Module 04 · The Kubernetes Ecosystem: OpenShift, Istio, etc.
Module 4 Glossary: OpenShift Basics模块 4 术语表：OpenShift 基础
| Term 术语 | Definition 定义 |
|---|---|
| A/B testing A/B 测试 | Strategy is mostly used for testing new features in front-end applications. It is used to evaluate two versions of the application namely A and B, to assess which one performs better in a controlled environment. The two versions of the applications differ in terms of features and cater to different sets of users. Based on the interaction and responses received from the users such as feedback, you can choose one of the versions of the application that can be deployed globally into production. 策略主要用于测试前端应用的新功能。它用于评估应用的两个版本 A 和 B，以评估哪个版本在受控环境中表现更好。这两个应用版本在功能上有所不同，并针对不同的用户群体。根据用户交互和反馈等收到的响应，你可以选择应用的一个版本，以便在全球范围内部署到生产环境中。 |
| Build 构建 | The process of transforming inputs into a resultant object. 将输入转化为结果对象的过程。 |
| BuildConfig | An OpenShift-specific object that defines the process for a build to follow. The build process makes use of the input sources and the build strategy. The BuildConfig is the blueprint, and the build is an instance of that blueprint. 一个 OpenShift 特定的对象，用于定义构建过程遵循的流程。构建过程利用输入源和构建策略。BuildConfig 是蓝图，而构建是该蓝图的实例。 |
| Canary Deployments | Aims to deploy the new version of the application by gradually increasing the number of users. The canary deployment strategy uses the real users to test the new version of the application. As a result, bugs and issues can be detected and fixed before the new version of the application is deployed globally for all the users. 旨在通过逐渐增加用户数量来部署应用程序的新版本。Canary 部署策略使用真实用户来测试应用程序的新版本。因此，在应用程序的新版本全局部署给所有用户之前，可以检测和修复错误和问题。 |
| Circuit breaking 断路 | A method to prevent errors in one microservice from cascading to other microservices. 一种防止一个微服务中的错误级联到其他微服务的方法。 |
| Configuration Change 配置变更 | A trigger that causes a new build to run when a new BuildConfig resource is created. 当创建新的 BuildConfig 资源时，触发新构建运行的触发器。 |
| Control Plane 控制平面 | The control plane takes the desired configuration and its view of the services and dynamically programs and updates the proxy servers as the environment changes. 控制平面获取所需的配置及其对服务的视图，并根据环境变化动态编程和更新代理服务器。 |
| Custom build strategy 自定义构建策略 | Requires you to define and create your own builder image. 需要您定义并创建自己的构建镜像。 |
| Custom builder images 定制构建镜像 | Are regular Docker images that contain the logic needed to transform the inputs into the expected output. 是包含将输入转换为预期输出的逻辑的常规 Docker 镜像。 |
| CRDs 自定义资源定义（CRD） | Custom code that defines a resource to add to your Kubernetes API server without building a complete custom server. 是用于向您的 Kubernetes API 服务器添加资源而无需构建完整自定义服务器的自定义代码。 |
| Custom controllers 自定义控制器 | Reconcile the custom resources (CRDs) actual state with its desired state. 使自定义资源（CRDs）的实际状态与其期望状态保持一致。 |
| Data plane 数据平面 | Communication between services is handled by the data plane. If a service mesh is absent, the network cannot identify the type of traffic that flows, the source, and the destination and make any necessary decisions. 服务之间的通信由数据平面处理。如果没有服务网格，网络无法识别流量类型、源地址和目标地址，也无法做出任何必要的决策。 |
| Enforceability (Control) 可执行性（控制） | Istio provides control by enforcing policies across an entire fleet and ensures resources are fairly distributed among consumers. Istio 通过在整个集群中执行策略来提供控制，并确保资源在消费者之间公平分配。 |
| Envoy proxy Envoy 代理 | All network traffic is subject to or intercepted by a proxy, called Envoy, used by the service mesh and allows many features depending on the configuration. 所有网络流量都受到或被名为 Envoy 的代理拦截，该代理由服务网格使用，并允许根据配置启用许多功能。 |
