kubernetes module: default auth mode to only RBAC

nixos/modules/services/cluster/kubernetes/default.nix

···
 
   taints = concatMapStringsSep "," (v: "${v.key}=${v.value}:${v.effect}") (mapAttrsToList (n: v: v) cfg.kubelet.taints);
 
-  defaultAuthorizationPolicy = (optionals (any (el: el == "ABAC") cfg.apiserver.authorizationMode) [
-    {
-      apiVersion = "abac.authorization.kubernetes.io/v1beta1";
-      kind = "Policy";
-      spec = {
-        user  = "kubecfg";
-        namespace = "*";
-        resource = "*";
-        apiGroup = "*";
-        nonResourcePath = "*";
-      };
-    }
-    {
-      apiVersion = "abac.authorization.kubernetes.io/v1beta1";
-      kind = "Policy";
-      spec = {
-        user  = "kubelet";
-        namespace = "*";
-        resource = "*";
-        apiGroup = "*";
-        nonResourcePath = "*";
-      };
-    }
-    {
-      apiVersion = "abac.authorization.kubernetes.io/v1beta1";
-      kind = "Policy";
-      spec = {
-        user  = "kube-worker";
-        namespace = "*";
-        resource = "*";
-        apiGroup = "*";
-        nonResourcePath = "*";
-      };
-    }
-    {
-      apiVersion = "abac.authorization.kubernetes.io/v1beta1";
-      kind = "Policy";
-      spec = {
-        user  = "kube_proxy";
-        namespace = "*";
-        resource = "*";
-        apiGroup = "*";
-        nonResourcePath = "*";
-      };
-    }
-    {
-      apiVersion = "abac.authorization.kubernetes.io/v1beta1";
-      kind = "Policy";
-      spec = {
-        user  = "client";
-        namespace = "*";
-        resource = "*";
-        apiGroup = "*";
-        nonResourcePath = "*";
-      };
-    }
-  ]) ++ (optionals (all (el: el != "RBAC") cfg.apiserver.authorizationMode) [
-    {
-      apiVersion = "abac.authorization.kubernetes.io/v1beta1";
-      kind = "Policy";
-      spec = {
-        user  = "admin";
-        namespace = "*";
-        resource = "*";
-        apiGroup = "*";
-        nonResourcePath = "*";
-      };
-    }
-    {
-      apiVersion = "abac.authorization.kubernetes.io/v1beta1";
-      kind = "Policy";
-      spec = {
-        group  = "system:serviceaccounts";
-        namespace = "*";
-        resource = "*";
-        apiGroup = "*";
-        nonResourcePath = "*";
-      };
-    }
-  ]);
-
   # needed for flannel to pass options to docker
   mkDockerOpts = pkgs.runCommand "mk-docker-opts" {
     buildInputs = [ pkgs.makeWrapper ];
···
           Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
           <link xlink:href="http://kubernetes.io/docs/admin/authorization.html"/>
         '';
-        default = ["ABAC" "RBAC"];
+        default = ["RBAC"];
         type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC"]);
       };
 
···
           Kubernetes apiserver authorization policy file. See
           <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authorization.html"/>
         '';
-        default = defaultAuthorizationPolicy;
+        default = [];
         type = types.listOf types.attrs;
       };