Merge branch 'master' into all-user-doc

docs/admin/authorization.md

@@ -55,7 +55,7 @@ A request has the following attributes that can be considered for authorization:
   - what resource is being accessed (for resource requests only)
   - what subresource is being accessed (for resource requests only)
   - the namespace of the object being accessed (for namespaced resource requests only)
-  - the API group being accessed (for resource requests only); an empty string designates the [core API group](../api.md#api-groups)
+  - the API group being accessed (for resource requests only); an empty string designates the [core API group](/docs/api/)
 
 The request verb for a resource API endpoint can be determined by the HTTP verb used and whether or not the request acts on an individual resource or a collection of resources:
 
@@ -85,8 +85,8 @@ properties:
     - `kind`, type string: valid values are "Policy". Allows versioning and conversion of the policy format.
   - `spec` property set to a map with the following properties:
     - Subject-matching properties:
-      - `user`, type string; the user-string from `--token-auth-file`. If you specify `user`, it must match the username of the authenticated user. `*` matches all requests.
-      - `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `*` matches all requests.
+      - `user`, type string; the user-string from `--token-auth-file`. If you specify `user`, it must match the username of the authenticated user.
+      - `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `system:authenticated` matches all authenticated requests. `system:unauthenticated` matches all unauthenticated requests.
     - `readonly`, type boolean, when true, means that the policy only applies to get, list, and watch operations.
     - Resource-matching properties:
       - `apiGroup`, type string; an API group, such as `extensions`. `*` matches all API groups.
@@ -115,8 +115,11 @@ The tuple of attributes is checked for a match against every policy in the
 policy file. If at least one line matches the request attributes, then the
 request is authorized (but may fail later validation).
 
-To permit any user to do something, write a policy with the user property set to
-`"*"`.
+To permit any authenticated user to do something, write a policy with the 
+group property set to `"system:authenticated"`.
+
+To permit any unauthenticated user to do something, write a policy with the 
+group property set to `"system:unauthenticated"`.
 
 To permit a user to do anything, write a policy with the apiGroup, namespace,
 resource, and nonResourcePath properties set to `"*"`.
@@ -165,7 +168,8 @@ up the verbosity:
  5. Anyone can make read-only requests to all non-resource paths:
 
     ```json
-    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "*", "readonly": true, "nonResourcePath": "*"}}
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:authenticated", "readonly": true, "nonResourcePath": "*"}}
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:unauthenticated", "readonly": true, "nonResourcePath": "*"}}
     ```
 
 [Complete file example](http://releases.k8s.io/{{page.githubbranch}}/pkg/auth/authorizer/abac/example_policy_file.jsonl)
@@ -259,7 +263,6 @@ rules:
   - apiGroups: [""] # The API group "" indicates the core API Group.
     resources: ["pods"]
     verbs: ["get", "watch", "list"]
-    nonResourceURLs: []
 ```
 
 `ClusterRoles` hold the same information as a `Role` but can apply to any
@@ -381,7 +384,7 @@ Subjects can be groups, users or service accounts.
 Users are represented by strings.  These can be plain usernames, like
 "alice", or email style names, like "bob@example.com", or numeric ids
 as string.  It is up to the Kubernetes admin to configure
-the [authentication modules](/doc/admin/authentication/) to produce
+the [authentication modules](/docs/admin/authentication/) to produce
 usernames in the desired format.  The RBAC authorization system does
 not require any particular format.  However, the prefix `system:` is
 reserved for Kubernetes system use, and so the admin should ensure
@@ -527,7 +530,7 @@ An example request body:
     "resourceAttributes": {
       "namespace": "kittensandponies",
       "verb": "GET",
-      "group": "*",
+      "group": "unicorn.example.org",
       "resource": "pods"
     },
     "user": "jane",
@@ -650,7 +653,7 @@ __EOF__
 
 --- snip lots of output ---
 
-I0913 08:12:31.362873   27425 request.go:908] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"resourceAttributes":{"namespace":"kittensandponies","verb":"GET","group":"*","resource":"pods"},"user":"jane","group":["group1","group2"]},"status":{"allowed":true}}
+I0913 08:12:31.362873   27425 request.go:908] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"resourceAttributes":{"namespace":"kittensandponies","verb":"GET","group":"unicorn.example.org","resource":"pods"},"user":"jane","group":["group1","group2"]},"status":{"allowed":true}}
 subjectaccessreview "" created
 ```