k3s.yaml RBAC

[cwrx777]

Hi,

what kind of kube API access when we use the k3s.yaml created during server installation?
I notice there is a user named default in the file. is it mapped to any one of of subject in ClusterRoleBindings or ServiceAccounts ?

[brandond]

The user in the kubeconfig struct doesn't matter; the subject on the client certificate is all that matters to the apiserver. The admin kubeconfig uses the special system:admin user and system:masters group which is treated specially by the apiserver, and bypassess all RBAC checks.