From 2841f6dabe92a7021fb60370ee8bd1dee9c21e46 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Fri, 2 Jun 2017 17:26:39 -0400 Subject: [PATCH] Improve RBAC doc (#3951) * Remove spurious cluster-status role description * Indicate controller-manager must be granted controller roles when not run with --use-service-account-credentials --- docs/admin/authorization/rbac.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/docs/admin/authorization/rbac.md b/docs/admin/authorization/rbac.md index 6860f0b1ed..ca2f55d951 100644 --- a/docs/admin/authorization/rbac.md +++ b/docs/admin/authorization/rbac.md @@ -416,11 +416,6 @@ When used in a ClusterRoleBinding, it gives full control over every resou When used in a RoleBinding, it gives full control over every resource in the rolebinding's namespace, including the namespace itself. -cluster-status -None -Allows read-only access to basic cluster status information. - - admin None Allows admin access, intended to be granted within a namespace using a RoleBinding. @@ -531,6 +526,8 @@ This is commonly used by add-on API servers for unified authentication and autho The [Kubernetes controller manager](/docs/admin/kube-controller-manager/) runs core control loops. When invoked with `--use-service-account-credentials`, each control loop is started using a separate service account. Corresponding roles exist for each control loop, prefixed with `system:controller:`. +If the controller manager is not started with `--use-service-account-credentials`, +it runs all control loops using its own credential, which must be granted all the relevant roles. These roles include: * system:controller:attachdetach-controller