Merge pull request #37020 from deads2k/rbac-20-delegated-role

Automatic merge from submit-queue auth delegation role Add a bootstrap role for authentication and authorization delegation. Useful for extension API servers. @kubernetes/sig-auth

Merge pull request #37020 from deads2k/rbac-20-delegated-role
4c504867 · Kubernetes Submit Queue · GitHub · e407a1fe · 18a909ed · 4c504867
Commit 4c504867 authored Dec 01, 2016 by Kubernetes Submit Queue Committed by GitHub Dec 01, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 9 additions and 0 deletions

policy.go plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go +9 -0

No files found.
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
@@ -194,6 +194,15 @@ func ClusterRoles() []rbac.ClusterRole {
 				rbac.NewRule("list", "watch").Groups(legacyGroup).Resources("services", "endpoints").RuleOrDie(),
 			},
 		},
+		{
+			// a role to use for allowing authentication and authorization delegation
+			ObjectMeta: api.ObjectMeta{Name: "system:auth-delegator"},
+			Rules: []rbac.PolicyRule{
+				// These creates are non-mutating
+				rbac.NewRule("create").Groups(authenticationGroup).Resources("tokenreviews").RuleOrDie(),
+				rbac.NewRule("create").Groups(authorizationGroup).Resources("subjectaccessreviews").RuleOrDie(),
+			},
+		},
 	}
 }