Question

Your team maintains a ClusterRole named 'monitoring-view' that must automatically gain any permissions defined by future custom ClusterRoles created by add-on operators. Rather than editing 'monitoring-view' each time, you want new ClusterRoles labeled 'rbac.example.com/aggregate-to-monitoring: "true"' to be merged into it automatically. Which configuration on the 'monitoring-view' ClusterRole achieves this?

Accepted Answer

Add an 'aggregationRule' with a 'clusterRoleSelectors' matchLabels entry of 'rbac.example.com/aggregate-to-monitoring: "true"' and leave the 'rules' field to be populated by the controller.

Answer

Add a 'roleRef' referencing each labeled ClusterRole so the API server chains the permissions together at bind time.

Answer

Create a ClusterRoleBinding that uses a labelSelector to bind all matching ClusterRoles to the same ServiceAccount.

Answer

Set the 'rules' field to '- apiGroups: ["*"]' and rely on the label to restrict which resources are actually granted.