keystone-policy-configmap.yaml

# This file lays out the policies of the cluster. It is only used
# if using Keystone for authorization. Note the difference between
# authentication and authorization.

# This configmap allows the users in the project 'demo' that have
# the 'k8s-viewer' role in Keystone to query the pod information
# from all the namespaces. The configmap is in the kube-system
# namespace due to the k8s-keystone-auth service existing in
# the kube-system namespace.

# This is version 1 policy definition

# apiVersion: v1
# kind: ConfigMap
# metadata:
#   name: k8s-auth-policy
# namespace: kube-system
#   labels:
#     k8s-app: k8s-keystone-auth
# data:
#   policies: |
#     [
#       {
#         "resource": {
#          "verbs": ["get", "list", "watch"],
#          "resources": ["pods"],
#          "version": "*",
#           "namespace": "default"
#         },
#        "match": [
#           {
#             "type": "role",
#             "values": ["k8s-viewer"]
#           },
#           {
#             "type": "project",
#             "values": ["demo"]
#           }
#        ]
#       }
#     ]

# This is version 2 policy definition

apiVersion: v1
kind: ConfigMap
metadata:
  name: k8s-auth-policy
  namespace: kube-system
data:
  policies: |
    [
      {
        "users": {
          "projects": ["demo"],
          "roles": ["member"]
        },
        "resource_permissions": {
          "*/pods": ["get", "list", "watch"]
        }
      }
    ]