> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

> KubeAuthorizerConfig configures kube-apiserver authorization by configuring a specific authorization plugin.

# KubeAuthorizerConfig

```yaml theme={null}
apiVersion: v1alpha1
kind: KubeAuthorizerConfig
name: node # Name of the authorizer, should be be DNS1123 labels like myauthorizername or subdomains like myauthorizer.example.domain.
type: Node # Type is the name of the authorizer.
```

```yaml theme={null}
apiVersion: v1alpha1
kind: KubeAuthorizerConfig
name: rbac # Name of the authorizer, should be be DNS1123 labels like myauthorizername or subdomains like myauthorizer.example.domain.
type: RBAC # Type is the name of the authorizer.
```

```yaml theme={null}
apiVersion: v1alpha1
kind: KubeAuthorizerConfig
name: webhook # Name of the authorizer, should be be DNS1123 labels like myauthorizername or subdomains like myauthorizer.example.domain.
type: Webhook # Type is the name of the authorizer.
# Webhook is the configuration for the webhook authorizer.
webhook:
    connectionInfo:
        type: InClusterConfig
    failurePolicy: Deny
    matchConditionSubjectAccessReviewVersion: v1
    matchConditions:
        - expression: has(request.resourceAttributes)
        - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
    subjectAccessReviewVersion: v1
    timeout: 3s
```

```yaml theme={null}
apiVersion: v1alpha1
kind: KubeAuthorizerConfig
name: in-cluster-authorizer # Name of the authorizer, should be be DNS1123 labels like myauthorizername or subdomains like myauthorizer.example.domain.
type: Webhook # Type is the name of the authorizer.
# Webhook is the configuration for the webhook authorizer.
webhook:
    connectionInfo:
        type: InClusterConfig
    failurePolicy: NoOpinion
    matchConditionSubjectAccessReviewVersion: v1
    subjectAccessReviewVersion: v1
    timeout: 3s
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`name`</td>
      <td>string</td>
      <td>Name of the authorizer, should be be DNS1123 labels like myauthorizername or subdomains like myauthorizer.example.domain.</td>

      <td />
    </tr>

    <tr>
      <td>`type`</td>
      <td>string</td>
      <td>Type is the name of the authorizer.</td>
      <td>`Node`<br />`RBAC`<br />`Webhook`<br /></td>
    </tr>

    <tr>
      <td>`webhook`</td>
      <td>Unstructured</td>
      <td>Webhook is the configuration for the webhook authorizer.<br /><br />This field is required if the AuthorizerType is Webhook, should not be set for other authorizer types.<br />The value is the literal Kubernetes webhook authorizer configuration.</td>

      <td />
    </tr>
  </tbody>
</table>