Issues

• PoC: Integrate conditional reads in Kubernetes

  upbound/kubernetes-cedar-authorizer#50 · Filter by author luxas opened on Dec 4, 2025
  8

• Provide some kind of "semantic diff" between old and new objects for updates

  upbound/kubernetes-cedar-authorizer#46 · Filter by author luxas opened on Aug 29, 2025

• Maybe define a Cedar <-> CEL interface through Cedar extension functions

  upbound/kubernetes-cedar-authorizer#45 · Filter by author luxas opened on Aug 29, 2025

• Map out transitive access paths using logic formulas & TPE

  upbound/kubernetes-cedar-authorizer#44 · Filter by author luxas opened on Aug 29, 2025

• Deal with SAR namespace="" meaning both "all" (for namespaced resources) and "none" (for cluster-wide resources)

  upbound/kubernetes-cedar-authorizer#43 · Filter by author luxas opened on Aug 29, 2025

• Report what request environments policies apply to, and whether the policy has any effect

  upbound/kubernetes-cedar-authorizer#42 · Filter by author luxas opened on Aug 28, 2025

• Make an RBAC converter to use for privilege escalation prevention, and analysis

  upbound/kubernetes-cedar-authorizer#41 · Filter by author luxas opened on Aug 28, 2025

• Store Cedar policies in CRDs and build a CLI for applying manifests

  upbound/kubernetes-cedar-authorizer#40 · Filter by author luxas opened on Aug 28, 2025

• Is it worth it to improve precision for weird policies for untyped resources through SymCC?

  upbound/kubernetes-cedar-authorizer#38 · Filter by author luxas opened on Aug 27, 2025

• Higher-precision error messages from selector authorization

  upbound/kubernetes-cedar-authorizer#37 · Filter by author luxas opened on Aug 27, 2025

• Should namespace metadata be available for reads?

  upbound/kubernetes-cedar-authorizer#36 · Filter by author luxas opened on Aug 25, 2025

• Implement privilege escalation prevention support

  upbound/kubernetes-cedar-authorizer#35 · Filter by author luxas opened on Aug 25, 2025

• Improvements for selector authorization

  upbound/kubernetes-cedar-authorizer#34 · Filter by author luxas opened on Aug 25, 2025

• Set up end to end tests with Github Actions

  upbound/kubernetes-cedar-authorizer#32 · Filter by author luxas opened on Aug 21, 2025

• Set up observability

  upbound/kubernetes-cedar-authorizer#31 · Filter by author luxas opened on Aug 21, 2025

• Figure out solution for "writing to a resource that the principal cannot read, such that it becomes readable"

  upbound/kubernetes-cedar-authorizer#29 · Filter by author luxas opened on Aug 20, 2025

• [schema generator] Should support both up- and downgrades of OpenAPI schemas

  upbound/kubernetes-cedar-authorizer#28 · Filter by author luxas opened on Aug 20, 2025

• Improve the Cedar -> CEL translation

  upbound/kubernetes-cedar-authorizer#27 · Filter by author luxas opened on Aug 20, 2025

• Prune the SymCC output to only show fields that are accessed in the residual expression

  upbound/kubernetes-cedar-authorizer#26 · Filter by author luxas opened on Aug 20, 2025

• Create semantic linter using Cedar Analysis

  upbound/kubernetes-cedar-authorizer#24 · Filter by author luxas opened on Aug 20, 2025
  1

• [schema generator] Register verb "capabilities" as Cedar action annotations

  upbound/kubernetes-cedar-authorizer#23 · Filter by author luxas opened on Aug 20, 2025

• [schema generation] Expose the "full" object in status subresources

  upbound/kubernetes-cedar-authorizer#22 · Filter by author luxas opened on Aug 20, 2025

• [schema generator] Make resource.request.metadata optional and an entity

  upbound/kubernetes-cedar-authorizer#21 · Filter by author luxas opened on Aug 20, 2025

• [schema generator] Add @kind and @apiGroup annotations to the Cedarschema

  upbound/kubernetes-cedar-authorizer#20 · Filter by author luxas opened on Aug 20, 2025

• [schema generator] Add <Verb>Options and DryRun to Cedar action context

  upbound/kubernetes-cedar-authorizer#19 · Filter by author luxas opened on Aug 20, 2025