Implement delegated authorization about cluster-registry

[ericchiang]

Couple thoughts on how this might go:

• Document how to use an authenticating/authorizing proxy
• Add instructions for running the registry as an aggregated API server while delegating auth-Z to the central API server
• Define CRDs equivalents with JSON schema validation to let users register cluster objects on a existing cluster and just use RBAC

The more the cluster-registry repo can avoid re-implementing an API server, I think the better.

[pmorie]

Define CRDs equivalents with JSON schema validation to let users register cluster objects on a existing cluster and just use RBAC

This shouldn't be necessary - you can write an RBAC rule for any API group and resource/subresources. If you have delegating authn/z back to the main API server you will just get this.

@font what do you think about implementing this?

[perotinus]

Changed the name of this issue to specifically address delegated authorization. I opened #46 to track non-delegated authorization.

[font]

Yes, I am working on this (realized I hadn't replied yet).

[font]

How do we want to handle the different personalities that clusterregistry will assume when running as a delegated vs standalone apiserver?

Some things that will need to be addressed:

• Authn model: currently CR has built-in authn model. Will also need to delegate to core k8s apiserver. Need to allow both.
• Authz model: currently CR has always-allow authz model. Will also need to delegate to core k8s apiserver. Need to allow both.
• Necessary flags: introducing new standalone flag while removing unnecessary flags when delegating
• Other stuff?

Some possible options:

• Add extra flag error checking and allow possible confusion when user specifies combinations that are not compatible.
• Do we want to add new subcommands to handle the different flags that could then trigger different paths for the authn/authz setup? This would seem strange for an apiserver. Are there any other apiservers doing this?
• Two separate binaries for delegated vs standalone. Probably try to avoid this.
• Other options?

[perotinus]

This is now implemented and working as of #120.