Admin kubeconfig docs #36
Conversation
Provides an example of how to create a client-cert based admin kubeconfig.
kcp-ci-bot
added
dco-signoff: yes
| :warning: this example allows global admin permissions across all workspaces, you may also want to | ||
| consider using more restricted groups for example `system:kcp:workspace:access` to provide a | ||
| user `system:authenticated` access to a workspace. |
There was a problem hiding this comment.
Nit: I don't think we should hardcode these kinds of groups (system:kcp:workspace:access will grant access to all workspaces automatically, no?) into certificates and instead link to the authZ docs to give users the tools to set up proper RBAC for their certificate-based users. So I would update this section with a brief note you can pass commonName in your cert instead of a system group and give permissions via RBAC to that new user. WDYT?
|
@embik: changing LGTM is restricted to collaborators In response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: sttts The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
kcp-ci-bot
added
the
approved
|
/lgtm |
|
@mjudeikis: you cannot LGTM your own PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Supersedes: #30