* GKE/GCE: New and upgraded 1.7 GCE/GKE clusters no longer have an RBAC ClusterRoleBinding that grants the cluster-admin ClusterRole to the default service account in the kube-system Namespace. ([#46750](https://github.com/kubernetes/kubernetes/pull/46750), [@cjcullen](https://github.com/cjcullen)). If this permission is still desired, run the following command to explicitly grant it, either before or after upgrading to 1.7:
    ```

* New and upgraded 1.7 GCE/GKE clusters no longer have an RBAC ClusterRoleBinding that grants the `cluster-admin` ClusterRole to the `default` service account in the `kube-system` namespace. ([#46750](https://github.com/kubernetes/kubernetes/pull/46750), [@cjcullen](https://github.com/cjcullen))
    * If this permission is still desired, run the following command to explicitly grant it, either before or after upgrading to 1.7:

  You can still access kubelet's `/healthz`, `/pods` and `/configz` by granting the caller `nodes/proxy` permission in RBAC but that also grants the caller permissions to exec, run and attach to containers on the nodes and doing so does not follow the least privilege principle. Granting callers more permissions than they need can give attackers an opportunity to escalate privileges. ([#12...

fa-brands-400.svg...

fa-brands-400.svg...

Shinsuke Sugaya <******@****.***> 1576358545 +0900

Shinsuke Sugaya <******@****.***> 1576358545 +0900

Shinsuke Sugaya <******@****.***> 1576358545 +0900

Shinsuke Sugaya <******@****.***> 1576358545 +0900

        // When
        Trans2QueryPathInformation trans = new Trans2QueryPathInformation(filename, informationLevel);

        // Then
        assertEquals(filename, trans.path, "The path should be set correctly.");
        assertEquals(ServerMessageBlock.SMB_COM_TRANSACTION2, trans.command, "The command should be SMB_COM_TRANSACTION2.");
        assertEquals(SmbComTransaction.TRANS2_QUERY_PATH_INFORMATION, trans.subCommand,