Hugo: Update rbac.md (#8500)

Fix broken list, all items were numbered as 1.
Use the shortcode for note and warnings in the list.
This commit is contained in:
Andreas Jaeger
2018-05-11 22:09:26 +02:00
committed by k8s-ci-robot
parent 3b2781a70c
commit 2532b57aaa
+9 -3
View File
@@ -764,7 +764,9 @@ In order from most secure to least secure, the approaches are:
If an application does not specify a `serviceAccountName`, it uses the "default" service account. If an application does not specify a `serviceAccountName`, it uses the "default" service account.
**NOTE:** Permissions given to the "default" service account are available to any pod in the namespace that does not specify a `serviceAccountName`. {{< note >}}**NOTE:** Permissions given to the "default" service
account are available to any pod in the namespace that does not
specify a `serviceAccountName`.{{< /note >}}
For example, grant read-only permission within "my-namespace" to the "default" service account: For example, grant read-only permission within "my-namespace" to the "default" service account:
@@ -778,7 +780,9 @@ In order from most secure to least secure, the approaches are:
Many [add-ons](/docs/concepts/cluster-administration/addons/) currently run as the "default" service account in the "kube-system" namespace. Many [add-ons](/docs/concepts/cluster-administration/addons/) currently run as the "default" service account in the "kube-system" namespace.
To allow those add-ons to run with super-user access, grant cluster-admin permissions to the "default" service account in the "kube-system" namespace. To allow those add-ons to run with super-user access, grant cluster-admin permissions to the "default" service account in the "kube-system" namespace.
**NOTE:** Enabling this means the "kube-system" namespace contains secrets that grant super-user access to the API. {{< note >}}**NOTE:** Enabling this means the "kube-system"
namespace contains secrets that grant super-user access to the
API.{{< /note >}}
```shell ```shell
kubectl create clusterrolebinding add-on-cluster-admin \ kubectl create clusterrolebinding add-on-cluster-admin \
@@ -816,7 +820,9 @@ In order from most secure to least secure, the approaches are:
If you don't care about partitioning permissions at all, you can grant super-user access to all service accounts. If you don't care about partitioning permissions at all, you can grant super-user access to all service accounts.
**WARNING:** This allows any user with read access to secrets or the ability to create a pod to access super-user credentials. {{< warning >}}**WARNING:** This allows any user with read access
to secrets or the ability to create a pod to access super-user
credentials.{{< /warning >}}
```shell ```shell
kubectl create clusterrolebinding serviceaccounts-cluster-admin \ kubectl create clusterrolebinding serviceaccounts-cluster-admin \