djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #528 from enj/enj/i/impersonation-proxy-authz-user-extra

Browse Source 
impersonation proxy: add RBAC to impersonate user extra and SAs
This commit is contained in:
Mo Khan 2021-03-26 00:37:24 -04:00 committed by GitHub
commit c2588cf035
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
deploy/concierge/rbac.yaml
View File

@ -32,7 +32,10 @@ rules:
verbs: [ use ] verbs: [ use ]
resourceNames: [ nonroot ] resourceNames: [ nonroot ]
- apiGroups: [ "" ] - apiGroups: [ "" ]
resources: [ "users", "groups" ] resources: [ "users", "groups", "serviceaccounts" ]
verbs: [ "impersonate" ]
- apiGroups: [ "authentication.k8s.io" ]
resources: [ "*" ] #! What we really want is userextras/* but the RBAC authorizer only supports */subresource, not resource/*
verbs: [ "impersonate" ] verbs: [ "impersonate" ]
- apiGroups: [ "" ] - apiGroups: [ "" ]
resources: [ nodes ] resources: [ nodes ]