Document TLS bootstrapping authorization requirements

[ericchiang]

Per comment in #1684 (comment) we currently recommend users give the TLS bootstrapping token the following user info:

02b50b05283e98dd0fd71db496ef01e8,kubelet-bootstrap,10001,"system:kubelet-bootstrap"

We need to document the authorization rule to associate with that group.

[liggitt]

kubernetes/kubernetes#40034 added a system:node-bootstrapper role

[liggitt]

also, "system:kubelet-bootstrap" is an example, not a specific group name recommendation

[ericchiang]

Awesome. Do we sync those default roles to kubernetes.io yet?

[liggitt]

we're trying (c.f. #2169), but there's apparently not a good way to merge pulls for work in master that hasn't hit a release yet (e.g. a release-1.6 doc branch)

[ericchiang]

We don't have a 1.6 branch? :(

Okay I'll keep my eye on that PR. Thanks.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale