Skip to content

Commit c283a4d

Browse files
committed
Remove docs related to 'require-kubeconfig'
With kubernetes/kubernetes#58367 merged, v1.10 will not use the "require-kubeconfig" flag. The flag has become a no-op solely to ensure existing deployments won't break.
1 parent dd7bb34 commit c283a4d

4 files changed

+4
-14
lines changed

cn/docs/admin/kubelet-authentication-authorization.md

+2-6
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,9 @@ To enable X509 client certificate authentication to the kubelet's HTTPS endpoint
3333
To enable API bearer tokens (including service account tokens) to be used to authenticate to the kubelet's HTTPS endpoint:
3434

3535
* ensure the `authentication.k8s.io/v1beta1` API group is enabled in the API server
36-
* start the kubelet with the `--authentication-token-webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
36+
* start the kubelet with the `--authentication-token-webhook` and the `--kubeconfig` flags
3737
* the kubelet calls the `TokenReview` API on the configured API server to determine user information from bearer tokens
3838

39-
**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8.
40-
4139
## Kubelet authorization
4240

4341
Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is `AlwaysAllow`, which allows all requests.
@@ -51,11 +49,9 @@ There are many possible reasons to subdivide access to the kubelet API:
5149
To subdivide access to the kubelet API, delegate authorization to the API server:
5250

5351
* ensure the `authorization.k8s.io/v1beta1` API group is enabled in the API server
54-
* start the kubelet with the `--authorization-mode=Webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
52+
* start the kubelet with the `--authorization-mode=Webhook` and the `--kubeconfig` flags
5553
* the kubelet calls the `SubjectAccessReview` API on the configured API server to determine whether each request is authorized
5654

57-
**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8.
58-
5955
The kubelet authorizes API requests using the same [request attributes](/docs/admin/authorization/#request-attributes) approach as the apiserver.
6056

6157
The verb is determined from the incoming request's HTTP verb:

cn/docs/admin/kubelet-tls-bootstrapping.md

-1
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,6 @@ When starting the kubelet, if the file specified by `--kubeconfig` does not exis
190190
**Note:** The following flags are required to enable this bootstrapping when starting the kubelet:
191191

192192
```
193-
--require-kubeconfig
194193
--bootstrap-kubeconfig="/path/to/bootstrap/kubeconfig"
195194
```
196195

docs/admin/kubelet-authentication-authorization.md

+2-6
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,9 @@ To enable X509 client certificate authentication to the kubelet's HTTPS endpoint
3333
To enable API bearer tokens (including service account tokens) to be used to authenticate to the kubelet's HTTPS endpoint:
3434

3535
* ensure the `authentication.k8s.io/v1beta1` API group is enabled in the API server
36-
* start the kubelet with the `--authentication-token-webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
36+
* start the kubelet with the `--authentication-token-webhook` and `--kubeconfig` flags
3737
* the kubelet calls the `TokenReview` API on the configured API server to determine user information from bearer tokens
3838

39-
**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8.
40-
4139
## Kubelet authorization
4240

4341
Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is `AlwaysAllow`, which allows all requests.
@@ -51,11 +49,9 @@ There are many possible reasons to subdivide access to the kubelet API:
5149
To subdivide access to the kubelet API, delegate authorization to the API server:
5250

5351
* ensure the `authorization.k8s.io/v1beta1` API group is enabled in the API server
54-
* start the kubelet with the `--authorization-mode=Webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
52+
* start the kubelet with the `--authorization-mode=Webhook` and the `--kubeconfig` flags
5553
* the kubelet calls the `SubjectAccessReview` API on the configured API server to determine whether each request is authorized
5654

57-
**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8.
58-
5955
The kubelet authorizes API requests using the same [request attributes](/docs/admin/authorization/#request-attributes) approach as the apiserver.
6056

6157
The verb is determined from the incoming request's HTTP verb:

docs/admin/kubelet-tls-bootstrapping.md

-1
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,6 @@ When starting the kubelet, if the file specified by `--kubeconfig` does not exis
198198
**Note:** The following flags are required to enable this bootstrapping when starting the kubelet:
199199

200200
```
201-
--require-kubeconfig
202201
--bootstrap-kubeconfig="/path/to/bootstrap/kubeconfig"
203202
```
204203

0 commit comments

Comments
 (0)