<p>I want to understand how system:discovery role is working in kubernetes.I'm able to see below non resource url's are the privileges contain in system:discovery role</p>

<pre><code>root@kubemas:~# kubectl describe clusterrole system:discovery
Name:         system:discovery
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
             [/api/*]           []              [get]
             [/api]             []              [get]
             [/apis/*]          []              [get]
             [/apis]            []              [get]
             [/healthz]         []              [get]
             [/livez]           []              [get]
             [/openapi/*]       []              [get]
             [/openapi]         []              [get]
             [/readyz]          []              [get]
             [/version/]        []              [get]
             [/version]         []              [get]
</code></pre>

<p>From clusterrolebinding description,</p>

<pre><code>root@kubemas:~# kubectl describe clusterrolebindings.rbac.authorization.k8s.io system:discovery
Name:         system:discovery
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
Role:
  Kind:  ClusterRole
  Name:  system:discovery
Subjects:
  Kind   Name                  Namespace
  ----   ----                  ---------
  Group  system:authenticated  
</code></pre>

<p>I can see only system:authenticated group can access  the non resource url's.If i execute below command,i can understand ,the request user is system:anonymous which coming under the group system:unathenticated ,so not permitted to see the output</p>

<pre><code>root@kubemas:~# curl -k https://192.168.56.101:6443/api
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/api\"",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403
</code></pre>

<p>But i was expecting the same from below request which i'm trying to get the kubernetes version which also non resource url.But i can able to get the version output without error.So how this is working.Is i'm misunderstood this mechanism?</p>

<pre><code>root@kubemas:~# curl -k https://192.168.56.101:6443/version
{
  "major": "1",
  "minor": "18",
  "gitVersion": "v1.18.3",
  "gitCommit": "2e7996e3e2712684bc73f0dec0200d64eec7fe40",
  "gitTreeState": "clean",
  "buildDate": "2020-05-20T12:43:34Z",
  "goVersion": "go1.13.9",
  "compiler": "gc",
  "platform": "linux/amd64"
}root@kubemas:~#
</code></pre>

<p><code>system:public-info-viewer</code> is the clusterrole which gives access to <code>/version</code>. This clusterole is bound to <code>system:authenticated</code> and <code>system:unauthenticated</code> groups. Since it's bound to <code>system:unauthenticated</code> group you are able to access it. </p>

<p>From the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#discovery-roles" rel="noreferrer">docs</a> </p>

<blockquote>
  <p>This clusterole Allows read-only access to non-sensitive information
  about the cluster. Introduced in Kubernetes v1.14.</p>
</blockquote>

<pre><code>kubectl describe clusterrole system:public-info-viewer
Name:         system:public-info-viewer
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
             [/healthz]         []              [get]
             [/livez]           []              [get]
             [/readyz]          []              [get]
             [/version/]        []              [get]
             [/version]         []              [get]
</code></pre>
