# This file lays out the policies of the cluster. It is only used
# if using Keystone for authorization. Note the difference between
# authentication and authorization.

# This configmap allows the users in the project 'demo' that have
# the 'k8s-viewer' role in Keystone to query the pod information
# from all the namespaces. The configmap is in the kube-system
# namespace due to the k8s-keystone-auth service existing in
# the kube-system namespace.

apiVersion: v1
kind: ConfigMap
metadata:
  name: k8s-auth-policy
  namespace: kube-system
  labels:
    k8s-app: k8s-keystone-auth
data:
  policies: |
    [
      {
        "resource": {
          "verbs": ["get", "list", "watch"],
          "resources": ["pods"],
          "version": "*",
          "namespace": "default"
        },
        "match": [
          {
            "type": "role",
            "values": ["k8s-viewer"]
          },
          {
            "type": "project",
            "values": ["demo"]
          }
        ]
      }
    ]
