Migrate LocalSubjectAccessReview from authorization.k8s.io/v1beta1

LocalSubjectAccessReview asks whether a user can perform an action in one namespace. It is a request, not a stored object, so it lives in code rather than manifests. Kubernetes 1.22 removed the v1beta1 version, and in v1 the spec.group field is renamed to spec.groups.

What replaces it

Replacement

authorization.k8s.io/v1

Available since

1.6

Deprecated in

1.19

Removed in

1.22

Check a manifest against 1.22, or read the official documentation.

Migration notes

• spec.group was renamed to spec.groups in v1

Before and after

Before:

apiVersion: authorization.k8s.io/v1beta1
kind: LocalSubjectAccessReview
metadata:
  name: can-jane-get-pods
  namespace: shop
spec:
  user: jane
  group: ["developers"]
  resourceAttributes:
    namespace: shop
    verb: get
    resource: pods

After:

apiVersion: authorization.k8s.io/v1
kind: LocalSubjectAccessReview
metadata:
  name: can-jane-get-pods
  namespace: shop
spec:
  user: jane
  groups: ["developers"]
  resourceAttributes:
    namespace: shop
    verb: get
    resource: pods