Skip to content

Commit f05d231

Browse files
committed
Address review comments
Signed-off-by: Rita Zhang <[email protected]>
1 parent 37eb843 commit f05d231

File tree

1 file changed

+6
-6
lines changed
  • keps/sig-auth/3221-structured-authorization-configuration

1 file changed

+6
-6
lines changed

keps/sig-auth/3221-structured-authorization-configuration/README.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -287,8 +287,8 @@ will not be able to start. This can be mitigated by fixing the malformed values.
287287
## Design Details
288288

289289
We would like to introduce a structured file format which allows authorization
290-
to be configured using a flag (`--authorization-config-file`) which accepts a
291-
path to a file on the disk. Setting both `--authorization-config-file` and
290+
to be configured using a flag (`--authorization-config`) which accepts a
291+
path to a file on the disk. Setting both `--authorization-config` and
292292
configuring an authorization webhook using the `--authorization-webhook-*`
293293
command line flags will not be allowed. If the user does that,
294294
there will be an error and API Server would exit right away.
@@ -577,7 +577,7 @@ Not applicable.
577577
###### How can this feature be enabled / disabled in a live cluster?
578578

579579
- [x] Feature gate
580-
- Feature gate name: `AuthorizationConfigFromFile`
580+
- Feature gate name: `AuthorizationConfig`
581581
- Components depending on the feature gate:
582582
- kube-apiserver
583583

@@ -591,7 +591,7 @@ Yes, the feature can be disabled once enabled.
591591

592592
###### What happens if we reenable the feature if it was previously rolled back?
593593

594-
When the feature is re-enabled, `--authorization-config-file` flag should be present.
594+
When the feature is re-enabled, `--authorization-config` flag should be present.
595595
The behaviour is the same as when the feature is enabled for the first time.
596596

597597
###### Are there any tests for feature enablement/disablement?
@@ -602,7 +602,7 @@ for the Authorizer chain in both the old and new configuration scenarios.
602602
We will add integration tests to validate the enablement/disablement flow.
603603
- When the feature is disabled, only the existing command line flag `--authorization-webhook-*`
604604
based mode is allowed.
605-
- When the feature is enable, setting both `--authorization-config-file` and
605+
- When the feature is enable, setting both `--authorization-config` and
606606
configuring an authorization webhook using the `--authorization-webhook-*`
607607
command line flags should return an error.
608608

@@ -648,7 +648,7 @@ must be completed when targeting beta to a release.
648648
###### How can an operator determine if the feature is in use by workloads?
649649

650650
The cluster administrators can check the flags passed to the `kube-apiserver` if
651-
they have access to the control plane nodes. If the `--authorization-config-file`
651+
they have access to the control plane nodes. If the `--authorization-config`
652652
is set to a valid authorization configuration file, the feature is being used.
653653
Or, they can look at the metrics exposed by `kube-apiserver`.
654654

0 commit comments

Comments
 (0)