From f6496b0de5230c7f5366520faa1456294f038f4d Mon Sep 17 00:00:00 2001 From: Nic Cope Date: Sat, 19 Sep 2020 03:30:30 -0700 Subject: [PATCH] Clarify that bind verb does not require resourceNames MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This may be intuitive for most, but the existing phrasing read to me as if `bind` were a special-case verb that _required_ me to explicitly state which Roles or ClusterRoles it should apply to. > You can only create/update a role binding if you […] or if you have > been authorized to perform the bind verb on the referenced role. > Grant them permissions needed to bind a particular role […] > explicitly, by giving them permission to perform the bind verb on the > particular Role (or ClusterRole). --- content/en/docs/reference/access-authn-authz/rbac.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index 2be833826c..f43c8e5045 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -908,6 +908,8 @@ subjects: name: user-1 ``` +Note that - as with any RBAC verb - you may omit `resourceNames` to allow `user-1` to grant other users _any_ ClusterRole in the namespace `user-1-namespace`. + When bootstrapping the first roles and role bindings, it is necessary for the initial user to grant permissions they do not yet have. To bootstrap initial roles and role bindings: