Migrate SubjectAccessReview from authorization.k8s.io/v1beta1

SubjectAccessReview asks the authorizer whether any user can perform an action. The kubelet and extension API servers use it to check access to their own APIs. Kubernetes 1.22 removed v1beta1, and in v1 the spec.group field that lists the user's groups is renamed to spec.groups.

What replaces it

Replacement

authorization.k8s.io/v1

Available since

1.6

Deprecated in

1.19

Removed in

1.22

Check a manifest against 1.22, or read the official documentation.

Migration notes

• spec.group was renamed to spec.groups in v1

Before and after

Before:

apiVersion: authorization.k8s.io/v1beta1
kind: SubjectAccessReview
metadata:
  name: can-jane-get-pods
spec:
  user: jane
  group: ["developers"]
  resourceAttributes:
    namespace: shop
    verb: get
    resource: pods

After:

apiVersion: authorization.k8s.io/v1
kind: SubjectAccessReview
metadata:
  name: can-jane-get-pods
spec:
  user: jane
  groups: ["developers"]
  resourceAttributes:
    namespace: shop
    verb: get
    resource: pods