title: Control plane authentication between components
body: <p>We are writing a service reading data from K8s control plane components. Across different distribution authentication with some of them is different.</p>
  <p>For example the scheduler supports authentication with token that works perfectly.
  However, there are tho -optional- flags that if missing denies all tokens:</p>
  <pre><code>--authentication-kubeconfig string
  kubeconfig file pointing at the 'core' kubernetes server with enough rights to create tokenreviews.authentication.k8s.io. This is optional. If empty, all token requests are considered to be anonymous and no client CA is looked up in the cluster.
  
  --authorization-kubeconfig string
  kubeconfig file pointing at the 'core' kubernetes server with enough rights to create subjectaccessreviews.authorization.k8s.io. This is optional. If empty, all requests not skipped by authorization are forbidden.
  </code></pre>
  <p>In Rancher those flags are missing out of the box and all our requests are denied.</p>
  <ul>
  <li>Do you know if there is an other method to authenticate?</li>
  <li>How the cluster is working without tokens? is it using mtls?</li>
  </ul>