@@ -287,8 +287,8 @@ will not be able to start. This can be mitigated by fixing the malformed values.
287
287
# # Design Details
288
288
289
289
We would like to introduce a structured file format which allows authorization
290
- to be configured using a flag (`--authorization-config-file `) which accepts a
291
- path to a file on the disk. Setting both `--authorization-config-file ` and
290
+ to be configured using a flag (`--authorization-config`) which accepts a
291
+ path to a file on the disk. Setting both `--authorization-config` and
292
292
configuring an authorization webhook using the `--authorization-webhook-*`
293
293
command line flags will not be allowed. If the user does that,
294
294
there will be an error and API Server would exit right away.
@@ -577,7 +577,7 @@ Not applicable.
577
577
# ##### How can this feature be enabled / disabled in a live cluster?
578
578
579
579
- [x] Feature gate
580
- - Feature gate name : ` AuthorizationConfigFromFile `
580
+ - Feature gate name : ` AuthorizationConfig `
581
581
- Components depending on the feature gate :
582
582
- kube-apiserver
583
583
@@ -591,7 +591,7 @@ Yes, the feature can be disabled once enabled.
591
591
592
592
# ##### What happens if we reenable the feature if it was previously rolled back?
593
593
594
- When the feature is re-enabled, `--authorization-config-file ` flag should be present.
594
+ When the feature is re-enabled, `--authorization-config` flag should be present.
595
595
The behaviour is the same as when the feature is enabled for the first time.
596
596
597
597
# ##### Are there any tests for feature enablement/disablement?
@@ -602,7 +602,7 @@ for the Authorizer chain in both the old and new configuration scenarios.
602
602
We will add integration tests to validate the enablement/disablement flow.
603
603
- When the feature is disabled, only the existing command line flag `--authorization-webhook-*`
604
604
based mode is allowed.
605
- - When the feature is enable, setting both `--authorization-config-file ` and
605
+ - When the feature is enable, setting both `--authorization-config` and
606
606
configuring an authorization webhook using the `--authorization-webhook-*`
607
607
command line flags should return an error.
608
608
@@ -648,7 +648,7 @@ must be completed when targeting beta to a release.
648
648
# ##### How can an operator determine if the feature is in use by workloads?
649
649
650
650
The cluster administrators can check the flags passed to the `kube-apiserver` if
651
- they have access to the control plane nodes. If the `--authorization-config-file `
651
+ they have access to the control plane nodes. If the `--authorization-config`
652
652
is set to a valid authorization configuration file, the feature is being used.
653
653
Or, they can look at the metrics exposed by `kube-apiserver`.
654
654
0 commit comments