Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

Chapter 13. Scoping tokens

13.1. About scoping tokens
Copiar enlace

You can create scoped tokens to delegate some of your permissions to another user or service account. For example, a project administrator might want to delegate the power to create pods.

A scoped token is a token that identifies as a given user but is limited to certain actions by its scope. Only a user with the 

cluster-admin
role can create scoped tokens.

Scopes are evaluated by converting the set of scopes for a token into a set of 

PolicyRules
. Then, the request is matched against those rules. The request attributes must match at least one of the scope rules to be passed to the "normal" authorizer for further authorization checks.

13.1.1. User scopes
Copiar enlace

User scopes are focused on getting information about a given user. They are intent-based, so the rules are automatically created for you: 

  • user:full
    - Allows full read/write access to the API with all of the user’s permissions. 
  • user:info
    - Allows read-only access to information about the user, such as name and groups. 
  • user:check-access
    - Allows access to 
    self-localsubjectaccessreviews
    and 
    self-subjectaccessreviews
    . These are the variables where you pass an empty user and groups in your request object. 
  • user:list-projects
    - Allows read-only access to list the projects the user has access to.

13.1.2. Role scope
Copiar enlace

The role scope allows you to have the same level of access as a given role filtered by namespace. 

  • role:<cluster-role name>:<namespace or * for all>
    - Limits the scope to the rules specified by the cluster-role, but only in the specified namespace .

    Note

    Caveat: This prevents escalating access. Even if the role allows access to resources like secrets, rolebindings, and roles, this scope will deny access to those resources. This helps prevent unexpected escalations. Many people do not think of a role like 

    edit
    as being an escalating role, but with access to a secret it is. 

  • role:<cluster-role name>:<namespace or * for all>:!
    - This is similar to the example above, except that including the bang causes this scope to allow escalating access.
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2026 Red HatVolver arriba