I have Kubernetes Dashboard installed with basic auth using ABAC. Is there a way to make a user/group that can readonly when logged into the dashboard? Currently, if I skip the login screen (not logged in), I can still view and modify the cluster inside dashboard. Adding "readonly":true to the system:authenticated line doesn't seem to do anything.

I have a policy file:

{
  "apiVersion": "abac.authorization.kubernetes.io/v1beta1",
  "kind": "Policy",
  "spec": {
    "user": "admin",
    "namespace": "*",
    "resource": "*",
    "apiGroup": "*"
  }
}
{
  "apiVersion": "abac.authorization.kubernetes.io/v1beta1",
  "kind": "Policy",
  "spec": {
    "group": "system:authenticated",
    "nonResourcePath": "*"
  }
}