Alexander Klizhentas f17625c1a8 Adds controls for impersonation requests. (#6009) (#6073) ...

Fixes #5352

```yaml
allow:
  impersonate:
    users: ['alice', 'bob']
    roles: ['*']
    where: 'contains(user.spec.traits["groups"], impersonate_role.traits)'
```

Adds "impersonator" to all X.509 and SSH client certs
issued using impersonation and does best effort to track
requests by impersonators in audit events.

Limits certs TTL to the impersonator's max session TTL.

Prevents impersonating users to recursively impersonate
other users.

Allows impersonating users to renew their own certificate,
for example to set route to cluster.

Adds missing token permission for editor role.

2021-03-19 16:04:43 -07:00

..

parse_test.go

RFD 1: user testify/require instead of testify/assert

2020-10-16 00:15:25 +00:00

parse.go

Adds controls for impersonation requests. (#6009) (#6073)

2021-03-19 16:04:43 -07:00