(41) Is a massive mutation of the authorizer.Attributes intended? Why? link.

[ibihim]

What

Why do we, by default, only care about those Resource Attributes:

• User
• Verb
• Path

And ignore:

• Namespace
• APIGroup
• APIVersion
• Resource
• SubResource
• Name

Why

Most probably, we assume that there must be a specific authorization to the path we are protecting with kube-rbac-proxy. Speak, is the: User allowed to Verb at Path.

But worth to investigate the behavior of the SAR request created in such a situation, if not trimmed and compare the results.

Notes

• link