RBAC: Add option to skip rbac check for specified verbs (#93654)

* Add option to skip rbac check for specified verbs

pkg/services/accesscontrol/authorizer.go

@@ -27,6 +27,9 @@ func (r ResourceResolverFunc) Resolve(ctx context.Context, ns claims.NamespaceIn
 type ResourceAuthorizerOptions struct {
 	// Resource is the resource name in plural.
 	Resource string
+	// Unchecked is used to skip authorization checks for specified verbs.
+	// This takes precedence over configured Mapping
+	Unchecked map[string]bool
 	// Attr is attribute used for resource scope. It's usually 'id' or 'uid'
 	// depending on what is stored for the resource.
 	Attr string
@@ -45,6 +48,9 @@ func NewLegacyAccessClient(ac AccessControl, opts ...ResourceAuthorizerOptions)
 	stored := map[string]ResourceAuthorizerOptions{}
 
 	for _, o := range opts {
+		if o.Unchecked == nil {
+			o.Unchecked = map[string]bool{}
+		}
 		if o.Mapping == nil {
 			o.Mapping = map[string]string{}
 		}
@@ -75,6 +81,11 @@ func (c *LegacyAccessClient) HasAccess(ctx context.Context, id claims.AuthInfo,
 		return false, nil
 	}
 
+	skip := opts.Unchecked[req.Verb]
+	if skip {
+		return true, nil
+	}
+
 	action, ok := opts.Mapping[req.Verb]
 	if !ok {
 		return false, fmt.Errorf("missing action for %s %s", req.Verb, req.Resource)