| Human operators 操作人员 | Understand the systems they control. They know how to deploy services and how to recognize and fix problems. 理解他们所控制的系统。他们知道如何部署服务以及如何识别和解决问题。 |
| Image Change 图像更改 | A trigger to rebuild a containerized application when a new or updated version of an image is available. For example, if an application is built using a Node.js base image, that image will be updated as security fixes are released and other updates occur. 当有新的或更新的图像版本可用时，触发重建容器化应用程序的机制。例如，如果应用程序是使用 Node.js 基础图像构建的，那么随着安全补丁的发布和其他更新，该图像将会被更新。 |
| ImageStream | An abstraction for referencing container images within OpenShift. Each image contains an ID, or digest, that identifies it. ImageStreams do not contain image data but rather are pointers to image digests. OpenShift 内部引用容器镜像的抽象。每个镜像包含一个 ID 或摘要，用于识别它。ImageStreams 不包含镜像数据，而是指向镜像摘要的指针。 |
| ImageStream Tag ImageStream 标签 | An identity to the pointer in an ImageStream that points to a certain image in a registry. 指向注册表中特定镜像的 ImageStream 指针的标识。 |
| Istio | A platform-independent and popular service mesh platform, often used with Kubernetes. It intelligently controls the flow of traffic and API calls between services, conducts a range of tests and reduces the complexity of managing network services. Istio secures services through authentication, authorization, and encryption. Istio provides control by defining policies that can be enforced across an entire fleet. With Istio, you can observe traffic flow in your mesh so you can trace call flows, dependencies, and you can view service communication metrics such as latency, traffic, errors and saturation. 一个平台无关且流行的服务网格平台，通常与 Kubernetes 一起使用。它智能地控制服务之间流量和 API 调用的流向，执行一系列测试并降低管理网络服务的复杂性。Istio 通过认证、授权和加密来保护服务。Istio 通过定义可在整个集群中强制执行的政策来提供控制。使用 Istio，您可以观察网格中的流量，以便跟踪调用流程、依赖关系，并查看服务通信指标，如延迟、流量、错误和饱和度。 |
| Man-in-the-middle attacks 中间人攻击 |
A man-in-the-middle (MiTM) attack is a type of cyber-attack where the attacker secretly intercepts and relays messages between two parties who believe they are communicating directly with each other. The attack is a type of eavesdropping in which the attacker intercepts and then controls the entire conversation. 中间人（MiTM）攻击是一种网络攻击方式，攻击者秘密地拦截并转发两个认为彼此直接通信的当事人之间的消息。这种攻击是一种窃听方式，攻击者拦截并控制整个对话。 |
| Observability 可观察性 | Helps to observe the traffic flow in your mesh, trace call flows and dependencies, and view metrics such as latency and errors. 有助于观察您的网状流量，追踪调用流程和依赖关系，并查看延迟和错误等指标。 |
| OpenShift | A hybrid cloud, enterprise Kubernetes application. 混合云，企业级 Kubernetes 应用。 |
| OpenShift CI/CD process OpenShift CI/CD 流程 | Automatically merges new code changes to the repository, builds, tests, approves, and deploys a new version to different environments. 自动将新代码变更合并到仓库，构建、测试、批准并向不同环境部署新版本。 |
| Operators 算子 | Automate cluster tasks and act as a custom controller to extend the Kubernetes API. 自动化集群任务，并作为自定义控制器扩展 Kubernetes API。 |
| Operator Framework 操作符框架 | Is a family of tools and capabilities to deliver an efficient customer experience. It is not just about writing code; what is also critical is testing, delivery, and updating Operators. 它是一系列工具和功能，旨在提供高效的客户体验。这不仅仅是编写代码；测试、交付和更新操作符同样至关重要。 |
| OperatorHub 操作符中心 | Web console lets cluster administrators find Operators to install on their cluster. It provides many different types of Operators available, including Red Hat Operators, Certified Operators from independent service vendors partnered with Red Hat, Community Operators from the open-source community but not officially supported by Red Hat, and custom Operators defined by users. Web 控制台允许集群管理员查找要在其集群上安装的操作符。它提供了多种类型的操作符，包括 Red Hat 操作符、来自与 Red Hat 合作的独立服务供应商的认证操作符、来自开源社区但未获得 Red Hat 官方支持的开源操作符，以及用户定义的自定义操作符。 |
