# this rolebinding allows access to the in-cluster CA bundles for authentication, the request header flags, and
# the front-proxy CA configuration so that anyone can set up a DelegatingAuthenticator that can terminate
# client certificates.
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: authentication-reader-for-authenticated-users
  namespace: kube-system
roleRef:
  kind: Role
  name: extension-apiserver-authentication-reader
  apiGroup: rbac.authorization.k8s.io
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: system:authenticated
