&#x4F7F;&#x7528; subject &#x7684; Common Name&#xFF08;CN&#xFF09;&#x4F5C;&#x4E3A;&#x8BF7;&#x6C42;&#x7684;&#x7528;&#x6237;&#x540D;&#x3002;&#x4ECE; Kubernetes 1.4&#x5F00;&#x59CB;&#xFF0C;&#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;&#x8FD8;&#x53EF;&#x4EE5;&#x4F7F;&#x7528;&#x8BC1;&#x4E66;&#x7684; organization &#x5B57;&#x6BB5;&#x6765;&#x6307;&#x793A;&#x7528;&#x6237;&#x7684;&#x7EC4;&#x6210;&#x5458;&#x8EAB;&#x4EFD;&#x3002;&#x8981;&#x4E3A;&#x7528;&#x6237;&#x5305;&#x542B;&#x591A;&#x4E2A;&#x7EC4;&#x6210;&#x5458;&#x8EAB;&#x4EFD;&#xFF0C;&#x8BF7;&#x5728;&#x8BC1;&#x4E66;&#x4E2D;&#x5305;&#x542B;&#x591A;&#x4E2A; organization &#x5B57;&#x6BB5;&#x3002;</p>
<p>&#x4F8B;&#x5982;&#xFF0C;&#x4F7F;&#x7528; <code>openssl</code> &#x547D;&#x4EE4;&#x5DE5;&#x5177;&#x751F;&#x6210;&#x7528;&#x4E8E;&#x7B7E;&#x540D;&#x8BA4;&#x8BC1;&#x8BF7;&#x6C42;&#x7684;&#x8BC1;&#x4E66;&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">openssl req -new -key jbeda.pem -out jbeda-csr.pem -subj <span class="token string">&quot;/CN=jbeda/O=app1/O=app2&quot;</span>
</code></pre>
<p>&#x8FD9;&#x5C06;&#x4E3A;&#x4E00;&#x4E2A;&#x7528;&#x6237;&#x540D;&#x4E3A; &#x201D;jbeda&#x201C; &#x7684; CSR&#xFF0C;&#x5C5E;&#x4E8E;&#x4E24;&#x4E2A;&#x7EC4;&#x201C;app1&#x201D;&#x548C;&#x201C;app2&#x201D;&#x3002;</p>
<h3 id="&#x9759;&#x6001;-token-&#x6587;&#x4EF6;">&#x9759;&#x6001; Token &#x6587;&#x4EF6;</h3>
<p>&#x5F53;&#x5728;&#x547D;&#x4EE4;&#x884C;&#x4E0A;&#x6307;&#x5B9A; <code>--token-auth-file=SOMEFILE</code> &#x9009;&#x9879;&#x65F6;&#xFF0C;API server &#x4ECE;&#x6587;&#x4EF6;&#x8BFB;&#x53D6; bearer token&#x3002;&#x76EE;&#x524D;&#xFF0C;token &#x4F1A;&#x65E0;&#x9650;&#x671F;&#x5730;&#x6301;&#x7EED;&#x4E0B;&#x53BB;&#xFF0C;&#x5E76;&#x4E14;&#x4E0D;&#x91CD;&#x65B0;&#x542F;&#x52A8; API server &#x7684;&#x8BDD;&#x5C31;&#x65E0;&#x6CD5;&#x66F4;&#x6539;&#x4EE4;&#x724C;&#x5217;&#x8868;&#x3002;</p>
<p>token &#x6587;&#x4EF6;&#x662F;&#x4E00;&#x4E2A; csv &#x6587;&#x4EF6;&#xFF0C;&#x6BCF;&#x884C;&#x81F3;&#x5C11;&#x5305;&#x542B;&#x4E09;&#x5217;&#xFF1A;token&#x3001;&#x7528;&#x6237;&#x540D;&#x3001;&#x7528;&#x6237; uid&#xFF0C;&#x5176;&#x6B21;&#x662F;&#x53EF;&#x9009;&#x7684;&#x7EC4;&#x540D;&#x3002;&#x8BF7;&#x6CE8;&#x610F;&#xFF0C;&#x5982;&#x679C;&#x60A8;&#x6709;&#x591A;&#x4E2A;&#x7EC4;&#xFF0C;&#x5219;&#x8BE5;&#x5217;&#x5FC5;&#x987B;&#x4F7F;&#x7528;&#x53CC;&#x5F15;&#x53F7;&#x3002;</p>
<pre class="language-"><code class="lang-ini">token,user,uid,&quot;group1,group2,group3&quot;
</code></pre>
<h4 id="&#x5728;&#x8BF7;&#x6C42;&#x4E2D;&#x653E;&#x7F6E;-bearer-token">&#x5728;&#x8BF7;&#x6C42;&#x4E2D;&#x653E;&#x7F6E; Bearer Token</h4>
<p>&#x5F53;&#x4F7F;&#x7528;&#x6765;&#x81EA; http &#x5BA2;&#x6237;&#x7AEF;&#x7684; bearer token &#x65F6;&#xFF0C;API server &#x671F;&#x671B; <code>Authorization</code> header &#x4E2D;&#x5305;&#x542B; <code>Bearer token</code> &#x7684;&#x503C;&#x3002;Bearer token &#x5FC5;&#x987B;&#x662F;&#x4E00;&#x4E2A;&#x5B57;&#x7B26;&#x4E32;&#x5E8F;&#x5217;&#xFF0C;&#x53EA;&#x9700;&#x4F7F;&#x7528; HTTP &#x7684;&#x7F16;&#x7801;&#x548C;&#x5F15;&#x7528;&#x529F;&#x80FD;&#x5C31;&#x53EF;&#x4EE5;&#x5C06;&#x5176;&#x653E;&#x5165;&#x5230; HTTP header &#x4E2D;&#x3002;&#x4F8B;&#x5982;&#xFF1A;&#x5982;&#x679C; bearer token &#x662F; <code>31ada4fd-adec-460c-809a-9e56ceb75269</code>&#xFF0C;&#x90A3;&#x4E48;&#x5B83;&#x5C06;&#x51FA;&#x73B0;&#x5728; HTTP header &#x4E2D;&#xFF0C;&#x5982;&#x4E0B;&#x6240;&#x793A;&#xFF1A;</p>
<pre class="language-"><code class="lang-http"><span class="token header-name keyword">Authorization:</span> Bearer 31ada4fd-adec-460c-809a-9e56ceb75269
</code></pre>
<h3 id="bootstrap-token">Bootstrap Token</h3>
<p>&#x8BE5;&#x529F;&#x80FD;&#x4ECD;&#x5904;&#x4E8E; <strong>alpha</strong> &#x7248;&#x672C;&#x3002;</p>
<p>&#x4E3A;&#x4E86;&#x7B80;&#x5316;&#x65B0;&#x96C6;&#x7FA4;&#x7684;&#x521D;&#x59CB;&#x5316;&#x5F15;&#x5BFC;&#x8FC7;&#x7A0B;&#xFF0C;Kubernetes &#x4E2D;&#x5305;&#x542B;&#x4E86;&#x4E00;&#x4E2A;&#x540D;&#x4E3A; <em>Bootstrap Token</em> &#x7684;&#x52A8;&#x6001;&#x7BA1;&#x7406;&#x7684; bearer token&#x3002;&#x8FD9;&#x4E9B; token &#x4F7F;&#x7528; Secret &#x5B58;&#x50A8;&#x5728; <code>kube-system</code> namespace &#x4E2D;&#xFF0C;&#x5728;&#x90A3;&#x91CC;&#x5B83;&#x4EEC;&#x53EF;&#x4EE5;&#x88AB;&#x52A8;&#x6001;&#x7BA1;&#x7406;&#x548C;&#x521B;&#x5EFA;&#x3002;Controller Manager &#x4E2D;&#x5305;&#x542B;&#x4E86;&#x4E00;&#x4E2A; TokenCleaner &#x63A7;&#x5236;&#x5668;&#xFF0C;&#x7528;&#x4E8E;&#x5728; bootstrap token &#x8FC7;&#x671F;&#x65F6;&#x5220;&#x9664;&#x5C06;&#x5176;&#x5220;&#x9664;&#x3002;</p>
<p>&#x8FD9;&#x4E9B; token &#x7684;&#x5F62;&#x5F0F;&#x662F; <code>[a-z0-9]{6}.[a-z0-9]{16}</code>&#x3002;&#x7B2C;&#x4E00;&#x90E8;&#x5206;&#x662F; Token ID&#xFF0C;&#x7B2C;&#x4E8C;&#x90E8;&#x5206;&#x662F; Token Secret&#x3002;&#x60A8;&#x5728; HTTP header &#x4E2D;&#x6307;&#x5B9A;&#x7684; token &#x5982;&#x4E0B;&#x6240;&#x793A;&#xFF1A;</p>
<pre class="language-"><code class="lang-http"><span class="token header-name keyword">Authorization:</span> Bearer 781292.db7bc3a58fc5f07e
</code></pre>
<p>&#x5728; API server &#x7684;&#x542F;&#x52A8;&#x53C2;&#x6570;&#x4E2D;&#x52A0;&#x4E0A; <code>--experimental-bootstrap-token-auth</code> &#x6807;&#x5FD7;&#x4EE5;&#x542F;&#x7528; Bootstrap Token Authenticator&#x3002;&#x60A8;&#x5FC5;&#x987B;&#x901A;&#x8FC7; Controller Manager &#x4E0A;&#x7684; <code>--controllers</code> &#x6807;&#x5FD7;&#x542F;&#x7528; TokenCleaner &#x63A7;&#x5236;&#x5668;&#xFF0C;&#x5982; <code>--controllers=*,tokencleaner</code>&#x3002;&#x5982;&#x679C;&#x60A8;&#x4F7F;&#x7528;&#x5B83;&#x6765;&#x5F15;&#x5BFC;&#x96C6;&#x7FA4;&#xFF0C; <code>kubeadm</code> &#x4F1A;&#x4E3A;&#x60A8;&#x5B8C;&#x6210;&#x3002;</p>
<p>&#x8BA4;&#x8BC1;&#x8005;&#x8BA4;&#x8BC1;&#x4E3A; <code>system:bootstrap:<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>Token</span> <span class="token attr-name">ID</span><span class="token punctuation">&gt;</span></span></code> &#x3002;&#x88AB;&#x5305;&#x542B;&#x5728; <code>system:bootstrappers</code> &#x7EC4;&#x4E2D;&#x3002;&#x547D;&#x540D;&#x548C;&#x7EC4;&#x662F;&#x6709;&#x610F;&#x9650;&#x5236;&#x7528;&#x6237;&#x4F7F;&#x7528;&#x8FC7;&#x53BB;&#x7684; bootstap token&#x3002;&#x53EF;&#x4EE5;&#x4F7F;&#x7528;&#x7528;&#x6237;&#x540D;&#x548C;&#x7EC4;&#xFF08;<code>kubeadm</code> &#x4F7F;&#x7528;&#xFF09;&#x6765;&#x5236;&#x5B9A;&#x9002;&#x5F53;&#x7684;&#x6388;&#x6743;&#x7B56;&#x7565;&#x4EE5;&#x652F;&#x6301;&#x5F15;&#x5BFC;&#x96C6;&#x7FA4;&#x3002; </p>
<p>&#x6709;&#x5173; Bootstrap Token &#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x5668;&#x548C;&#x63A7;&#x5236;&#x5668;&#x7684;&#x66F4;&#x6DF1;&#x5165;&#x7684;&#x6587;&#x6863;&#xFF0C;&#x4EE5;&#x53CA;&#x5982;&#x4F55;&#x4F7F;&#x7528; <code>kubeadm</code> &#x7BA1;&#x7406;&#x8FD9;&#x4E9B;&#x4EE4;&#x724C;&#xFF0C;&#x8BF7;&#x53C2;&#x9605; <a href="https://kubernetes.io/docs/admin/bootstrap-tokens/" target="_blank">Bootstrap Token</a>&#x3002;</p>
<h3 id="&#x9759;&#x6001;&#x5BC6;&#x7801;&#x6587;&#x4EF6;">&#x9759;&#x6001;&#x5BC6;&#x7801;&#x6587;&#x4EF6;</h3>
<p>&#x901A;&#x8FC7;&#x5C06; <code>--basic-auth-file=SOMEFILE</code> &#x9009;&#x9879;&#x4F20;&#x9012;&#x7ED9; API server &#x6765;&#x542F;&#x7528;&#x57FA;&#x672C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x3002;&#x76EE;&#x524D;&#xFF0C;&#x57FA;&#x672C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x51ED;&#x8BC1;&#x5C06;&#x65E0;&#x9650;&#x671F;&#x5730;&#x4FDD;&#x7559;&#xFF0C;&#x5E76;&#x4E14;&#x5BC6;&#x7801;&#x5728;&#x4E0D;&#x91CD;&#x65B0;&#x542F;&#x52A8;API&#x670D;&#x52A1;&#x5668;&#x7684;&#x60C5;&#x51B5;&#x4E0B;&#x65E0;&#x6CD5;&#x66F4;&#x6539;&#x3002;&#x8BF7;&#x6CE8;&#x610F;&#xFF0C;&#x4E3A;&#x4E86;&#x65B9;&#x4FBF;&#x8D77;&#x89C1;&#xFF0C;&#x76EE;&#x524D;&#x652F;&#x6301;&#x57FA;&#x672C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#xFF0C;&#x800C;&#x4E0A;&#x8FF0;&#x6A21;&#x5F0F;&#x66F4;&#x5B89;&#x5168;&#x66F4;&#x5BB9;&#x6613;&#x4F7F;&#x7528;&#x3002;</p>
<p>&#x57FA;&#x672C;&#x8EAB;&#x4EFD;&#x8BA4;&#x8BC1;&#x662F;&#x4E00;&#x4E2A; csv &#x6587;&#x4EF6;&#xFF0C;&#x81F3;&#x5C11;&#x5305;&#x542B;3&#x5217;&#xFF1A;&#x5BC6;&#x7801;&#x3001;&#x7528;&#x6237;&#x540D;&#x548C;&#x7528;&#x6237; ID&#x3002;&#x5728; Kubernetes 1.6 &#x548C;&#x66F4;&#x9AD8;&#x7248;&#x672C;&#x4E2D;&#xFF0C;&#x53EF;&#x4EE5;&#x6307;&#x5B9A;&#x5305;&#x542B;&#x4EE5;&#x9017;&#x53F7;&#x5206;&#x9694;&#x7684;&#x7EC4;&#x540D;&#x79F0;&#x7684;&#x53EF;&#x9009;&#x7B2C;&#x56DB;&#x5217;&#x3002;&#x5982;&#x679C;&#x60A8;&#x6709;&#x591A;&#x4E2A;&#x7EC4;&#xFF0C;&#x5219;&#x5FC5;&#x987B;&#x5C06;&#x7B2C;&#x56DB;&#x5217;&#x503C;&#x7528;&#x53CC;&#x5F15;&#x53F7;&#xFF08;&#x201C;&#xFF09;&#x62EC;&#x8D77;&#x6765;&#xFF0C;&#x8BF7;&#x53C2;&#x9605;&#x4EE5;&#x4E0B;&#x793A;&#x4F8B;&#xFF1A;</p>
<pre class="language-"><code class="lang-ini">password,user,uid,&quot;group1,group2,group3&quot;
</code></pre>
<p>&#x5F53;&#x4F7F;&#x7528;&#x6765;&#x81EA; HTTP &#x5BA2;&#x6237;&#x7AEF;&#x7684;&#x57FA;&#x672C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x65F6;&#xFF0C;API server &#x9700;&#x8981;<code>Authorization</code> header &#x4E2D;&#x5305;&#x542B; <code>Basic BASE64ENCODED(USER:PASSWORD)</code> &#x7684;&#x503C;&#x3002;</p>
<h3 id="service-account-token">Service Account Token</h3>
<p>Service account &#x662F;&#x4E00;&#x4E2A;&#x81EA;&#x52A8;&#x542F;&#x7528;&#x7684;&#x9A8C;&#x8BC1;&#x5668;&#xFF0C;&#x5B83;&#x4F7F;&#x7528;&#x7B7E;&#x540D;&#x7684; bearer token &#x6765;&#x9A8C;&#x8BC1;&#x8BF7;&#x6C42;&#x3002;&#x8BE5;&#x63D2;&#x4EF6;&#x5305;&#x62EC;&#x4E24;&#x4E2A;&#x53EF;&#x9009;&#x7684;&#x6807;&#x5FD7;&#xFF1A;</p>
<ul>
<li><code>--service-account-key-file</code> &#x4E00;&#x4E2A;&#x5305;&#x542B;&#x7B7E;&#x540D; bearer token &#x7684; PEM &#x7F16;&#x7801;&#x6587;&#x4EF6;&#x3002;&#x5982;&#x679C;&#x672A;&#x6307;&#x5B9A;&#xFF0C;&#x5C06;&#x4F7F;&#x7528; API server &#x7684; TLS &#x79C1;&#x94A5;&#x3002;</li>
<li><code>--service-account-lookup</code> &#x5982;&#x679C;&#x542F;&#x7528;&#xFF0C;&#x4ECE; API &#x4E2D;&#x5220;&#x9664;&#x6389;&#x7684; token &#x5C06;&#x88AB;&#x64A4;&#x9500;&#x3002;</li>
</ul>
<p>Service account &#x901A;&#x5E38; API server &#x81EA;&#x52A8;&#x521B;&#x5EFA;&#xFF0C;&#x5E76;&#x901A;&#x8FC7; <code>ServiceAccount</code> <a href="https://kubernetes.io/docs/admin/admission-controllers/" target="_blank">&#x6CE8;&#x5165;&#x63A7;&#x5236;&#x5668;</a> &#x5173;&#x8054;&#x5230;&#x96C6;&#x7FA4;&#x4E2D;&#x8FD0;&#x884C;&#x7684; Pod &#x4E0A;&#x3002;Bearer token &#x6302;&#x8F7D;&#x5230; pod &#x4E2D;&#x4F17;&#x6240;&#x5468;&#x77E5;&#x7684;&#x4F4D;&#x7F6E;&#xFF0C;&#x5E76;&#x5141;&#x8BB8;&#x96C6;&#x7FA4;&#x8FDB;&#x7A0B;&#x4E0E; API server &#x901A;&#x4FE1;&#x3002; &#x5E10;&#x6237;&#x53EF;&#x4EE5;&#x4F7F;&#x7528; <code>PodSpec</code> &#x7684; <code>serviceAccountName</code> &#x5B57;&#x6BB5;&#x663E;&#x5F0F;&#x5730;&#x4E0E;Pod&#x5173;&#x8054;&#x3002;</p>
<p>&#x6CE8;&#x610F;&#xFF1A; <code>serviceAccountName</code> &#x901A;&#x5E38;&#x88AB;&#x7701;&#x7565;&#xFF0C;&#x56E0;&#x4E3A;&#x8FD9;&#x4F1A;&#x81EA;&#x52A8;&#x751F;&#x6210;&#x3002;</p>
<pre class="language-"><code class="lang-yaml"><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> apps/v1beta2
<span class="token key atrule">kind</span><span class="token punctuation">:</span> Deployment
<span class="token key atrule">metadata</span><span class="token punctuation">:</span>
<span class="token key atrule">name</span><span class="token punctuation">:</span> nginx<span class="token punctuation">-</span>deployment
<span class="token key atrule">namespace</span><span class="token punctuation">:</span> default
<span class="token key atrule">spec</span><span class="token punctuation">:</span>
<span class="token key atrule">replicas</span><span class="token punctuation">:</span> <span class="token number">3</span>
<span class="token key atrule">template</span><span class="token punctuation">:</span>
<span class="token key atrule">metadata</span><span class="token punctuation">:</span>
<span class="token comment"># ...</span>
<span class="token key atrule">spec</span><span class="token punctuation">:</span>
<span class="token key atrule">containers</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token key atrule">name</span><span class="token punctuation">:</span> nginx
<span class="token key atrule">image</span><span class="token punctuation">:</span> nginx<span class="token punctuation">:</span>1.7.9
<span class="token key atrule">serviceAccountName</span><span class="token punctuation">:</span> bob<span class="token punctuation">-</span>the<span class="token punctuation">-</span>bot
</code></pre>
<p>Service account bearer token &#x5728;&#x96C6;&#x7FA4;&#x5916;&#x4F7F;&#x7528;&#x4E5F;&#x662F;&#x5B8C;&#x5168;&#x6709;&#x6548;&#x7684;&#xFF0C;&#x5E76;&#x4E14;&#x53EF;&#x4EE5;&#x7528;&#x4E8E;&#x4E3A;&#x5E0C;&#x671B;&#x4E0E; Kubernetes &#x901A;&#x4FE1;&#x7684;&#x957F;&#x671F;&#x8FD0;&#x884C;&#x4F5C;&#x4E1A;&#x521B;&#x5EFA;&#x8EAB;&#x4EFD;&#x3002;&#x8981;&#x624B;&#x52A8;&#x521B;&#x5EFA; service account&#xFF0C;&#x53EA;&#x9700;&#x8981;&#x4F7F;&#x7528; <code>kubectl create serviceaccount (NAME)</code> &#x547D;&#x4EE4;&#x3002;&#x8FD9;&#x5C06;&#x5728;&#x5F53;&#x524D;&#x7684; namespace &#x548C;&#x76F8;&#x5173;&#x8FDE;&#x7684; secret &#x4E2D;&#x521B;&#x5EFA;&#x4E00;&#x4E2A; service account&#x3002;</p>
<pre class="language-"><code class="lang-bash">$ kubectl create serviceaccount jenkins
serviceaccount <span class="token string">&quot;jenkins&quot;</span> created
$ kubectl get serviceaccounts jenkins -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
<span class="token comment"># ...</span>
secrets:
- name: jenkins-token-1yvwg
</code></pre>
<p>&#x521B;&#x5EFA;&#x51FA;&#x7684; secret &#x4E2D;&#x62E5;&#x6709; API server &#x7684;&#x516C;&#x5171; CA &#x548C;&#x524D;&#x9762;&#x7684; JSON Web Token&#xFF08;JWT&#xFF09;&#x3002;</p>
<pre class="language-"><code class="lang-bash">$ kubectl get secret jenkins-token-1yvwg -o yaml
apiVersion: v1
data:
ca.crt: <span class="token punctuation">(</span>APISERVER&apos;S CA BASE64 ENCODED<span class="token punctuation">)</span>
namespace: <span class="token assign-left variable">ZGVmYXVsdA</span><span class="token operator">==</span>
token: <span class="token punctuation">(</span>BEARER TOKEN BASE64 ENCODED<span class="token punctuation">)</span>
kind: Secret
metadata:
<span class="token comment"># ...</span>
type: kubernetes.io/service-account-token
</code></pre>
<p>&#x6CE8;&#x610F;&#xFF1A;&#x6240;&#x6709;&#x503C;&#x662F;&#x57FA;&#x4E8E; base64 &#x7F16;&#x7801;&#x7684;&#xFF0C;&#x56E0;&#x4E3A; secret &#x603B;&#x662F;&#x57FA;&#x4E8E; base64 &#x7F16;&#x7801;&#x3002;</p>
<p>&#x7ECF;&#x8FC7;&#x7B7E;&#x540D;&#x7684; JWT &#x53EF;&#x4EE5;&#x7528;&#x4F5C; bearer token &#x4E0E;&#x7ED9;&#x5B9A;&#x7684; service account &#x8FDB;&#x884C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x3002;&#x8BF7;&#x53C2;&#x9605;&#x4E0A;&#x9762;&#x5173;&#x4E8E;&#x5982;&#x4F55;&#x5728;&#x8BF7;&#x6C42;&#x4E2D;&#x653E;&#x7F6E; bearer token&#x3002;&#x901A;&#x5E38;&#x60C5;&#x51B5;&#x4E0B;&#xFF0C;&#x8FD9;&#x4E9B; secret &#x88AB;&#x6302;&#x8F7D;&#x5230; pod &#x4E2D;&#xFF0C;&#x4EE5;&#x4FBF;&#x5BF9;&#x96C6;&#x7FA4;&#x5185;&#x7684; API server &#x8FDB;&#x884C;&#x8BBF;&#x95EE;&#xFF0C;&#x4F46;&#x4E5F;&#x53EF;&#x4EE5;&#x4ECE;&#x96C6;&#x7FA4;&#x5916;&#x8BBF;&#x95EE;&#x3002;</p>
<p>Service account &#x9A8C;&#x8BC1;&#x65F6;&#x7528;&#x6237;&#x540D; <code>system:serviceaccount:(NAMESPACE):(SERVICEACCOUNT)</code>&#xFF0C;&#x88AB;&#x6307;&#x5B9A;&#x5230;&#x7EC4; <code>system:serviceaccounts</code> &#x548C; <code>system:serviceaccounts:(NAMESPACE)</code>&#x3002;</p>
<p>&#x6CE8;&#x610F;&#xFF1A;&#x7531;&#x4E8E; service account &#x7684; token &#x5B58;&#x50A8;&#x5728; secret &#x4E2D;&#xFF0C;&#x6240;&#x4EE5;&#x5177;&#x6709;&#x5BF9;&#x8FD9;&#x4E9B; secret &#x7684;&#x8BFB;&#x53D6;&#x6743;&#x9650;&#x7684;&#x4EFB;&#x4F55;&#x7528;&#x6237;&#x90FD;&#x53EF;&#x4EE5;&#x4F5C;&#x4E3A; service account &#x8FDB;&#x884C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x3002;&#x6388;&#x4E88; service account &#x6743;&#x9650;&#x548C;&#x8BFB;&#x53D6; secret &#x529F;&#x80FD;&#x65F6;&#x8981;&#x8C28;&#x614E;&#x3002;</p>
<h3 id="openid-connect-token">OpenID Connect Token</h3>
<p><a href="https://openid.net/connect/" target="_blank">OpenID Connect</a> &#x662F;&#x7531; OAuth2 &#x4F9B;&#x5E94;&#x5546;&#x63D0;&#x4F9B;&#x7684; OAuth2&#xFF0C;&#x7279;&#x522B;&#x662F; Azure Active Directory&#x3001;Salesforce &#x548C; Google&#x3002;&#x5BF9; OAuth2 &#x534F;&#x8BAE;&#x7684;&#x4E3B;&#x8981;&#x6269;&#x5C55;&#x662F;&#x8FD4;&#x56DE;&#x4E00;&#x4E2A;&#x79F0;&#x4F5C; <a href="https://openid.net/specs/openid-connect-core-1_0.html#IDToken" target="_blank">ID Token</a> &#x7684;&#x683C;&#x5916;&#x5B57;&#x6BB5;&#x3002;&#x8BE5; token &#x662F;&#x4E00;&#x4E2A; JSON Web Token (JWT) &#xFF0C;&#x6709;&#x670D;&#x52A1;&#x5668;&#x7B7E;&#x540D;&#xFF0C;&#x5177;&#x6709;&#x4F17;&#x6240;&#x5468;&#x77E5;&#x7684;&#x5B57;&#x6BB5;&#xFF0C;&#x5982;&#x7528;&#x6237;&#x7684;&#x7535;&#x5B50;&#x90AE;&#x4EF6;&#x3002;</p>
<p>&#x4E3A;&#x4E86;&#x8BC6;&#x522B;&#x7528;&#x6237;&#xFF0C;&#x8BA4;&#x8BC1;&#x8005;&#x4F7F;&#x7528; OAuth2 <a href="https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse" target="_blank">token &#x54CD;&#x5E94;</a> &#x4E2D;&#x7684; <code>id_token</code>&#xFF08;&#x800C;&#x4E0D;&#x662F; <code>access_token</code>&#xFF09;&#x4F5C;&#x4E3A; bearer token&#x3002;&#x8BF7;&#x53C2;&#x9605;&#x4E0A;&#x9762;&#x7684;&#x5173;&#x4E8E;&#x5C06; token &#x7F6E;&#x4E8E;&#x8BF7;&#x6C42;&#x4E2D;&#x3002;</p>
<figure id="fig5.4.7.1"><a href="../images/kubernetes-oidc-login.jpg" data-lightbox="28fb2e78-d4f4-4fbe-9e8e-98f9f65d2c53" data-title="Kubernetes OpenID Connect Flow"><img src="../images/kubernetes-oidc-login.jpg" alt="Kubernetes OpenID Connect Flow"></a><figcaption>&#x56FE; 5.4.7.1&#xFF1A;Kubernetes OpenID Connect Flow</figcaption></figure>
<ol>
<li>&#x767B;&#x9646;&#x5230;&#x60A8;&#x7684;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x5546;</li>
<li>&#x60A8;&#x7684;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x5546;&#x5C06;&#x4E3A;&#x60A8;&#x63D0;&#x4F9B;&#x4E00;&#x4E2A; <code>access_token</code>&#xFF0C;&#x4E00;&#x4E2A; <code>id_token</code> &#x548C;&#x4E00;&#x4E2A; <code>refresh_token</code></li>
<li>&#x5F53;&#x4F7F;&#x7528; <code>kubectl</code> &#x65F6;&#xFF0C;&#x4F7F;&#x7528; <code>--token</code> &#x6807;&#x5FD7;&#x548C; <code>id_token</code> &#xFF0C;&#x6216;&#x8005;&#x76F4;&#x63A5;&#x52A0;&#x5165;&#x5230;&#x60A8;&#x7684; <code>kubeconfig</code> &#x6587;&#x4EF6;&#x4E2D;</li>
<li><code>kubectl</code> &#x5728;&#x8C03;&#x7528; API server &#x65F6;&#x5C06; <code>id_token</code> &#x7F6E;&#x4E8E; HTTP header &#x4E2D;</li>
<li>API server &#x5C06;&#x901A;&#x8FC7;&#x68C0;&#x67E5;&#x914D;&#x7F6E;&#x4E2D;&#x6307;&#x5B9A;&#x7684;&#x8BC1;&#x4E66;&#x6765;&#x786E;&#x4FDD; JWT &#x7B7E;&#x540D;&#x6709;&#x6548;</li>
<li>&#x68C0;&#x67E5;&#x4EE5;&#x786E;&#x4FDD; <code>id_token</code> &#x6CA1;&#x6709;&#x8FC7;&#x671F;</li>
<li>&#x786E;&#x4FDD;&#x7528;&#x6237;&#x5DF2;&#x6388;&#x6743;</li>
<li>&#x6388;&#x6743; API server &#x540E;&#x5411; <code>kubectl</code> </li>
<li><code>kubectl</code> &#x5411;&#x7528;&#x6237;&#x63D0;&#x4F9B;&#x53CD;&#x9988;</li>
</ol>
<p>&#x7531;&#x4E8E;&#x6240;&#x6709;&#x9700;&#x8981;&#x9A8C;&#x8BC1;&#x60A8;&#x8EAB;&#x4EFD;&#x7684;&#x6570;&#x636E;&#x90FD;&#x5728; <code>id_token</code> &#x4E2D;&#xFF0C;Kubernetes &#x4E0D;&#x9700;&#x8981;&#x5411;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x5546; &#x201C;phone home&#x201D;&#x3002;&#x5728;&#x6BCF;&#x4E2A;&#x8BF7;&#x6C42;&#x90FD;&#x662F;&#x65E0;&#x72B6;&#x6001;&#x7684;&#x6A21;&#x578B;&#x4E2D;&#xFF0C;&#x8FD9;&#x4E3A;&#x8BA4;&#x8BC1;&#x63D0;&#x4F9B;&#x4E86;&#x975E;&#x5E38;&#x53EF;&#x6269;&#x5C55;&#x7684;&#x89E3;&#x51B3;&#x65B9;&#x6848;&#x3002;&#x5B83;&#x786E;&#x5B9E;&#x63D0;&#x4F9B;&#x4E86;&#x4E00;&#x4E9B;&#x6311;&#x6218;&#xFF1A;</p>
<ol>
<li>Kubernetes &#x6CA1;&#x6709; &#x201D;web &#x63A5;&#x53E3;&#x201C; &#x6765;&#x51FA;&#x53D1;&#x9A8C;&#x8BC1;&#x8FDB;&#x7A0B;&#x3002;&#x6CA1;&#x6709;&#x6D4F;&#x89C8;&#x5668;&#x6216;&#x754C;&#x9762;&#x6765;&#x6536;&#x96C6;&#x51ED;&#x636E;&#xFF0C;&#x8FD9;&#x5C31;&#x662F;&#x4E3A;&#x4EC0;&#x4E48;&#x60A8;&#x9700;&#x8981;&#x9996;&#x5148;&#x8BA4;&#x8BC1;&#x60A8;&#x7684;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x5546;&#x3002;</li>
<li><code>id_token</code> &#x65E0;&#x6CD5;&#x64A4;&#x9500;&#xFF0C;&#x5C31;&#x50CF;&#x4E00;&#x4E2A;&#x8BC1;&#x4E66;&#xFF0C;&#x6240;&#x4EE5;&#x5B83;&#x5E94;&#x8BE5;&#x662F;&#x77ED;&#x6682;&#x7684;&#xFF08;&#x53EA;&#x6709;&#x51E0;&#x5206;&#x949F;&#xFF09;&#xFF0C;&#x6240;&#x4EE5;&#x6BCF;&#x9694;&#x51E0;&#x5206;&#x949F;&#x5C31;&#x5F97;&#x5230;&#x4E00;&#x4E2A;&#x65B0;&#x7684;&#x4EE4;&#x724C;&#x662F;&#x975E;&#x5E38;&#x70E6;&#x4EBA;&#x7684;&#x3002;</li>
<li>&#x6CA1;&#x6709;&#x4F7F;&#x7528; <code>kubectl proxy</code> &#x547D;&#x4EE4;&#x6216;&#x6CE8;&#x5165; <code>id_token</code> &#x7684;&#x53CD;&#x5411;&#x4EE3;&#x7406;&#xFF0C;&#x65E0;&#x6CD5;&#x7B80;&#x5355;&#x5730;&#x5BF9; Kubernetes dashboard &#x8FDB;&#x884C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x3002;</li>
</ol>
<h4 id="&#x914D;&#x7F6E;-api-server">&#x914D;&#x7F6E; API Server</h4>
<p>&#x8981;&#x542F;&#x7528;&#x8BE5;&#x63D2;&#x4EF6;&#xFF0C;&#x9700;&#x8981;&#x5728; API server &#x4E2D;&#x914D;&#x7F6E;&#x5982;&#x4E0B;&#x6807;&#x5FD7;&#xFF1A;</p>
<table>
<thead>
<tr>
<th>&#x53C2;&#x6570;</th>
<th>&#x63CF;&#x8FF0;</th>
<th>&#x793A;&#x4F8B;</th>
<th>&#x662F;&#x5426;&#x5FC5;&#x9700;</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>--oidc-issuer-url</code></td>
