From f6496b0de5230c7f5366520faa1456294f038f4d Mon Sep 17 00:00:00 2001 From: Nic Cope Date: Sat, 19 Sep 2020 03:30:30 -0700 Subject: [PATCH 1/2] Clarify that bind verb does not require resourceNames MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This may be intuitive for most, but the existing phrasing read to me as if `bind` were a special-case verb that _required_ me to explicitly state which Roles or ClusterRoles it should apply to. > You can only create/update a role binding if you […] or if you have > been authorized to perform the bind verb on the referenced role. > Grant them permissions needed to bind a particular role […] > explicitly, by giving them permission to perform the bind verb on the > particular Role (or ClusterRole). --- content/en/docs/reference/access-authn-authz/rbac.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index 2be833826c..f43c8e5045 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -908,6 +908,8 @@ subjects: name: user-1 ``` +Note that - as with any RBAC verb - you may omit `resourceNames` to allow `user-1` to grant other users _any_ ClusterRole in the namespace `user-1-namespace`. + When bootstrapping the first roles and role bindings, it is necessary for the initial user to grant permissions they do not yet have. To bootstrap initial roles and role bindings: From 2f9b5e122ee9aab23552438f21d528f4a22c5f17 Mon Sep 17 00:00:00 2001 From: Nic Cope Date: Sat, 19 Sep 2020 16:34:06 -0700 Subject: [PATCH 2/2] Move bind verb resourceNames hint inline of example --- content/en/docs/reference/access-authn-authz/rbac.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index f43c8e5045..6dea2e0d31 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -891,6 +891,7 @@ rules: - apiGroups: ["rbac.authorization.k8s.io"] resources: ["clusterroles"] verbs: ["bind"] + # omit resourceNames to allow binding any ClusterRole resourceNames: ["admin","edit","view"] --- apiVersion: rbac.authorization.k8s.io/v1 @@ -908,8 +909,6 @@ subjects: name: user-1 ``` -Note that - as with any RBAC verb - you may omit `resourceNames` to allow `user-1` to grant other users _any_ ClusterRole in the namespace `user-1-namespace`. - When bootstrapping the first roles and role bindings, it is necessary for the initial user to grant permissions they do not yet have. To bootstrap initial roles and role bindings: