authentication, authorization, admission overview

Added diagram too.

docs/admin/authorization.md

@@ -2,8 +2,8 @@
 ---
 
 In Kubernetes, authorization happens as a separate step from authentication.
-See the [authentication documentation](/docs/admin/authentication) for an
-overview of authentication.
+See the [Accessing Control Overview](/docs/admin/accessing-the-api/) for an
+overview of how authentication and authorization are applied to requests.
 
 Authorization applies to all HTTP accesses on the main (secure) apiserver port.
 
@@ -16,9 +16,9 @@ The following implementations are available, and are selected by flag:
   - `--authorization-mode=AlwaysDeny` blocks all requests (used in tests).
   - `--authorization-mode=AlwaysAllow` allows all requests; use if you don't
 need authorization.
-  - `--authorization-mode=ABAC`allows for user-configured authorization policy.
-ABAC stands for
-  Attribute-Based Access Control.
+  - `--authorization-mode=ABAC` allows for a simple local-file-based user-configured
+authorization policy.  ABAC stands for Attribute-Based Access Control.
+authorization policy. 
   - `--authorization-mode=RBAC` is an experimental implementation which allows
 for authorization to be driven by the Kubernetes API.
 RBAC stands for Roles-Based Access Control.
@@ -444,7 +444,7 @@ restricting access to the REST api.
 For further documentation refer to the authorization.v1beta1 API objects and
 plugin/pkg/auth/authorizer/webhook/webhook.go.
 
-## Plugin Development
+## Module Development
 
 Other implementations can be developed fairly easily.
 The APIserver calls the Authorizer interface: