},
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",
            "version": "v1"
          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",
            "version": "v1alpha1"
          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",

- Added RBAC reconcile commands with `kubectl auth reconcile -f FILE`. When
  passed a file which contains RBAC roles, rolebindings, clusterroles, or
  clusterrolebindings, this command computes covers and adds the missing rules.
  The logic required to properly apply RBAC permissions is more complicated

---
# Source: calico/templates/calico-node-rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: calico-node
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: calico-node
subjects:
- kind: ServiceAccount
  name: calico-node
  namespace: kube-system
---
# Source: calico/templates/calico-node-rbac.yaml

- Kubeadm: avoided uploading a defaulted flag value "--authorization-mode=Node,RBAC" for the kube-apiserver in the ClusterConfiguration stored in the "kube-system/kubeadm-config" ConfigMap. "Node,RBAC" are already the kubeadm defaults for this flag, so this action is redundant. ([#123555](https://github.com/kubernetes/kubernetes/pull/123555), [@neolit123](https://github.com/neolit123))

          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",
            "version": "v1"
          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",
            "version": "v1alpha1"
          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",

          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",
            "version": "v1"
          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",
            "version": "v1alpha1"
          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",

 - `kubeadm`: a separate "super-admin.conf" file is now deployed. The User in `admin.conf` is now bound to a new RBAC Group `kubeadm:cluster-admins` that has `cluster-admin` `ClusterRole` access. The User in `super-admin.conf` is now bound to the `system:masters` built-in super-powers / break-glass Group that can bypass RBAC. Before this change, the default `admin.conf` was bound to `system:masters` Group, which was undesired. Executing `kubeadm init phase kubeconfig...

          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",
            "version": "v1"
          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",
            "version": "v1alpha1"
          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",

          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",
            "version": "v1"
          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",
            "version": "v1alpha1"
          },
          {
            "group": "rbac.authorization.k8s.io",
            "kind": "DeleteOptions",

Beta and enabled the feature by default. This implies that 1) for new clusters kubeadm will start using the `kube-system/kubelet-config` naming scheme for the kubelet ConfigMap and RBAC rules, instead of the legacy `kubelet-config-x.yy` naming. 2) during upgrade, kubeadm will only write the new scheme ConfigMap and RBAC objects. To disable the feature you can pass `UnversionedKubeletConfigMap: false` in the kubeadm config for new clusters. For upgrade on existing clusters you can also override the...