<td>&#x5141;&#x8BB8; API server &#x53D1;&#x73B0;&#x516C;&#x5171;&#x7B7E;&#x540D;&#x5BC6;&#x94A5;&#x7684;&#x63D0;&#x4F9B;&#x8005;&#x7684; URL&#x3002;&#x53EA;&#x63A5;&#x53D7;&#x4F7F;&#x7528; <code>https://</code> &#x7684;&#x65B9;&#x6848;&#x3002;&#x901A;&#x5E38;&#x662F;&#x63D0;&#x4F9B;&#x5546;&#x7684; URL &#x5730;&#x5740;&#xFF0C;&#x4E0D;&#x5305;&#x542B;&#x8DEF;&#x5F84;&#xFF0C;&#x4F8B;&#x5982;&#x201C;<a href="https://accounts.google.com" target="_blank">https://accounts.google.com</a>&#x201D; &#x6216;&#x8005; &#x201C;<a href="https://login.salesforce.com" target="_blank">https://login.salesforce.com</a>&#x201D;&#x3002;&#x8FD9;&#x4E2A; URL &#x5E94;&#x8BE5;&#x6307;&#x5411;&#x4E0B;&#x9762;&#x7684; .well-known/openid-configuration</td>
<td>&#x5982;&#x679C;&#x53D1;&#x73B0; URL &#x662F; <code>https://accounts.google.com/.well-known/openid-configuration</code>&#xFF0C;&#x503C;&#x5E94;&#x8BE5;&#x662F;<code>https://accounts.google.com</code></td>
<td>&#x662F;</td>
</tr>
<tr>
<td><code>--oidc-client-id</code></td>
<td>&#x6240;&#x6709;&#x7684; token &#x5FC5;&#x987B;&#x4E3A;&#x5176;&#x9881;&#x53D1;&#x7684;&#x5BA2;&#x6237;&#x7AEF; ID</td>
<td>kubernetes</td>
<td>&#x662F;</td>
</tr>
<tr>
<td><code>--oidc-username-claim</code></td>
<td>JWT&#x58F0;&#x660E;&#x4F7F;&#x7528;&#x7684;&#x7528;&#x6237;&#x540D;&#x3002;&#x9ED8;&#x8BA4;&#x60C5;&#x51B5;&#x4E0B;&#xFF0C;<code>sub</code> &#x662F;&#x6700;&#x7EC8;&#x7528;&#x6237;&#x7684;&#x552F;&#x4E00;&#x6807;&#x8BC6;&#x7B26;&#x3002;&#x7BA1;&#x7406;&#x5458;&#x53EF;&#x4EE5;&#x9009;&#x62E9;&#x5176;&#x4ED6;&#x58F0;&#x660E;&#xFF0C;&#x5982;<code>email</code> &#x6216; <code>name</code>&#xFF0C;&#x5177;&#x4F53;&#x53D6;&#x51B3;&#x4E8E;&#x4ED6;&#x4EEC;&#x7684;&#x63D0;&#x4F9B;&#x8005;&#x3002;&#x4E0D;&#x8FC7;&#xFF0C;<code>email</code> &#x4EE5;&#x5916;&#x7684;&#x5176;&#x4ED6;&#x58F0;&#x660E;&#x5C06;&#x4EE5;&#x53D1;&#x884C;&#x8005;&#x7684; URL &#x4F5C;&#x4E3A;&#x524D;&#x7F00;&#xFF0C;&#x4EE5;&#x9632;&#x6B62;&#x4E0E;&#x5176;&#x4ED6;&#x63D2;&#x4EF6;&#x547D;&#x540D;&#x51B2;&#x7A81;&#x3002;</td>
<td>sub</td>
<td>&#x5426;</td>
</tr>
<tr>
<td><code>--oidc-groups-claim</code></td>
<td>JWT&#x58F0;&#x660E;&#x4F7F;&#x7528;&#x7684;&#x7528;&#x6237;&#x7EC4;&#x3002;&#x5982;&#x679C;&#x751F;&#x547D;&#x5B58;&#x5728;&#xFF0C;&#x5B83;&#x5FC5;&#x987B;&#x662F;&#x4E00;&#x4E2A;&#x5B57;&#x7B26;&#x4E32;&#x6570;&#x7EC4;&#x3002;</td>
<td>groups</td>
<td>&#x5426;</td>
</tr>
<tr>
<td><code>--oidc-ca-file</code></td>
<td>&#x7528;&#x6765;&#x7B7E;&#x540D;&#x60A8;&#x7684;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x5546;&#x7684;&#x7F51;&#x7EDC; CA &#x8BC1;&#x4E66;&#x7684;&#x8DEF;&#x5F84;&#x3002;&#x9ED8;&#x8BA4;&#x4E3A;&#x4E3B;&#x673A;&#x7684;&#x8DDF; CA&#x3002;</td>
<td><code>/etc/kubernetes/ssl/kc-ca.pem</code></td>
<td>&#x5426;</td>
</tr>
</tbody>
</table>
<p>&#x5982;&#x679C;&#x4E3A; <code>--oidc-username-claim</code> &#x9009;&#x62E9;&#x4E86;&#x9664; <code>email</code> &#x4EE5;&#x5916;&#x7684;&#x5176;&#x4ED6;&#x58F0;&#x660E;&#xFF0C;&#x5219;&#x8BE5;&#x503C;&#x5C06;&#x4EE5; <code>--oidc-issuer-url</code> &#x4F5C;&#x4E3A;&#x524D;&#x7F00;&#xFF0C;&#x4EE5;&#x9632;&#x6B62;&#x4E0E;&#x73B0;&#x6709; Kubernetes &#x540D;&#x79F0;&#xFF08;&#x4F8B;&#x5982; <code>system:users</code>&#xFF09;&#x51B2;&#x7A81;&#x3002;&#x4F8B;&#x5982;&#xFF0C;&#x5982;&#x679C;&#x63D0;&#x4F9B;&#x5546;&#x7F51;&#x5740;&#x662F; <a href="https://accounts.google.com&#xFF0C;&#x800C;&#x7528;&#x6237;&#x540D;&#x58F0;&#x660E;&#x6620;&#x5C04;&#x5230;" target="_blank">https://accounts.google.com&#xFF0C;&#x800C;&#x7528;&#x6237;&#x540D;&#x58F0;&#x660E;&#x6620;&#x5C04;&#x5230;</a> <code>jane</code>&#xFF0C;&#x5219;&#x63D2;&#x4EF6;&#x4F1A;&#x5C06;&#x7528;&#x6237;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x4E3A;&#xFF1A;</p>
<pre class="language-"><code class="lang-http"><span class="token header-name keyword">https:</span>//accounts.google.com#jane
</code></pre>
<p>&#x91CD;&#x8981;&#x7684;&#x662F;&#xFF0C;API server &#x4E0D;&#x662F; OAuth2 &#x5BA2;&#x6237;&#x7AEF;&#xFF0C;&#x800C;&#x53EA;&#x80FD;&#x914D;&#x7F6E;&#x4E3A;&#x4FE1;&#x4EFB;&#x5355;&#x4E2A;&#x53D1;&#x884C;&#x8005;&#x3002;&#x8FD9;&#x5141;&#x8BB8;&#x4F7F;&#x7528; Google &#x7B49;&#x516C;&#x5171;&#x63D0;&#x4F9B;&#x8005;&#xFF0C;&#x800C;&#x4E0D;&#x5FC5;&#x4FE1;&#x4EFB;&#x7B2C;&#x4E09;&#x65B9;&#x53D1;&#x884C;&#x7684;&#x51ED;&#x636E;&#x3002;&#x5E0C;&#x671B;&#x5229;&#x7528;&#x591A;&#x4E2A; OAuth &#x5BA2;&#x6237;&#x7AEF;&#x7684;&#x7BA1;&#x7406;&#x5458;&#x5E94;&#x8BE5;&#x63A2;&#x7D22;&#x652F;&#x6301; <code>azp</code>&#xFF08;&#x6388;&#x6743;&#x65B9;&#xFF09;&#x58F0;&#x660E;&#x7684;&#x63D0;&#x4F9B;&#x8005;&#xFF0C;&#x8FD9;&#x662F;&#x5141;&#x8BB8;&#x4E00;&#x4E2A;&#x5BA2;&#x6237;&#x7AEF;&#x4EE3;&#x8868;&#x53E6;&#x4E00;&#x4E2A;&#x5BA2;&#x6237;&#x7AEF;&#x53D1;&#x653E;&#x4EE4;&#x724C;&#x7684;&#x673A;&#x5236;&#x3002;</p>
<p>Kubernetes&#x4E0D;&#x63D0;&#x4F9B; OpenID Connect &#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x5546;&#x3002;&#x60A8;&#x53EF;&#x4EE5;&#x4F7F;&#x7528;&#x73B0;&#x6709;&#x7684;&#x516C;&#x5171; OpenID Connect &#x6807;&#x8BC6;&#x63D0;&#x4F9B;&#x7A0B;&#x5E8F;&#xFF08;&#x4F8B;&#x5982;Google &#x6216; <a href="http://connect2id.com/products/nimbus-oauth-openid-connect-sdk/openid-connect-providers" target="_blank">&#x5176;&#x4ED6;</a>&#xFF09;&#x3002;&#x6216;&#x8005;&#xFF0C;&#x60A8;&#x53EF;&#x4EE5;&#x8FD0;&#x884C;&#x81EA;&#x5DF1;&#x7684;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x7A0B;&#x5E8F;&#xFF0C;&#x4F8B;&#x5982; CoreOS <a href="https://github.com/coreos/dex" target="_blank">dex</a>&#x3001;<a href="https://github.com/keycloak/keycloak" target="_blank">Keycloak</a>&#x3001;CloudFoundry <a href="https://github.com/cloudfoundry/uaa" target="_blank">UAA</a> &#x6216; Tremolo Security &#x7684; <a href="https://github.com/tremolosecurity/openunison" target="_blank">OpenUnison</a>&#x3002;</p>
<p>&#x5BF9;&#x4E8E;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x5546;&#x80FD;&#x591F;&#x9002;&#x7528;&#x4E8E; Kubernetes&#xFF0C;&#x5FC5;&#x987B;&#x6EE1;&#x8DB3;&#x5982;&#x4E0B;&#x6761;&#x4EF6;&#xFF1A;Kubernetes it must:</p>
<ol>
<li>&#x652F;&#x6301; <a href="https://openid.net/specs/openid-connect-discovery-1_0.html" target="_blank">OpenID connect &#x53D1;&#x73B0;</a>&#xFF1B;&#x4E0D;&#x5FC5;&#x662F;&#x5168;&#x90E8;&#x3002;</li>
<li>&#x4F7F;&#x7528;&#x975E;&#x8FC7;&#x65F6;&#x5BC6;&#x7801;&#x5728;TLS&#x4E2D;&#x8FD0;&#x884C;</li>
<li>&#x62E5;&#x6709; CA &#x7B7E;&#x540D;&#x8BC1;&#x4E66;&#xFF08;&#x5373;&#x4F7F; CA &#x4E0D;&#x662F;&#x5546;&#x4E1A; CA &#x6216;&#x81EA;&#x7B7E;&#x540D;&#xFF09;</li>
</ol>
<p>&#x6709;&#x5173;&#x4E0A;&#x8FF0;&#x8981;&#x6C42;3&#x7684;&#x8BF4;&#x660E;&#xFF0C;&#x9700;&#x8981; CA &#x7B7E;&#x540D;&#x8BC1;&#x4E66;&#x3002;&#x5982;&#x679C;&#x60A8;&#x90E8;&#x7F72;&#x81EA;&#x5DF1;&#x7684;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x5546;&#xFF08;&#x800C;&#x4E0D;&#x662F;&#x50CF; Google &#x6216; Microsoft &#x4E4B;&#x7C7B;&#x7684;&#x4E91;&#x63D0;&#x4F9B;&#x5546;&#xFF09;&#xFF0C;&#x5219;&#x5FC5;&#x987B;&#x8BA9;&#x60A8;&#x7684;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x5546;&#x7684; Web &#x670D;&#x52A1;&#x5668;&#x8BC1;&#x4E66;&#x7531; CA &#x6807;&#x5FD7;&#x8BBE;&#x7F6E;&#x4E3A; TRUE &#x7684;&#x8BC1;&#x4E66;&#x7B7E;&#x540D;&#xFF0C;&#x5373;&#x4F7F;&#x662F;&#x81EA;&#x7B7E;&#x540D;&#x7684;&#x3002;&#x8FD9;&#x662F;&#x7531;&#x4E8E; GoLang &#x7684; TLS &#x5BA2;&#x6237;&#x7AEF;&#x5B9E;&#x73B0;&#x5BF9;&#x8BC1;&#x4E66;&#x9A8C;&#x8BC1;&#x7684;&#x6807;&#x51C6;&#x975E;&#x5E38;&#x4E25;&#x683C;&#x3002;&#x5982;&#x679C;&#x60A8;&#x6CA1;&#x6709; <code>CA</code>&#xFF0C;&#x53EF;&#x4EE5;&#x4F7F;&#x7528; <code>CoreOS</code> &#x56E2;&#x961F;&#x7684; <a href="https://github.com/coreos/dex/blob/1ee5920c54f5926d6468d2607c728b71cfe98092/examples/k8s/gencert.sh" target="_blank">&#x8FD9;&#x4E2A;&#x811A;&#x672C;</a> &#x521B;&#x5EFA;&#x4E00;&#x4E2A;&#x7B80;&#x5355;&#x7684; CA &#x548C;&#x4E00;&#x4E2A;&#x7B7E;&#x540D;&#x7684;&#x8BC1;&#x4E66;&#x548C;&#x5BC6;&#x94A5;&#x5BF9;&#x3002;</p>
<p>&#x9488;&#x5BF9;&#x7279;&#x5B9A;&#x7CFB;&#x7EDF;&#x7684;&#x5B89;&#x88C5;&#x8BF4;&#x660E;&#xFF1A;</p>
<ul>
<li><a href="https://apigee.com/about/blog/engineering/kubernetes-authentication-enterprise" target="_blank">UAA</a></li>
<li><a href="https://speakerdeck.com/ericchiang/kubernetes-access-control-with-dex" target="_blank">Dex</a></li>
<li><a href="https://github.com/TremoloSecurity/openunison-qs-kubernetes" target="_blank">OpenUnison</a></li>
</ul>
<h4 id="&#x4F7F;&#x7528;-kubectl">&#x4F7F;&#x7528; kubectl</h4>
<h5 id="&#x9009;&#x9879;-1---oidc-&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x5668;">&#x9009;&#x9879; 1 - OIDC &#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x5668;</h5>
<p>&#x7B2C;&#x4E00;&#x4E2A;&#x9009;&#x9879;&#x662F;&#x4F7F;&#x7528; <code>oidc</code> &#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x5668;&#x3002;&#x6B64;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x7A0B;&#x5E8F;&#x5C06;&#x60A8;&#x7684; <code>id_token</code>&#x3001;<code>refresh_token</code> &#x548C;&#x60A8;&#x7684; OIDC <code>client_secret</code> &#x81EA;&#x52A8;&#x5237;&#x65B0;&#x60A8;&#x7684; token&#x3002;&#x4E00;&#x65E6;&#x60A8;&#x5BF9;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x8005;&#x8FDB;&#x884C;&#x4E86;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">kubectl config set-credentials USER_NAME <span class="token punctuation">\</span>
--auth-provider<span class="token operator">=</span>oidc <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>idp-issuer-url<span class="token operator">=</span><span class="token punctuation">(</span> issuer url <span class="token punctuation">)</span> <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>client-id<span class="token operator">=</span><span class="token punctuation">(</span> your client <span class="token function">id</span> <span class="token punctuation">)</span> <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>client-secret<span class="token operator">=</span><span class="token punctuation">(</span> your client secret <span class="token punctuation">)</span> <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>refresh-token<span class="token operator">=</span><span class="token punctuation">(</span> your refresh token <span class="token punctuation">)</span> <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>idp-certificate-authority<span class="token operator">=</span><span class="token punctuation">(</span> path to your ca certificate <span class="token punctuation">)</span> <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>id-token<span class="token operator">=</span><span class="token punctuation">(</span> your id_token <span class="token punctuation">)</span> <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>extra-scopes<span class="token operator">=</span><span class="token punctuation">(</span> comma separated list of scopes to <span class="token function">add</span> to <span class="token string">&quot;openid email profile&quot;</span>, optional <span class="token punctuation">)</span>
</code></pre>
<p>&#x4F8B;&#x5982;&#xFF0C;&#x5728;&#x5411;&#x8EAB;&#x4EFD;&#x63D0;&#x4F9B;&#x8005;&#x8FDB;&#x884C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x4E4B;&#x540E;&#x8FD0;&#x884C;&#x4EE5;&#x4E0B;&#x547D;&#x4EE4;&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">kubectl config set-credentials mmosley <span class="token punctuation">\</span>
--auth-provider<span class="token operator">=</span>oidc <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>idp-issuer-url<span class="token operator">=</span>https://oidcidp.tremolo.lan:8443/auth/idp/OidcIdP <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>client-id<span class="token operator">=</span>kubernetes <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>client-secret<span class="token operator">=</span>1db158f6-177d-4d9c-8a8b-d36869918ec5 <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>refresh-token<span class="token operator">=</span>q1bKLFOyUiosTfawzA93TzZIDzH2TNa2SMm0zEiPKTUwME6BkEo6Sql5yUWVBSWpKUGphaWpxSVAfekBOZbBhaEW+VlFUeVRGcluyVF5JT4+haZmPsluFoFu5XkpXk5BXqHega4GAXlF+ma+vmYpFcHe5eZR+slBFpZKtQA<span class="token operator">=</span> <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>idp-certificate-authority<span class="token operator">=</span>/root/ca.pem <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>extra-scopes<span class="token operator">=</span>groups <span class="token punctuation">\</span>
--auth-provider-arg<span class="token operator">=</span>id-token<span class="token operator">=</span>eyJraWQiOiJDTj1vaWRjaWRwLnRyZW1vbG8ubGFuLCBPVT1EZW1vLCBPPVRybWVvbG8gU2VjdXJpdHksIEw9QXJsaW5ndG9uLCBTVD1WaXJnaW5pYSwgQz1VUy1DTj1rdWJlLWNhLTEyMDIxNDc5MjEwMzYwNzMyMTUyIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL29pZGNpZHAudHJlbW9sby5sYW46ODQ0My9hdXRoL2lkcC9PaWRjSWRQIiwiYXVkIjoia3ViZXJuZXRlcyIsImV4cCI6MTQ4MzU0OTUxMSwianRpIjoiMm96US15TXdFcHV4WDlHZUhQdy1hZyIsImlhdCI6MTQ4MzU0OTQ1MSwibmJmIjoxNDgzNTQ5MzMxLCJzdWIiOiI0YWViMzdiYS1iNjQ1LTQ4ZmQtYWIzMC0xYTAxZWU0MWUyMTgifQ.w6p4J_6qQ1HzTG9nrEOrubxIMb9K5hzcMPxc9IxPx2K4xO9l-oFiUw93daH3m5pluP6K7eOE6txBuRVfEcpJSwlelsOsW8gb8VJcnzMS9EnZpeA0tW_p-mnkFc3VcfyXuhe5R3G7aa5d8uHv70yJ9Y3-UhjiN9EhpMdfPAoEB9fYKKkJRzF7utTTIPGrSaSU6d2pcpfYKaxIwePzEkT4DfcQthoZdy9ucNvvLoi1DIC-UocFD8HLs8LYKEqSxQvOcvnThbObJ9af71EwmuE21fO5KzMW20KtAeget1gnldOosPtz1G5EwvaQ401-RPQzPGMVBld0_zMCAwZttJ4knw
</code></pre>
<p>&#x5C06;&#x4EA7;&#x751F;&#x4E0B;&#x9762;&#x7684;&#x914D;&#x7F6E;&#xFF1A;</p>
<pre class="language-"><code class="lang-yaml"><span class="token key atrule">users</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token key atrule">name</span><span class="token punctuation">:</span> mmosley
<span class="token key atrule">user</span><span class="token punctuation">:</span>
<span class="token key atrule">auth-provider</span><span class="token punctuation">:</span>
<span class="token key atrule">config</span><span class="token punctuation">:</span>
<span class="token key atrule">client-id</span><span class="token punctuation">:</span> kubernetes
<span class="token key atrule">client-secret</span><span class="token punctuation">:</span> 1db158f6<span class="token punctuation">-</span>177d<span class="token punctuation">-</span>4d9c<span class="token punctuation">-</span>8a8b<span class="token punctuation">-</span>d36869918ec5
<span class="token key atrule">extra-scopes</span><span class="token punctuation">:</span> groups
<span class="token key atrule">id-token</span><span class="token punctuation">:</span> eyJraWQiOiJDTj1vaWRjaWRwLnRyZW1vbG8ubGFuLCBPVT1EZW1vLCBPPVRybWVvbG8gU2VjdXJpdHksIEw9QXJsaW5ndG9uLCBTVD1WaXJnaW5pYSwgQz1VUy1DTj1rdWJlLWNhLTEyMDIxNDc5MjEwMzYwNzMyMTUyIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL29pZGNpZHAudHJlbW9sby5sYW46ODQ0My9hdXRoL2lkcC9PaWRjSWRQIiwiYXVkIjoia3ViZXJuZXRlcyIsImV4cCI6MTQ4MzU0OTUxMSwianRpIjoiMm96US15TXdFcHV4WDlHZUhQdy1hZyIsImlhdCI6MTQ4MzU0OTQ1MSwibmJmIjoxNDgzNTQ5MzMxLCJzdWIiOiI0YWViMzdiYS1iNjQ1LTQ4ZmQtYWIzMC0xYTAxZWU0MWUyMTgifQ.w6p4J_6qQ1HzTG9nrEOrubxIMb9K5hzcMPxc9IxPx2K4xO9l<span class="token punctuation">-</span>oFiUw93daH3m5pluP6K7eOE6txBuRVfEcpJSwlelsOsW8gb8VJcnzMS9EnZpeA0tW_p<span class="token punctuation">-</span>mnkFc3VcfyXuhe5R3G7aa5d8uHv70yJ9Y3<span class="token punctuation">-</span>UhjiN9EhpMdfPAoEB9fYKKkJRzF7utTTIPGrSaSU6d2pcpfYKaxIwePzEkT4DfcQthoZdy9ucNvvLoi1DIC<span class="token punctuation">-</span>UocFD8HLs8LYKEqSxQvOcvnThbObJ9af71EwmuE21fO5KzMW20KtAeget1gnldOosPtz1G5EwvaQ401<span class="token punctuation">-</span>RPQzPGMVBld0_zMCAwZttJ4knw
<span class="token key atrule">idp-certificate-authority</span><span class="token punctuation">:</span> /root/ca.pem
<span class="token key atrule">idp-issuer-url</span><span class="token punctuation">:</span> https<span class="token punctuation">:</span>//oidcidp.tremolo.lan<span class="token punctuation">:</span>8443/auth/idp/OidcIdP
<span class="token key atrule">refresh-token</span><span class="token punctuation">:</span> q1bKLFOyUiosTfawzA93TzZIDzH2TNa2SMm0zEiPKTUwME6BkEo6Sql5yUWVBSWpKUGphaWpxSVAfekBOZbBhaEW+VlFUeVRGcluyVF5JT4+haZmPsluFoFu5XkpXk5BXq
<span class="token key atrule">name</span><span class="token punctuation">:</span> oidc
</code></pre>
<p>&#x4E00;&#x65E6;&#x60A8;&#x7684; <code>id_token</code> &#x8FC7;&#x671F;&#xFF0C;<code>kubectl</code> &#x5C06;&#x4F7F;&#x7528; <code>refresh_token</code> &#x5237;&#x65B0; <code>id_token</code>&#xFF0C;&#x7136;&#x540E;&#x5728; <code>kube/.config</code> &#x6587;&#x4EF6;&#x7684;<code>client_secret</code> &#x4E2D;&#x5B58;&#x50A8; <code>id_token</code> &#x7684;&#x503C;&#x548C;<code>refresh_token</code> &#x7684;&#x65B0;&#x503C;&#x3002;</p>
<h5 id="&#x9009;&#x9879;-2---&#x4F7F;&#x7528;---token-&#x9009;&#x9879;">&#x9009;&#x9879; 2 - &#x4F7F;&#x7528; <code>--token</code> &#x9009;&#x9879;</h5>
<p>&#x53EF;&#x4EE5;&#x5728; <code>kubectl</code> &#x547D;&#x4EE4;&#x7684; <code>--token</code> &#x9009;&#x9879;&#x4E2D;&#x4F20;&#x5165; token&#x3002;&#x7B80;&#x5355;&#x7684;&#x62F7;&#x8D1D;&#x548C;&#x590D;&#x5236; <code>id_token</code> &#x5230;&#x8BE5;&#x9009;&#x9879;&#x4E2D;&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">kubectl --token<span class="token operator">=</span>eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL21sYi50cmVtb2xvLmxhbjo4MDQzL2F1dGgvaWRwL29pZGMiLCJhdWQiOiJrdWJlcm5ldGVzIiwiZXhwIjoxNDc0NTk2NjY5LCJqdGkiOiI2RDUzNXoxUEpFNjJOR3QxaWVyYm9RIiwiaWF0IjoxNDc0NTk2MzY5LCJuYmYiOjE0NzQ1OTYyNDksInN1YiI6Im13aW5kdSIsInVzZXJfcm9sZSI6WyJ1c2VycyIsIm5ldy1uYW1lc3BhY2Utdmlld2VyIl0sImVtYWlsIjoibXdpbmR1QG5vbW9yZWplZGkuY29tIn0.f2As579n9VNoaKzoF-dOQGmXkFKf1FMyNV0-va_B63jn-_n9LGSCca_6IVMP8pO-Zb4KvRqGyTP0r3HkHxYy5c81AnIh8ijarruczl-TK_yF5akjSTHFZD-0gRzlevBDiH8Q79NAr-ky0P4iIXS8lY9Vnjch5MF74Zx0c3alKJHJUnnpjIACByfF2SCaYzbWFMUNat-K1PaUk5-ujMBG7yYnr95xD-63n8CO8teGUAAEMx6zRjzfhnhbzX-ajwZLGwGUBT4WqjMs70-6a7_8gZmLZb2az1cZynkFRj2BaCkVT3A2RrjeEwZEtGXlMqKJ1_I2ulrOVsYx01_yD35-rw get nodes
</code></pre>
<h3 id="webhook-token-&#x8BA4;&#x8BC1;">Webhook Token &#x8BA4;&#x8BC1;</h3>
<p>Webhook &#x8BA4;&#x8BC1;&#x662F;&#x7528;&#x6765;&#x8BA4;&#x8BC1; bearer token &#x7684; hook&#x3002;</p>
<ul>
<li><code>--authentication-token-webhook-config-file</code> &#x662F;&#x4E00;&#x4E2A;&#x7528;&#x6765;&#x63CF;&#x8FF0;&#x5982;&#x4F55;&#x8BBF;&#x95EE;&#x8FDC;&#x7A0B; webhook &#x670D;&#x52A1;&#x7684; kubeconfig &#x6587;&#x4EF6;&#x3002;</li>
<li><code>--authentication-token-webhook-cache-ttl</code> &#x7F13;&#x5B58;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x7B56;&#x7565;&#x7684;&#x65F6;&#x95F4;&#x3002;&#x9ED8;&#x8BA4;&#x4E3A;&#x4E24;&#x5206;&#x949F;&#x3002;</li>
</ul>
<p>&#x914D;&#x7F6E;&#x6587;&#x4EF6;&#x4F7F;&#x7528; <a href="https://kubernetes.io/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/" target="_blank">kubeconfig</a> &#x6587;&#x4EF6;&#x683C;&#x5F0F;&#x3002;&#x6587;&#x4EF6;&#x4E2D;&#x7684; &#x201D;user&#x201C; &#x6307;&#x7684;&#x662F; API server &#x7684; webhook&#xFF0C;&#x201D;clusters&#x201C; &#x662F;&#x6307;&#x8FDC;&#x7A0B;&#x670D;&#x52A1;&#x3002;&#x89C1;&#x4E0B;&#x9762;&#x7684;&#x4F8B;&#x5B50;&#xFF1A;</p>
<pre class="language-"><code class="lang-yaml"><span class="token comment"># clusters refers to the remote service.</span>
<span class="token key atrule">clusters</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token key atrule">name</span><span class="token punctuation">:</span> name<span class="token punctuation">-</span>of<span class="token punctuation">-</span>remote<span class="token punctuation">-</span>authn<span class="token punctuation">-</span>service
<span class="token key atrule">cluster</span><span class="token punctuation">:</span>
<span class="token key atrule">certificate-authority</span><span class="token punctuation">:</span> /path/to/ca.pem <span class="token comment"># CA for verifying the remote service.</span>
<span class="token key atrule">server</span><span class="token punctuation">:</span> https<span class="token punctuation">:</span>//authn.example.com/authenticate <span class="token comment"># URL of remote service to query. Must use &apos;https&apos;.</span>
<span class="token comment"># users refers to the API server&apos;s webhook configuration.</span>
<span class="token key atrule">users</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token key atrule">name</span><span class="token punctuation">:</span> name<span class="token punctuation">-</span>of<span class="token punctuation">-</span>api<span class="token punctuation">-</span>server
<span class="token key atrule">user</span><span class="token punctuation">:</span>
<span class="token key atrule">client-certificate</span><span class="token punctuation">:</span> /path/to/cert.pem <span class="token comment"># cert for the webhook plugin to use</span>
<span class="token key atrule">client-key</span><span class="token punctuation">:</span> /path/to/key.pem <span class="token comment"># key matching the cert</span>
<span class="token comment"># kubeconfig files require a context. Provide one for the API server.</span>
<span class="token key atrule">current-context</span><span class="token punctuation">:</span> webhook
<span class="token key atrule">contexts</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token key atrule">context</span><span class="token punctuation">:</span>
<span class="token key atrule">cluster</span><span class="token punctuation">:</span> name<span class="token punctuation">-</span>of<span class="token punctuation">-</span>remote<span class="token punctuation">-</span>authn<span class="token punctuation">-</span>service
<span class="token key atrule">user</span><span class="token punctuation">:</span> name<span class="token punctuation">-</span>of<span class="token punctuation">-</span>api<span class="token punctuation">-</span>sever
<span class="token key atrule">name</span><span class="token punctuation">:</span> webhook
