RedHat allows following roles for system:anonymous user and system:unauthenticated group: 

oc get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.kind

== "Group" and .subjects[]?.name == "system:unauthenticated") |

.metadata.name' | uniq

Returns what unauthenticated users can do, which is the following:

"self-access-reviewers"

"system:oauth-token-deleters"

"system:openshift:public-info-viewer"

"system:public-info-viewer"

"system:scope-impersonation"

"system:webhooks"

Customers would like to minimize the allowed permissions to unauthenticated groups and users. 

Workaround available: Gating the access with policy engines 

Outcome: Minimize the allowed roles for unauthenticated access 

Goals of spike:

1. Investigate impact of disabling the roles listed above for new and existing clusters
2. Document risks and feasibility