mirror of https://github.com/k3s-io/k3s
1f4e2efc5b
Automatic merge from submit-queue (batch tested with PRs 41357, 41178, 41280, 41184, 41278) Switch RBAC subject apiVersion to apiGroup in v1beta1 Referencing a subject from an RBAC role binding, the API group and kind of the subject is needed to fully-qualify the reference. The version is not, and adds complexity around re-writing the reference when returning the binding from different versions of the API, and when reconciling subjects. This PR: * v1beta1: change the subject `apiVersion` field to `apiGroup` (to match roleRef) * v1alpha1: convert apiVersion to apiGroup for backwards compatibility * all versions: add defaulting for the three allowed subject kinds * all versions: add validation to the field so we can count on the data in etcd being good until we decide to relax the apiGroup restriction ```release-note RBAC `v1beta1` RoleBinding/ClusterRoleBinding subjects changed `apiVersion` to `apiGroup` to fully-qualify a subject. ServiceAccount subjects default to an apiGroup of `""`, User and Group subjects default to an apiGroup of `"rbac.authorization.k8s.io"`. ``` @deads2k @kubernetes/sig-auth-api-reviews @kubernetes/sig-auth-pr-reviews |
||
|---|---|---|
| .. | ||
| BUILD | ||
| api.json | ||
| apis.json | ||
| apps.json | ||
| apps_v1alpha1.json | ||
| apps_v1beta1.json | ||
| authentication.k8s.io.json | ||
| authentication.k8s.io_v1.json | ||
| authentication.k8s.io_v1beta1.json | ||
| authorization.k8s.io.json | ||
| authorization.k8s.io_v1.json | ||
| authorization.k8s.io_v1beta1.json | ||
| autoscaling.json | ||
| autoscaling_v1.json | ||
| autoscaling_v2alpha1.json | ||
| batch.json | ||
| batch_v1.json | ||
| batch_v2alpha1.json | ||
| certificates.k8s.io.json | ||
| certificates.k8s.io_v1alpha1.json | ||
| certificates.k8s.io_v1beta1.json | ||
| extensions.json | ||
| extensions_v1beta1.json | ||
| logs.json | ||
| policy.json | ||
| policy_v1alpha1.json | ||
| policy_v1beta1.json | ||
| rbac.authorization.k8s.io.json | ||
| rbac.authorization.k8s.io_v1alpha1.json | ||
| rbac.authorization.k8s.io_v1beta1.json | ||
| resourceListing.json | ||
| storage.authorization.k8s.io_v1beta1.json | ||
| storage.k8s.io.json | ||
| storage.k8s.io_v1beta1.json | ||
| v1.json | ||
| version.json | ||