whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document node authorization mode

Browse Source
This commit is contained in:
Jordan Liggitt
2017-06-14 00:11:20 -04:00
parent 57a769f506
commit 91e90da99f
5 changed files with 107 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/authorization/rbac.md
+6 -5
View File
@@ -461,11 +461,12 @@ The permissions required by individual control loops are contained in the <a hre
</tr>
<tr>
<td><b>system:node</b></td>
<td><b>system:nodes</b> group</td>
<td>Allows access to resources required by the kubelet component, <b>including read access to secrets, and write access to pods</b>.
In the future, read access to secrets and write access to pods will be restricted to objects scheduled to the node.
To maintain permissions in the future, Kubelets must identify themselves with the group <b>system:nodes</b> and a username in the form <b>system:node:&lt;node-name&gt;</b>.
See <a href="https://pr.k8s.io/40476">https://pr.k8s.io/40476</a> for details.
<td><b>system:nodes</b> group (deprecated in 1.7)</td>
<td>Allows access to resources required by the kubelet component, <b>including read access to all secrets, and write access to all pods</b>.
As of 1.7, use of the [Node authorizer](/docs/admin/authorization/node/)
and [NodeRestriction admission plugin](/docs/admin/admission-controllers#NodeRestriction)
is recommended instead of this role, and allow granting API access to kubelets based on the pods scheduled to run on them.
As of 1.7, when the `Node` authorization mode is enabled, the automatic binding to the `system:nodes` group is not created.
</td>
</tr>
<tr>