whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update instructions for viewing rbac denials in the log (#10674)

Browse Source
This commit is contained in:
Jordan Liggitt
2018-10-23 14:30:38 -04:00
committed by k8s-ci-robot
parent 255d95da31
commit 6705b17ebc
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/reference/access-authn-authz/rbac.md
+2 -1
View File
@@ -898,7 +898,8 @@ The RBAC authorizer will attempt to authorize requests first. If it denies an AP
the ABAC authorizer is then run. This means that any request allowed by *either* the RBAC the ABAC authorizer is then run. This means that any request allowed by *either* the RBAC
or ABAC policies is allowed. or ABAC policies is allowed.
When run with a log level of 2 or higher (`--v=2`), you can see RBAC denials in the apiserver log (prefixed with `RBAC DENY:`). When the apiserver is run with a log level of 5 or higher for the RBAC component (`--vmodule=rbac*=5` or `--v=5`),
you can see RBAC denials in the apiserver log (prefixed with `RBAC DENY:`).
You can use that information to determine which roles need to be granted to which users, groups, or service accounts. You can use that information to determine which roles need to be granted to which users, groups, or service accounts.
Once you have [granted roles to service accounts](#service-account-permissions) and workloads are running with no RBAC denial messages Once you have [granted roles to service accounts](#service-account-permissions) and workloads are running with no RBAC denial messages
in the server logs, you can remove the ABAC authorizer. in the server logs, you can remove the ABAC authorizer.