From 732aef88207c437ea2bd026332cc6e3f7632a5e0 Mon Sep 17 00:00:00 2001 From: lemon-tree Date: Fri, 18 Aug 2017 05:04:45 +0800 Subject: [PATCH] Update rbac.md (#4973) Added the lost "." .And the "NOTE" should be in a new line. --- docs/admin/authorization/rbac.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/admin/authorization/rbac.md b/docs/admin/authorization/rbac.md index d091c6e65e..1bf36a4b15 100644 --- a/docs/admin/authorization/rbac.md +++ b/docs/admin/authorization/rbac.md @@ -647,7 +647,7 @@ Grants a `ClusterRole` across the entire cluster, including all namespaces. Exam `kubectl create clusterrolebinding myapp-view-binding --clusterrole=view --serviceaccount=acme:myapp` -See the CLI help for detailed usage +See the CLI help for detailed usage. ## Service Account Permissions @@ -691,6 +691,7 @@ In order from most secure to least secure, the approaches are: Many [add-ons](/docs/concepts/cluster-administration/addons/) currently run as the "default" service account in the "kube-system" namespace. To allow those add-ons to run with super-user access, grant cluster-admin permissions to the "default" service account in the "kube-system" namespace. + NOTE: Enabling this means the "kube-system" namespace contains secrets that grant super-user access to the API. ```shell