</code></pre>
<p>&#x5F53;&#x5BA2;&#x6237;&#x7AEF;&#x5C1D;&#x8BD5;&#x4F7F;&#x7528; bearer token &#x4E0E;API server &#x8FDB;&#x884C;&#x8BA4;&#x8BC1;&#x662F;&#xFF0C;&#x5982;&#x4E0A;&#x8BBA;&#x8FF0;&#xFF0C;&#x8BA4;&#x8BC1; webhook &#x7528;&#x9971;&#x542B;&#x8BE5; token &#x7684;&#x5BF9;&#x8C61;&#x67E5;&#x8BE2;&#x8FDC;&#x7A0B;&#x670D;&#x52A1;&#x3002;Kubernetes &#x4E0D;&#x4F1A;&#x6311;&#x6218;&#x7F3A;&#x5C11;&#x8BE5; header &#x7684;&#x8BF7;&#x6C42;&#x3002;</p>
<p>&#x8BF7;&#x6CE8;&#x610F;&#xFF0C;webhook API&#x5BF9;&#x8C61;&#x4E0E;&#x5176;&#x4ED6; Kubernetes API &#x5BF9;&#x8C61;&#x5177;&#x6709;&#x76F8;&#x540C;&#x7684; <a href="https://kubernetes.io/docs/concepts/overview/kubernetes-api/" target="_blank">&#x7248;&#x672C;&#x63A7;&#x5236;&#x517C;&#x5BB9;&#x6027;&#x89C4;&#x5219;</a>&#x3002;&#x5B9E;&#x73B0;&#x8005;&#x5E94;&#x8BE5;&#x610F;&#x8BC6;&#x5230; Beta &#x5BF9;&#x8C61;&#x7684;&#x5BBD;&#x677E;&#x517C;&#x5BB9;&#x6027;&#x627F;&#x8BFA;&#xFF0C;&#x5E76;&#x68C0;&#x67E5;&#x8BF7;&#x6C42;&#x7684; &#x201C;apiVersion&#x201D; &#x5B57;&#x6BB5;&#x4EE5;&#x786E;&#x4FDD;&#x6B63;&#x786E;&#x7684;&#x53CD;&#x5E8F;&#x5217;&#x5316;&#x3002;&#x6B64;&#x5916;&#xFF0C;API server &#x5FC5;&#x987B;&#x542F;&#x7528; <code>authentication.k8s.io/v1beta1</code> API &#x6269;&#x5C55;&#x7EC4;&#xFF08;<code>--runtime config =authentication.k8s.io/v1beta1=true</code>&#xFF09;&#x3002;</p>
<p>The request body will be of the following format:</p>
<pre class="language-"><code class="lang-json"><span class="token punctuation">{</span>
<span class="token property">&quot;apiVersion&quot;</span><span class="token operator">:</span> <span class="token string">&quot;authentication.k8s.io/v1beta1&quot;</span><span class="token punctuation">,</span>
<span class="token property">&quot;kind&quot;</span><span class="token operator">:</span> <span class="token string">&quot;TokenReview&quot;</span><span class="token punctuation">,</span>
<span class="token property">&quot;spec&quot;</span><span class="token operator">:</span> <span class="token punctuation">{</span>
<span class="token property">&quot;token&quot;</span><span class="token operator">:</span> <span class="token string">&quot;(BEARERTOKEN)&quot;</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
</code></pre>
<p>&#x9884;&#x8BA1;&#x8FDC;&#x7A0B;&#x670D;&#x52A1;&#x5C06;&#x586B;&#x5199;&#x8BF7;&#x6C42;&#x7684; <code>status</code> &#x5B57;&#x6BB5;&#x4EE5;&#x6307;&#x793A;&#x767B;&#x5F55;&#x6210;&#x529F;&#x3002;&#x54CD;&#x5E94;&#x4E3B;&#x4F53;&#x7684; <code>spec</code> &#x5B57;&#x6BB5;&#x88AB;&#x5FFD;&#x7565;&#xFF0C;&#x53EF;&#x4EE5;&#x7701;&#x7565;&#x3002;&#x6210;&#x529F;&#x9A8C;&#x8BC1;&#x540E;&#x7684; bearer token &#x5C06;&#x8FD4;&#x56DE;&#xFF1A;</p>
<pre class="language-"><code class="lang-json"><span class="token punctuation">{</span>
<span class="token property">&quot;apiVersion&quot;</span><span class="token operator">:</span> <span class="token string">&quot;authentication.k8s.io/v1beta1&quot;</span><span class="token punctuation">,</span>
<span class="token property">&quot;kind&quot;</span><span class="token operator">:</span> <span class="token string">&quot;TokenReview&quot;</span><span class="token punctuation">,</span>
<span class="token property">&quot;status&quot;</span><span class="token operator">:</span> <span class="token punctuation">{</span>
<span class="token property">&quot;authenticated&quot;</span><span class="token operator">:</span> <span class="token boolean">true</span><span class="token punctuation">,</span>
<span class="token property">&quot;user&quot;</span><span class="token operator">:</span> <span class="token punctuation">{</span>
<span class="token property">&quot;username&quot;</span><span class="token operator">:</span> <span class="token string">&quot;janedoe@example.com&quot;</span><span class="token punctuation">,</span>
<span class="token property">&quot;uid&quot;</span><span class="token operator">:</span> <span class="token string">&quot;42&quot;</span><span class="token punctuation">,</span>
<span class="token property">&quot;groups&quot;</span><span class="token operator">:</span> <span class="token punctuation">[</span>
<span class="token string">&quot;developers&quot;</span><span class="token punctuation">,</span>
<span class="token string">&quot;qa&quot;</span>
<span class="token punctuation">]</span><span class="token punctuation">,</span>
<span class="token property">&quot;extra&quot;</span><span class="token operator">:</span> <span class="token punctuation">{</span>
<span class="token property">&quot;extrafield1&quot;</span><span class="token operator">:</span> <span class="token punctuation">[</span>
<span class="token string">&quot;extravalue1&quot;</span><span class="token punctuation">,</span>
<span class="token string">&quot;extravalue2&quot;</span>
<span class="token punctuation">]</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
</code></pre>
<p>&#x672A;&#x6210;&#x529F;&#x7684;&#x8BF7;&#x6C42;&#x5C06;&#x8FD4;&#x56DE;&#xFF1A;</p>
<pre class="language-"><code class="lang-json"><span class="token punctuation">{</span>
<span class="token property">&quot;apiVersion&quot;</span><span class="token operator">:</span> <span class="token string">&quot;authentication.k8s.io/v1beta1&quot;</span><span class="token punctuation">,</span>
<span class="token property">&quot;kind&quot;</span><span class="token operator">:</span> <span class="token string">&quot;TokenReview&quot;</span><span class="token punctuation">,</span>
<span class="token property">&quot;status&quot;</span><span class="token operator">:</span> <span class="token punctuation">{</span>
<span class="token property">&quot;authenticated&quot;</span><span class="token operator">:</span> <span class="token boolean">false</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
</code></pre>
<p>HTTP&#x72B6;&#x6001;&#x4EE3;&#x7801;&#x53EF;&#x4EE5;&#x7528;&#x6765;&#x63D0;&#x4F9B;&#x989D;&#x5916;&#x7684;&#x9519;&#x8BEF;&#x4E0A;&#x4E0B;&#x6587;&#x3002;</p>
<h3 id="&#x8BA4;&#x8BC1;&#x4EE3;&#x7406;">&#x8BA4;&#x8BC1;&#x4EE3;&#x7406;</h3>
<p>&#x53EF;&#x4EE5;&#x914D;&#x7F6E; API server &#x4ECE;&#x8BF7;&#x6C42; header &#x7684;&#x503C;&#x4E2D;&#x8BC6;&#x522B;&#x7528;&#x6237;&#xFF0C;&#x4F8B;&#x5982; <code>X-Remote-User</code>&#x3002;&#x8FD9;&#x6837;&#x7684;&#x8BBE;&#x8BA1;&#x662F;&#x7528;&#x6765;&#x4E0E;&#x8BF7;&#x6C42; header &#x503C;&#x7684;&#x9A8C;&#x8BC1;&#x4EE3;&#x7406;&#x7ED3;&#x5408;&#x4F7F;&#x7528;&#x3002;</p>
<ul>
<li><code>--requestheader-username-headers</code> &#x5FC5;&#x9700;&#xFF0C;&#x5927;&#x5C0F;&#x5199;&#x654F;&#x611F;&#x3002;&#x6309; header &#x540D;&#x79F0;&#x548C;&#x987A;&#x5E8F;&#x68C0;&#x67E5;&#x7528;&#x6237;&#x6807;&#x8BC6;&#x3002;&#x5305;&#x542B;&#x503C;&#x7684;&#x7B2C;&#x4E00;&#x4E2A; header &#x5C06;&#x88AB;&#x4F5C;&#x4E3A;&#x7528;&#x6237;&#x540D;&#x3002;</li>
<li><code>--requestheader-group-headers</code> 1.6 &#x4EE5;&#x4E0A;&#x7248;&#x672C;&#x3002;&#x53EF;&#x9009;&#x3002;&#x5927;&#x5C0F;&#x5199;&#x654F;&#x611F;&#x3002;&#x5EFA;&#x8BAE;&#x4E3A; &#x201C;X-Remote-Group&#x201D;&#x3002;&#x6309; header &#x540D;&#x79F0;&#x548C;&#x987A;&#x5E8F;&#x68C0;&#x67E5;&#x7528;&#x6237;&#x7EC4;&#x3002;&#x6240;&#x6709;&#x6307;&#x5B9A;&#x7684; header &#x4E2D;&#x7684;&#x6240;&#x6709;&#x503C;&#x90FD;&#x5C06;&#x4F5C;&#x4E3A;&#x7EC4;&#x540D;&#x3002; </li>
<li><code>--requestheader-extra-headers-prefix</code> 1.6 &#x4EE5;&#x4E0A;&#x7248;&#x672C;&#x3002;&#x53EF;&#x9009;&#xFF0C;&#x5927;&#x5C0F;&#x5199;&#x654F;&#x611F;&#x3002;&#x5EFA;&#x8BAE;&#x4E3A; &#x201C;X-Remote-Extra-&#x201D;&#x3002;&#x6807;&#x9898;&#x524D;&#x7F00;&#x53EF;&#x7528;&#x4E8E;&#x67E5;&#x627E;&#x6709;&#x5173;&#x7528;&#x6237;&#x7684;&#x989D;&#x5916;&#x4FE1;&#x606F;&#xFF08;&#x901A;&#x5E38;&#x7531;&#x914D;&#x7F6E;&#x7684;&#x6388;&#x6743;&#x63D2;&#x4EF6;&#x4F7F;&#x7528;&#xFF09;&#x3002;&#x4EE5;&#x4EFB;&#x4F55;&#x6307;&#x5B9A;&#x7684;&#x524D;&#x7F00;&#x5F00;&#x5934;&#x7684; header &#x90FD;&#x4F1A;&#x5220;&#x9664;&#x524D;&#x7F00;&#xFF0C;header &#x540D;&#x79F0;&#x7684;&#x5176;&#x4F59;&#x90E8;&#x5206;&#x5C06;&#x6210;&#x4E3A;&#x989D;&#x5916;&#x7684;&#x952E;&#x503C;&#xFF0C;&#x800C; header &#x503C;&#x5219;&#x662F;&#x989D;&#x5916;&#x7684;&#x503C;&#x3002;</li>
</ul>
<p>&#x4F8B;&#x5982;&#x4E0B;&#x9762;&#x7684;&#x914D;&#x7F6E;&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">--requestheader-username-headers<span class="token operator">=</span>X-Remote-User
--requestheader-group-headers<span class="token operator">=</span>X-Remote-Group
--requestheader-extra-headers-prefix<span class="token operator">=</span>X-Remote-Extra-
</code></pre>
<p>&#x8BE5;&#x8BF7;&#x6C42;&#xFF1A;</p>
<pre class="language-"><code class="lang-http">GET / HTTP/1.1
<span class="token header-name keyword">X-Remote-User:</span> fido
<span class="token header-name keyword">X-Remote-Group:</span> dogs
<span class="token header-name keyword">X-Remote-Group:</span> dachshunds
<span class="token header-name keyword">X-Remote-Extra-Scopes:</span> openid
<span class="token header-name keyword">X-Remote-Extra-Scopes:</span> profile
</code></pre>
<p>&#x5C06;&#x4EA7;&#x751F;&#x5982;&#x4E0B;&#x7684;&#x7528;&#x6237;&#x4FE1;&#x606F;&#xFF1A;</p>
<pre class="language-"><code class="lang-yaml"><span class="token key atrule">name</span><span class="token punctuation">:</span> fido
<span class="token key atrule">groups</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> dogs
<span class="token punctuation">-</span> dachshunds
<span class="token key atrule">extra</span><span class="token punctuation">:</span>
<span class="token key atrule">scopes</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> openid
<span class="token punctuation">-</span> profile
</code></pre>
<p>&#x4E3A;&#x4E86;&#x9632;&#x6B62; header &#x6B3A;&#x9A97;&#xFF0C;&#x9A8C;&#x8BC1;&#x4EE3;&#x7406;&#x9700;&#x8981;&#x5728;&#x9A8C;&#x8BC1;&#x8BF7;&#x6C42; header &#x4E4B;&#x524D;&#x5411; API server &#x63D0;&#x4F9B;&#x6709;&#x6548;&#x7684;&#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;&#xFF0C;&#x4EE5;&#x5BF9;&#x7167;&#x6307;&#x5B9A;&#x7684; CA &#x8FDB;&#x884C;&#x9A8C;&#x8BC1;&#x3002;</p>
<ul>
<li><code>--requestheader-client-ca-file</code> &#x5FC5;&#x9700;&#x3002;PEM &#x7F16;&#x7801;&#x7684;&#x8BC1;&#x4E66;&#x5305;&#x3002;&#x5728;&#x68C0;&#x67E5;&#x7528;&#x6237;&#x540D;&#x7684;&#x8BF7;&#x6C42; header &#x4E4B;&#x524D;&#xFF0C;&#x5FC5;&#x987B;&#x9488;&#x5BF9;&#x6307;&#x5B9A;&#x6587;&#x4EF6;&#x4E2D;&#x7684;&#x8BC1;&#x4E66;&#x9881;&#x53D1;&#x673A;&#x6784;&#x63D0;&#x4EA4;&#x5E76;&#x9A8C;&#x8BC1;&#x6709;&#x6548;&#x7684;&#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;&#x3002;</li>
<li><code>--requestheader-allowed-names</code> &#x53EF;&#x9009;&#x3002;Common Name &#xFF08;cn&#xFF09;&#x5217;&#x8868;&#x3002;&#x5982;&#x679C;&#x8BBE;&#x7F6E;&#x4E86;&#xFF0C;&#x5219;&#x5728;&#x68C0;&#x67E5;&#x7528;&#x6237;&#x540D;&#x7684;&#x8BF7;&#x6C42; header &#x4E4B;&#x524D;&#xFF0C; &#x5FC5;&#x987B;&#x63D0;&#x4F9B;&#x6307;&#x5B9A;&#x5217;&#x8868;&#x4E2D; Common Name&#xFF08;cn&#xFF09;&#x7684;&#x6709;&#x6548;&#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;&#x3002;&#x5982;&#x679C;&#x4E3A;&#x7A7A;&#xFF0C;&#x5219;&#x5141;&#x8BB8;&#x4F7F;&#x7528;&#x4EFB;&#x4F55; Common Name&#x3002;</li>
</ul>
<h3 id="keystone-&#x5BC6;&#x7801;">Keystone &#x5BC6;&#x7801;</h3>
<p>&#x901A;&#x8FC7;&#x5728;&#x542F;&#x52A8;&#x8FC7;&#x7A0B;&#x4E2D;&#x5C06; <code>--experimental-keystone-url=<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AuthURL</span><span class="token punctuation">&gt;</span></span></code> &#x9009;&#x9879;&#x4F20;&#x9012;&#x7ED9; API server &#x6765;&#x542F;&#x7528; Keystone &#x8BA4;&#x8BC1;&#x3002;&#x8BE5;&#x63D2;&#x4EF6;&#x5728; <code>plugin/pkg/auth/authenticator/password/keystone/keystone.go</code> &#x4E2D;&#x5B9E;&#x73B0;&#xFF0C;&#x76EE;&#x524D;&#x4F7F;&#x7528;&#x57FA;&#x672C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x901A;&#x8FC7;&#x7528;&#x6237;&#x540D;&#x548C;&#x5BC6;&#x7801;&#x9A8C;&#x8BC1;&#x7528;&#x6237;&#x3002;</p>
<p>&#x5982;&#x679C;&#x60A8;&#x4E3A; Keystone &#x670D;&#x52A1;&#x5668;&#x914D;&#x7F6E;&#x4E86;&#x81EA;&#x7B7E;&#x540D;&#x8BC1;&#x4E66;&#xFF0C;&#x5219;&#x5728;&#x542F;&#x52A8; Kubernetes API server &#x65F6;&#x53EF;&#x80FD;&#x9700;&#x8981;&#x8BBE;&#x7F6E; <code>--experimental-keystone-ca-file=SOMEFILE</code> &#x9009;&#x9879;&#x3002;&#x5982;&#x679C;&#x60A8;&#x8BBE;&#x7F6E;&#x4E86;&#x8BE5;&#x9009;&#x9879;&#xFF0C;Keystone &#x670D;&#x52A1;&#x5668;&#x7684;&#x8BC1;&#x4E66;&#x5C06;&#x7531;<code>experimental-keystone-ca-file</code> &#x4E2D;&#x7684;&#x67D0;&#x4E2A;&#x6743;&#x5A01;&#x673A;&#x6784;&#x9A8C;&#x8BC1;&#x3002;&#x5426;&#x5219;&#xFF0C;&#x8BC1;&#x4E66;&#x7531;&#x4E3B;&#x673A;&#x7684;&#x6839;&#x8BC1;&#x4E66;&#x9881;&#x53D1;&#x673A;&#x6784;&#x9A8C;&#x8BC1;&#x3002;</p>
<p>&#x6709;&#x5173;&#x5982;&#x4F55;&#x4F7F;&#x7528; keystone &#x6765;&#x7BA1;&#x7406;&#x9879;&#x76EE;&#x548C;&#x7528;&#x6237;&#x7684;&#x8BE6;&#x7EC6;&#x4FE1;&#x606F;&#xFF0C;&#x8BF7;&#x53C2;&#x9605; <a href="http://docs.openstack.org/developer/keystone/" target="_blank">Keystone &#x6587;&#x6863;</a>&#x3002;&#x8BF7;&#x6CE8;&#x610F;&#xFF0C;&#x8FD9;&#x4E2A;&#x63D2;&#x4EF6;&#x4ECD;&#x5904;&#x4E8E;&#x8BD5;&#x9A8C;&#x9636;&#x6BB5;&#xFF0C;&#x6B63;&#x5728;&#x79EF;&#x6781;&#x5F00;&#x53D1;&#x4E4B;&#x4E2D;&#xFF0C;&#x5E76;&#x53EF;&#x80FD;&#x5728;&#x540E;&#x7EED;&#x7248;&#x672C;&#x4E2D;&#x8FDB;&#x884C;&#x66F4;&#x6539;&#x3002;</p>
<p>&#x8BF7;&#x53C2;&#x8003; <a href="https://github.com/kubernetes/kubernetes/pull/11798#issuecomment-129655212" target="_blank">&#x8BA8;&#x8BBA;</a>&#x3001;<a href="https://github.com/kubernetes/kubernetes/issues/11626" target="_blank">&#x84DD;&#x56FE;</a> &#x548C; <a href="https://github.com/kubernetes/kubernetes/pull/25536" target="_blank">&#x63D0;&#x51FA;&#x7684;&#x6539;&#x53D8;</a> &#x83B7;&#x53D6;&#x66F4;&#x591A;&#x4FE1;&#x606F;&#x3002;</p>
<h2 id="&#x533F;&#x540D;&#x8BF7;&#x6C42;">&#x533F;&#x540D;&#x8BF7;&#x6C42;</h2>
<p>&#x542F;&#x7528;&#x65F6;&#xFF0C;&#x672A;&#x88AB;&#x5176;&#x4ED6;&#x5DF2;&#x914D;&#x7F6E;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x65B9;&#x6CD5;&#x62D2;&#x7EDD;&#x7684;&#x8BF7;&#x6C42;&#x5C06;&#x88AB;&#x89C6;&#x4E3A;&#x533F;&#x540D;&#x8BF7;&#x6C42;&#xFF0C;&#x5E76;&#x7ED9;&#x4E88; <code>system:anonymous</code> &#x7684;&#x7528;&#x6237;&#x540D;&#x548C;<code>system:unuthenticated</code> &#x7684;&#x7EC4;&#x540D;&#x3002;</p>
<p>&#x4F8B;&#x5982;&#xFF0C;&#x5728;&#x914D;&#x7F6E;&#x4E86;&#x4EE4;&#x724C;&#x8BA4;&#x8BC1;&#x548C;&#x542F;&#x7528;&#x4E86;&#x533F;&#x540D;&#x8BBF;&#x95EE;&#x7684;&#x670D;&#x52A1;&#x5668;&#x4E0A;&#xFF0C;&#x63D0;&#x4F9B;&#x65E0;&#x6548;&#x7684; bearer token &#x7684;&#x8BF7;&#x6C42;&#x5C06;&#x6536;&#x5230; <code>401 Unauthorized</code> &#x9519;&#x8BEF;&#x3002;&#x63D0;&#x4F9B; bearer token &#x7684;&#x8BF7;&#x6C42;&#x5C06;&#x88AB;&#x89C6;&#x4E3A;&#x533F;&#x540D;&#x8BF7;&#x6C42;&#x3002;</p>
<p>&#x5728; 1.5.1 - 1.5.x &#x7248;&#x672C;&#x4E2D;&#xFF0C;&#x9ED8;&#x8BA4;&#x60C5;&#x51B5;&#x4E0B;&#x547D;&#x540D;&#x8BBF;&#x95EE;&#x662F;&#x88AB;&#x7981;&#x7528;&#x7684;&#xFF0C;&#x53EF;&#x4EE5;&#x901A;&#x8FC7;&#x4F20;&#x9012; <code>--anonymous-auth=false</code> &#x9009;&#x9879;&#x7ED9; API server &#x6765;&#x542F;&#x7528;&#x3002;</p>
<p>&#x5728; 1.6+ &#x7248;&#x672C;&#x4E2D;&#xFF0C;&#x5982;&#x679C;&#x4F7F;&#x7528; <code>AlwaysAllow</code> &#x4EE5;&#x5916;&#x7684;&#x6388;&#x6743;&#x6A21;&#x5F0F;&#xFF0C;&#x5219;&#x9ED8;&#x8BA4;&#x542F;&#x7528;&#x533F;&#x540D;&#x8BBF;&#x95EE;&#xFF0C;&#x5E76;&#x4E14;&#x53EF;&#x4EE5;&#x901A;&#x8FC7;&#x5C06; <code>--anonymous-auth=false</code>&#x9009;&#x9879;&#x4F20;&#x9012;&#x7ED9;API&#x670D;&#x52A1;&#x5668;&#x6765;&#x7981;&#x7528;&#x3002;&#x4ECE; 1.6 &#x5F00;&#x59CB;&#xFF0C;ABAC &#x548C; RBAC &#x6388;&#x6743;&#x4EBA;&#x9700;&#x8981;&#x660E;&#x786E;&#x6388;&#x6743; <code>system:annoymous</code> &#x6216; <code>system:unauthenticated</code> &#x7EC4;&#xFF0C;&#x56E0;&#x6B64;&#x6388;&#x4E88;&#x5BF9; <code>*</code> &#x7528;&#x6237;&#x6216; <code>*</code> &#x7EC4;&#x8BBF;&#x95EE;&#x6743;&#x7684;&#x4F20;&#x7EDF;&#x7B56;&#x7565;&#x89C4;&#x5219;&#x4E0D;&#x5305;&#x62EC;&#x533F;&#x540D;&#x7528;&#x6237;&#x3002;</p>
<h2 id="&#x7528;&#x6237;&#x6A21;&#x62DF;">&#x7528;&#x6237;&#x6A21;&#x62DF;</h2>
<p>&#x7528;&#x6237;&#x53EF;&#x4EE5;&#x901A;&#x8FC7;&#x6A21;&#x62DF; header &#x5145;&#x5F53;&#x53E6;&#x4E00;&#x4E2A;&#x7528;&#x6237;&#x3002;&#x8BE5;&#x8BF7;&#x6C42;&#x4F1A;&#x8986;&#x76D6;&#x8BF7;&#x6C42;&#x8BA4;&#x8BC1;&#x7684;&#x7528;&#x6237;&#x4FE1;&#x606F;&#x3002;&#x4F8B;&#x5982;&#xFF0C;&#x7BA1;&#x7406;&#x5458;&#x53EF;&#x4EE5;&#x4F7F;&#x7528;&#x6B64;&#x529F;&#x80FD;&#x901A;&#x8FC7;&#x6682;&#x65F6;&#x6A21;&#x62DF;&#x5176;&#x4ED6;&#x7528;&#x6237;&#x5E76;&#x67E5;&#x770B;&#x8BF7;&#x6C42;&#x662F;&#x5426;&#x88AB;&#x62D2;&#x7EDD;&#x6765;&#x8C03;&#x8BD5;&#x6388;&#x6743;&#x7B56;&#x7565;&#x3002;</p>
<p>&#x6A21;&#x62DF;&#x8BF7;&#x6C42;&#x9996;&#x5148;&#x8BA4;&#x8BC1;&#x4E3A;&#x8BF7;&#x6C42;&#x7528;&#x6237;&#xFF0C;&#x7136;&#x540E;&#x5207;&#x6362;&#x5230;&#x6A21;&#x62DF;&#x7684;&#x7528;&#x6237;&#x4FE1;&#x606F;&#x3002;</p>
<ul>
<li>&#x7528;&#x6237;&#x4F7F;&#x7528;&#x4ED6;&#x4EEC;&#x7684;&#x51ED;&#x8BC1;<em>&#x548C;</em>&#x6A21;&#x62DF; header &#x8FDB;&#x884C; API &#x8C03;&#x7528;&#x3002;</li>
<li>API server &#x8BA4;&#x8BC1;&#x7528;&#x6237;</li>
<li>API server &#x786E;&#x4FDD;&#x7ECF;&#x8FC7;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x7684;&#x7528;&#x6237;&#x5177;&#x6709;&#x6A21;&#x62DF;&#x6743;&#x9650;&#x3002;</li>
<li>&#x8BF7;&#x6C42;&#x7528;&#x6237;&#x7684;&#x4FE1;&#x606F;&#x88AB;&#x66FF;&#x6362;&#x4E3A;&#x6A21;&#x62DF;&#x503C;</li>
<li>&#x8BF7;&#x6C42;&#x88AB;&#x8BC4;&#x4F30;&#xFF0C;&#x6388;&#x6743;&#x4F5C;&#x7528;&#x4E8E;&#x6A21;&#x62DF;&#x7684;&#x7528;&#x6237;&#x4FE1;&#x606F;&#x3002;</li>
</ul>
<p>&#x4EE5;&#x4E0B; HTTP header &#x53EF;&#x7528;&#x6237;&#x6267;&#x884C;&#x6A21;&#x62DF;&#x8BF7;&#x6C42;&#xFF1A;</p>
<ul>
<li><code>Impersonate-User</code>&#xFF1A;&#x5145;&#x5F53;&#x7684;&#x7528;&#x6237;&#x540D;</li>
<li><code>Impersonate-Group</code>&#xFF1A;&#x4F5C;&#x4E3A;&#x7EC4;&#x540D;&#x3002;&#x53EF;&#x4EE5;&#x591A;&#x6B21;&#x4F7F;&#x7528;&#x6765;&#x8BBE;&#x7F6E;&#x591A;&#x4E2A;&#x7EC4;&#x3002;&#x53EF;&#x9009;&#x7684;&#xFF0C;&#x9700;&#x8981; &#x201C;Impersonate-User&#x201D;</li>
<li><code>Impersonate-Extra-( extra name )</code>&#xFF1A;&#x7528;&#x4E8E;&#x5C06;&#x989D;&#x5916;&#x5B57;&#x6BB5;&#x4E0E;&#x7528;&#x6237;&#x5173;&#x8054;&#x7684;&#x52A8;&#x6001; header&#x3002;&#x53EF;&#x9009;&#x3002;&#x9700;&#x8981; &#x201C;Impersonate-User&#x201D;</li>
</ul>
<p>&#x4E00;&#x7EC4;&#x793A;&#x4F8B; header&#xFF1A;</p>
<pre class="language-"><code class="lang-http"><span class="token header-name keyword">Impersonate-User:</span> jane.doe@example.com
<span class="token header-name keyword">Impersonate-Group:</span> developers
<span class="token header-name keyword">Impersonate-Group:</span> admins
<span class="token header-name keyword">Impersonate-Extra-dn:</span> cn=jane,ou=engineers,dc=example,dc=com
<span class="token header-name keyword">Impersonate-Extra-scopes:</span> view
<span class="token header-name keyword">Impersonate-Extra-scopes:</span> development
</code></pre>
<p>&#x5F53;&#x4F7F;&#x7528; <code>kubectl</code> &#x7684; <code>--as</code> &#x6807;&#x5FD7;&#x6765;&#x914D;&#x7F6E; <code>Impersonate-User</code> header &#x65F6;&#xFF0C;&#x53EF;&#x4EE5;&#x4F7F;&#x7528; <code>--as-group</code> &#x6807;&#x5FD7;&#x6765;&#x914D;&#x7F6E; <code>Impersonate-Group</code> header&#x3002;</p>
<pre class="language-"><code class="lang-bash">$ kubectl drain mynode
Error from server <span class="token punctuation">(</span>Forbidden<span class="token punctuation">)</span>: User <span class="token string">&quot;clark&quot;</span> cannot get nodes at the cluster scope. <span class="token punctuation">(</span>get nodes mynode<span class="token punctuation">)</span>
$ kubectl drain mynode --as<span class="token operator">=</span>superman --as-group<span class="token operator">=</span>system:masters
node <span class="token string">&quot;mynode&quot;</span> cordoned
node <span class="token string">&quot;mynode&quot;</span> draine
</code></pre>
<p>&#x4E3A;&#x6A21;&#x4EFF;&#x7528;&#x6237;&#x3001;&#x7EC4;&#x6216;&#x8BBE;&#x7F6E;&#x989D;&#x5916;&#x5B57;&#x6BB5;&#xFF0C;&#x6A21;&#x62DF;&#x7528;&#x6237;&#x5FC5;&#x987B;&#x80FD;&#x591F;&#x5BF9;&#x6B63;&#x5728;&#x6A21;&#x62DF;&#x7684;&#x5C5E;&#x6027;&#x7684;&#x79CD;&#x7C7B;&#xFF08;&#x201C;&#x7528;&#x6237;&#x201D;&#xFF0C;&#x201C;&#x7EC4;&#x201D;&#x7B49;&#xFF09;&#x6267;&#x884C;&#x201C;&#x6A21;&#x62DF;&#x201D;&#x52A8;&#x8BCD;&#x3002;&#x5BF9;&#x4E8E;&#x542F;&#x7528;&#x4E86; RBAC &#x6388;&#x6743;&#x63D2;&#x4EF6;&#x7684;&#x96C6;&#x7FA4;&#xFF0C;&#x4EE5;&#x4E0B; ClusterRole &#x5305;&#x542B;&#x8BBE;&#x7F6E;&#x7528;&#x6237;&#x548C;&#x7EC4;&#x6A21;&#x62DF; header &#x6240;&#x9700;&#x7684;&#x89C4;&#x5219;&#xFF1A;</p>
<pre class="language-"><code class="lang-yaml"><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> rbac.authorization.k8s.io/v1
<span class="token key atrule">kind</span><span class="token punctuation">:</span> ClusterRole
<span class="token key atrule">metadata</span><span class="token punctuation">:</span>
<span class="token key atrule">name</span><span class="token punctuation">:</span> impersonator
<span class="token key atrule">rules</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token key atrule">apiGroups</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">resources</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;users&quot;</span><span class="token punctuation">,</span> <span class="token string">&quot;groups&quot;</span><span class="token punctuation">,</span> <span class="token string">&quot;serviceaccounts&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">verbs</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;impersonate&quot;</span><span class="token punctuation">]</span>
