From fbda55316db9f371413e26b5b43d634394e9a3bb Mon Sep 17 00:00:00 2001
From: Daniele Stefano Ferru <ferruvich@gmail.com>
Date: Thu, 16 May 2024 11:57:49 +0200
Subject: [PATCH] K8s: Set X-Remote-Extra-User-Instance-Role header for
 SignedInUser (#87958)

---
 pkg/services/apiserver/auth/authenticator/signedinuser.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/services/apiserver/auth/authenticator/signedinuser.go b/pkg/services/apiserver/auth/authenticator/signedinuser.go
index 76dc5289bb6..fceecd02e8a 100644
--- a/pkg/services/apiserver/auth/authenticator/signedinuser.go
+++ b/pkg/services/apiserver/auth/authenticator/signedinuser.go
@@ -38,6 +38,9 @@ func signedInUserAuthenticator(req *http.Request) (*authenticator.Response, bool
 	if signedInUser.IDToken != "" {
 		userInfo.Extra["id-token"] = []string{signedInUser.IDToken}
 	}
+	if signedInUser.OrgRole.IsValid() {
+		userInfo.Extra["user-instance-role"] = []string{string(signedInUser.OrgRole)}
+	}
 
 	return &authenticator.Response{
 		User: userInfo,