The proxy sidecar delegates certain authorization requests to Openshift.

• It delegates authorization checks for specific resources (identified by name) using the --openshift-delegate-urls option (this is defined as static per host). For example:

--openshift-delegate-urls ={"/": {"resource": "services", "verb": "get", "name": "odh-dashboard" } }

* For each newly created notebook namespace, the injected oauth-proxy defines SARs (SubjectAccessReviews) to ensure that a given user can perform certain actions on a particular resource, for example:

--openshift-sar= {"verb":"get","resource":"notebooks","resourceAPIGroup":"kubeflow.org", + "resourceName":" + notebook.Name + ","namespace":"$(NAMESPACE)" }

With offloading it to the mesh we have to find a way to provide those checks.

See Kubernetes docs about authentication and authorization for more details.