From 47d4c63bfdc9c388ff789f43856dc9897bafcd98 Mon Sep 17 00:00:00 2001 From: Brandon Philips Date: Thu, 6 Sep 2018 18:28:08 -0700 Subject: [PATCH] rbac: add information on unauthenticated discovery roles (#10212) The Product Security Team got a report about these unauthenticated discovery roles. The reporter was surprised about getting 200 requests when unauthenticated. And given the light documentation on the intention of these roles it is justifiable. Increase documentation on these roles. --- content/en/docs/reference/access-authn-authz/rbac.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index b3b31a36ad..f89e765d68 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -452,6 +452,16 @@ Auto-reconciliation is enabled in Kubernetes version 1.6+ when the RBAC authoriz ### Discovery Roles +Default role bindings authorize unauthenticated and authenticated users to read API information that is deemed safe to be publicly accessible. To disable anonymous unauthenticated access add `--anonymous-auth=false` to the API server configuration. + +To view the configuration of these roles via `kubectl` run: + +``` +kubectl get clusterroles system:discovery -o yaml +``` + +NOTE: editing the role is not recommended as changes will be overwritten on API server restart via auto-reconciliation (see above). +