</code></pre>
<p>&#x989D;&#x5916;&#x7684;&#x5B57;&#x6BB5;&#x88AB;&#x8BC4;&#x4F30;&#x4E3A;&#x8D44;&#x6E90; &#x201C;userextras&#x201D; &#x7684;&#x5B50;&#x8D44;&#x6E90;&#x3002;&#x4E3A;&#x4E86;&#x5141;&#x8BB8;&#x7528;&#x6237;&#x4F7F;&#x7528;&#x989D;&#x5916;&#x5B57;&#x6BB5; &#x201C;scope&#x201D; &#x7684;&#x6A21;&#x62DF; header&#xFF0C;&#x5E94;&#x6388;&#x4E88;&#x7528;&#x6237;&#x4EE5;&#x4E0B;&#x89D2;&#x8272;&#xFF1A;</p>
<pre class="language-"><code class="lang-yaml"><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> rbac.authorization.k8s.io/v1
<span class="token key atrule">kind</span><span class="token punctuation">:</span> ClusterRole
<span class="token key atrule">metadata</span><span class="token punctuation">:</span>
<span class="token key atrule">name</span><span class="token punctuation">:</span> scopes<span class="token punctuation">-</span>impersonator
<span class="token comment"># Can set &quot;Impersonate-Extra-scopes&quot; header.</span>
<span class="token punctuation">-</span> <span class="token key atrule">apiGroups</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;authentication.k8s.io&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">resources</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;userextras/scopes&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">verbs</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;impersonate&quot;</span><span class="token punctuation">]</span>
</code></pre>
<p>&#x6A21;&#x62DF; header &#x7684;&#x53EF;&#x7528;&#x503C;&#x53EF;&#x4EE5;&#x901A;&#x8FC7;&#x8BBE;&#x7F6E; <code>resourceNames</code> &#x53EF;&#x4EE5;&#x4F7F;&#x7528;&#x7684;&#x8D44;&#x6E90;&#x6765;&#x9650;&#x5236;&#x3002;</p>
<pre class="language-"><code class="lang-yaml"><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> rbac.authorization.k8s.io/v1
<span class="token key atrule">kind</span><span class="token punctuation">:</span> ClusterRole
<span class="token key atrule">metadata</span><span class="token punctuation">:</span>
<span class="token key atrule">name</span><span class="token punctuation">:</span> limited<span class="token punctuation">-</span>impersonator
<span class="token key atrule">rules</span><span class="token punctuation">:</span>
<span class="token comment"># Can impersonate the user &quot;jane.doe@example.com&quot;</span>
<span class="token punctuation">-</span> <span class="token key atrule">apiGroups</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">resources</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;users&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">verbs</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;impersonate&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">resourceNames</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;jane.doe@example.com&quot;</span><span class="token punctuation">]</span>
<span class="token comment"># Can impersonate the groups &quot;developers&quot; and &quot;admins&quot;</span>
<span class="token punctuation">-</span> <span class="token key atrule">apiGroups</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">resources</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;groups&quot;</span><span class="token punctuation">]</span>
<span class="token punctuation">-</span> <span class="token key atrule">verbs</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;impersonate&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">resourceNames</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;developers&quot;</span><span class="token punctuation">,</span><span class="token string">&quot;admins&quot;</span><span class="token punctuation">]</span>
<span class="token comment"># Can impersonate the extras field &quot;scopes&quot; with the values &quot;view&quot; and &quot;development&quot;</span>
<span class="token punctuation">-</span> <span class="token key atrule">apiGroups</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;authentication.k8s.io&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">resources</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;userextras/scopes&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">verbs</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;impersonate&quot;</span><span class="token punctuation">]</span>
<span class="token key atrule">resourceNames</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token string">&quot;view&quot;</span><span class="token punctuation">,</span> <span class="token string">&quot;development&quot;</span><span class="token punctuation">]</span>
</code></pre>
<h2 id="&#x9644;&#x5F55;">&#x9644;&#x5F55;</h2>
<h3 id="&#x521B;&#x5EFA;&#x8BC1;&#x4E66;">&#x521B;&#x5EFA;&#x8BC1;&#x4E66;</h3>
<p>&#x4F7F;&#x7528;&#x5BA2;&#x6237;&#x7AEF;&#x8BC1;&#x4E66;&#x8FDB;&#x884C;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#x65F6;&#xFF0C;&#x53EF;&#x4EE5;&#x4F7F;&#x7528;&#x73B0;&#x6709;&#x7684;&#x90E8;&#x7F72;&#x811A;&#x672C;&#x6216;&#x901A;&#x8FC7; <code>easyrsa</code> &#x6216; <code>openssl</code> &#x624B;&#x52A8;&#x751F;&#x6210;&#x8BC1;&#x4E66;&#x3002;</p>
<h4 id="&#x4F7F;&#x7528;&#x5DF2;&#x6709;&#x7684;&#x90E8;&#x7F72;&#x811A;&#x672C;">&#x4F7F;&#x7528;&#x5DF2;&#x6709;&#x7684;&#x90E8;&#x7F72;&#x811A;&#x672C;</h4>
<p><strong>&#x5DF2;&#x6709;&#x7684;&#x90E8;&#x7F72;&#x811A;&#x672C;</strong> &#x5728; <code>cluster/saltbase/salt/generate-cert/make-ca-cert.sh</code>&#x3002;</p>
<p>&#x6267;&#x884C;&#x8BE5;&#x811A;&#x672C;&#x65F6;&#x9700;&#x8981;&#x4F20;&#x9012;&#x4E24;&#x4E2A;&#x53C2;&#x6570;&#x3002;&#x7B2C;&#x4E00;&#x4E2A;&#x53C2;&#x6570;&#x662F; API server &#x7684; IP&#x5730;&#x5740;&#x3002;&#x7B2C;&#x4E8C;&#x4E2A;&#x53C2;&#x6570;&#x662F; IP &#x5F62;&#x5F0F;&#x7684;&#x4E3B;&#x9898;&#x5907;&#x7528;&#x540D;&#x79F0;&#x5217;&#x8868;&#xFF1A; <code>IP:<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>ip-address</span><span class="token punctuation">&gt;</span></span></code> &#x6216; <code>DNS:<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>dns-name</span><span class="token punctuation">&gt;</span></span></code>&#x3002;</p>
<p>&#x8BE5;&#x811A;&#x672C;&#x5C06;&#x751F;&#x6210;&#x4E09;&#x4E2A;&#x6587;&#x4EF6;&#xFF1A; <code>ca.crt</code>&#x3001;<code>server.crt</code> &#x548C; <code>server.key</code>&#x3002;</p>
<p>&#x6700;&#x540E;&#xFF0C;&#x5C06;&#x4E00;&#x4E0B;&#x53C2;&#x6570;&#x6DFB;&#x52A0;&#x5230; API server &#x7684;&#x542F;&#x52A8;&#x53C2;&#x6570;&#x4E2D;&#xFF1A;</p>
<ul>
<li><code>--client-ca-file=/srv/kubernetes/ca.crt</code></li>
<li><code>--tls-cert-file=/srv/kubernetes/server.crt</code></li>
<li><code>--tls-private-key-file=/srv/kubernetes/server.key</code></li>
</ul>
<h4 id="easyrsa">easyrsa</h4>
<p><strong>easyrsa</strong> &#x53EF;&#x4EE5;&#x7528;&#x6765;&#x624B;&#x52A8;&#x4E3A;&#x96C6;&#x7FA4;&#x751F;&#x6210;&#x8BC1;&#x4E66;&#x3002;</p>
<ol>
<li><p>&#x4E0B;&#x8F7D;&#xFF0C;&#x89E3;&#x538B;&#xFF0C;&#x5E76;&#x521D;&#x59CB;&#x5316;&#x4FEE;&#x8865;&#x7248;&#x672C;&#x7684;easyrsa3&#x3002;</p>
<pre class="language-"><code class="lang-bash"><span class="token function">curl</span> -L -O https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz
<span class="token function">tar</span> xzf easy-rsa.tar.gz
<span class="token builtin class-name">cd</span> easy-rsa-master/easyrsa3
./easyrsa init-pki
</code></pre>
</li>
<li><p>&#x751F;&#x6210; CA&#xFF08;&#x4F7F;&#x7528; <code>--batch</code> &#x8BBE;&#x7F6E;&#x4E3A;&#x81EA;&#x52A8;&#x6A21;&#x5F0F;&#x3002;&#x4F7F;&#x7528; <code>--req-cn</code> &#x8BBE;&#x7F6E;&#x9ED8;&#x8BA4;&#x7684; CN&#xFF09;</p>
<pre class="language-"><code class="lang-bash">./easyrsa --batch <span class="token string">&quot;--req-cn=<span class="token variable">${MASTER_IP}</span>@<span class="token variable"><span class="token variable">`</span><span class="token function">date</span> +%s<span class="token variable">`</span></span>&quot;</span> build-ca nopass
</code></pre>
</li>
<li><p>&#x751F;&#x6210;&#x670D;&#x52A1;&#x5668;&#x8BC1;&#x4E66;&#x548C;&#x5BC6;&#x94A5;&#x3002;&#xFF08;build-server-full [&#x6587;&#x4EF6;&#x540D;]&#xFF1A;&#x751F;&#x6210;&#x4E00;&#x4E2A;&#x952E;&#x503C;&#x5BF9;&#xFF0C;&#x5728;&#x672C;&#x5730;&#x4E3A;&#x5BA2;&#x6237;&#x7AEF;&#x548C;&#x670D;&#x52A1;&#x5668;&#x7B7E;&#x540D;&#x3002;&#xFF09;</p>
<pre class="language-"><code class="lang-bash">./easyrsa --subject-alt-name<span class="token operator">=</span><span class="token string">&quot;IP:<span class="token variable">${MASTER_IP}</span>&quot;</span> build-server-full server nopass
</code></pre>
</li>
<li><p>&#x590D;&#x5236; <code>pki/ca.crt</code>, <code>pki/issued/server.crt</code> &#x548C; <code>pki/private/server.key</code> &#x5230;&#x60A8;&#x7684;&#x76EE;&#x5F55;&#x4E0B;&#x3002;</p>
</li>
<li><p>&#x5C06;&#x4EE5;&#x4E0B;&#x53C2;&#x6570;&#x6DFB;&#x52A0;&#x5230; API server &#x7684;&#x542F;&#x52A8;&#x53C2;&#x6570;&#x4E2D;&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">--client-ca-file<span class="token operator">=</span>/yourdirectory/ca.crt
--tls-cert-file<span class="token operator">=</span>/yourdirectory/server.crt
--tls-private-key-file<span class="token operator">=</span>/yourdirectory/server.key
</code></pre>
</li>
</ol>
<h4 id="openssl">openssl</h4>
<p><strong>openssl</strong> &#x53EF;&#x4EE5;&#x7528;&#x6765;&#x624B;&#x52A8;&#x4E3A;&#x96C6;&#x7FA4;&#x751F;&#x6210;&#x8BC1;&#x4E66;&#x3002;</p>
<ol>
<li><p>&#x751F;&#x6210;&#x4E00;&#x4E2A; 2048 bit &#x7684; ca.key&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">openssl genrsa -out ca.key <span class="token number">2048</span>
</code></pre>
</li>
<li><p>&#x6839;&#x636E; ca.key &#x751F;&#x6210;&#x4E00;&#x4E2A; ca.crt&#xFF08;&#x4F7F;&#x7528; -days &#x8BBE;&#x7F6E;&#x8BC1;&#x4E66;&#x7684;&#x6709;&#x6548;&#x65F6;&#x95F4;&#xFF09;&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">openssl req -x509 -new -nodes -key ca.key -subj <span class="token string">&quot;/CN=<span class="token variable">${MASTER_IP}</span>&quot;</span> -days <span class="token number">10000</span> -out ca.crt
</code></pre>
</li>
<li><p>&#x751F;&#x6210;&#x4E00;&#x4E2A; 2048 bit &#x7684; server.key&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">openssl genrsa -out server.key <span class="token number">2048</span>
</code></pre>
</li>
<li><p>&#x6839;&#x636E; server.key &#x751F;&#x6210;&#x4E00;&#x4E2A; server.csr&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">openssl req -new -key server.key -subj <span class="token string">&quot;/CN=<span class="token variable">${MASTER_IP}</span>&quot;</span> -out server.csr
</code></pre>
</li>
<li><p>&#x6839;&#x636E; ca.key&#x3001;ca.crt &#x548C; server.csr &#x751F;&#x6210; server.crt&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days <span class="token number">10000</span>
</code></pre>
</li>
<li><p>&#x67E5;&#x770B;&#x8BC1;&#x4E66;&#xFF1A;</p>
<pre class="language-"><code class="lang-bash">openssl x509 -noout -text -in ./server.crt
</code></pre>
</li>
</ol>
<p>&#x6700;&#x540E;&#xFF0C;&#x4E0D;&#x8981;&#x5FD8;&#x4E86;&#x5411; API server &#x7684;&#x542F;&#x52A8;&#x53C2;&#x6570;&#x4E2D;&#x589E;&#x52A0;&#x914D;&#x7F6E;&#x3002;</p>
<h4 id="&#x8BA4;&#x8BC1;-api">&#x8BA4;&#x8BC1; API</h4>
<p>&#x60A8;&#x53EF;&#x4EE5;&#x4F7F;&#x7528; <code>certificates.k8s.io</code> API&#x5C06; x509 &#x8BC1;&#x4E66;&#x914D;&#x7F6E;&#x4E3A;&#x7528;&#x4E8E;&#x8EAB;&#x4EFD;&#x9A8C;&#x8BC1;&#xFF0C;&#x5982; <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster" target="_blank">&#x6B64;&#x5904;</a> &#x6240;&#x8FF0;&#x3002;</p>
<h2 id="&#x53C2;&#x8003;">&#x53C2;&#x8003;</h2>
<ul>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" target="_blank">Authenticating - kubernetes.io</a></li>
</ul>
<footer class="page-footer"><span class="copyright">Copyright &#xA9; 2017-2022 | Distributed under <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/deed.zh" target="_blank">CC BY 4.0</a> | <a href="https://jimmysong.io" target="_blank">jimmysong.io</a> all right reserved.</span><span class="footer-modification"> Updated at
2022-04-18 02:49:41
</span></footer>
</section>
</div>
<div class="search-results">
<div class="has-results">
<h1 class="search-results-title"><span class='search-results-count'></span> results matching "<span class='search-query'></span>"</h1>
<ul class="search-results-list"></ul>
</div>
<div class="no-results">
<h1 class="search-results-title">No results matching "<span class='search-query'></span>"</h1>
</div>
</div>
</div>
</div>
</div>
</div>
<a href="auth-with-kubeconfig-or-token.html" class="navigation navigation-prev " aria-label="Previous page: 使用 kubeconfig 或 token 进行用户身份认证">
<i class="fa fa-angle-left"></i>
</a>
<a href="kubernetes-security-best-practice.html" class="navigation navigation-next " aria-label="Next page: Kubernetes 集群安全性配置最佳实践">
<i class="fa fa-angle-right"></i>
</a>
</div>
<script>
var gitbook = gitbook || [];
gitbook.push(function() {
gitbook.page.hasChanged({"page":{"title":"Kubernetes 中的用户与身份认证授权","level":"5.4.7","depth":2,"next":{"title":"Kubernetes 集群安全性配置最佳实践","level":"5.4.8","depth":2,"path":"guide/kubernetes-security-best-practice.md","ref":"guide/kubernetes-security-best-practice.md","articles":[]},"previous":{"title":"使用 kubeconfig 或 token 进行用户身份认证","level":"5.4.6","depth":2,"path":"guide/auth-with-kubeconfig-or-token.md","ref":"guide/auth-with-kubeconfig-or-token.md","articles":[]},"dir":"ltr"},"config":{"plugins":["github","codesnippet","splitter","page-toc-button","image-captions","editlink","back-to-top-button","-lunr","-search","search-plus","github-buttons@2.1.0","favicon@^0.0.2","tbfed-pagefooter@^0.0.1","3-ba","theme-default","-highlight","prism","prism-themes","lightbox","ga","sitemap-general","hide-element","expandable-chapters-small","insert-logo","adsense"],"styles":{"ebook":"styles/ebook.css","epub":"styles/epub.css","mobi":"styles/mobi.css","pdf":"styles/pdf.css","print":"styles/print.css","website":"styles/website.css"},"pluginsConfig":{"tbfed-pagefooter":{"copyright":"Copyright © 2017-2022 | Distributed under <a href=https://creativecommons.org/licenses/by-nc-sa/4.0/deed.zh>CC BY 4.0</a> | <a href=https://jimmysong.io>jimmysong.io</a>","modify_label":" Updated at ","modify_format":"YYYY-MM-DD HH:mm:ss"},"prism":{"css":["prism-themes/themes/prism-ghcolors.css"]},"github":{"url":"https://github.com/rootsongjc/kubernetes-handbook"},"editlink":{"label":"编辑本页","multilingual":false,"base":"https://github.com/rootsongjc/kubernetes-handbook/blob/master/"},"splitter":{},"adsense":{"client":"ca-pub-4029167986768912","slot":"2445941692","format":"auto","element":".page-inner section","position":"bottom"},"codesnippet":{},"sitemap-general":{"prefix":"https://jimmysong.io/kubernetes-handbook/"},"hide-element":{"elements":[".gitbook-link"]},"fontsettings":{"theme":"white","family":"sans","size":2},"favicon":{"shortcut":"favicon.ico","bookmark":"favicon.ico"},"lightbox":{"jquery":true,"sameUuid":false},"page-toc-button":{},"back-to-top-button":{},"prism-themes":{},"github-buttons":{"repo":"rootsongjc/kubernetes-handbook","types":["star"],"size":"small"},"3-ba":{"configuration":"auto","token":"11f7d254cfa4e0ca44b175c66d379ecc"},"expandable-chapters-small":{},"ga":{"configuration":"auto","token":"UA-93485976-1"},"sharing":{"facebook":true,"twitter":true,"google":false,"weibo":false,"instapaper":false,"vk":false,"all":["facebook","google","twitter","weibo","instapaper"]},"theme-default":{"showLevel":true,"styles":{"ebook":"styles/ebook.css","epub":"styles/epub.css","mobi":"styles/mobi.css","pdf":"styles/pdf.css","print":"styles/print.css","website":"styles/website.css"}},"insert-logo":{"style":"background: none; max-height: 100px; min-height: 30px","url":"https://jimmysong.io/images/logo-black-text.png"},"search-plus":{},"image-captions":{"caption":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","variable_name":"_pictures"}},"theme":"default","author":"宋净超（Jimmy Song）","pdf":{"pageNumbers":true,"fontSize":12,"fontFamily":"Arial","paperSize":"a4","chapterMark":"pagebreak","pageBreaksBefore":"/","margin":{"right":62,"left":62,"top":56,"bottom":56}},"structure":{"langs":"LANGS.md","readme":"README.md","glossary":"GLOSSARY.md","summary":"SUMMARY.md"},"variables":{"_pictures":[{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.1","level":"2.4","list_caption":"Figure: 云计算演进历程","alt":"云计算演进历程","nro":1,"url":"../images/cloud-computing-evolution-road.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云计算演进历程","attributes":{},"skip":false,"key":"2.4.1"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.2","level":"2.4","list_caption":"Figure: 来自 Twitter @MarcWilczek","alt":"来自 Twitter @MarcWilczek","nro":2,"url":"../images/cloud-native-comes-of-age.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"来自 Twitter @MarcWilczek","attributes":{},"skip":false,"key":"2.4.2"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.3","level":"2.4","list_caption":"Figure: 云原生思维导图","alt":"云原生思维导图","nro":3,"url":"../images/cloud-native-architecutre-mindnode.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生思维导图","attributes":{},"skip":false,"key":"2.4.3"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.4","level":"2.4","list_caption":"Figure: 十二因素应用","alt":"十二因素应用","nro":4,"url":"../images/12-factor-app.png","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"十二因素应用","attributes":{},"skip":false,"key":"2.4.4"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.5","level":"2.4","list_caption":"Figure: 容器生态","alt":"容器生态","nro":5,"url":"../images/container-ecosystem.png","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"容器生态","attributes":{},"skip":false,"key":"2.4.5"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.6","level":"2.4","list_caption":"Figure: 使用 Jenkins 进行持续集成与发布流程图","alt":"使用 Jenkins 进行持续集成与发布流程图","nro":6,"url":"../images/kubernetes-jenkins-ci-cd.png","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"使用 Jenkins 进行持续集成与发布流程图","attributes":{},"skip":false,"key":"2.4.6"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.7","level":"2.4","list_caption":"Figure: filebeat 日志收集架构图","alt":"filebeat 日志收集架构图","nro":7,"url":"../images/filebeat-log-collector-arch.png","index":7,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"filebeat 日志收集架构图","attributes":{},"skip":false,"key":"2.4.7"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.8","level":"2.4","list_caption":"Figure: API 文档","alt":"API 文档","nro":8,"url":"../images/k8s-app-monitor-test-api-doc.jpg","index":8,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"API 文档","attributes":{},"skip":false,"key":"2.4.8"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.9","level":"2.4","list_caption":"Figure: 迁移步骤示意图","alt":"迁移步骤示意图","nro":9,"url":"../images/migrating-hadoop-yarn-to-kubernetes.png","index":9,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"迁移步骤示意图","attributes":{},"skip":false,"key":"2.4.9"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.10","level":"2.4","list_caption":"Figure: service mesh 架构图","alt":"service mesh 架构图","nro":10,"url":"../images/serivce-mesh-control-plane.png","index":10,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"service mesh 架构图","attributes":{},"skip":false,"key":"2.4.10"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.11","level":"2.4","list_caption":"Figure: kibana 界面","alt":"kibana 界面","nro":11,"url":"../images/filebeat-docker-test.jpg","index":11,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"kibana 界面","attributes":{},"skip":false,"key":"2.4.11"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.12","level":"2.4","list_caption":"Figure: Kubernetes 集群全局监控图 1","alt":"Kubernetes 集群全局监控图 1","nro":12,"url":"../images/kubernetes-devops-example-grafana-1.png","index":12,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 集群全局监控图 1","attributes":{},"skip":false,"key":"2.4.12"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.13","level":"2.4","list_caption":"Figure: Kubernetes 全局监控图 2","alt":"Kubernetes 全局监控图 2","nro":13,"url":"../images/kubernetes-devops-example-grafana-2.png","index":13,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 全局监控图 2","attributes":{},"skip":false,"key":"2.4.13"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.14","level":"2.4","list_caption":"Figure: Grafana 界面示意图 3","alt":"Grafana 界面示意图 3","nro":14,"url":"../images/kubernetes-devops-example-grafana-3.png","index":14,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Grafana 界面示意图 3","attributes":{},"skip":false,"key":"2.4.14"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.15","level":"2.4","list_caption":"Figure: dashboard","alt":"dashboard","nro":15,"url":"../images/spark-job-on-kubernetes-example-1.jpg","index":15,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"dashboard","attributes":{},"skip":false,"key":"2.4.15"},{"backlink":"cloud-native/kubernetes-and-cloud-native-app-overview.html#fig2.4.16","level":"2.4","list_caption":"Figure: Grafana","alt":"Grafana","nro":16,"url":"../images/spark-job-on-kubernetes-example-2.jpg","index":16,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Grafana","attributes":{},"skip":false,"key":"2.4.16"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.1","level":"2.5","list_caption":"Figure: 容器生态图","alt":"容器生态图","nro":17,"url":"../images/container-ecosystem.