kubernetes系统：发现角色机制

我想了解system:discovery角色在kubernetes中是如何工作的。我能够看到下面的非资源url是system:discovery角色中包含的权限

root@kubemas:~# kubectl describe clusterrole system:discovery
Name:         system:discovery
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
             [/api/*]           []              [get]
             [/api]             []              [get]
             [/apis/*]          []              [get]
             [/apis]            []              [get]
             [/healthz]         []              [get]
             [/livez]           []              [get]
             [/openapi/*]       []              [get]
             [/openapi]         []              [get]
             [/readyz]          []              [get]
             [/version/]        []              [get]
             [/version]         []              [get]

根据clusterrolebinding描述

root@kubemas:~# kubectl describe clusterrolebindings.rbac.authorization.k8s.io system:discovery
Name:         system:discovery
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
Role:
  Kind:  ClusterRole
  Name:  system:discovery
Subjects:
  Kind   Name                  Namespace
  ----   ----                  ---------
  Group  system:authenticated  

我只能看到system:authenticated group可以访问非资源url。如果我执行下面的命令，我可以理解，请求用户是system:anonymous，属于group system:Unatehenticated，因此不允许查看输出

root@kubemas:~# curl -k https://192.168.56.101:6443/api
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/api\"",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403

但是我希望从下面的请求中得到相同的结果，我正在尝试获得kubernetes版本，该版本也是非资源url。但是我能够无错误地获得版本输出。那么这是如何工作的呢。我是否误解了这种机制

root@kubemas:~# curl -k https://192.168.56.101:6443/version
{
  "major": "1",
  "minor": "18",
  "gitVersion": "v1.18.3",
  "gitCommit": "2e7996e3e2712684bc73f0dec0200d64eec7fe40",
  "gitTreeState": "clean",
  "buildDate": "2020-05-20T12:43:34Z",
  "goVersion": "go1.13.9",
  "compiler": "gc",
  "platform": "linux/amd64"
}root@kubemas:~#

系统：公共信息查看器是clusterrole，可访问/version。此clusterole绑定到system:authenticated和system:unauthenticated组。因为它绑定到system:unauthenticated group，所以您可以访问它

从

此clusterole允许以只读方式访问非敏感信息 关于集群。在Kubernetes v1.14中引入

系统：公共信息查看器是clusterrole，可访问/version。此clusterole绑定到system:authenticated和system:unauthenticated组。因为它绑定到system:unauthenticated group，所以您可以访问它

从

此clusterole允许以只读方式访问非敏感信息 关于集群。在Kubernetes v1.14中引入

kubectl describe clusterrole system:public-info-viewer
Name:         system:public-info-viewer
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
             [/healthz]         []              [get]
             [/livez]           []              [get]
             [/readyz]          []              [get]
             [/version/]        []              [get]
             [/version]         []              [get]