From af65de3877261354922f1ed3b1b2dc32a6998d75 Mon Sep 17 00:00:00 2001 From: Raki <46581776+mdrakiburrahman@users.noreply.github.com> Date: Tue, 14 Jun 2022 13:09:33 -0700 Subject: [PATCH] Callout that impersonation needs (ClusterRole)Binding (#34082) * Callout that impersonation needs (ClusterRole)Binding I learned through trial and error that impersonation does not work with Role and RoleBinding - this was not obvious. It would be good if the docs call this out. * Update content/en/docs/reference/access-authn-authz/authentication.md Co-authored-by: Qiming Teng * Update content/en/docs/reference/access-authn-authz/authentication.md Co-authored-by: Tim Bannister * Update content/en/docs/reference/access-authn-authz/authentication.md Co-authored-by: ZSC * Update content/en/docs/reference/access-authn-authz/authentication.md Co-authored-by: ZSC Co-authored-by: Qiming Teng Co-authored-by: Tim Bannister Co-authored-by: ZSC --- .../docs/reference/access-authn-authz/authentication.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index b33b239199..1641cb8e54 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -856,6 +856,14 @@ rules: resourceNames: ["06f6ce97-e2c5-4ab8-7ba5-7654dd08d52b"] ``` +{{< note >}} +Impersonating a user or group allows you to perform any action as if you were that user or group; +for that reason, impersonation is not namespace scoped. +If you want to allow impersonation using Kubernetes RBAC, +this requires using a `ClusterRole` and a `ClusterRoleBinding`, +not a `Role` and `RoleBinding`. +{{< /note >}} + ## client-go credential plugins {{< feature-state for_k8s_version="v1.22" state="stable" >}}