T2system:auth-delegatorcluster
Allows extension API servers to delegate authentication and authorization to the main Kubernetes API server via TokenReview and SubjectAccessReview.
- →
Used by aggregated API servers (metrics-server, custom API extensions) to validate caller identities.
- →
A compromised extension server with this role can probe whether arbitrary service account tokens are valid against the API server.
Permissions (2)
| apiGroup | resources / urls | verbs |
|---|---|---|
| authentication.k8s.io | tokenreviews | create |
| authorization.k8s.io | subjectaccessreviews | create |
Audit: RequestResponseK8s docs ↗