djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

impersonation proxy: add RBAC to impersonate user extra and SAs

Browse Source 
Signed-off-by: Monis Khan <mok@vmware.com>
This commit is contained in:
Monis Khan 2021-03-25 17:09:29 -04:00
parent b6e217e13a
commit 2179c2879a
No known key found for this signature in database
GPG Key ID: 52C90ADA01B269B8
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
deploy/concierge/rbac.yaml
View File

@ -32,7 +32,10 @@ rules:
verbs: [ use ] verbs: [ use ]
resourceNames: [ nonroot ] resourceNames: [ nonroot ]
- apiGroups: [ "" ] - apiGroups: [ "" ]
resources: [ "users", "groups" ] resources: [ "users", "groups", "serviceaccounts" ]
verbs: [ "impersonate" ]
- apiGroups: [ "authentication.k8s.io" ]
resources: [ "*" ] #! What we really want is userextras/* but the RBAC authorizer only supports */subresource, not resource/*
verbs: [ "impersonate" ] verbs: [ "impersonate" ]
- apiGroups: [ "" ] - apiGroups: [ "" ]
resources: [ nodes ] resources: [ nodes ]