-
Feature Request
-
Resolution: Unresolved
-
Major
-
None
-
None
-
None
-
None
-
None
-
Product / Portfolio Work
-
None
-
False
-
-
None
-
None
-
None
-
-
None
-
None
-
None
-
None
-
None
Goal: Feature parity between KRP and Oauth-proxy.
Features listed below:
As part of the rbac configuration for https://github.com/openshift/oauth-proxy users could define a "verb" at the top level for an rbac expression. For example ...
--openshift-sar={"namespace": "NAMESPACE", "resource": "inferenceservices", "group": "serving.kserve.io", "name": "ISVC_NAME", "verb": "get"}
Currently, kube-rbac-proxy doesn't allow for "verb" at the "resourceAttribute" level. It can only be declared in the "static" section, which then also requires declaring a "user" for proper evaluation, which is not exactly the same as how it worked for oauth-proxy.
We would like to extend the configuration schema of kube-rbac-proxy's "resourceAttribute" section to have an explicit declaration of the http verb to use, instead of inheriting whatever method the incoming request is.
- is duplicated by
-
OCPSTRAT-2510 Feature Parity between kube-rbac-proxy and oauth-proxy
-
- Refinement
-