Skip to content

Commit d00a1fb

Browse files
committed
Address review comments
Signed-off-by: Nabarun Pal <[email protected]>
1 parent 2da201d commit d00a1fb

File tree

1 file changed

+2
-2
lines changed
  • keps/sig-auth/3221-structured-authorization-configuration

1 file changed

+2
-2
lines changed

keps/sig-auth/3221-structured-authorization-configuration/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ is unreachable.
8989
Authorization chain.
9090
- Allow ordered definition of authorization modes.
9191
- Allow definition of multiple webhooks in the authorization chain while all
92-
other types of authorizers should only be specified once.
92+
other types of authorizers should at most be specified once.
9393
- Allow resource/user based pre-filtering of webhooks using CEL to prevent unnecessary
9494
invocations.
9595
- Enable user to define the policy when a webhook can't be reached due to
@@ -425,7 +425,7 @@ to a `request` variable containing a `SubjectAccessReview` object in the version
425425
by `subjectAccessReviewVersion`.
426426

427427
When no matchConditions are satisfied for a request, the webhook would be skipped. In such
428-
situations, the decision is logged in the audit log with the `webhookskipped.k8s.io` annotation.
428+
situations, the decision is logged in the audit log with the `authorization.k8s.io/webhook-skipped` annotation.
429429
Benefit of this is that resource and user info will also be logged.
430430

431431
The code path for enabling the above will only be triggered if the feature flag is enabled

0 commit comments

Comments
 (0)