| Operator Lifecycle Manager 操作员生命周期管理器 |
(or OLM) Controls the install, upgrade, and role-based access control (or RBAC) of Operators in a cluster. （或 OLM）控制集群中操作员的安装、升级和基于角色的访问控制（或 RBAC）。 |
| Operator maturity model 操作员成熟度模型 | Defines the phases of maturity for general day two Operations activities and ranges from Basic Install to Auto Pilot. 定义了通用日常运营活动的成熟度阶段，范围从基本安装到自动飞行。 |
| Operator Pattern 操作模式 | A system design that links a Controller to one or more custom resources. 一种将控制器链接到一个或多个自定义资源的系统设计。 |
| Operator Registry 操作器注册表 | Stores CRDs, cluster service versions (CSVs), and Operator metadata for packages and channels. It runs in Kubernetes or OpenShift clusters to provide the Operator catalog data to OLM. 存储包和通道的 CRDs、集群服务版本（CSVs）和操作器元数据。它在 Kubernetes 或 OpenShift 集群中运行，为 OLM 提供操作器目录数据。 |
| Operator SDK 操作员 SDK | (which includes Helm, Go, and Ansible) Helps authors build, test, and package their Operators without requiring knowledge of Kubernetes API complexities. （包括 Helm、Go 和 Ansible）帮助作者构建、测试和打包他们的操作员，而无需了解 Kubernetes API 的复杂性。 |
| postCommit | Section defines an optional build hook. 部分定义了一个可选的构建钩子。 |
| Retries 重试 | A mechanism used in microservices to automatically reattempt a failed request to another service. 一种在微服务中使用的机制，用于自动重新尝试对另一个服务的失败请求。 |
| runPolicy | Field controls how builds created from a build configuration need to run. Values include the default Serial (sequentially) and simultaneously. 一个字段，控制从构建配置创建的构建需要如何运行。值包括默认的串行（顺序）和同时。 |
| Service Broker 服务代理 | Provides a short-running process that cannot perform the consecutive day’s operations such as upgrades, failover, or scaling. 提供一个短时运行的过程，无法执行连续几天的操作，例如升级、故障转移或扩展。 |
| Service Mesh 服务网格 | A dedicated layer for making service-to-service communication secure and reliable. It provides traffic management to control the flow of traffic between services, security to encrypt traffic between services, and observability of service behavior; so, you can troubleshoot and optimize applications. 一个专门用于确保服务间通信安全可靠的层。它提供流量管理来控制服务间的流量，安全功能来加密服务间的通信，以及服务行为的可观察性；因此，您可以进行故障排除和应用程序优化。 |
| Software operators 软件操作员 | Try to capture the knowledge of human operators and automate the same processes. 尝试捕获人类操作员的知识并自动化相同流程。 |
| Source-to-Image 源到镜像 | A tool for building reproducible container images. Also abbreviated S2i, it injects application source code into a container image to produce a ready-to-run image. 一种用于构建可重复容器镜像的工具。也缩写为 S2i，它将应用程序源代码注入到容器镜像中以生成可立即运行的镜像。 |
| Source strategy 源策略 | Section shows the strategy used to execute the build, such as a Source, Docker, or Custom strategy. 本节展示了用于执行构建的策略，例如源策略、Docker 策略或自定义策略。 |
| Source type 源类型 | Determines the primary input like a Git repository, an inline Dockerfile, or binary payloads. 确定主要输入，例如 Git 仓库、内联 Dockerfile 或二进制有效负载。 |
| Webhook | A trigger that sends a request to an OpenShift Container Platform API endpoint. Often this will be a GitHub webhook, though it can also be a generic webhook. If a GitHub webhook is utilized, GitHub can send the request to OpenShift when there is a new commit on a certain branch, or a pull request is merged, or under many more circumstances. Webhooks are a great way to automate development flows so that builds can occur automatically as new code is developed. 一个向 OpenShift 容器平台 API 端点发送请求的触发器。这通常是一个 GitHub webhook，但也可以是一个通用 webhook。如果使用 GitHub webhook，当某个分支有新提交、拉取请求被合并，或处于许多其他情况下，GitHub 可以将请求发送到 OpenShift。Webhooks 是自动化开发流程的绝佳方式，以便在开发新代码时自动进行构建。 |