Aggregating ClusterRoles

Aggregating ClusterRoles

Automagically aggregate rules into new ClusterRoles

```yaml [5-8] apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: monitoring aggregationRule: clusterRoleSelectors:

• matchLabels: aggregate-to-monitoring: “true” rules: [] ```

```yaml [5-6] apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: monitoring-endpoints labels: aggregate-to-monitoring: “true” rules:

• apiGroups: [””] resources: [“services”, “endpointslices”, “pods”] verbs: [“get”, “list”, “watch”] ```

Heavily used in builtin ClusterRoles

• rbac.authorization.k8s.io/aggregate-to-(admin|edit|view)

Demo

Inspect builtin ClusterRoles with aggregation

Create custom aggregation