June 2021
Intermediate to advanced
335 pages
5h 50m
Chinese
Content preview from Kubernetes编程
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
262
｜
第
8
章
Error from server (Forbidden): error when creating "pizza-margherita.yaml":
pizzas.restaurant.programming-kubernetes.info "margherita" is forbidden:
unknown topping: mozzarella
不能制作一个不含莫泽雷勒干酪（
Mozzarella
）的玛格丽格披萨，很多体面的
意大利餐厅都是这样的。
看上去我们已经实现了“
8.2
示例：一个披萨店”中所描述的所有功能，但是
事实上我们还遗漏了系统的安全性：我们没有正确处理有关证书相关的东西。
一个恶意的披萨供应商可以想办法干扰我们的用户与自定义
API
服务器之间
的互动，因为
Kubernetes API
服务器没有检查服务器证书，会接受所有的证书。
下面我们来解决这个问题。
8.5.4
证书与信任
APIService
对象中包含一个名为
caBundle
的字段。这个字段用于配置聚合器
（在
Kubernetes API
服务器内）使它能信任自定义的
API
服务器。这个
CA
中包含了用于验证聚合
API
服务器并真正拥有它所声明的身份的证书（以及
中间证书）。在正式的集群环境中，需要把对应的
CA
填到该字段中。
在
APIService
中，可以配置
insecureSkipTLSVerify
来禁用证书验证，但
在生产环境中这么做是非常不好的。
Kubernetes API
服务器会向其信任的聚
合
API
服务器发送请求，把 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.