From d44b8900c196b75dd2cab0fffb6acba6b8ff387f Mon Sep 17 00:00:00 2001 From: Kyle Bai Date: Thu, 2 Nov 2017 05:52:26 +0800 Subject: [PATCH] Remind the flag `--require-kubeconfig` is deprecated (#6087) * Remove --require-kubeconfig flag * Revert --require-kubeconfig flag * Remind the flag is deprecated --- cn/docs/admin/kubelet-authentication-authorization.md | 4 ++++ docs/admin/kubelet-authentication-authorization.md | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/cn/docs/admin/kubelet-authentication-authorization.md b/cn/docs/admin/kubelet-authentication-authorization.md index 6d26b1c670..03ab5fd64b 100644 --- a/cn/docs/admin/kubelet-authentication-authorization.md +++ b/cn/docs/admin/kubelet-authentication-authorization.md @@ -36,6 +36,8 @@ To enable API bearer tokens (including service account tokens) to be used to aut * start the kubelet with the `--authentication-token-webhook`, `--kubeconfig`, and `--require-kubeconfig` flags * the kubelet calls the `TokenReview` API on the configured API server to determine user information from bearer tokens +**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8. + ## Kubelet authorization Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is `AlwaysAllow`, which allows all requests. @@ -52,6 +54,8 @@ To subdivide access to the kubelet API, delegate authorization to the API server * start the kubelet with the `--authorization-mode=Webhook`, `--kubeconfig`, and `--require-kubeconfig` flags * the kubelet calls the `SubjectAccessReview` API on the configured API server to determine whether each request is authorized +**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8. + The kubelet authorizes API requests using the same [request attributes](/docs/admin/authorization/#request-attributes) approach as the apiserver. The verb is determined from the incoming request's HTTP verb: diff --git a/docs/admin/kubelet-authentication-authorization.md b/docs/admin/kubelet-authentication-authorization.md index 6d26b1c670..03ab5fd64b 100644 --- a/docs/admin/kubelet-authentication-authorization.md +++ b/docs/admin/kubelet-authentication-authorization.md @@ -36,6 +36,8 @@ To enable API bearer tokens (including service account tokens) to be used to aut * start the kubelet with the `--authentication-token-webhook`, `--kubeconfig`, and `--require-kubeconfig` flags * the kubelet calls the `TokenReview` API on the configured API server to determine user information from bearer tokens +**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8. + ## Kubelet authorization Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is `AlwaysAllow`, which allows all requests. @@ -52,6 +54,8 @@ To subdivide access to the kubelet API, delegate authorization to the API server * start the kubelet with the `--authorization-mode=Webhook`, `--kubeconfig`, and `--require-kubeconfig` flags * the kubelet calls the `SubjectAccessReview` API on the configured API server to determine whether each request is authorized +**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8. + The kubelet authorizes API requests using the same [request attributes](/docs/admin/authorization/#request-attributes) approach as the apiserver. The verb is determined from the incoming request's HTTP verb: