Rendering issues on#service-account-permissions #21029

content/en/docs/reference/access-authn-authz/rbac.md

@@ -1079,37 +1079,37 @@ In order from most secure to least secure, the approaches are:
 
 2. Grant a role to the "default" service account in a namespace
 
-    If an application does not specify a `serviceAccountName`, it uses the "default" service account.
+If an application does not specify a `serviceAccountName`, it uses the "default" service account.
 
-    {{< note >}}
+{{< note >}}
-    Permissions given to the "default" service account are available to any pod
+Permissions given to the "default" service account are available to any pod
-    in the namespace that does not specify a `serviceAccountName`.
+in the namespace that does not specify a `serviceAccountName`.
-    {{< /note >}}
+{{< /note >}}
 
-    For example, grant read-only permission within "my-namespace" to the "default" service account:
+For example, grant read-only permission within "my-namespace" to the "default" service account:
 
-    ```shell
+```shell
-    kubectl create rolebinding default-view \
+kubectl create rolebinding default-view \
-      --clusterrole=view \
+  --clusterrole=view \
-      --serviceaccount=my-namespace:default \
+  --serviceaccount=my-namespace:default \
-      --namespace=my-namespace
+  --namespace=my-namespace
-    ```
+```
 
-    Many [add-ons](/docs/concepts/cluster-administration/addons/) run as the
+Many [add-ons](/docs/concepts/cluster-administration/addons/) run as the
-    "default" service account in the `kube-system` namespace.
+"default" service account in the `kube-system` namespace.
-    To allow those add-ons to run with super-user access, grant cluster-admin
+To allow those add-ons to run with super-user access, grant cluster-admin
-    permissions to the "default" service account in the `kube-system` namespace.
+permissions to the "default" service account in the `kube-system` namespace.
 
-    {{< caution >}}
+{{< caution >}}
-    Enabling this means the `kube-system` namespace contains Secrets
+Enabling this means the `kube-system` namespace contains Secrets
-    that grant super-user access to your cluster's API.
+that grant super-user access to your cluster's API.
-    {{< /caution >}}
+{{< /caution >}}
 
-    ```shell
+```shell
-    kubectl create clusterrolebinding add-on-cluster-admin \
+kubectl create clusterrolebinding add-on-cluster-admin \
-      --clusterrole=cluster-admin \
+  --clusterrole=cluster-admin \
-      --serviceaccount=kube-system:default
+  --serviceaccount=kube-system:default
-    ```
+```
 
 3. Grant a role to all service accounts in a namespace