Clarify that bind verb does not require resourceNames

This may be intuitive for most, but the existing phrasing read to me as
if `bind` were a special-case verb that _required_ me to explicitly state
which Roles or ClusterRoles it should apply to.

> You can only create/update a role binding if you […] or if you have
> been authorized to perform the bind verb on the referenced role.

> Grant them permissions needed to bind a particular role […]
> explicitly, by giving them permission to perform the bind verb on the
> particular Role (or ClusterRole).
This commit is contained in:
Nic Cope
2020-09-19 03:30:30 -07:00
committed by GitHub
parent 5ecdaee70a
commit f6496b0de5
@@ -908,6 +908,8 @@ subjects:
name: user-1
```
Note that - as with any RBAC verb - you may omit `resourceNames` to allow `user-1` to grant other users _any_ ClusterRole in the namespace `user-1-namespace`.
When bootstrapping the first roles and role bindings, it is necessary for the initial user to grant permissions they do not yet have.
To bootstrap initial roles and role bindings: