<p>When a client authenticates to the apiserver, a number of <a href="https://kubernetes.io/docs/admin/authentication/#authentication-strategies" rel="nofollow noreferrer">attributes are associated with the request</a>. These attributes include an "extra" attribute which is just a map of strings to lists of strings.</p>

<p>Authorisation plugins can review these attributes to make authorisation decisions. Does the RBAC authorisation plugin support reviewing these "extra" attributes?</p>

dippynark
<p>A brief description of extra attributes from <a href="https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go#L31" rel="nofollow noreferrer">source code</a> tells that:</p>

<pre><code>    // GetExtra can contain any additional information that the authenticator
    // thought was interesting.  One example would be scopes on a token.
    // Keys in this map should be namespaced to the authenticator or
    // authenticator/authorizer pair making use of them.
    // For instance: "example.org/foo" instead of "foo"
    // This is a map[string][]string because it needs to be serializeable into
    // a SubjectAccessReviewSpec.authorization.k8s.io for proper authorization
    // delegation flows
    // In order to faithfully round-trip through an impersonation flow, these keys
    // MUST be lowercase.
    GetExtra() map[string][]string
}

func (i *DefaultInfo) GetExtra() map[string][]string {
    return i.Extra
}
</code></pre>

<p>After reading the code I haven't found any reference to extra attributes.<br>
It looks like extra attributes are not used in RBAC plugin at the moment, but can be used in <a href="https://kubernetes.io/docs/admin/authorization/webhook/" rel="nofollow noreferrer">Webhook authorization mode</a>.</p>
