Skip to content

Commit

Permalink
Simplify external k8s KEP link
Browse files Browse the repository at this point in the history
Signed-off-by: Derek Nola <[email protected]>
  • Loading branch information
dereknola committed Oct 21, 2024
1 parent 7769b61 commit 05346c8
Show file tree
Hide file tree
Showing 4 changed files with 4 additions and 4 deletions.
2 changes: 1 addition & 1 deletion docs/advanced.md
Original file line number Diff line number Diff line change
Expand Up @@ -279,7 +279,7 @@ All current versions of Kubernetes restrict nodes from registering with most lab

> Nodes are not permitted to assert their own role labels. Node roles are typically used to identify privileged or control plane types of nodes, and allowing nodes to label themselves into that pool allows a compromised node to trivially attract workloads (like control plane daemonsets) that confer access to higher privilege credentials.

See [SIG-Auth KEP 279](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/279-limit-node-access/README.md#proposal) for more information.
See [SIG-Auth KEP 279](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/279-limit-node-access/README.md) for more information.

If you want to change node labels and taints after node registration, or add reserved labels, you should use `kubectl`. Refer to the official Kubernetes documentation for details on how to add [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) and [node labels.](https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/#add-a-label-to-a-node)

Expand Down
2 changes: 1 addition & 1 deletion i18n/ja/docusaurus-plugin-content-docs/current/advanced.md
Original file line number Diff line number Diff line change
Expand Up @@ -280,7 +280,7 @@ K3s エージェントは、kubelet にラベルとテイントを追加する

> ノードは自分自身の役割ラベルを主張することは許可されていません。ノードの役割は通常、特権またはコントロールプレーンタイプのノードを識別するために使用され、ノードが自分自身をそのプールにラベル付けすることを許可すると、侵害されたノードが高い特権の資格情報にアクセスするワークロード(コントロールプレーンデーモンセットなど)を簡単に引き付けることができます。

詳細については [SIG-Auth KEP 279](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/279-limit-node-access/README.md#proposal) を参照してください。
詳細については [SIG-Auth KEP 279](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/279-limit-node-access/README.md) を参照してください。

ノードの登録後にノードラベルとテイントを変更したり、予約済みラベルを追加したりする場合は、`kubectl` を使用する必要があります。テイントの追加方法については公式の Kubernetes ドキュメントを参照してください。[テイント](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) および [ノードラベル](https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/#add-a-label-to-a-node) の詳細を参照してください。

Expand Down
2 changes: 1 addition & 1 deletion i18n/kr/docusaurus-plugin-content-docs/current/advanced.md
Original file line number Diff line number Diff line change
Expand Up @@ -266,7 +266,7 @@ K3s 에이전트는 `--node-label` 및 `--node-taint` 옵션으로 구성할 수

> 노드는 자체 역할 레이블을 어설트하는 것이 허용되지 않습니다. 노드 역할은 일반적으로 권한 또는 컨트롤 플레인 유형의 노드를 식별하는 데 사용되며, 노드가 해당 풀에 레이블을 지정하도록 허용하면 손상된 노드가 더 높은 권한 자격 증명에 대한 액세스 권한을 부여하는 워크로드(예: 컨트롤 플레인 데몬셋)를 사소하게 끌어들일 수 있습니다.

자세한 내용은 [SIG-Auth KEP 279](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/279-limit-node-access/README.md#proposal)를 참조하세요.
자세한 내용은 [SIG-Auth KEP 279](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/279-limit-node-access/README.md)를 참조하세요.

노드 등록 후 노드 레이블과 틴트를 변경하거나 예약 레이블을 추가하려면 `kubectl`을 사용해야 합니다. [taint](https://kubernetes.io/ko/docs/concepts/scheduling-eviction/taint-and-toleration/) 및 [노드 레이블](https://kubernetes.io/ko/docs/tasks/configure-pod-container/assign-pods-nodes/#add-a-label-to-a-node)을 추가하는 방법에 대한 자세한 내용은 쿠버네티스 공식 문서를 참고하세요.

Expand Down
2 changes: 1 addition & 1 deletion i18n/zh/docusaurus-plugin-content-docs/current/advanced.md
Original file line number Diff line number Diff line change
Expand Up @@ -261,7 +261,7 @@ K3s Agent 可以通过 `--node-label` 和 `--node-taint` 选项来配置,它

> 不允许节点断言自己的角色标签。节点角色通常用于识别节点的特权或 control plane 类型,如果允许节点将自己标记到该池,那么受感染的节点将能吸引可授予更高特权凭证访问权限的工作负载(如 control plane 守护进程)。

有关详细信息,请参阅 [SIG-Auth KEP 279](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/279-limit-node-access/README.md#proposal)。
有关详细信息,请参阅 [SIG-Auth KEP 279](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/279-limit-node-access/README.md)。

如果你想在节点注册后更改节点标签和污点,或者添加保留标签,请使用 `kubectl`。关于如何添加[污点](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)和[节点标签](https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/#add-a-label-to-a-node)的详细信息,请参阅官方 Kubernetes 文档。

Expand Down

0 comments on commit 05346c8

Please sign in to comment.