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"容器生态图","attributes":{},"skip":false,"key":"2.5.1"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.2","level":"2.5","list_caption":"Figure: Kubernetes架构","alt":"Kubernetes架构","nro":18,"url":"../images/kubernetes-high-level-component-archtecture.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes架构","attributes":{},"skip":false,"key":"2.5.2"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.3","level":"2.5","list_caption":"Figure: 云原生的核心目标","alt":"云原生的核心目标","nro":19,"url":"../images/cloud-native-core-target.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生的核心目标","attributes":{},"skip":false,"key":"2.5.3"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.4","level":"2.5","list_caption":"Figure: FaaS Landscape","alt":"FaaS Landscape","nro":20,"url":"../images/redpoint-faas-landscape.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"FaaS Landscape","attributes":{},"skip":false,"key":"2.5.4"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.5","level":"2.5","list_caption":"Figure: 运行在 Kubernetes 上的负载（2017 年）","alt":"运行在 Kubernetes 上的负载（2017 年）","nro":21,"url":"../images/0069RVTdgy1fv5mxr6fxtj31kw11q484.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"运行在 Kubernetes 上的负载（2017 年）","attributes":{},"skip":false,"key":"2.5.5"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.6","level":"2.5","list_caption":"Figure: Gartner 技术爆发趋势图（2017 年）","alt":"Gartner 技术爆发趋势图（2017 年）","nro":22,"url":"../images/0069RVTdgy1fv5my2jtxzj315o0z8dkr.jpg","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Gartner 技术爆发趋势图（2017 年）","attributes":{},"skip":false,"key":"2.5.6"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.7","level":"2.5","list_caption":"Figure: 微服务的关注点","alt":"微服务的关注点","nro":23,"url":"../images/microservices-concerns.jpg","index":7,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"微服务的关注点","attributes":{},"skip":false,"key":"2.5.7"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.8","level":"2.5","list_caption":"Figure: 微服务中的两种服务发现方式","alt":"微服务中的两种服务发现方式","nro":24,"url":"../images/service-discovery-in-microservices.png","index":8,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"微服务中的两种服务发现方式","attributes":{},"skip":false,"key":"2.5.8"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.9","level":"2.5","list_caption":"Figure: Cloud Native Features","alt":"Cloud Native Features","nro":25,"url":"https://jimmysong.io/kubernetes-handbook/images/cloud-native-architecutre-mindnode.jpg","index":9,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Cloud Native Features","attributes":{},"skip":false,"key":"2.5.9"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.10","level":"2.5","list_caption":"Figure: Cloud Native Landscape v1.0","alt":"Cloud Native Landscape v1.0","nro":26,"url":"../images/0069RVTdgy1fv5myp6ednj31kw0w0u0x.jpg","index":10,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Cloud Native Landscape v1.0","attributes":{},"skip":false,"key":"2.5.10"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.11","level":"2.5","list_caption":"Figure: 使用 Kubernetes 构建云原生架构应用","alt":"使用 Kubernetes 构建云原生架构应用","nro":27,"url":"../images/building-cloud-native-architecture-with-kubernetes.png","index":11,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"使用 Kubernetes 构建云原生架构应用","attributes":{},"skip":false,"key":"2.5.11"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.12","level":"2.5","list_caption":"Figure: 创建 Kubernetes 原生应用","alt":"创建 Kubernetes 原生应用","nro":28,"url":"../images/creating-kubernetes-native-app.jpg","index":12,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"创建 Kubernetes 原生应用","attributes":{},"skip":false,"key":"2.5.12"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.13","level":"2.5","list_caption":"Figure: istio vs linkerd","alt":"istio vs linkerd","nro":29,"url":"../images/istio-vs-linkerd.jpg","index":13,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"istio vs linkerd","attributes":{},"skip":false,"key":"2.5.13"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.14","level":"2.5","list_caption":"Figure: 部署流水线","alt":"部署流水线","nro":30,"url":"../images/0069RVTdgy1fv5mzj8rj6j318g1ewtfc.jpg","index":14,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"部署流水线","attributes":{},"skip":false,"key":"2.5.14"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.15","level":"2.5","list_caption":"Figure: 使用不同调度器的 Spark on Kubernetes","alt":"使用不同调度器的 Spark on Kubernetes","nro":31,"url":"../images/spark-on-kubernetes-with-different-schedulers.jpg","index":15,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"使用不同调度器的 Spark on Kubernetes","attributes":{},"skip":false,"key":"2.5.15"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.16","level":"2.5","list_caption":"Figure: Kubernetes 解决方案","alt":"Kubernetes 解决方案","nro":32,"url":"../images/0069RVTdgy1fv5mzywc83j31fk1i8qg4.jpg","index":16,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 解决方案","attributes":{},"skip":false,"key":"2.5.16"},{"backlink":"cloud-native/from-kubernetes-to-cloud-native.html#fig2.5.17","level":"2.5","list_caption":"Figure: Kubernetes SIG","alt":"Kubernetes SIG","nro":33,"url":"../images/kubernetes-sigs.jpg","index":17,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes SIG","attributes":{},"skip":false,"key":"2.5.17"},{"backlink":"cloud-native/define-cloud-native-app.html#fig2.6.1","level":"2.6","list_caption":"Figure: 云原生应用模型","alt":"云原生应用模型","nro":34,"url":"../images/cloud-native-app-model.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生应用模型","attributes":{},"skip":false,"key":"2.6.1"},{"backlink":"cloud-native/define-cloud-native-app.html#fig2.6.2","level":"2.6","list_caption":"Figure: 云原生应用模型中的目标角色","alt":"云原生应用模型中的目标角色","nro":35,"url":"../images/roles.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生应用模型中的目标角色","attributes":{},"skip":false,"key":"2.6.2"},{"backlink":"cloud-native/oam.html#fig2.6.1.1","level":"2.6.1","list_caption":"Figure: OAM 规范示意图","alt":"OAM 规范示意图","nro":36,"url":"../images/oam-spec.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OAM 规范示意图","attributes":{},"skip":false,"key":"2.6.1.1"},{"backlink":"cloud-native/oam.html#fig2.6.1.2","level":"2.6.1","list_caption":"Figure: OAM 的原理","alt":"OAM 的原理","nro":37,"url":"../images/oam-principle.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OAM 的原理","attributes":{},"skip":false,"key":"2.6.1.2"},{"backlink":"cloud-native/crossplane.html#fig2.6.2.1","level":"2.6.2","list_caption":"Figure: Wordpress 页面","alt":"Wordpress 页面","nro":38,"url":"../images/wordpress.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Wordpress 页面","attributes":{},"skip":false,"key":"2.6.2.1"},{"backlink":"cloud-native/cloud-native-programming-language-ballerina.html#fig2.7.1.1","level":"2.7.1","list_caption":"Figure: 云原生编程语言ballerina","alt":"云原生编程语言ballerina","nro":39,"url":"../images/philosophy-page-diagrams-top.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生编程语言ballerina","attributes":{},"skip":false,"key":"2.7.1.1"},{"backlink":"cloud-native/cloud-native-programming-language-ballerina.html#fig2.7.1.2","level":"2.7.1","list_caption":"Figure: 云原生编程语言Ballerina的序列图设计理念","alt":"云原生编程语言Ballerina的序列图设计理念","nro":40,"url":"../images/philosophy-principle-diagrams-01.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生编程语言Ballerina的序列图设计理念","attributes":{},"skip":false,"key":"2.7.1.2"},{"backlink":"cloud-native/cloud-native-programming-language-ballerina.html#fig2.7.1.3","level":"2.7.1","list_caption":"Figure: 云原生编程语言Ballerina的并发理念","alt":"云原生编程语言Ballerina的并发理念","nro":41,"url":"../images/philosophy-principle-diagrams-02.png","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生编程语言Ballerina的并发理念","attributes":{},"skip":false,"key":"2.7.1.3"},{"backlink":"cloud-native/cloud-native-programming-language-ballerina.html#fig2.7.1.4","level":"2.7.1","list_caption":"Figure: 云原生编程语言ballerina运行时架构","alt":"云原生编程语言ballerina运行时架构","nro":42,"url":"../images/philosophy-diagrams-for-site-02.png","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生编程语言ballerina运行时架构","attributes":{},"skip":false,"key":"2.7.1.4"},{"backlink":"cloud-native/cloud-native-programming-language-ballerina.html#fig2.7.1.5","level":"2.7.1","list_caption":"Figure: 云原生编程语言ballerina部署架构图","alt":"云原生编程语言ballerina部署架构图","nro":43,"url":"../images/philosophy-diagrams-for-site-03.png","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生编程语言ballerina部署架构图","attributes":{},"skip":false,"key":"2.7.1.5"},{"backlink":"cloud-native/cloud-native-programming-language-ballerina.html#fig2.7.1.6","level":"2.7.1","list_caption":"Figure: 云原生编程语言ballerina生命周期架构图","alt":"云原生编程语言ballerina生命周期架构图","nro":44,"url":"../images/philosophy-diagrams-for-site-04.png","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生编程语言ballerina生命周期架构图","attributes":{},"skip":false,"key":"2.7.1.6"},{"backlink":"cloud-native/cloud-native-programming-language-pulumi.html#fig2.7.2.1","level":"2.7.2","list_caption":"Figure: 云原生编程语言Pulumi","alt":"云原生编程语言Pulumi","nro":45,"url":"../images/pulumi.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生编程语言Pulumi","attributes":{},"skip":false,"key":"2.7.2.1"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.1","level":"2.8","list_caption":"Figure: Kubernetes 云原生的操作系统","alt":"Kubernetes 云原生的操作系统","nro":46,"url":"../images/00704eQkgy1frr4z08j6oj31p20w2n6n.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 云原生的操作系统","attributes":{},"skip":false,"key":"2.8.1"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.2","level":"2.8","list_caption":"Figure: 操作系统层次","alt":"操作系统层次","nro":47,"url":"../images/00704eQkgy1frr52hl4eaj31qy15en74.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"操作系统层次","attributes":{},"skip":false,"key":"2.8.2"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.3","level":"2.8","list_caption":"Figure: 云原生景观图","alt":"云原生景观图","nro":48,"url":"../images/00704eQkgy1frr53j3aiuj32fs1dc7wi.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生景观图","attributes":{},"skip":false,"key":"2.8.3"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.4","level":"2.8","list_caption":"Figure: KubeVirt架构图","alt":"KubeVirt架构图","nro":49,"url":"../images/00704eQkgy1frr54de5oyj31qw14qn2x.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"KubeVirt架构图","attributes":{},"skip":false,"key":"2.8.4"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.5","level":"2.8","list_caption":"Figure: Kubernetes中的资源隔离","alt":"Kubernetes中的资源隔离","nro":50,"url":"../images/00704eQkgy1frr54ztql2j329q0zwwlf.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes中的资源隔离","attributes":{},"skip":false,"key":"2.8.5"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.6","level":"2.8","list_caption":"Figure: OpenEBS 控制平面架构","alt":"OpenEBS 控制平面架构","nro":51,"url":"../images/00704eQkgy1frr56m7z2sj31y010y17y.jpg","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OpenEBS 控制平面架构","attributes":{},"skip":false,"key":"2.8.6"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.7","level":"2.8","list_caption":"Figure: OpenEBS 的存储卷管理","alt":"OpenEBS 的存储卷管理","nro":52,"url":"../images/00704eQkgy1frr57nm2mnj31xk11qqej.jpg","index":7,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OpenEBS 的存储卷管理","attributes":{},"skip":false,"key":"2.8.7"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.8","level":"2.8","list_caption":"Figure: Hadoop YARN 迁移到 Kubernetes的示例","alt":"Hadoop YARN 迁移到 Kubernetes的示例","nro":53,"url":"../images/00704eQkgy1frr58ebf2lj323o11219r.jpg","index":8,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Hadoop YARN 迁移到 Kubernetes的示例","attributes":{},"skip":false,"key":"2.8.8"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.9","level":"2.8","list_caption":"Figure: Spark on Yarn with Kubernetes","alt":"Spark on Yarn with Kubernetes","nro":54,"url":"../images/00704eQkgy1frr59gzzwsj32gg16k4qp.jpg","index":9,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Spark on Yarn with Kubernetes","attributes":{},"skip":false,"key":"2.8.9"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.10","level":"2.8","list_caption":"Figure: 云原生与12因素应用","alt":"云原生与12因素应用","nro":55,"url":"../images/00704eQkgy1frr5arzvetj31no12mdre.jpg","index":10,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生与12因素应用","attributes":{},"skip":false,"key":"2.8.10"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.11","level":"2.8","list_caption":"Figure: 云原生编程语言","alt":"云原生编程语言","nro":56,"url":"../images/00704eQkgy1frr5c8bwmtj31ou152qc3.jpg","index":11,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生编程语言","attributes":{},"skip":false,"key":"2.8.11"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.12","level":"2.8","list_caption":"Figure: Gitkube","alt":"Gitkube","nro":57,"url":"../images/00704eQkgy1frr5bulhuhj329m10iwua.jpg","index":12,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Gitkube","attributes":{},"skip":false,"key":"2.8.12"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.13","level":"2.8","list_caption":"Figure: Kuberentes中的流量管理","alt":"Kuberentes中的流量管理","nro":58,"url":"../images/00704eQkgy1frr5dsurx6j320i140tpf.jpg","index":13,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kuberentes中的流量管理","attributes":{},"skip":false,"key":"2.8.13"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.14","level":"2.8","list_caption":"Figure: Istio Service Mesh架构图","alt":"Istio Service Mesh架构图","nro":59,"url":"../images/00704eQkgy1frr5exqm7kj320u18mh2t.jpg","index":14,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Istio Service Mesh架构图","attributes":{},"skip":false,"key":"2.8.14"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.15","level":"2.8","list_caption":"Figure: Service Mesh架构","alt":"Service Mesh架构","nro":60,"url":"../images/00704eQkgy1frr5fxzoltj32f81akqr2.jpg","index":15,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Service Mesh架构","attributes":{},"skip":false,"key":"2.8.15"},{"backlink":"cloud-native/the-future-of-cloud-native.html#fig2.8.16","level":"2.8","list_caption":"Figure: Envoy proxy架构图","alt":"Envoy proxy架构图","nro":61,"url":"../images/envoy-arch.png","index":16,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Envoy proxy架构图","attributes":{},"skip":false,"key":"2.8.16"},{"backlink":"cloud-native/play-with-kubernetes.html#fig3.2.1","level":"3.2","list_caption":"Figure: Play with Kubernetes 网页截图","alt":"Play with Kubernetes 网页截图","nro":62,"url":"../images/play-with-kubernetes.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Play with Kubernetes 网页截图","attributes":{},"skip":false,"key":"3.2.1"},{"backlink":"cloud-native/cloud-native-local-quick-start.html#fig3.3.1","level":"3.3","list_caption":"Figure: Kubernetes dashboard","alt":"Kubernetes dashboard","nro":63,"url":"https://github.com/rootsongjc/kubernetes-vagrant-centos-cluster/raw/master/images/dashboard-animation.gif","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes dashboard","attributes":{},"skip":false,"key":"3.3.1"},{"backlink":"cloud-native/cloud-native-local-quick-start.html#fig3.3.2","level":"3.3","list_caption":"Figure: Grafana","alt":"Grafana","nro":64,"url":"https://github.com/rootsongjc/kubernetes-vagrant-centos-cluster/raw/master/images/grafana-animation.gif","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Grafana","attributes":{},"skip":false,"key":"3.3.2"},{"backlink":"cloud-native/cloud-native-local-quick-start.html#fig3.3.3","level":"3.3","list_caption":"Figure: Traefik dashboard","alt":"Traefik dashboard","nro":65,"url":"https://github.com/rootsongjc/kubernetes-vagrant-centos-cluster/raw/master/images/traefik-ingress.gif","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Traefik dashboard","attributes":{},"skip":false,"key":"3.3.3"},{"backlink":"cloud-native/cloud-native-local-quick-start.html#fig3.3.4","level":"3.3","list_caption":"Figure: bookinfo示例","alt":"bookinfo示例","nro":66,"url":"https://github.com/rootsongjc/kubernetes-vagrant-centos-cluster/raw/master/images/bookinfo-demo.gif","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"bookinfo示例","attributes":{},"skip":false,"key":"3.3.4"},{"backlink":"cloud-native/cloud-native-local-quick-start.html#fig3.3.5","level":"3.3","list_caption":"Figure: Kiali页面","alt":"Kiali页面","nro":67,"url":"https://github.com/rootsongjc/kubernetes-vagrant-centos-cluster/raw/master/images/kiali.gif","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kiali页面","attributes":{},"skip":false,"key":"3.3.5"},{"backlink":"cloud-native/cloud-native-local-quick-start.html#fig3.3.6","level":"3.3","list_caption":"Figure: Scope页面","alt":"Scope页面","nro":68,"url":"https://github.com/rootsongjc/kubernetes-vagrant-centos-cluster/raw/master/images/weave-scope-animation.gif","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Scope页面","attributes":{},"skip":false,"key":"3.3.6"},{"backlink":"cloud-native/setup-kubernetes-with-rancher-and-aliyun.html#fig3.4.1","level":"3.4","list_caption":"Figure: Rancher 界面","alt":"Rancher 界面","nro":69,"url":"../images/rancher-web.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Rancher 界面","attributes":{},"skip":false,"key":"3.4.1"},{"backlink":"cloud-native/setup-kubernetes-with-rancher-and-aliyun.html#fig3.4.2","level":"3.4","list_caption":"Figure: 自定义节点信息","alt":"自定义节点信息","nro":70,"url":"../images/rancher-customize-node.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"自定义节点信息","attributes":{},"skip":false,"key":"3.4.2"},{"backlink":"cloud-native/setup-kubernetes-with-rancher-and-aliyun.html#fig3.4.3","level":"3.4","list_caption":"Figure: Rancher 集群监控页面","alt":"Rancher 集群监控页面","nro":71,"url":"../images/rancher-cluster.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Rancher 集群监控页面","attributes":{},"skip":false,"key":"3.4.3"},{"backlink":"concepts/index.html#fig4.1.1","level":"4.1","list_caption":"Figure: Borg 架构","alt":"Borg 架构","nro":72,"url":"../images/borg.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Borg 架构","attributes":{},"skip":false,"key":"4.1.1"},{"backlink":"concepts/index.html#fig4.1.2","level":"4.1","list_caption":"Figure: Kubernetes 架构","alt":"Kubernetes 架构","nro":73,"url":"../images/architecture.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 架构","attributes":{},"skip":false,"key":"4.1.2"},{"backlink":"concepts/index.html#fig4.1.3","level":"4.1","list_caption":"Figure: Kuberentes 架构（图片来自于网络）","alt":"Kuberentes 架构（图片来自于网络）","nro":74,"url":"../images/kubernetes-high-level-component-archtecture.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kuberentes 架构（图片来自于网络）","attributes":{},"skip":false,"key":"4.1.3"},{"backlink":"concepts/index.html#fig4.1.4","level":"4.1","list_caption":"Figure: kubernetes 整体架构示意图","alt":"kubernetes 整体架构示意图","nro":75,"url":"../images/kubernetes-whole-arch.png","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"kubernetes 整体架构示意图","attributes":{},"skip":false,"key":"4.1.4"},{"backlink":"concepts/index.html#fig4.1.5","level":"4.1","list_caption":"Figure: Kubernetes master 架构示意图","alt":"Kubernetes master 架构示意图","nro":76,"url":"../images/kubernetes-master-arch.png","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes master 架构示意图","attributes":{},"skip":false,"key":"4.1.5"},{"backlink":"concepts/index.html#fig4.1.6","level":"4.1","list_caption":"Figure: kubernetes node 架构示意图","alt":"kubernetes node 架构示意图","nro":77,"url":"../images/kubernetes-node-arch.png","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"kubernetes node 架构示意图","attributes":{},"skip":false,"key":"4.1.6"},{"backlink":"concepts/index.html#fig4.1.7","level":"4.1","list_caption":"Figure: Kubernetes 分层架构示意图","alt":"Kubernetes 分层架构示意图","nro":78,"url":"../images/kubernetes-layers-arch.png","index":7,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 分层架构示意图","attributes":{},"skip":false,"key":"4.1.7"},{"backlink":"concepts/concepts.html#fig4.1.1.1","level":"4.1.1","list_caption":"Figure: Kubernetes 分层架构示意图","alt":"Kubernetes 分层架构示意图","nro":79,"url":"../images/006tNc79ly1fzniqvmi51j31gq0s0q5u.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 分层架构示意图","attributes":{},"skip":false,"key":"4.1.1.1"},{"backlink":"concepts/cri.html#fig4.1.3.1.1","level":"4.1.3.1","list_caption":"Figure: CRI 架构 - 图片来自 kubernetes blog","alt":"CRI 架构 - 图片来自 kubernetes blog","nro":80,"url":"../images/cri-architecture.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CRI 架构 - 图片来自 kubernetes blog","attributes":{},"skip":false,"key":"4.1.3.1.1"},{"backlink":"concepts/pod-overview.html#fig4.2.1.1","level":"4.2.1","list_caption":"Figure: pod diagram","alt":"pod diagram","nro":81,"url":"../images/pod-overview.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"pod diagram","attributes":{},"skip":false,"key":"4.2.1.1"},{"backlink":"concepts/pod.html#fig4.2.2.1","level":"4.2.2","list_caption":"Figure: Pod Cheatsheet","alt":"Pod Cheatsheet","nro":82,"url":"../images/kubernetes-pod-cheatsheet.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Pod Cheatsheet","attributes":{},"skip":false,"key":"4.2.2.1"},{"backlink":"concepts/pod.html#fig4.2.2.2","level":"4.2.2","list_caption":"Figure: Pod示意图","alt":"Pod示意图","nro":83,"url":"../images/pod-overview.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Pod示意图","attributes":{},"skip":false,"key":"4.2.2.2"},{"backlink":"concepts/pause-container.html#fig4.2.4.1","level":"4.2.4","list_caption":"Figure: Pause容器","alt":"Pause容器","nro":84,"url":"../images/pause-container.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Pause容器","attributes":{},"skip":false,"key":"4.2.4.1"},{"backlink":"concepts/pod-lifecycle.html#fig4.2.6.1","level":"4.2.6","list_caption":"Figure: Pod的生命周期示意图（图片来自网络）","alt":"Pod的生命周期示意图（图片来自网络）","nro":85,"url":"../images/kubernetes-pod-life-cycle.