Are there security implication when granting system:service-account-issuer-discovery for system:unauthenticated in OpenShift Container Platform 4
Issue
-
We were requested to apply the below change on our platform and we now would like to know if we may hit security implication / risk when granting the below
ClusterRoletosystem:unauthenticated.kubectl create clusterrolebinding oidc-reviewer \ --clusterrole=system:service-account-issuer-discovery \ --group=system:unauthenticated -
oidc-reviewerneedssystem:unauthicated. - Are there concerns with regards to security when granting
system:service-account-issuer-discoveryforsystem:unauthenticated?
Environment
- Red Hat OpenShift Container Platform (RHOCP) 4
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.