mirror of https://github.com/k3s-io/k3s
c3aac2b938
Automatic merge from submit-queue (batch tested with PRs 36751, 38968) Convert * users/groups to system:authenticated group in ABAC Part of enabling anonymous auth by default in 1.6 means protecting earlier policies that did not intend to grant access to anonymous users. This modifies ABAC policies that match `user` or `group` `*` to only match authenticated users. Docs PR to update examples to use `system:authenticated` or `system:unauthenticated` groups explicitly: https://github.com/kubernetes/kubernetes.github.io/pull/1992 ```release-note ABAC policies using "user":"*" or "group":"*" to match all users or groups will only match authenticated requests. To match unauthenticated requests, ABAC policies must explicitly specify "group":"system:unauthenticated" ``` |
||
|---|---|---|
| .. | ||
| admission | ||
| api | ||
| apimachinery | ||
| apis | ||
| apiserver | ||
| auth | ||
| capabilities | ||
| client | ||
| cloudprovider | ||
| controller | ||
| conversion | ||
| credentialprovider | ||
| dns | ||
| fieldpath | ||
| fields | ||
| generated | ||
| genericapiserver | ||
| healthz | ||
| httplog | ||
| hyperkube | ||
| kubectl | ||
| kubelet | ||
| kubemark | ||
| labels | ||
| master | ||
| metrics | ||
| probe | ||
| proxy | ||
| quota | ||
| registry | ||
| routes | ||
| runtime | ||
| security | ||
| securitycontext | ||
| selection | ||
| serviceaccount | ||
| ssh | ||
| storage | ||
| types | ||
| util | ||
| version | ||
| volume | ||
| watch | ||
| OWNERS | ||