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Pod的生命周期示意图（图片来自网络）","attributes":{},"skip":false,"key":"4.2.6.1"},{"backlink":"concepts/label.html#fig4.3.3.1","level":"4.3.3","list_caption":"Figure: label示意图","alt":"label示意图","nro":86,"url":"../images/labels.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"label示意图","attributes":{},"skip":false,"key":"4.3.3.1"},{"backlink":"concepts/deployment.html#fig4.4.1.1","level":"4.4.1","list_caption":"Figure: kubernetes deployment cheatsheet","alt":"kubernetes deployment cheatsheet","nro":87,"url":"../images/deployment-cheatsheet.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"kubernetes deployment cheatsheet","attributes":{},"skip":false,"key":"4.4.1.1"},{"backlink":"concepts/horizontal-pod-autoscaling.html#fig4.4.7.1","level":"4.4.7","list_caption":"Figure: horizontal-pod-autoscaler","alt":"horizontal-pod-autoscaler","nro":88,"url":"../images/horizontal-pod-autoscaler.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"horizontal-pod-autoscaler","attributes":{},"skip":false,"key":"4.4.7.1"},{"backlink":"concepts/service.html#fig4.5.1.1","level":"4.5.1","list_caption":"Figure: userspace代理模式下Service概览图","alt":"userspace代理模式下Service概览图","nro":89,"url":"../images/services-userspace-overview.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"userspace代理模式下Service概览图","attributes":{},"skip":false,"key":"4.5.1.1"},{"backlink":"concepts/service.html#fig4.5.1.2","level":"4.5.1","list_caption":"Figure: iptables代理模式下Service概览图","alt":"iptables代理模式下Service概览图","nro":90,"url":"../images/services-iptables-overview.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"iptables代理模式下Service概览图","attributes":{},"skip":false,"key":"4.5.1.2"},{"backlink":"concepts/service.html#fig4.5.1.3","level":"4.5.1","list_caption":"Figure: ipvs代理模式下Service概览图","alt":"ipvs代理模式下Service概览图","nro":91,"url":"../images/service-ipvs-overview.png","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"ipvs代理模式下Service概览图","attributes":{},"skip":false,"key":"4.5.1.3"},{"backlink":"concepts/gateway.html#fig4.5.4.1","level":"4.5.4","list_caption":"Figure: Kubernetes Gateway API 简介","alt":"Kubernetes Gateway API 简介","nro":92,"url":"../images/kubernetes-gateway-api-intro.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes Gateway API 简介","attributes":{},"skip":false,"key":"4.5.4.1"},{"backlink":"concepts/gateway.html#fig4.5.4.2","level":"4.5.4","list_caption":"Figure: 路由绑定示意图","alt":"路由绑定示意图","nro":93,"url":"../images/gateway-api-route-binding.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"路由绑定示意图","attributes":{},"skip":false,"key":"4.5.4.2"},{"backlink":"concepts/gateway.html#fig4.5.4.3","level":"4.5.4","list_caption":"Figure: Gateway API 流程图","alt":"Gateway API 流程图","nro":94,"url":"../images/gateway-api-request-flow.png","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Gateway API 流程图","attributes":{},"skip":false,"key":"4.5.4.3"},{"backlink":"concepts/flannel.html#fig4.7.1.1","level":"4.7.1","list_caption":"Figure: flannel 网络架构（图片来自 openshift）","alt":"flannel 网络架构（图片来自 openshift）","nro":95,"url":"../images/flannel-networking.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"flannel 网络架构（图片来自 openshift）","attributes":{},"skip":false,"key":"4.7.1.1"},{"backlink":"concepts/calico.html#fig4.7.2.1","level":"4.7.2","list_caption":"Figure: Calico","alt":"Calico","nro":96,"url":"../images/006tNc79gy1fz65bt7ieej30c90bsgn2.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Calico","attributes":{},"skip":false,"key":"4.7.2.1"},{"backlink":"concepts/calico.html#fig4.7.2.2","level":"4.7.2","list_caption":"Figure: Calico 架构图","alt":"Calico 架构图","nro":97,"url":"../images/calico-architecture.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Calico 架构图","attributes":{},"skip":false,"key":"4.7.2.2"},{"backlink":"concepts/cilium.html#fig4.7.3.1","level":"4.7.3","list_caption":"Figure: Cilium","alt":"Cilium","nro":98,"url":"../images/006tNbRwly1fwqi98i51ij30sc0j80zn.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Cilium","attributes":{},"skip":false,"key":"4.7.3.1"},{"backlink":"concepts/cilium-concepts.html#fig4.7.3.1.1","level":"4.7.3.1","list_caption":"Figure: Cilium 组件(来自 Cilium 官网)","alt":"Cilium 组件(来自 Cilium 官网)","nro":99,"url":"../images/006tNbRwly1fwztvhg0gmj318z143tdv.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Cilium 组件(来自 Cilium 官网)","attributes":{},"skip":false,"key":"4.7.3.1.1"},{"backlink":"concepts/cilium-concepts.html#fig4.7.3.1.2","level":"4.7.3.1","list_caption":"Figure: Cilium 网络配置策略","alt":"Cilium 网络配置策略","nro":100,"url":"../images/006tNbRwly1fwzreaalj6j30dz0dy3z3.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Cilium 网络配置策略","attributes":{},"skip":false,"key":"4.7.3.1.2"},{"backlink":"concepts/service-catalog.html#fig4.9.5.1","level":"4.9.5","list_caption":"Figure: Service Catalog 架构","alt":"Service Catalog 架构","nro":101,"url":"../images/service-catalog-architecture.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Service Catalog 架构","attributes":{},"skip":false,"key":"4.9.5.1"},{"backlink":"concepts/service-catalog.html#fig4.9.5.2","level":"4.9.5","list_caption":"Figure: 列出服务","alt":"列出服务","nro":102,"url":"../images/service-catalog-list.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"列出服务","attributes":{},"skip":false,"key":"4.9.5.2"},{"backlink":"concepts/service-catalog.html#fig4.9.5.3","level":"4.9.5","list_caption":"Figure: 启用一个服务","alt":"启用一个服务","nro":103,"url":"../images/service-catalog-provision.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"启用一个服务","attributes":{},"skip":false,"key":"4.9.5.3"},{"backlink":"concepts/service-catalog.html#fig4.9.5.4","level":"4.9.5","list_caption":"Figure: Bind to a managed service","alt":"Bind to a managed service","nro":104,"url":"../images/service-catalog-bind.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Bind to a managed service","attributes":{},"skip":false,"key":"4.9.5.4"},{"backlink":"concepts/service-catalog.html#fig4.9.5.5","level":"4.9.5","list_caption":"Figure: 映射连接凭证","alt":"映射连接凭证","nro":105,"url":"../images/service-catalog-map.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"映射连接凭证","attributes":{},"skip":false,"key":"4.9.5.5"},{"backlink":"practice/federation.html#fig4.10.2.1","level":"4.10.2","list_caption":"Figure: Kubernetes 集群联邦架构图","alt":"Kubernetes 集群联邦架构图","nro":106,"url":"../images/federation-concepts.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 集群联邦架构图","attributes":{},"skip":false,"key":"4.10.2.1"},{"backlink":"practice/federation.html#fig4.10.2.2","level":"4.10.2","list_caption":"Figure: KubeFed 基础架构","alt":"KubeFed 基础架构","nro":107,"url":"../images/sync-controller.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"KubeFed 基础架构","attributes":{},"skip":false,"key":"4.10.2.2"},{"backlink":"practice/federation.html#fig4.10.2.3","level":"4.10.2","list_caption":"Figure: RSP","alt":"RSP","nro":108,"url":"../images/kubefed-rsp.png","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"RSP","attributes":{},"skip":false,"key":"4.10.2.3"},{"backlink":"practice/federation.html#fig4.10.2.4","level":"4.10.2","list_caption":"Figure: DNS","alt":"DNS","nro":109,"url":"../images/kubefed-service-dns.png","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"DNS","attributes":{},"skip":false,"key":"4.10.2.4"},{"backlink":"guide/using-kubectl.html#fig5.3.2.1","level":"5.3.2","list_caption":"Figure: kubectl cheatsheet","alt":"kubectl cheatsheet","nro":110,"url":"../images/kubernetes-kubectl-cheatsheet.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"kubectl cheatsheet","attributes":{},"skip":false,"key":"5.3.2.1"},{"backlink":"guide/using-kubectl.html#fig5.3.2.2","level":"5.3.2","list_caption":"Figure: 增加kubeclt命令的工具（图片来自网络）","alt":"增加kubeclt命令的工具（图片来自网络）","nro":111,"url":"../images/tools-to-supercharge-kubectl.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"增加kubeclt命令的工具（图片来自网络）","attributes":{},"skip":false,"key":"5.3.2.2"},{"backlink":"guide/using-kubectl.html#fig5.3.2.3","level":"5.3.2","list_caption":"Figure: 增强的kubectl命令","alt":"增强的kubectl命令","nro":112,"url":"../images/supercharged-kubectl.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"增强的kubectl命令","attributes":{},"skip":false,"key":"5.3.2.3"},{"backlink":"guide/using-kubectl.html#fig5.3.2.4","level":"5.3.2","list_caption":"Figure: kube-shell页面","alt":"kube-shell页面","nro":113,"url":"../images/kube-shell.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"kube-shell页面","attributes":{},"skip":false,"key":"5.3.2.4"},{"backlink":"guide/ip-masq-agent.html#fig5.4.5.1","level":"5.4.5","list_caption":"Figure: IP伪装代理示意图","alt":"IP伪装代理示意图","nro":114,"url":"../images/ip-masq.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"IP伪装代理示意图","attributes":{},"skip":false,"key":"5.4.5.1"},{"backlink":"guide/auth-with-kubeconfig-or-token.html#fig5.4.6.1","level":"5.4.6","list_caption":"Figure: kubeconfig文件","alt":"kubeconfig文件","nro":115,"url":"../images/brand-kubeconfig-yaml.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"kubeconfig文件","attributes":{},"skip":false,"key":"5.4.6.1"},{"backlink":"guide/authentication.html#fig5.4.7.1","level":"5.4.7","list_caption":"Figure: Kubernetes OpenID Connect Flow","alt":"Kubernetes OpenID Connect Flow","nro":116,"url":"../images/kubernetes-oidc-login.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes OpenID Connect Flow","attributes":{},"skip":false,"key":"5.4.7.1"},{"backlink":"guide/kubernetes-desktop-client.html#fig5.5.6.1","level":"5.5.6","list_caption":"Figure: Lens Kubernetes IDE 界面","alt":"Lens Kubernetes IDE 界面","nro":117,"url":"../images/lens.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Lens Kubernetes IDE 界面","attributes":{},"skip":false,"key":"5.5.6.1"},{"backlink":"guide/kubernator-kubernetes-ui.html#fig5.5.7.1","level":"5.5.7","list_caption":"Figure: Kubernator catalog 页面","alt":"Kubernator catalog 页面","nro":118,"url":"../images/kubernator-catalog.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernator catalog 页面","attributes":{},"skip":false,"key":"5.5.7.1"},{"backlink":"guide/kubernator-kubernetes-ui.html#fig5.5.7.2","level":"5.5.7","list_caption":"Figure: Kubernator rbac 页面","alt":"Kubernator rbac 页面","nro":119,"url":"../images/kubernator-rbac.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernator rbac 页面","attributes":{},"skip":false,"key":"5.5.7.2"},{"backlink":"guide/deploy-applications-in-kubernetes.html#fig5.6.1.1","level":"5.6.1","list_caption":"Figure: 流程图","alt":"流程图","nro":120,"url":"../images/how-to-use-kubernetes-with-istio.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"流程图","attributes":{},"skip":false,"key":"5.6.1.1"},{"backlink":"guide/deploy-applications-in-kubernetes.html#fig5.6.1.2","level":"5.6.1","list_caption":"Figure: API","alt":"API","nro":121,"url":"../images/k8s-app-monitor-test-api-doc.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"API","attributes":{},"skip":false,"key":"5.6.1.2"},{"backlink":"guide/deploy-applications-in-kubernetes.html#fig5.6.1.3","level":"5.6.1","list_caption":"Figure: wercker构建页面","alt":"wercker构建页面","nro":122,"url":"../images/k8s-app-monitor-agent-wercker.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"wercker构建页面","attributes":{},"skip":false,"key":"5.6.1.3"},{"backlink":"guide/deploy-applications-in-kubernetes.html#fig5.6.1.4","level":"5.6.1","list_caption":"Figure: 图表","alt":"图表","nro":123,"url":"../images/k8s-app-monitor-agent.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"图表","attributes":{},"skip":false,"key":"5.6.1.4"},{"backlink":"guide/deploy-applications-in-kubernetes.html#fig5.6.1.5","level":"5.6.1","list_caption":"Figure: Grafana页面","alt":"Grafana页面","nro":124,"url":"../images/k8s-app-monitor-istio-grafana.png","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Grafana页面","attributes":{},"skip":false,"key":"5.6.1.5"},{"backlink":"guide/deploy-applications-in-kubernetes.html#fig5.6.1.6","level":"5.6.1","list_caption":"Figure: servicegraph 页面","alt":"servicegraph 页面","nro":125,"url":"../images/k8s-app-monitor-istio-servicegraph-dotviz.png","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"servicegraph 页面","attributes":{},"skip":false,"key":"5.6.1.6"},{"backlink":"guide/deploy-applications-in-kubernetes.html#fig5.6.1.7","level":"5.6.1","list_caption":"Figure: Zipkin页面","alt":"Zipkin页面","nro":126,"url":"../images/k8s-app-monitor-istio-zipkin.png","index":7,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Zipkin页面","attributes":{},"skip":false,"key":"5.6.1.7"},{"backlink":"guide/migrating-hadoop-yarn-to-kubernetes.html#fig5.6.2.1","level":"5.6.2","list_caption":"Figure: 将单体应用迁移到云原生(图片来自DevOpsDay Toronto)","alt":"将单体应用迁移到云原生(图片来自DevOpsDay Toronto)","nro":127,"url":"../images/migrating-monolith-to-kubernetes.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"将单体应用迁移到云原生(图片来自DevOpsDay Toronto)","attributes":{},"skip":false,"key":"5.6.2.1"},{"backlink":"guide/migrating-hadoop-yarn-to-kubernetes.html#fig5.6.2.2","level":"5.6.2","list_caption":"Figure: spark on yarn with kubernetes","alt":"spark on yarn with kubernetes","nro":128,"url":"../images/spark-on-yarn-with-kubernetes.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"spark on yarn with kubernetes","attributes":{},"skip":false,"key":"5.6.2.2"},{"backlink":"guide/migrating-hadoop-yarn-to-kubernetes.html#fig5.6.2.3","level":"5.6.2","list_caption":"Figure: Terms","alt":"Terms","nro":129,"url":"../images/terms-in-kubernetes-app-deployment.png","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Terms","attributes":{},"skip":false,"key":"5.6.2.3"},{"backlink":"guide/migrating-hadoop-yarn-to-kubernetes.html#fig5.6.2.4","level":"5.6.2","list_caption":"Figure: 分解步骤解析","alt":"分解步骤解析","nro":130,"url":"../images/migrating-hadoop-yarn-to-kubernetes.png","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"分解步骤解析","attributes":{},"skip":false,"key":"5.6.2.4"},{"backlink":"practice/node-installation.html#fig6.2.7.1","level":"6.2.7","list_caption":"Figure: nginx欢迎页面","alt":"nginx欢迎页面","nro":131,"url":"../images/kubernetes-installation-test-nginx.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"nginx欢迎页面","attributes":{},"skip":false,"key":"6.2.7.1"},{"backlink":"practice/dashboard-addon-installation.html#fig6.2.9.1","level":"6.2.9","list_caption":"Figure: kubernetes dashboard","alt":"kubernetes dashboard","nro":132,"url":"../images/kubernetes-dashboard-raw.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"kubernetes dashboard","attributes":{},"skip":false,"key":"6.2.9.1"},{"backlink":"practice/dashboard-addon-installation.html#fig6.2.9.2","level":"6.2.9","list_caption":"Figure: V1.6.3版本的dashboard界面","alt":"V1.6.3版本的dashboard界面","nro":133,"url":"../images/dashboard-v163.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"V1.6.3版本的dashboard界面","attributes":{},"skip":false,"key":"6.2.9.2"},{"backlink":"practice/dashboard-addon-installation.html#fig6.2.9.3","level":"6.2.9","list_caption":"Figure: pod无法正常启动","alt":"pod无法正常启动","nro":134,"url":"../images/dashboard-addon-installation001.png","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"pod无法正常启动","attributes":{},"skip":false,"key":"6.2.9.3"},{"backlink":"practice/heapster-addon-installation.html#fig6.2.10.1","level":"6.2.10","list_caption":"Figure: dashboard-heapster","alt":"dashboard-heapster","nro":135,"url":"../images/kubernetes-dashboard-with-heapster.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"dashboard-heapster","attributes":{},"skip":false,"key":"6.2.10.1"},{"backlink":"practice/heapster-addon-installation.html#fig6.2.10.2","level":"6.2.10","list_caption":"Figure: grafana","alt":"grafana","nro":136,"url":"../images/kubernetes-heapster-grafana.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"grafana","attributes":{},"skip":false,"key":"6.2.10.2"},{"backlink":"practice/heapster-addon-installation.html#fig6.2.10.3","level":"6.2.10","list_caption":"Figure: Influxdb 页面","alt":"Influxdb 页面","nro":137,"url":"../images/kubernetes-influxdb-heapster.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Influxdb 页面","attributes":{},"skip":false,"key":"6.2.10.3"},{"backlink":"practice/heapster-addon-installation.html#fig6.2.10.4","level":"6.2.10","list_caption":"Figure: 修改grafana模板","alt":"修改grafana模板","nro":138,"url":"../images/grafana-dashboard-setting.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"修改grafana模板","attributes":{},"skip":false,"key":"6.2.10.4"},{"backlink":"practice/efk-addon-installation.html#fig6.2.11.1","level":"6.2.11","list_caption":"Figure: es-setting","alt":"es-setting","nro":139,"url":"../images/es-setting.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"es-setting","attributes":{},"skip":false,"key":"6.2.11.1"},{"backlink":"practice/efk-addon-installation.html#fig6.2.11.2","level":"6.2.11","list_caption":"Figure: es-home","alt":"es-home","nro":140,"url":"../images/kubernetes-efk-kibana.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"es-home","attributes":{},"skip":false,"key":"6.2.11.2"},{"backlink":"practice/traefik-ingress-installation.html#fig6.4.1.1","level":"6.4.1","list_caption":"Figure: Terafik dashboard","alt":"Terafik dashboard","nro":141,"url":"../images/traefik-dashboard.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Terafik dashboard","attributes":{},"skip":false,"key":"6.4.1.1"},{"backlink":"practice/traefik-ingress-installation.html#fig6.4.1.2","level":"6.4.1","list_caption":"Figure: Nginx 页面","alt":"Nginx 页面","nro":142,"url":"../images/traefik-nginx.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Nginx 页面","attributes":{},"skip":false,"key":"6.4.1.2"},{"backlink":"practice/traefik-ingress-installation.html#fig6.4.1.3","level":"6.4.1","list_caption":"Figure: Guestbook 页面","alt":"Guestbook 页面","nro":143,"url":"../images/traefik-guestbook.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Guestbook 页面","attributes":{},"skip":false,"key":"6.4.1.3"},{"backlink":"practice/distributed-load-test.html#fig6.4.2.1","level":"6.4.2","list_caption":"Figure: 使用 dashboard 来扩容","alt":"使用 dashboard 来扩容","nro":144,"url":"../images/dashbaord-scale.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"使用 dashboard 来扩容","attributes":{},"skip":false,"key":"6.4.2.1"},{"backlink":"practice/distributed-load-test.html#fig6.4.2.2","level":"6.4.2","list_caption":"Figure: Traefik的UI","alt":"Traefik的UI","nro":145,"url":"../images/traefik-dashboard-locust.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Traefik的UI","attributes":{},"skip":false,"key":"6.4.2.2"},{"backlink":"practice/distributed-load-test.html#fig6.4.2.3","level":"6.4.2","list_caption":"Figure: Locust启动界面","alt":"Locust启动界面","nro":146,"url":"../images/locust-start-swarming.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Locust启动界面","attributes":{},"skip":false,"key":"6.4.2.3"},{"backlink":"practice/distributed-load-test.html#fig6.4.2.4","level":"6.4.2","list_caption":"Figure: Dashboard查看页面","alt":"Dashboard查看页面","nro":147,"url":"../images/sample-webapp-rc.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Dashboard查看页面","attributes":{},"skip":false,"key":"6.4.2.4"},{"backlink":"practice/distributed-load-test.html#fig6.4.2.5","level":"6.4.2","list_caption":"Figure: Locust测试结果页面","alt":"Locust测试结果页面","nro":148,"url":"../images/locust-dashboard.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Locust测试结果页面","attributes":{},"skip":false,"key":"6.4.2.5"},{"backlink":"practice/network-and-cluster-perfermance-test.html#fig6.4.3.1","level":"6.4.3","list_caption":"Figure: Kubernetes dashboard","alt":"Kubernetes dashboard","nro":149,"url":"../images/kubenetes-e2e-test.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes dashboard","attributes":{},"skip":false,"key":"6.4.3.1"},{"backlink":"practice/network-and-cluster-perfermance-test.html#fig6.4.3.2","level":"6.4.3","list_caption":"Figure: locust测试页面","alt":"locust测试页面","nro":150,"url":"../images/kubernetes-locust-test.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"locust测试页面","attributes":{},"skip":false,"key":"6.4.3.2"},{"backlink":"practice/edge-node-configuration.html#fig6.4.4.1","level":"6.4.4","list_caption":"Figure: 边缘节点架构","alt":"边缘节点架构","nro":151,"url":"../images/kubernetes-edge-node-architecture.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"边缘节点架构","attributes":{},"skip":false,"key":"6.4.4.1"},{"backlink":"practice/edge-node-configuration.html#fig6.4.4.2","level":"6.4.4","list_caption":"Figure: 使用域名来访问Kubernetes中的服务","alt":"使用域名来访问Kubernetes中的服务","nro":152,"url":"../images/accessing-kubernetes-services-with-dns-name.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"使用域名来访问Kubernetes中的服务","attributes":{},"skip":false,"key":"6.4.4.2"},{"backlink":"practice/configuring-dns.html#fig6.4.6.1.1","level":"6.4.6.1","list_caption":"Figure: DNS lookup flow","alt":"DNS lookup flow","nro":153,"url":"https://d33wubrfki0l68.cloudfront.net/340889cb80e81dcd19a16bc34697a7907e2b229a/24ad0/docs/tasks/administer-cluster/dns-custom-nameservers/dns.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"DNS lookup flow","attributes":{},"skip":false,"key":"6.4.6.1.1"},{"backlink":"practice/master-ha.html#fig6.5.1.1","level":"6.5.1","list_caption":"Figure: Master HA架构图","alt":"Master HA架构图","nro":154,"url":"../images/master-ha.JPG","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Master HA架构图","attributes":{},"skip":false,"key":"6.5.1.1"},{"backlink":"practice/app-log-collection.html#fig6.5.3.1","level":"6.5.3","list_caption":"Figure: filebeat日志收集架构图","alt":"filebeat日志收集架构图","nro":155,"url":"../images/filebeat-log-collector.