You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
With kubernetes/kubernetes#58367 merged, v1.10 will not use the
"require-kubeconfig" flag. The flag has become a no-op solely to ensure
existing deployments won't break.
Copy file name to clipboardExpand all lines: cn/docs/admin/kubelet-authentication-authorization.md
+2-6
Original file line number
Diff line number
Diff line change
@@ -33,11 +33,9 @@ To enable X509 client certificate authentication to the kubelet's HTTPS endpoint
33
33
To enable API bearer tokens (including service account tokens) to be used to authenticate to the kubelet's HTTPS endpoint:
34
34
35
35
* ensure the `authentication.k8s.io/v1beta1` API group is enabled in the API server
36
-
* start the kubelet with the `--authentication-token-webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
36
+
* start the kubelet with the `--authentication-token-webhook`and the `--kubeconfig` flags
37
37
* the kubelet calls the `TokenReview` API on the configured API server to determine user information from bearer tokens
38
38
39
-
**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8.
40
-
41
39
## Kubelet authorization
42
40
43
41
Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is `AlwaysAllow`, which allows all requests.
@@ -51,11 +49,9 @@ There are many possible reasons to subdivide access to the kubelet API:
51
49
To subdivide access to the kubelet API, delegate authorization to the API server:
52
50
53
51
* ensure the `authorization.k8s.io/v1beta1` API group is enabled in the API server
54
-
* start the kubelet with the `--authorization-mode=Webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
52
+
* start the kubelet with the `--authorization-mode=Webhook`and the `--kubeconfig` flags
55
53
* the kubelet calls the `SubjectAccessReview` API on the configured API server to determine whether each request is authorized
56
54
57
-
**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8.
58
-
59
55
The kubelet authorizes API requests using the same [request attributes](/docs/admin/authorization/#request-attributes) approach as the apiserver.
60
56
61
57
The verb is determined from the incoming request's HTTP verb:
Copy file name to clipboardExpand all lines: docs/admin/kubelet-authentication-authorization.md
+2-6
Original file line number
Diff line number
Diff line change
@@ -33,11 +33,9 @@ To enable X509 client certificate authentication to the kubelet's HTTPS endpoint
33
33
To enable API bearer tokens (including service account tokens) to be used to authenticate to the kubelet's HTTPS endpoint:
34
34
35
35
* ensure the `authentication.k8s.io/v1beta1` API group is enabled in the API server
36
-
* start the kubelet with the `--authentication-token-webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
36
+
* start the kubelet with the `--authentication-token-webhook`and `--kubeconfig` flags
37
37
* the kubelet calls the `TokenReview` API on the configured API server to determine user information from bearer tokens
38
38
39
-
**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8.
40
-
41
39
## Kubelet authorization
42
40
43
41
Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is `AlwaysAllow`, which allows all requests.
@@ -51,11 +49,9 @@ There are many possible reasons to subdivide access to the kubelet API:
51
49
To subdivide access to the kubelet API, delegate authorization to the API server:
52
50
53
51
* ensure the `authorization.k8s.io/v1beta1` API group is enabled in the API server
54
-
* start the kubelet with the `--authorization-mode=Webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
52
+
* start the kubelet with the `--authorization-mode=Webhook`and the `--kubeconfig` flags
55
53
* the kubelet calls the `SubjectAccessReview` API on the configured API server to determine whether each request is authorized
56
54
57
-
**Note:** The flag `--require-kubeconfig` is deprecated as of Kubernetes 1.8, this will be removed in a future version. You no longer need to use `--require-kubeconfig` in Kubernetes 1.8.
58
-
59
55
The kubelet authorizes API requests using the same [request attributes](/docs/admin/authorization/#request-attributes) approach as the apiserver.
60
56
61
57
The verb is determined from the incoming request's HTTP verb:
0 commit comments