RBAC可以设置subject:user,group和serviceaccount.

user不是k8s管理的，可以通过具体的服务进行管理。对应k8s中就是secret。

serviceaccount是通过k8s管理的。就是每个pod访问api server的权限。

api启动参数分为--client的各种crt,key kubelete各种证书，tls(api srever自己用于客户端认证)各种证书，service account,etcd,bootstrap-token-auth（用于kubelete启动自动获取证书的证书）

aggregate api:

The kube-apiserver needs a proxy client certificate for the aggregated API servers to trust in order to effectively proxy authentication. kubeadm already has the cert/key pairs required and #43715 wires them together.

We need similar wiring for kube-up.sh so that our e2e tests can test the authentication and authorization flows.

所以apiserver需要设置如下:

 - --proxy-client-cert-file=/etc/kubernetes/secrets/apiserver-proxy.crt
        - --proxy-client-key-file=/etc/kubernetes/secrets/apiserver-proxy.key
        - --requestheader-client-ca-file=/etc/kubernetes/secrets/aggregator-ca.crt
        - --requestheader-allowed-names=kube-apiserver-proxy
        - --requestheader-extra-headers-prefix=X-Remote-Extra-
        - --requestheader-group-headers=X-Remote-Group
        - --requestheader-username-headers=X-Remote-User