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"filebeat日志收集架构图","attributes":{},"skip":false,"key":"6.5.3.1"},{"backlink":"practice/app-log-collection.html#fig6.5.3.2","level":"6.5.3","list_caption":"Figure: Kibana页面","alt":"Kibana页面","nro":156,"url":"../images/filebeat-docker-test.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kibana页面","attributes":{},"skip":false,"key":"6.5.3.2"},{"backlink":"practice/app-log-collection.html#fig6.5.3.3","level":"6.5.3","list_caption":"Figure: filebeat收集的日志详细信息","alt":"filebeat收集的日志详细信息","nro":157,"url":"../images/kubernetes-filebeat-detail.png","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"filebeat收集的日志详细信息","attributes":{},"skip":false,"key":"6.5.3.3"},{"backlink":"practice/monitor.html#fig6.5.5.1","level":"6.5.5","list_caption":"Figure: Kubernetes集群中的监控","alt":"Kubernetes集群中的监控","nro":158,"url":"../images/monitoring-in-kubernetes.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes集群中的监控","attributes":{},"skip":false,"key":"6.5.5.1"},{"backlink":"practice/monitor.html#fig6.5.5.2","level":"6.5.5","list_caption":"Figure: kubernetes的容器命名规则示意图","alt":"kubernetes的容器命名规则示意图","nro":159,"url":"../images/kubernetes-container-naming-rule.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"kubernetes的容器命名规则示意图","attributes":{},"skip":false,"key":"6.5.5.2"},{"backlink":"practice/monitor.html#fig6.5.5.3","level":"6.5.5","list_caption":"Figure: Heapster架构图（改进版）","alt":"Heapster架构图（改进版）","nro":160,"url":"../images/kubernetes-heapster-monitoring.png","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Heapster架构图（改进版）","attributes":{},"skip":false,"key":"6.5.5.3"},{"backlink":"practice/monitor.html#fig6.5.5.4","level":"6.5.5","list_caption":"Figure: 应用监控架构图","alt":"应用监控架构图","nro":161,"url":"../images/kubernetes-app-monitoring.png","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"应用监控架构图","attributes":{},"skip":false,"key":"6.5.5.4"},{"backlink":"practice/monitor.html#fig6.5.5.5","level":"6.5.5","list_caption":"Figure: 应用拓扑图","alt":"应用拓扑图","nro":162,"url":"../images/weave-scope-service-topology.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"应用拓扑图","attributes":{},"skip":false,"key":"6.5.5.5"},{"backlink":"practice/data-persistence-problem.html#fig6.5.6.1","level":"6.5.6","list_caption":"Figure: 日志持久化收集解决方案示意图","alt":"日志持久化收集解决方案示意图","nro":163,"url":"../images/log-persistence-logstash.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"日志持久化收集解决方案示意图","attributes":{},"skip":false,"key":"6.5.6.1"},{"backlink":"practice/storage-for-containers-using-glusterfs-with-openshift.html#fig6.6.1.3.1","level":"6.6.1.3","list_caption":"Figure: 创建存储","alt":"创建存储","nro":164,"url":"../images/create-gluster-storage.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"创建存储","attributes":{},"skip":false,"key":"6.6.1.3.1"},{"backlink":"practice/storage-for-containers-using-glusterfs-with-openshift.html#fig6.6.1.3.2","level":"6.6.1.3","list_caption":"Figure: 容器存储","alt":"容器存储","nro":165,"url":"../images/container-storage.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"容器存储","attributes":{},"skip":false,"key":"6.6.1.3.2"},{"backlink":"practice/openebs.html#fig6.6.4.1","level":"6.6.4","list_caption":"Figure: OpenEBS 集群数据平面（图片来自 https://github.com/openebs/openebs/blob/master/contribute/design/README.md）","alt":"OpenEBS 集群数据平面（图片来自 https://github.com/openebs/openebs/blob/master/contribute/design/README.md）","nro":166,"url":"../images/OpenEBS-Data-Plane.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OpenEBS 集群数据平面（图片来自 https://github.com/openebs/openebs/blob/master/contribute/design/README.md）","attributes":{},"skip":false,"key":"6.6.4.1"},{"backlink":"practice/openebs.html#fig6.6.4.2","level":"6.6.4","list_caption":"Figure: OpenEBS 集群的控制平面 (图片来自 https://github.com/openebs/openebs/blob/master/contribute/design/README.md）","alt":"OpenEBS 集群的控制平面 (图片来自 https://github.com/openebs/openebs/blob/master/contribute/design/README.md）","nro":167,"url":"../images/OpenEBS-Control-Plane.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OpenEBS 集群的控制平面 (图片来自 https://github.com/openebs/openebs/blob/master/contribute/design/README.md）","attributes":{},"skip":false,"key":"6.6.4.2"},{"backlink":"practice/using-openebs-for-persistent-storage.html#fig6.6.4.1.1","level":"6.6.4.1","list_caption":"Figure: Kubernetes iSCSI架构","alt":"Kubernetes iSCSI架构","nro":168,"url":"../images/iscsi-on-kubernetes.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes iSCSI架构","attributes":{},"skip":false,"key":"6.6.4.1.1"},{"backlink":"practice/using-heapster-to-get-object-metrics.html#fig6.7.1.1.1","level":"6.7.1.1","list_caption":"Figure: Heapster架构图","alt":"Heapster架构图","nro":169,"url":"../images/heapster-architecture.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Heapster架构图","attributes":{},"skip":false,"key":"6.7.1.1.1"},{"backlink":"practice/prometheus.html#fig6.7.2.1","level":"6.7.2","list_caption":"Figure: Prometheus 架构图","alt":"Prometheus 架构图","nro":170,"url":"../images/006tNbRwly1fwcgsn11fej311j0mjadw.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Prometheus 架构图","attributes":{},"skip":false,"key":"6.7.2.1"},{"backlink":"practice/using-prometheus-to-monitor-kuberentes-cluster.html#fig6.7.2.1.1","level":"6.7.2.1","list_caption":"Figure: Grafana页面","alt":"Grafana页面","nro":171,"url":"../images/kubernetes-prometheus-monitoring.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Grafana页面","attributes":{},"skip":false,"key":"6.7.2.1.1"},{"backlink":"practice/promql.html#fig6.7.2.2.1","level":"6.7.2.2","list_caption":"Figure: Prometheus 的查询页面","alt":"Prometheus 的查询页面","nro":172,"url":"../images/006tNbRwly1fwcl7v28rhj30xl0onadv.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Prometheus 的查询页面","attributes":{},"skip":false,"key":"6.7.2.2.1"},{"backlink":"practice/opentracing.html#fig6.8.1.1","level":"6.8.1","list_caption":"Figure: Jaeger UI","alt":"Jaeger UI","nro":173,"url":"../images/006tNbRwly1fwjg48fh7xj31kw0wedrg.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Jaeger UI","attributes":{},"skip":false,"key":"6.8.1.1"},{"backlink":"practice/opentracing.html#fig6.8.1.2","level":"6.8.1","list_caption":"Figure: Chrome Inspector","alt":"Chrome Inspector","nro":174,"url":"../images/006tNbRwly1fwjkfbvfluj30y70hf0y9.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Chrome Inspector","attributes":{},"skip":false,"key":"6.8.1.2"},{"backlink":"practice/helm.html#fig6.9.1.1","level":"6.9.1","list_caption":"Figure: Helm 架构图（来自 IBM Developer Blog）","alt":"Helm 架构图（来自 IBM Developer Blog）","nro":175,"url":"../images/helm-chart.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Helm 架构图（来自 IBM Developer Blog）","attributes":{},"skip":false,"key":"6.9.1.1"},{"backlink":"practice/create-private-charts-repo.html#fig6.9.2.1","level":"6.9.2","list_caption":"Figure: Helm monocular界面","alt":"Helm monocular界面","nro":176,"url":"../images/helm-monocular-jimmysong.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Helm monocular界面","attributes":{},"skip":false,"key":"6.9.2.1"},{"backlink":"practice/ci-cd.html#fig6.10.1","level":"6.10","list_caption":"Figure: Kubernetes 改变了应用的基础架构","alt":"Kubernetes 改变了应用的基础架构","nro":177,"url":"../images/00704eQkgy1fsayashxz3j31c00w6aed.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 改变了应用的基础架构","attributes":{},"skip":false,"key":"6.10.1"},{"backlink":"practice/ci-cd.html#fig6.10.2","level":"6.10","list_caption":"Figure: Kubernetes 中的 CI/CD","alt":"Kubernetes 中的 CI/CD","nro":178,"url":"../images/00704eQkgy1fsayfzk3ezj31bu0tkdky.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 中的 CI/CD","attributes":{},"skip":false,"key":"6.10.2"},{"backlink":"practice/ci-cd.html#fig6.10.3","level":"6.10","list_caption":"Figure: Kubernetes 中的 GitOps 流程示意图","alt":"Kubernetes 中的 GitOps 流程示意图","nro":179,"url":"../images/gitops.png","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 中的 GitOps 流程示意图","attributes":{},"skip":false,"key":"6.10.3"},{"backlink":"practice/ci-cd.html#fig6.10.4","level":"6.10","list_caption":"Figure: 云原生工作负载","alt":"云原生工作负载","nro":180,"url":"../images/00704eQkgy1fsayrk6vppj31bu0w0gsd.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生工作负载","attributes":{},"skip":false,"key":"6.10.4"},{"backlink":"practice/ci-cd.html#fig6.10.5","level":"6.10","list_caption":"Figure: 云原生工作负载映射到 Kuberentes 原语","alt":"云原生工作负载映射到 Kuberentes 原语","nro":181,"url":"../images/00704eQkgy1fsaytbabxgj31c00w2n4r.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生工作负载映射到 Kuberentes 原语","attributes":{},"skip":false,"key":"6.10.5"},{"backlink":"practice/jenkins-ci-cd.html#fig6.10.1.1","level":"6.10.1","list_caption":"Figure: 基于 Jenkins 的持续集成与发布","alt":"基于 Jenkins 的持续集成与发布","nro":182,"url":"../images/kubernetes-jenkins-ci-cd.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"基于 Jenkins 的持续集成与发布","attributes":{},"skip":false,"key":"6.10.1.1"},{"backlink":"practice/drone-ci-cd.html#fig6.10.2.1","level":"6.10.2","list_caption":"Figure: OAuth 注册","alt":"OAuth 注册","nro":183,"url":"../images/github-oauth-register.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OAuth 注册","attributes":{},"skip":false,"key":"6.10.2.1"},{"backlink":"practice/drone-ci-cd.html#fig6.10.2.2","level":"6.10.2","list_caption":"Figure: OAuth key","alt":"OAuth key","nro":184,"url":"../images/github-oauth-drone-key.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OAuth key","attributes":{},"skip":false,"key":"6.10.2.2"},{"backlink":"practice/drone-ci-cd.html#fig6.10.2.3","level":"6.10.2","list_caption":"Figure: Drone 登陆界面","alt":"Drone 登陆界面","nro":185,"url":"../images/drone-login-github.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Drone 登陆界面","attributes":{},"skip":false,"key":"6.10.2.3"},{"backlink":"practice/drone-ci-cd.html#fig6.10.2.4","level":"6.10.2","list_caption":"Figure: Github 启用 repo 设置","alt":"Github 启用 repo 设置","nro":186,"url":"../images/drone-github-active.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Github 启用 repo 设置","attributes":{},"skip":false,"key":"6.10.2.4"},{"backlink":"practice/drone-ci-cd.html#fig6.10.2.5","level":"6.10.2","list_caption":"Figure: Github 单个 repo 设置","alt":"Github 单个 repo 设置","nro":187,"url":"../images/drone-github-repo-setting.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Github 单个 repo 设置","attributes":{},"skip":false,"key":"6.10.2.5"},{"backlink":"practice/manually-upgrade.html#fig6.11.1.1","level":"6.11.1","list_caption":"Figure: Kubernetes零宕机时间升级建议","alt":"Kubernetes零宕机时间升级建议","nro":188,"url":"../images/zero-downtime-kubernetes-upgrade-tips.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes零宕机时间升级建议","attributes":{},"skip":false,"key":"6.11.1.1"},{"backlink":"practice/manually-upgrade.html#fig6.11.1.2","level":"6.11.1","list_caption":"Figure: Kuberentes API对象的版本演进","alt":"Kuberentes API对象的版本演进","nro":189,"url":"../images/kubernetes-apversions-changes.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kuberentes API对象的版本演进","attributes":{},"skip":false,"key":"6.11.1.2"},{"backlink":"practice/dashboard-upgrade.html#fig6.11.2.1","level":"6.11.2","list_caption":"Figure: 登陆界面","alt":"登陆界面","nro":190,"url":"../images/kubernetes-dashboard-1.7.1-login.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"登陆界面","attributes":{},"skip":false,"key":"6.11.2.1"},{"backlink":"practice/dashboard-upgrade.html#fig6.11.2.2","level":"6.11.2","list_caption":"Figure: Dashboard首页","alt":"Dashboard首页","nro":191,"url":"../images/kubernetes-dashboard-1.7.1-default-page.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Dashboard首页","attributes":{},"skip":false,"key":"6.11.2.2"},{"backlink":"practice/dashboard-upgrade.html#fig6.11.2.3","level":"6.11.2","list_caption":"Figure: Dashboard用户空间页面","alt":"Dashboard用户空间页面","nro":192,"url":"../images/kubernetes-dashboard-1.7.1-brand.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Dashboard用户空间页面","attributes":{},"skip":false,"key":"6.11.2.3"},{"backlink":"practice/dashboard-upgrade.html#fig6.11.2.4","level":"6.11.2","list_caption":"Figure: kubeconfig文件","alt":"kubeconfig文件","nro":193,"url":"../images/brand-kubeconfig-yaml.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"kubeconfig文件","attributes":{},"skip":false,"key":"6.11.2.4"},{"backlink":"practice/open-policy-agent.html#fig6.13.1.1","level":"6.13.1","list_caption":"Figure: OPA 原理图","alt":"OPA 原理图","nro":194,"url":"../images/opa-arch.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OPA 原理图","attributes":{},"skip":false,"key":"6.13.1.1"},{"backlink":"usecases/service-mesh.html#fig7.1.1","level":"7.1","list_caption":"Figure: 下一代异构微服务架构","alt":"下一代异构微服务架构","nro":195,"url":"../images/polyglot-microservices-serivce-mesh.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"下一代异构微服务架构","attributes":{},"skip":false,"key":"7.1.1"},{"backlink":"usecases/service-mesh.html#fig7.1.2","level":"7.1","list_caption":"Figure: Service Mesh 架构图","alt":"Service Mesh 架构图","nro":196,"url":"../images/serivce-mesh-control-plane.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Service Mesh 架构图","attributes":{},"skip":false,"key":"7.1.2"},{"backlink":"usecases/service-mesh-fundamental.html#fig7.2.1.1","level":"7.2.1","list_caption":"Figure: 服务网格模型对比","alt":"服务网格模型对比","nro":197,"url":"../images/0069RVTdly1fuafvbnuc7j310a0oqdm9.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"服务网格模型对比","attributes":{},"skip":false,"key":"7.2.1.1"},{"backlink":"usecases/service-mesh-fundamental.html#fig7.2.1.2","level":"7.2.1","list_caption":"Figure: 网状网络拓扑","alt":"网状网络拓扑","nro":198,"url":"../images/0069RVTdly1fuaie8jan8j310a0kitem.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"网状网络拓扑","attributes":{},"skip":false,"key":"7.2.1.2"},{"backlink":"usecases/service-mesh-fundamental.html#fig7.2.1.3","level":"7.2.1","list_caption":"Figure: 服务网格架构图","alt":"服务网格架构图","nro":199,"url":"../images/0069RVTdly1fuail4d24jj31080rkgr7.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"服务网格架构图","attributes":{},"skip":false,"key":"7.2.1.3"},{"backlink":"usecases/service-mesh-fundamental.html#fig7.2.1.4","level":"7.2.1","list_caption":"Figure: Istio Mixer","alt":"Istio Mixer","nro":200,"url":"../images/0069RVTdly1fuam4ln45jj30yu0o6wkc.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Istio Mixer","attributes":{},"skip":false,"key":"7.2.1.4"},{"backlink":"usecases/service-mesh-fundamental.html#fig7.2.1.5","level":"7.2.1","list_caption":"Figure: Istio架构图","alt":"Istio架构图","nro":201,"url":"../images/0069RVTdly1fuamvq97cuj30yu0wg7cr.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Istio架构图","attributes":{},"skip":false,"key":"7.2.1.5"},{"backlink":"usecases/service-mesh-fundamental.html#fig7.2.1.6","level":"7.2.1","list_caption":"Figure: OSI模型","alt":"OSI模型","nro":202,"url":"../images/0069RVTdly1fuanez4qbtj30v4183n7p.jpg","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OSI模型","attributes":{},"skip":false,"key":"7.2.1.6"},{"backlink":"usecases/service-mesh-fundamental.html#fig7.2.1.7","level":"7.2.1","list_caption":"Figure: 在L5解耦","alt":"在L5解耦","nro":203,"url":"../images/006tNbRwly1fubfiiryirj30w20ayjui.jpg","index":7,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"在L5解耦","attributes":{},"skip":false,"key":"7.2.1.7"},{"backlink":"usecases/comparing-service-mesh-technologies.html#fig7.2.2.1","level":"7.2.2","list_caption":"Figure: 客户端库","alt":"客户端库","nro":204,"url":"../images/006tNbRwly1fubnx0q9bpj30vq0pq465.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"客户端库","attributes":{},"skip":false,"key":"7.2.2.1"},{"backlink":"usecases/service-mesh-adoption-and-evolution.html#fig7.2.4.1","level":"7.2.4","list_caption":"Figure: Service Mesh架构图","alt":"Service Mesh架构图","nro":205,"url":"../images/006tNbRwly1fubs6ts3sgj30vo0osdnj.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Service Mesh架构图","attributes":{},"skip":false,"key":"7.2.4.1"},{"backlink":"usecases/service-mesh-adoption-and-evolution.html#fig7.2.4.2","level":"7.2.4","list_caption":"Figure: Ingress或边缘代理架构图","alt":"Ingress或边缘代理架构图","nro":206,"url":"../images/006tNbRwly1fubsk4v16hj30vo0bq75z.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Ingress或边缘代理架构图","attributes":{},"skip":false,"key":"7.2.4.2"},{"backlink":"usecases/service-mesh-adoption-and-evolution.html#fig7.2.4.3","level":"7.2.4","list_caption":"Figure: 路由器网格架构图","alt":"路由器网格架构图","nro":207,"url":"../images/006tNbRwly1fubsxrph3dj30vq0duq53.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"路由器网格架构图","attributes":{},"skip":false,"key":"7.2.4.3"},{"backlink":"usecases/service-mesh-adoption-and-evolution.html#fig7.2.4.4","level":"7.2.4","list_caption":"Figure: Proxy per Node架构图","alt":"Proxy per Node架构图","nro":208,"url":"../images/006tNbRwly1fubt5a97h7j30vq0bcq5p.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Proxy per Node架构图","attributes":{},"skip":false,"key":"7.2.4.4"},{"backlink":"usecases/service-mesh-adoption-and-evolution.html#fig7.2.4.5","level":"7.2.4","list_caption":"Figure: Sidecar代理/Fabric模型架构图","alt":"Sidecar代理/Fabric模型架构图","nro":209,"url":"../images/006tNbRwly1fubvi0dnhlj30vo0ekwhx.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Sidecar代理/Fabric模型架构图","attributes":{},"skip":false,"key":"7.2.4.5"},{"backlink":"usecases/service-mesh-adoption-and-evolution.html#fig7.2.4.6","level":"7.2.4","list_caption":"Figure: Sidecar代理/控制平面架构图","alt":"Sidecar代理/控制平面架构图","nro":210,"url":"../images/006tNbRwly1fubvr83wvgj30vq0mmdip.jpg","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Sidecar代理/控制平面架构图","attributes":{},"skip":false,"key":"7.2.4.6"},{"backlink":"usecases/service-mesh-customization-and-integration.html#fig7.2.5.1","level":"7.2.5","list_caption":"Figure: nginMesh架构图","alt":"nginMesh架构图","nro":211,"url":"../images/006tNbRwly1fucp8yralaj30vu0sijx8.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"nginMesh架构图","attributes":{},"skip":false,"key":"7.2.5.1"},{"backlink":"usecases/service-mesh-customization-and-integration.html#fig7.2.5.2","level":"7.2.5","list_caption":"Figure: SOFAMesh","alt":"SOFAMesh","nro":212,"url":"../images/mosn-with-service-mesh.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"SOFAMesh","attributes":{},"skip":false,"key":"7.2.5.2"},{"backlink":"usecases/istio.html#fig7.3.1","level":"7.3","list_caption":"Figure: Istio的mindmap","alt":"Istio的mindmap","nro":213,"url":"../images/istio-mindmap.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Istio的mindmap","attributes":{},"skip":false,"key":"7.3.1"},{"backlink":"usecases/istio.html#fig7.3.2","level":"7.3","list_caption":"Figure: Istio架构图","alt":"Istio架构图","nro":214,"url":"../images/istio-mesh-arch.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Istio架构图","attributes":{},"skip":false,"key":"7.3.2"},{"backlink":"usecases/understand-sidecar-injection-and-traffic-hijack-in-istio-service-mesh.html#fig7.3.4.1","level":"7.3.4","list_caption":"Figure: Sidecar 模式示意图","alt":"Sidecar 模式示意图","nro":215,"url":"../images/sidecar-pattern.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Sidecar 模式示意图","attributes":{},"skip":false,"key":"7.3.4.1"},{"backlink":"usecases/understand-sidecar-injection-and-traffic-hijack-in-istio-service-mesh.html#fig7.3.4.2","level":"7.3.4","list_caption":"Figure: Sidecar 流量劫持示意图","alt":"Sidecar 流量劫持示意图","nro":216,"url":"../images/envoy-sidecar-traffic-interception-jimmysong-blog.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Sidecar 流量劫持示意图","attributes":{},"skip":false,"key":"7.3.4.2"},{"backlink":"usecases/understand-sidecar-injection-and-traffic-hijack-in-istio-service-mesh.html#fig7.3.4.3","level":"7.3.4","list_caption":"Figure: iptables 调用链","alt":"iptables 调用链","nro":217,"url":"../images/iptables.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"iptables 调用链","attributes":{},"skip":false,"key":"7.3.4.3"},{"backlink":"usecases/understand-sidecar-injection-and-traffic-hijack-in-istio-service-mesh.html#fig7.3.4.4","level":"7.3.4","list_caption":"Figure: hook-connect 原理示意图","alt":"hook-connect 原理示意图","nro":218,"url":"../images/hook-connect.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"hook-connect 原理示意图","attributes":{},"skip":false,"key":"7.3.4.4"},{"backlink":"usecases/how-to-integrate-istio-with-vm.html#fig7.3.5.1","level":"7.3.5","list_caption":"Figure: Istio 中的服务注册发现模型","alt":"Istio 中的服务注册发现模型","nro":219,"url":"https://tva1.sinaimg.cn/large/0081Kckwly1gktf3b63j0j30p30ehwf5.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Istio 中的服务注册发现模型","attributes":{},"skip":false,"key":"7.3.5.1"},{"backlink":"usecases/how-to-integrate-istio-with-vm.html#fig7.3.5.2","level":"7.3.5","list_caption":"Figure: Bookinfo 示例中的流量示意图","alt":"Bookinfo 示例中的流量示意图","nro":220,"url":"../images/istio-bookinfo-vm-traffic.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Bookinfo 示例中的流量示意图","attributes":{},"skip":false,"key":"7.3.5.2"},{"backlink":"usecases/istio-vm-support.html#fig7.3.6.1","level":"7.3.6","list_caption":"Figure: 云原生应用的三个阶段","alt":"云原生应用的三个阶段","nro":221,"url":"../images/0081Kckwly1gm0d6t775lj31s80k8go8.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生应用的三个阶段","attributes":{},"skip":false,"key":"7.3.6.1"},{"backlink":"usecases/istio-vm-support.html#fig7.3.6.2","level":"7.3.6","list_caption":"Figure: 图一：从集成虚拟机到在 mesh 中访问虚拟机中服务的详细流程","alt":"图一：从集成虚拟机到在 mesh 中访问虚拟机中服务的详细流程","nro":222,"url":"../images/0081Kckwly1gm0d6rogojj30u00yhdil.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"图一：从集成虚拟机到在 mesh 中访问虚拟机中服务的详细流程","attributes":{},"skip":false,"key":"7.3.6.2"},{"backlink":"usecases/istio-vm-support.html#fig7.3.6.3","level":"7.3.6","list_caption":"Figure: 图二：通过配置虚拟机本地 /etc/hosts 访问 mesh 内服务的流程","alt":"图二：通过配置虚拟机本地 /etc/hosts 访问 mesh 内服务的流程","nro":223,"url":"../images/0081Kckwly1gm0d6qx2o0j30sq0v440v.