Pregunta de Service Configuration #019e3a4f

The default value for the --authorization-mode flag in the Kubernetes API server is AlwaysAllow. This means that by default, all requests to the API server are allowed without any authorization checks. This is a permissive setting intended for development or testing environments, but it is not recommended for production use.

How it Works

The --authorization-mode flag determines how the API server authorizes requests. The available modes include:

• AlwaysAllow: Allows all requests (default).
• AlwaysDeny: Denies all requests.
• ABAC (Attribute-Based Access Control): Uses policies defined in a file.
• RBAC (Role-Based Access Control): Uses roles and role bindings.
• Webhook: Delegates authorization to an external HTTP service.
• Node: Special mode for authorizing kubelet requests.

When no --authorization-mode is specified, the API server defaults to AlwaysAllow. This can be verified by checking the API server's help output or documentation.

Why the Correct Value is Right

The AlwaysAllow mode is the default because it provides the simplest setup for getting started with Kubernetes. It allows all requests without requiring any configuration of authorization policies. However, for production clusters, it is strongly recommended to enable RBAC or another authorization mode to enforce security.

Why the Incorrect Values are Wrong

• --authorization-mode=RBAC: RBAC is not the default; it must be explicitly enabled by setting the flag to RBAC. It is a common choice for production but not the default.
• --authorization-mode=AlwaysDeny: This mode denies all requests, which would make the cluster unusable unless combined with other modes. It is not the default.
• --authorization-mode=ABAC: ABAC is an older authorization mode that requires a policy file. It is not the default and is less commonly used than RBAC.

In summary, the default authorization mode is AlwaysAllow, which is permissive and should be changed for production environments.