Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-8236

[kube-rbac-proxy] Feature Parity with oauth-proxy

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • None
    • None
    • None
    • None
    • Product / Portfolio Work
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Goal: Feature parity between KRP and Oauth-proxy. 

      Features listed below: 

      As part of the rbac configuration for https://github.com/openshift/oauth-proxy users could define a "verb" at the top level for an rbac expression. For example ...

      --openshift-sar={"namespace": "NAMESPACE", "resource": "inferenceservices", "group": "serving.kserve.io", "name": "ISVC_NAME", "verb": "get"}
      

      Currently, kube-rbac-proxy doesn't allow for "verb" at the "resourceAttribute" level. It can only be declared in the "static" section, which then also requires declaring a "user" for proper evaluation, which is not exactly the same as how it worked for oauth-proxy.

      We would like to extend the configuration schema of kube-rbac-proxy's "resourceAttribute" section to have an explicit declaration of the http verb to use, instead of inheriting whatever method the incoming request is.

              atelang@redhat.com Anjali Telang
              jtanner@redhat.com James Tanner
              None
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                None
                None