NodeRestriction admission prevents kubelet taint removal (#8911)

kubernetes · Jun 20, 2018 · 4770301 · 4770301
1 parent 40d66b4
commit 4770301
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/content/en/docs/reference/access-authn-authz/admission-controllers.md b/content/en/docs/reference/access-authn-authz/admission-controllers.md
@@ -396,6 +396,7 @@ namespace.  In order to enforce integrity of that process, we strongly recommend
 This admission controller limits the `Node` and `Pod` objects a kubelet can modify. In order to be limited by this admission controller,
 kubelets must use credentials in the `system:nodes` group, with a username in the form `system:node:<nodeName>`.
 Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node.
+In Kubernetes 1.11+, kubelets are not allowed to update or remove taints from their `Node` API object.
 Future versions may add additional restrictions to ensure kubelets have the minimal set of permissions required to operate correctly.
 
 ### OwnerReferencesPermissionEnforcement