Hugo: Update rbac.md (#8500)
Fix broken list, all items were numbered as 1. Use the shortcode for note and warnings in the list.
This commit is contained in:
committed by
k8s-ci-robot
parent
3b2781a70c
commit
2532b57aaa
@@ -764,7 +764,9 @@ In order from most secure to least secure, the approaches are:
|
|||||||
|
|
||||||
If an application does not specify a `serviceAccountName`, it uses the "default" service account.
|
If an application does not specify a `serviceAccountName`, it uses the "default" service account.
|
||||||
|
|
||||||
**NOTE:** Permissions given to the "default" service account are available to any pod in the namespace that does not specify a `serviceAccountName`.
|
{{< note >}}**NOTE:** Permissions given to the "default" service
|
||||||
|
account are available to any pod in the namespace that does not
|
||||||
|
specify a `serviceAccountName`.{{< /note >}}
|
||||||
|
|
||||||
For example, grant read-only permission within "my-namespace" to the "default" service account:
|
For example, grant read-only permission within "my-namespace" to the "default" service account:
|
||||||
|
|
||||||
@@ -778,7 +780,9 @@ In order from most secure to least secure, the approaches are:
|
|||||||
Many [add-ons](/docs/concepts/cluster-administration/addons/) currently run as the "default" service account in the "kube-system" namespace.
|
Many [add-ons](/docs/concepts/cluster-administration/addons/) currently run as the "default" service account in the "kube-system" namespace.
|
||||||
To allow those add-ons to run with super-user access, grant cluster-admin permissions to the "default" service account in the "kube-system" namespace.
|
To allow those add-ons to run with super-user access, grant cluster-admin permissions to the "default" service account in the "kube-system" namespace.
|
||||||
|
|
||||||
**NOTE:** Enabling this means the "kube-system" namespace contains secrets that grant super-user access to the API.
|
{{< note >}}**NOTE:** Enabling this means the "kube-system"
|
||||||
|
namespace contains secrets that grant super-user access to the
|
||||||
|
API.{{< /note >}}
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
kubectl create clusterrolebinding add-on-cluster-admin \
|
kubectl create clusterrolebinding add-on-cluster-admin \
|
||||||
@@ -816,7 +820,9 @@ In order from most secure to least secure, the approaches are:
|
|||||||
|
|
||||||
If you don't care about partitioning permissions at all, you can grant super-user access to all service accounts.
|
If you don't care about partitioning permissions at all, you can grant super-user access to all service accounts.
|
||||||
|
|
||||||
**WARNING:** This allows any user with read access to secrets or the ability to create a pod to access super-user credentials.
|
{{< warning >}}**WARNING:** This allows any user with read access
|
||||||
|
to secrets or the ability to create a pod to access super-user
|
||||||
|
credentials.{{< /warning >}}
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
kubectl create clusterrolebinding serviceaccounts-cluster-admin \
|
kubectl create clusterrolebinding serviceaccounts-cluster-admin \
|
||||||
|
|||||||
Reference in New Issue
Block a user