是否可以使用与apiserver请求关联的“extra”属性与RBAC做出授权决策?

中的额外属性的简要说明 source code 说明:

    // GetExtra can contain any additional information that the authenticator
    // thought was interesting.  One example would be scopes on a token.
    // Keys in this map should be namespaced to the authenticator or
    // authenticator/authorizer pair making use of them.
    // For instance: "example.org/foo" instead of "foo"
    // This is a map[string][]string because it needs to be serializeable into
    // a SubjectAccessReviewSpec.authorization.k8s.io for proper authorization
    // delegation flows
    // In order to faithfully round-trip through an impersonation flow, these keys
    // MUST be lowercase.
    GetExtra() map[string][]string
}

func (i *DefaultInfo) GetExtra() map[string][]string {
    return i.Extra
}

阅读完代码后,我没有找到任何对额外属性的引用。
看起来RBAC插件目前没有使用额外的属性,但可以在 Webhook authorization mode 。