Merge pull request #528 from enj/enj/i/impersonation-proxy-authz-user-extra

impersonation proxy: add RBAC to impersonate user extra and SAs
2021-03-26 00:37:24 -04:00 · 2021-03-26 00:37:24 -04:00 · c2588cf035
parent b6e217e13a 2179c2879a
commit c2588cf035
1 changed files with 4 additions and 1 deletions
--- a/deploy/concierge/rbac.yaml
+++ b/deploy/concierge/rbac.yaml
@ -32,7 +32,10 @@ rules:
    verbs: [ use ]
    resourceNames: [ nonroot ]
  - apiGroups: [ "" ]
-    resources: [ "users", "groups" ]
+    resources: [ "users", "groups", "serviceaccounts" ]
+    verbs: [ "impersonate" ]
+  - apiGroups: [ "authentication.k8s.io" ]
+    resources: [ "*" ]  #! What we really want is userextras/* but the RBAC authorizer only supports */subresource, not resource/*
    verbs: [ "impersonate" ]
  - apiGroups: [ "" ]
    resources: [ nodes ]