Skip to content

Commit baf7e1a

Browse files
committed
fixup! KEP-3221: update kep
Signed-off-by: Nabarun Pal <[email protected]>
1 parent bd077a3 commit baf7e1a

File tree

1 file changed

+5
-3
lines changed
  • keps/sig-auth/3221-structured-authorization-configuration

1 file changed

+5
-3
lines changed

keps/sig-auth/3221-structured-authorization-configuration/README.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -299,9 +299,11 @@ start if the configuration is invalid.
299299

300300
The API server will periodically reload the configuration. If it changes, the
301301
new configuration will be used for the Authorizer chain. If the new configuration
302-
is invalid, the last known valid configuration will be used. Logging and metrics
303-
would be used to signal success/failure of a config reload so that cluster admins
304-
can have observability over this process. Reload must not add or remove Node or RBAC
302+
is invalid, the last known valid configuration will be used. The reloader will also
303+
check if the webhook exists, thereby preventing any typo/misconfiguration with the
304+
Webhook resulting in bad Authorizer config. Logging and metrics would be used to
305+
signal success/failure of a config reload so that cluster admins can have
306+
observability over this process.Reload must not add or remove Node or RBAC
305307
authorizers. They can be reordered, but cannot be added or removed.
306308

307309
The proposed structure is illustrated below:

0 commit comments

Comments
 (0)