Federation needs this now (on the nodes), and I suspect ingress
controllers will shortly want this also.  Given we're going to authorize
it on the nodes, we should authorize it on the master also (the master
is much more trusted).

Fix #27467