Document kubelet authentication + authorization

[ericchiang]

Hi! As of Kubernetes 1.5 the kubelet has the ability to restrict its API using client certs or via an internal Kubernetes token. A full overview can be found here:

https://kubernetes.io/docs/admin/kubelet-authentication-authorization/

This isn't on by default, but is a much better than SSH to avoid this exploit.

Maybe a link to this doc could be added to the "workarounds" section? (Happy to send the PR.)

[kayrus]

Yes, I know it was fixed in 1.5. Feel free to add PR, but this repo is not relevant anymore. It was made to draw attention on this issue.

[ericchiang]

@kayrus it's still pretty relevant since the defaults allow this exploit. Even at CoreOS we've got developers who are surprised by this behavior :)

[kayrus]

@ericchiang thus feel free to make a PR