Glossary
system:anonymous
The username Kubernetes gives to unauthenticated API requests when anonymous authentication is enabled, in the group system:unauthenticated.
When anonymous authentication is enabled, requests without credentials are authenticated as system:anonymous, in group system:unauthenticated. Out of the box they can usually only reach health and discovery endpoints. It can be disabled with --anonymous-auth=false, or limited to specific paths with the authentication configuration file on recent versions.
A (Cluster)RoleBinding naming system:anonymous or system:unauthenticated gives its rights to anyone who can reach the API server. In the audit log, look for such bindings and for allowed anonymous requests beyond health endpoints. See RBAC privilege escalation and the authentication documentation.