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"图二：通过配置虚拟机本地 /etc/hosts 访问 mesh 内服务的流程","attributes":{},"skip":false,"key":"7.3.6.3"},{"backlink":"usecases/istio-vm-support.html#fig7.3.6.4","level":"7.3.6","list_caption":"Figure: 图三：引入了智能 DNS 代理后虚拟机访问 mesh 内服务的流程","alt":"图三：引入了智能 DNS 代理后虚拟机访问 mesh 内服务的流程","nro":224,"url":"../images/0081Kckwly1gm0d6sgfpxj30oi0rsjt5.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"图三：引入了智能 DNS 代理后虚拟机访问 mesh 内服务的流程","attributes":{},"skip":false,"key":"7.3.6.4"},{"backlink":"usecases/envoy.html#fig7.4.1","level":"7.4","list_caption":"Figure: 负载均衡器的特性以及拓扑类型","alt":"负载均衡器的特性以及拓扑类型","nro":225,"url":"../images/load-balancing-and-proxing.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"负载均衡器的特性以及拓扑类型","attributes":{},"skip":false,"key":"7.4.1"},{"backlink":"usecases/envoy-terminology.html#fig7.4.1.1","level":"7.4.1","list_caption":"Figure: Envoy proxy 架构图","alt":"Envoy proxy 架构图","nro":226,"url":"../images/envoy-arch.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Envoy proxy 架构图","attributes":{},"skip":false,"key":"7.4.1.1"},{"backlink":"usecases/envoy-front-proxy.html#fig7.4.2.1","level":"7.4.2","list_caption":"Figure: Front proxy 部署结构图（转自https://www.envoyproxy.io/docs/envoy/latest/start/sandboxes/front_proxy）","alt":"Front proxy 部署结构图（转自https://www.envoyproxy.io/docs/envoy/latest/start/sandboxes/front_proxy）","nro":227,"url":"../images/envoyproxy-docker-compose.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Front proxy 部署结构图（转自https://www.envoyproxy.io/docs/envoy/latest/start/sandboxes/front_proxy）","attributes":{},"skip":false,"key":"7.4.2.1"},{"backlink":"usecases/envoy-mesh-in-kubernetes-tutorial.html#fig7.4.3.1","level":"7.4.3","list_caption":"Figure: Envoy Mesh架构图","alt":"Envoy Mesh架构图","nro":228,"url":"../images/envoy-mesh-in-kubernetes.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Envoy Mesh架构图","attributes":{},"skip":false,"key":"7.4.3.1"},{"backlink":"usecases/microservices.html#fig8.2.1","level":"8.2","list_caption":"Figure: 微服务关注的部分","alt":"微服务关注的部分","nro":229,"url":"../images/microservices-concerns.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"微服务关注的部分","attributes":{},"skip":false,"key":"8.2.1"},{"backlink":"usecases/service-discovery-in-microservices.html#fig8.2.1.1","level":"8.2.1","list_caption":"Figure: 微服务中的服务发现","alt":"微服务中的服务发现","nro":230,"url":"../images/service-discovery-in-microservices.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"微服务中的服务发现","attributes":{},"skip":false,"key":"8.2.1.1"},{"backlink":"usecases/microservices-for-java-developers.html#fig8.2.2.1","level":"8.2.2","list_caption":"Figure: Spring技术栈","alt":"Spring技术栈","nro":231,"url":"../images/spring-stack.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Spring技术栈","attributes":{},"skip":false,"key":"8.2.2.1"},{"backlink":"usecases/microservices-for-java-developers.html#fig8.2.2.2","level":"8.2.2","list_caption":"Figure: Spring Boot的知识点","alt":"Spring Boot的知识点","nro":232,"url":"../images/spring-boot-note-spots.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Spring Boot的知识点","attributes":{},"skip":false,"key":"8.2.2.2"},{"backlink":"usecases/spark-on-kubernetes.html#fig8.3.1.1","level":"8.3.1","list_caption":"Figure: Spark on yarn with kubernetes","alt":"Spark on yarn with kubernetes","nro":233,"url":"../images/spark-on-yarn-with-kubernetes.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Spark on yarn with kubernetes","attributes":{},"skip":false,"key":"8.3.1.1"},{"backlink":"usecases/spark-on-kubernetes.html#fig8.3.1.2","level":"8.3.1","list_caption":"Figure: 在 kubernetes 上使用多种调度方式","alt":"在 kubernetes 上使用多种调度方式","nro":234,"url":"../images/spark-on-kubernetes-with-different-schedulers.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"在 kubernetes 上使用多种调度方式","attributes":{},"skip":false,"key":"8.3.1.2"},{"backlink":"usecases/spark-standalone-on-kubernetes.html#fig8.3.1.1.1","level":"8.3.1.1","list_caption":"Figure: spark master ui","alt":"spark master ui","nro":235,"url":"../images/spark-ui.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"spark master ui","attributes":{},"skip":false,"key":"8.3.1.1.1"},{"backlink":"usecases/spark-standalone-on-kubernetes.html#fig8.3.1.1.2","level":"8.3.1.1","list_caption":"Figure: zeppelin ui","alt":"zeppelin ui","nro":236,"url":"../images/zeppelin-ui.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"zeppelin ui","attributes":{},"skip":false,"key":"8.3.1.1.2"},{"backlink":"usecases/serverless.html#fig8.4.1","level":"8.4","list_caption":"Figure: Serverless Landscape","alt":"Serverless Landscape","nro":237,"url":"../images/006tNbRwly1fx0ie2kb90j31kw0ynha3.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Serverless Landscape","attributes":{},"skip":false,"key":"8.4.1"},{"backlink":"usecases/serverless.html#fig8.4.2","level":"8.4","list_caption":"Figure: 从物理机到函数计算","alt":"从物理机到函数计算","nro":238,"url":"../images/from-bare-metal-to-functions.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"从物理机到函数计算","attributes":{},"skip":false,"key":"8.4.2"},{"backlink":"usecases/serverless.html#fig8.4.3","level":"8.4","list_caption":"Figure: FaaS Landscape","alt":"FaaS Landscape","nro":239,"url":"../images/redpoint-faas-landscape.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"FaaS Landscape","attributes":{},"skip":false,"key":"8.4.3"},{"backlink":"usecases/understanding-serverless.html#fig8.4.1.1","level":"8.4.1","list_caption":"Figure: Serverless 在云原生技术中的地位","alt":"Serverless 在云原生技术中的地位","nro":240,"url":"../images/cloud-landscape-zh.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Serverless 在云原生技术中的地位","attributes":{},"skip":false,"key":"8.4.1.1"},{"backlink":"usecases/understanding-serverless.html#fig8.4.1.2","level":"8.4.1","list_caption":"Figure: 服务端软件的运行环境","alt":"服务端软件的运行环境","nro":241,"url":"../images/serverless-server-side-software.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"服务端软件的运行环境","attributes":{},"skip":false,"key":"8.4.1.2"},{"backlink":"usecases/understanding-serverless.html#fig8.4.1.3","level":"8.4.1","list_caption":"Figure: FaaS应用架构","alt":"FaaS应用架构","nro":242,"url":"../images/serverless-faas-platform.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"FaaS应用架构","attributes":{},"skip":false,"key":"8.4.1.3"},{"backlink":"usecases/understanding-serverless.html#fig8.4.1.4","level":"8.4.1","list_caption":"Figure: Serverless 中的函数定义","alt":"Serverless 中的函数定义","nro":243,"url":"../images/006y8mN6ly1g7ldey3l7gj31ti0mwta9.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Serverless 中的函数定义","attributes":{},"skip":false,"key":"8.4.1.4"},{"backlink":"usecases/understanding-serverless.html#fig8.4.1.5","level":"8.4.1","list_caption":"Figure: FaaS 中的函数","alt":"FaaS 中的函数","nro":244,"url":"../images/006y8mN6ly1g7ldhm7bxyj31040u0q5n.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"FaaS 中的函数","attributes":{},"skip":false,"key":"8.4.1.5"},{"backlink":"usecases/understanding-serverless.html#fig8.4.1.6","level":"8.4.1","list_caption":"Figure: 传统应用程序架构","alt":"传统应用程序架构","nro":245,"url":"../images/non-serverless-game-arch.jpg","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"传统应用程序架构","attributes":{},"skip":false,"key":"8.4.1.6"},{"backlink":"usecases/understanding-serverless.html#fig8.4.1.7","level":"8.4.1","list_caption":"Figure: Serverless架构","alt":"Serverless架构","nro":246,"url":"../images/serverless-game-arch.jpg","index":7,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Serverless架构","attributes":{},"skip":false,"key":"8.4.1.7"},{"backlink":"usecases/openfaas-quick-start.html#fig8.4.2.1.1","level":"8.4.2.1","list_caption":"Figure: OpenFaaS架构","alt":"OpenFaaS架构","nro":247,"url":"../images/openfaas-arch.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OpenFaaS架构","attributes":{},"skip":false,"key":"8.4.2.1.1"},{"backlink":"usecases/openfaas-quick-start.html#fig8.4.2.1.2","level":"8.4.2.1","list_caption":"Figure: OpenFaaS Prometheus","alt":"OpenFaaS Prometheus","nro":248,"url":"../images/openfaas-prometheus.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OpenFaaS Prometheus","attributes":{},"skip":false,"key":"8.4.2.1.2"},{"backlink":"usecases/openfaas-quick-start.html#fig8.4.2.1.3","level":"8.4.2.1","list_caption":"Figure: OpenFaas Grafana监控","alt":"OpenFaas Grafana监控","nro":249,"url":"../images/openfaas-grafana.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OpenFaas Grafana监控","attributes":{},"skip":false,"key":"8.4.2.1.3"},{"backlink":"usecases/openfaas-quick-start.html#fig8.4.2.1.4","level":"8.4.2.1","list_caption":"Figure: OpenFaas Dashboard","alt":"OpenFaas Dashboard","nro":250,"url":"../images/openfaas-deploy-a-function.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"OpenFaas Dashboard","attributes":{},"skip":false,"key":"8.4.2.1.4"},{"backlink":"usecases/openfaas-quick-start.html#fig8.4.2.1.5","level":"8.4.2.1","list_caption":"Figure: NodeInfo执行结果","alt":"NodeInfo执行结果","nro":251,"url":"../images/openfaas-nodeinfo.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"NodeInfo执行结果","attributes":{},"skip":false,"key":"8.4.2.1.5"},{"backlink":"usecases/knative.html#fig8.4.3.1","level":"8.4.3","list_caption":"Figure: Knative logo","alt":"Knative logo","nro":252,"url":"https://tva1.sinaimg.cn/large/006y8mN6ly1g7pg0iwbzfj30d8080dfp.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Knative logo","attributes":{},"skip":false,"key":"8.4.3.1"},{"backlink":"usecases/knative.html#fig8.4.3.2","level":"8.4.3","list_caption":"Figure: Knative 受众（图片来自 knative.dev）","alt":"Knative 受众（图片来自 knative.dev）","nro":253,"url":"https://tva1.sinaimg.cn/large/006y8mN6ly1g7po5i7cgqj31ap0u075l.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Knative 受众（图片来自 knative.dev）","attributes":{},"skip":false,"key":"8.4.3.2"},{"backlink":"develop/sigs-and-working-group.html#fig9.2.1","level":"9.2","list_caption":"Figure: Kubernetes SIG","alt":"Kubernetes SIG","nro":254,"url":"../images/kubernetes-sigs.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes SIG","attributes":{},"skip":false,"key":"9.2.1"},{"backlink":"develop/testing.html#fig9.4.1","level":"9.4","list_caption":"Figure: test-infra架构图（图片来自官方GitHub）","alt":"test-infra架构图（图片来自官方GitHub）","nro":255,"url":"../images/kubernetes-test-architecture.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"test-infra架构图（图片来自官方GitHub）","attributes":{},"skip":false,"key":"9.4.1"},{"backlink":"develop/client-go-sample.html#fig9.5.1","level":"9.5","list_caption":"Figure: 使用kubernetes dashboard进行故障排查","alt":"使用kubernetes dashboard进行故障排查","nro":256,"url":"../images/kubernetes-client-go-sample-update.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"使用kubernetes dashboard进行故障排查","attributes":{},"skip":false,"key":"9.5.1"},{"backlink":"develop/client-go-informer-sourcecode-analyse.html#fig9.5.1.1","level":"9.5.1","list_caption":"Figure: client-go informer","alt":"client-go informer","nro":257,"url":"../images/client-go-informer.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"client-go informer","attributes":{},"skip":false,"key":"9.5.1.1"},{"backlink":"develop/client-go-informer-sourcecode-analyse.html#fig9.5.1.2","level":"9.5.1","list_caption":"Figure: image","alt":"image","nro":258,"url":"https://github.com/jianlongzhou/client-go-source-analysis/blob/main/deltaFIFO.png?raw=true","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"image","attributes":{},"skip":false,"key":"9.5.1.2"},{"backlink":"develop/client-go-informer-sourcecode-analyse.html#fig9.5.1.3","level":"9.5.1","list_caption":"Figure: 图片来源于网络","alt":"图片来源于网络","nro":259,"url":"https://user-images.githubusercontent.com/41672087/116666278-5981ca00-a9cd-11eb-9570-8ee6eb447d05.png","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"图片来源于网络","attributes":{},"skip":false,"key":"9.5.1.3"},{"backlink":"cloud-native/cncf.html#fig10.1.1","level":"10.1","list_caption":"Figure: CNCF landscape","alt":"CNCF landscape","nro":260,"url":"../images/006tNbRwly1fxmx633ymqj31dp0u0kjn.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CNCF landscape","attributes":{},"skip":false,"key":"10.1.1"},{"backlink":"cloud-native/cncf.html#fig10.1.2","level":"10.1","list_caption":"Figure: CNCF项目成熟度级别","alt":"CNCF项目成熟度级别","nro":261,"url":"../images/cncf-graduation-criteria-v2.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CNCF项目成熟度级别","attributes":{},"skip":false,"key":"10.1.2"},{"backlink":"cloud-native/cncf-charter.html#fig10.1.1.1","level":"10.1.1","list_caption":"Figure: CNCF 组织架构图","alt":"CNCF 组织架构图","nro":262,"url":"../images/cncf-org-arch.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CNCF 组织架构图","attributes":{},"skip":false,"key":"10.1.1.1"},{"backlink":"cloud-native/cncf-charter.html#fig10.1.1.2","level":"10.1.1","list_caption":"Figure: 云原生的理想分层架构","alt":"云原生的理想分层架构","nro":263,"url":"../images/006tKfTcly1ft3zgjlisxj30n70ffjth.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"云原生的理想分层架构","attributes":{},"skip":false,"key":"10.1.1.2"},{"backlink":"cloud-native/cncf-sandbox-criteria.html#fig10.1.3.1","level":"10.1.3","list_caption":"Figure: sandbox 流程","alt":"sandbox 流程","nro":264,"url":"../images/sandbox-process.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"sandbox 流程","attributes":{},"skip":false,"key":"10.1.3.1"},{"backlink":"cloud-native/cncf-project-governing.html#fig10.1.4.1","level":"10.1.4","list_caption":"Figure: CNCF 项目的成熟度分类","alt":"CNCF 项目的成熟度分类","nro":265,"url":"../images/cncf-graduation.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CNCF 项目的成熟度分类","attributes":{},"skip":false,"key":"10.1.4.1"},{"backlink":"cloud-native/cncf-project-governing.html#fig10.1.4.2","level":"10.1.4","list_caption":"Figure: CNCF 中的项目运作","alt":"CNCF 中的项目运作","nro":266,"url":"../images/006tNc79ly1g1yz80ag98j31cs0n2gr7.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CNCF 中的项目运作","attributes":{},"skip":false,"key":"10.1.4.2"},{"backlink":"cloud-native/cncf-project-governing.html#fig10.1.4.3","level":"10.1.4","list_caption":"Figure: CNCF 项目成熟度级别","alt":"CNCF 项目成熟度级别","nro":267,"url":"../images/cncf-graduation-criteria-v2.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CNCF 项目成熟度级别","attributes":{},"skip":false,"key":"10.1.4.3"},{"backlink":"appendix/about-cka-candidate.html#fig10.2.2.1","level":"10.2.2","list_caption":"Figure: cka-question","alt":"cka-question","nro":268,"url":"../images/cka-question.png","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"cka-question","attributes":{},"skip":false,"key":"10.2.2.1"},{"backlink":"appendix/about-cka-candidate.html#fig10.2.2.2","level":"10.2.2","list_caption":"Figure: CKA mindmap","alt":"CKA mindmap","nro":269,"url":"../images/cka-mindmap.png","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CKA mindmap","attributes":{},"skip":false,"key":"10.2.2.2"},{"backlink":"appendix/issues.html#fig11.5.1","level":"11.5","list_caption":"Figure: pvc-storage-limit","alt":"pvc-storage-limit","nro":270,"url":"../images/pvc-storage-limit.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"pvc-storage-limit","attributes":{},"skip":false,"key":"11.5.1"},{"backlink":"appendix/kubernetes-and-cloud-native-summary-in-2018-and-outlook-for-2019.html#fig11.6.2.1","level":"11.6.2","list_caption":"Figure: Kubernetes 搜索趋势(来自 Google trends)","alt":"Kubernetes 搜索趋势(来自 Google trends)","nro":271,"url":"../images/006tNc79ly1fzne6y4f2ej31q60fedho.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 搜索趋势(来自 Google trends)","attributes":{},"skip":false,"key":"11.6.2.1"},{"backlink":"appendix/kubernetes-and-cloud-native-summary-in-2018-and-outlook-for-2019.html#fig11.6.2.2","level":"11.6.2","list_caption":"Figure: Kubernetes 的百度指数","alt":"Kubernetes 的百度指数","nro":272,"url":"../images/006tNc79ly1fznegoocmvj31y00hmgon.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Kubernetes 的百度指数","attributes":{},"skip":false,"key":"11.6.2.2"},{"backlink":"appendix/kubernetes-and-cloud-native-summary-in-2018-and-outlook-for-2019.html#fig11.6.2.3","level":"11.6.2","list_caption":"Figure: Istio 中的 CRD","alt":"Istio 中的 CRD","nro":273,"url":"../images/006tNc79ly1fzna87wmfij30u00zc4qp.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"Istio 中的 CRD","attributes":{},"skip":false,"key":"11.6.2.3"},{"backlink":"appendix/kubernetes-and-cloud-native-summary-in-2018-and-outlook-for-2019.html#fig11.6.2.4","level":"11.6.2","list_caption":"Figure: 2019 Q1 软件架构趋势 - 来自 InfoQ","alt":"2019 Q1 软件架构趋势 - 来自 InfoQ","nro":274,"url":"../images/006tNc79ly1fzor2k6f7wj313j0u0dl3.jpg","index":4,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"2019 Q1 软件架构趋势 - 来自 InfoQ","attributes":{},"skip":false,"key":"11.6.2.4"},{"backlink":"appendix/kubernetes-and-cloud-native-summary-in-2018-and-outlook-for-2019.html#fig11.6.2.5","level":"11.6.2","list_caption":"Figure: ServiceMesher 社区 Logo","alt":"ServiceMesher 社区 Logo","nro":275,"url":"../images/006tNc79ly1fznadbp63qj31jt0beq9s.jpg","index":5,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"ServiceMesher 社区 Logo","attributes":{},"skip":false,"key":"11.6.2.5"},{"backlink":"appendix/kubernetes-and-cloud-native-summary-in-2018-and-outlook-for-2019.html#fig11.6.2.6","level":"11.6.2","list_caption":"Figure: ServiceMesher 社区 2018 年活动一览","alt":"ServiceMesher 社区 2018 年活动一览","nro":276,"url":"../images/006tNc79ly1fzm9vs4o3aj31s00u0x6p.jpg","index":6,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"ServiceMesher 社区 2018 年活动一览","attributes":{},"skip":false,"key":"11.6.2.6"},{"backlink":"appendix/kubernetes-and-cloud-native-summary-in-2018-and-outlook-for-2019.html#fig11.6.2.7","level":"11.6.2","list_caption":"Figure: CNCF Landscape 中的 Serverless 单元","alt":"CNCF Landscape 中的 Serverless 单元","nro":277,"url":"../images/006tNc79ly1fznbh3vfbwj310f0jxgxj.jpg","index":7,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CNCF Landscape 中的 Serverless 单元","attributes":{},"skip":false,"key":"11.6.2.7"},{"backlink":"appendix/cncf-annual-report-2018.html#fig11.7.1.1","level":"11.7.1","list_caption":"Figure: CNCF 项目成熟度级别","alt":"CNCF 项目成熟度级别","nro":278,"url":"../images/006tNc79ly1g04s0oznytj31tg0ok7ca.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CNCF 项目成熟度级别","attributes":{},"skip":false,"key":"11.7.1.1"},{"backlink":"appendix/cncf-annual-report-2018.html#fig11.7.1.2","level":"11.7.1","list_caption":"Figure: KCSP","alt":"KCSP","nro":279,"url":"../images/006tNc79ly1g04tl97vm4j318v0h7dpt.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"KCSP","attributes":{},"skip":false,"key":"11.7.1.2"},{"backlink":"appendix/cncf-annual-report-2020.html#fig11.7.2.1","level":"11.7.2","list_caption":"Figure: CNCF 会员增长情况","alt":"CNCF 会员增长情况","nro":280,"url":"../images/008eGmZEly1gmhqzaxsy1j31dz0u0acn.jpg","index":1,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"CNCF 会员增长情况","attributes":{},"skip":false,"key":"11.7.2.1"},{"backlink":"appendix/cncf-annual-report-2020.html#fig11.7.2.2","level":"11.7.2","list_caption":"Figure: 新收录的开源项目","alt":"新收录的开源项目","nro":281,"url":"../images/008eGmZEly1gmhrip3dc2j315q0u01e0.jpg","index":2,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"新收录的开源项目","attributes":{},"skip":false,"key":"11.7.2.2"},{"backlink":"appendix/cncf-annual-report-2020.html#fig11.7.2.3","level":"11.7.2","list_caption":"Figure: 项目更新","alt":"项目更新","nro":282,"url":"../images/008eGmZEly1gmhrl3860hj31ob0u0wn4.jpg","index":3,"caption_template":"图 _PAGE_LEVEL_._PAGE_IMAGE_NUMBER_：_CAPTION_","label":"项目更新","attributes":{},"skip":false,"key":"11.7.2.3"}]},"title":"Kubernetes 中文指南——云原生应用架构实战手册","language":"zh-hans","links":{"sidebar":{"回到主页":"https://jimmysong.io","全部书籍":"https://jimmysong.io/book/","云原生开源项目大全":"https://jimmysong.io/awesome-cloud-native/","云原生社区":"https://cloudnative.to"}},"gitbook":"*","description":"Kubernetes Handbook - Kubernetes 中文指南/云原生应用架构实战手册，本书记录了本人从零开始学习和使用 Kubernetes 的心路历程，着重于经验分享和总结，同时也会有相关的概念解析，希望能够帮助大家少踩坑，少走弯路，还会指引大家关注Kubernetes生态周边，如微服务构建、DevOps、大数据应用、Service Mesh、Cloud Native等领域。"},"file":{"path":"guide/authentication.md","mtime":"2022-04-18T02:49:41.920Z","type":"markdown"},"gitbook":{"version":"3.2.3","time":"2022-04-18T02:50:11.426Z"},"basePath":"..","book":{"language":""}});
});
</script>
</div>
<script src="../gitbook/gitbook.js"></script>
<script src="../gitbook/theme.js"></script>
<script src="../gitbook/gitbook-plugin-github/plugin.js"></script>
<script src="../gitbook/gitbook-plugin-splitter/splitter.js"></script>
<script src="../gitbook/gitbook-plugin-page-toc-button/plugin.js"></script>
<script src="../gitbook/gitbook-plugin-editlink/plugin.js"></script>
<script src="../gitbook/gitbook-plugin-back-to-top-button/plugin.js"></script>
<script src="../gitbook/gitbook-plugin-search-plus/jquery.mark.min.js"></script>
<script src="../gitbook/gitbook-plugin-search-plus/search.js"></script>
<script src="../gitbook/gitbook-plugin-github-buttons/plugin.js"></script>
<script src="../gitbook/gitbook-plugin-3-ba/plugin.js"></script>
<script src="../gitbook/gitbook-plugin-lightbox/js/lightbox.min.js"></script>
<script src="../gitbook/gitbook-plugin-ga/plugin.js"></script>
<script src="../gitbook/gitbook-plugin-hide-element/plugin.js"></script>
<script src="../gitbook/gitbook-plugin-expandable-chapters-small/expandable-chapters-small.js"></script>
<script src="../gitbook/gitbook-plugin-insert-logo/plugin.js"></script>
<script src="../gitbook/gitbook-plugin-adsense/plugin.js"></script>
<script src="../gitbook/gitbook-plugin-sharing/buttons.js"></script>
<script src="../gitbook/gitbook-plugin-fontsettings/fontsettings.js"></script>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink