linkerd
Include extra attributes in SubjectAccessReview
Kubernetes authorization plugins can rely on extra attributes on a user, and these are provided via X-Remote-Extra- headers. Currently the Linkerd Viz tap API doesn't include these attributes when making the SubjectAccessReview request which means the Tap API cannot be used by end-users who's clusters use such authz plugins.
This change updates the tap controller to parse the X-Remote-Extra- headers and include them in the SubjectAccessReview request.
Fixed #13169
Hey @multimac, just a quick check-in -- we're heads-down to ship Linkerd 2.17 but will be coming back to this as soon as we can. Sorry for the delay!
This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.
![stale[bot] avatar](https://avatars.githubusercontent.com/in/1724?v=4 "Published by a pub.dev verified publisher"){kind=small}
@kflynn: Looks like 2.17 is out by now. Is there plan to revisit this?
Unassigning @adleong so that this bubbles back up for prioritization. Since this branch isn't passing CI, it will clearly need some more work before it can be merged.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.