Feature: RBAC Add view, edit and admin roles for BackendConfig #2608
Description
Right now if you issue edit role on a Namespace, you cannot add BackendConfigs within that namespace by default.
I propose that we add those ClusterRoles in:
This is what I am thinking:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: ingress-gce-edit
labels:
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
- apiGroups:
- cloud.google.com
resources:
- backendconfigs
verbs:
- create
- delete
- deletecollection
- patch
- update
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: ingress-gce-view
labels:
rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
- apiGroups:
- cloud.google.com
resources:
- backendconfigs
verbs:
- get
- list
- watch
I know that EndpointSlices were disabled from edit permission due to possible cross-namespace namespace forwarding. I don't believe this is a problem in BackendConfigs, but someone with experience with the implimentation should confirm. See: kubernetes/kubernetes#103675