File tree Expand file tree Collapse file tree 1 file changed +5
-3
lines changed
keps/sig-auth/3221-structured-authorization-configuration Expand file tree Collapse file tree 1 file changed +5
-3
lines changed Original file line number Diff line number Diff line change @@ -299,9 +299,11 @@ start if the configuration is invalid.
299
299
300
300
The API server will periodically reload the configuration. If it changes, the
301
301
new configuration will be used for the Authorizer chain. If the new configuration
302
- is invalid, the last known valid configuration will be used. Logging and metrics
303
- would be used to signal success/failure of a config reload so that cluster admins
304
- can have observability over this process. Reload must not add or remove Node or RBAC
302
+ is invalid, the last known valid configuration will be used. The reloader will also
303
+ check if the webhook exists, thereby preventing any typo/misconfiguration with the
304
+ Webhook resulting in bad Authorizer config. Logging and metrics would be used to
305
+ signal success/failure of a config reload so that cluster admins can have
306
+ observability over this process.Reload must not add or remove Node or RBAC
305
307
authorizers. They can be reordered, but cannot be added or removed.
306
308
307
309
The proposed structure is illustrated below :
You can’t perform that action at this time.
0 commit comments