kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Callout that impersonation needs (ClusterRole)Binding (#34082) 

* Callout that impersonation needs (ClusterRole)Binding

I learned through trial and error that impersonation does not work with Role and RoleBinding - this was not obvious. It would be good if the docs call this out.

* Update content/en/docs/reference/access-authn-authz/authentication.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/en/docs/reference/access-authn-authz/authentication.md

Co-authored-by: Tim Bannister <tim@scalefactory.com>

* Update content/en/docs/reference/access-authn-authz/authentication.md

Co-authored-by: ZSC <zacharysarah@users.noreply.github.com>

* Update content/en/docs/reference/access-authn-authz/authentication.md

Co-authored-by: ZSC <zacharysarah@users.noreply.github.com>

Co-authored-by: Qiming Teng <tengqm@outlook.com>
Co-authored-by: Tim Bannister <tim@scalefactory.com>
Co-authored-by: ZSC <zacharysarah@users.noreply.github.com>
This commit is contained in:
Raki 2022-06-14 13:09:33 -07:00 committed by GitHub
parent 7aa5a90d74
commit af65de3877
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
content/en/docs/reference/access-authn-authz/authentication.md
View File

@ -856,6 +856,14 @@ rules:
resourceNames: ["06f6ce97-e2c5-4ab8-7ba5-7654dd08d52b"]
```
{{< note >}}
Impersonating a user or group allows you to perform any action as if you were that user or group;
for that reason, impersonation is not namespace scoped.
If you want to allow impersonation using Kubernetes RBAC,
this requires using a `ClusterRole` and a `ClusterRoleBinding`,
not a `Role` and `RoleBinding`.
{{< /note >}}
## client-go credential plugins
{{< feature-state for_k8s_version="v1.22" state="stable" >}}