From e475da84814fb0cf127fa64fb8db959074a7509e Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Tue, 1 Aug 2017 12:00:19 -0400 Subject: [PATCH] Deprecate system:nodes binding --- docs/admin/authorization/rbac.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/admin/authorization/rbac.md b/docs/admin/authorization/rbac.md index 9694f9e00f..d3883b1712 100644 --- a/docs/admin/authorization/rbac.md +++ b/docs/admin/authorization/rbac.md @@ -461,12 +461,13 @@ The permissions required by individual control loops are contained in the system:node -system:nodes group (deprecated in 1.7) +system:nodes group (deprecated in 1.7, removed in 1.8) Allows access to resources required by the kubelet component, including read access to all secrets, and write access to all pods. As of 1.7, use of the [Node authorizer](/docs/admin/authorization/node/) and [NodeRestriction admission plugin](/docs/admin/admission-controllers#NodeRestriction) is recommended instead of this role, and allow granting API access to kubelets based on the pods scheduled to run on them. As of 1.7, when the `Node` authorization mode is enabled, the automatic binding to the `system:nodes` group is not created. +As of 1.8, the automatic binding to the `system:nodes` group is not created.