whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update content/en/docs/reference/access-authn-authz/rbac.md

Browse Source 
Co-authored-by: Jordan Liggitt <jordan@liggitt.net>
This commit is contained in:
Abirdcfly
2021-08-23 21:45:10 +08:00
committed by GitHub
parent 162da6561b
commit 19807f866c
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/reference/access-authn-authz/rbac.md
+2 -1
View File
@@ -281,7 +281,8 @@ rules:
{{< note >}} {{< note >}}
You cannot restrict `create` or `deletecollection` requests by their resource name. You cannot restrict `create` or `deletecollection` requests by their resource name.
For `create`, this limitation is because the name of the new object may not be known at authorization time. For `create`, this limitation is because the name of the new object may not be known at authorization time.
If you restrict `list` or `watch` by resourceName, then the only way that a client including kubectl can perform that `list` or `watch` is by specifying a field selector that matches on metadata.name. If you restrict `list` or `watch` by resourceName, clients must include a `metadata.name` field selector in their `list` or `watch` request that matches the specified resourceName in order to be authorized.
For example, `kubectl get configmaps --field-selector=metadata.name=my-configmap`
{{< /note >}} {{< /note >}}