KubeAuthorizerConfig

apiVersion: v1alpha1
kind: KubeAuthorizerConfig
name: node # Name of the authorizer, should be be DNS1123 labels like myauthorizername or subdomains like myauthorizer.example.domain.
type: Node # Type is the name of the authorizer.

apiVersion: v1alpha1
kind: KubeAuthorizerConfig
name: rbac # Name of the authorizer, should be be DNS1123 labels like myauthorizername or subdomains like myauthorizer.example.domain.
type: RBAC # Type is the name of the authorizer.

apiVersion: v1alpha1
kind: KubeAuthorizerConfig
name: webhook # Name of the authorizer, should be be DNS1123 labels like myauthorizername or subdomains like myauthorizer.example.domain.
type: Webhook # Type is the name of the authorizer.
# Webhook is the configuration for the webhook authorizer.
webhook:
    connectionInfo:
        type: InClusterConfig
    failurePolicy: Deny
    matchConditionSubjectAccessReviewVersion: v1
    matchConditions:
        - expression: has(request.resourceAttributes)
        - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
    subjectAccessReviewVersion: v1
    timeout: 3s

apiVersion: v1alpha1
kind: KubeAuthorizerConfig
name: in-cluster-authorizer # Name of the authorizer, should be be DNS1123 labels like myauthorizername or subdomains like myauthorizer.example.domain.
type: Webhook # Type is the name of the authorizer.
# Webhook is the configuration for the webhook authorizer.
webhook:
    connectionInfo:
        type: InClusterConfig
    failurePolicy: NoOpinion
    matchConditionSubjectAccessReviewVersion: v1
    subjectAccessReviewVersion: v1
    timeout: 3s