KEP-4633: Graduate to BETA.

[vinayakankugoyal]

• One-line PR description: Graduate KEP-4633 to BETA.

• Issue link: Only allow anonymous auth for configured endpoints. #4633

• Other comments:

[vinayakankugoyal]

@liggitt we need to make a call on addressing this. What are your thoughts? I think while it is related to authentication it is a separate concern from the intent of the KEP itself.

[liggitt]

A user that arrives authenticated and is allowed to impersonate system:anonymous is not actually anonymous. I think that is out of scope for this KEP.

This KEP is focused on giving cluster admins a tool to constrain actually anonymous requests. I think it is reasonable to expect cluster admins 1) also control their other configured authenticators, and that 2) other authenticators don't authenticate as system:anonymous.

Admins can already disallow system:anonymous being returned from configured JWT authenticators via userValidationRules. If we wanted to add more options to webhook authenticators and add userValidationRules capabilities there as well, we could consider that, but that is a separate effort.

I wouldn't fold in changes for those to this KEP. You could summarize that and move that discussion to a "possible future improvements" section if you want and delete the "Open Questions for BETA" section

[liggitt]

lgtm once the "open questions" bit is moved to "possible future improvements"

[vinayakankugoyal]

lgtm once the "open questions" bit is moved to "possible future improvements"

Done! Thanks.

[liggitt]

/lgtm
/approve

[liggitt]

/assign @jpbetz
for PRR

[jpbetz]

/approve
For PRR
Thanks for the attention to detail here.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jpbetz, liggitt, vinayakankugoyal

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• keps/prod-readiness/OWNERS [jpbetz]
• keps/sig-auth/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment