[chupakobra6]

Description

Adds Kubernetes authorization (AuthZ) to docker_auth. After Kubernetes-based AuthN (TokenReview), requested actions (pull/push) are authorized via Kubernetes RBAC using SubjectAccessReview (SAR). Repository scopes are mapped to Kubernetes ResourceAttributes.

Why do we need it, and what problem does it solve?

Enables native, auditable RBAC control over registry actions without maintaining static ACLs. Aligns registry permissions with existing Kubernetes identities/roles for users and CI ServiceAccounts.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: docker-auth
type: feat
summary: Add Kubernetes authorization via SubjectAccessReview (RBAC) with mapping of repository scopes to Kubernetes resources.
impact_level: default