search

kubernetes / kubeadm

Aggregator for issues filed against kubeadm
Apache License 2.0
3.76k stars 716 forks source link

track the rename of the "system:masters" group #2322

Open neolit123 opened 4 years ago

neolit123 commented 4 years ago

Kubernetes includes a stock "system:masters" group that have full access to cluster resources: https://kubernetes.io/docs/reference/access-authn-authz/rbac/

kubeadm binds its administrator account to this group: https://github.com/kubernetes/kubernetes/blob/e45b8bfe0f45c276537bb8e927b2ae5af8466590/cmd/kubeadm/app/constants/constants.go#L168

this ticket is created with the assumption that the group name will be changed at some point (based on the efforts by wg-naming), potentially by introducing a new group that has the same level of access and deprecating the old group.

on the side of kubeadm we'd have to track this effort and adapt kubeadm to handle the introduction of the new group.

k/k issue: (NONE exists yet?) plan: TODO

justaugustus commented 3 years ago

@neolit123 -- do we have any updates on this one?

neolit123 commented 3 years ago

@justaugustus no, this one is on sig-auth.

justaugustus commented 3 years ago

Ping @kubernetes/sig-auth-feature-requests

enj commented 3 years ago

Uh, I did not know we were planning on changing this group. I do not think we can ever safely stop supporting system:masters because it could break existing clusters. That string is considered special in many places in the k/k code.

celestehorgan commented 3 years ago

@kubernetes/sig-architecture-leads – @enj brings up a great point above. For reasons I think are obvious though we'd like to at least remove system:masters going forward, even if we need to maintain backwards compatibility. Thoughts?

dims commented 3 years ago

@celestehorgan @enj i'd request sig-auth to take the lead here propose a plan that can work (some sort of switch to help existing clusters + a more forward looking better name may be?)

neolit123 commented 3 years ago

the topic for k8s core needs a kubernetes/kubernetes issue. this one is for kubeadm.

enj commented 3 years ago

We discussed this extensively in a recent sig-auth meeting. I have the AI to distill the discussion into a k/k issue that outlines the available options. That would enable the creation of the KEP needed to address this (as best as we can).

justaugustus commented 3 years ago

@enj @neolit123 -- How are we doing w/ discussions on next steps?

k8s-triage-robot commented 3 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

neolit123 commented 3 years ago

i don't know if we have a k/k issue. /remove-lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

neolit123 commented 2 years ago

/lifecycle frozen

ibihim commented 1 year ago

We discussed this extensively in a recent sig-auth meeting. I have the AI to distill the discussion into a k/k issue that outlines the available options. That would enable the creation of the KEP needed to address this (as best as we can).

Based on this, we have an action item open to create an issue for that or do we want to close it? @enj

neolit123 commented 1 year ago

@ibihim please post a link to the new issue once it's created here.