whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Clarify that bind verb does not require resourceNames

Browse Source 
This may be intuitive for most, but the existing phrasing read to me as
if `bind` were a special-case verb that _required_ me to explicitly state
which Roles or ClusterRoles it should apply to.

> You can only create/update a role binding if you […] or if you have
> been authorized to perform the bind verb on the referenced role.

> Grant them permissions needed to bind a particular role […]
> explicitly, by giving them permission to perform the bind verb on the
> particular Role (or ClusterRole).
This commit is contained in:
Nic Cope
2020-09-19 03:30:30 -07:00
committed by GitHub
parent 5ecdaee70a
commit f6496b0de5
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/reference/access-authn-authz/rbac.md
+2
View File
@@ -908,6 +908,8 @@ subjects:
name: user-1 name: user-1
``` ```
Note that - as with any RBAC verb - you may omit `resourceNames` to allow `user-1` to grant other users _any_ ClusterRole in the namespace `user-1-namespace`.
When bootstrapping the first roles and role bindings, it is necessary for the initial user to grant permissions they do not yet have. When bootstrapping the first roles and role bindings, it is necessary for the initial user to grant permissions they do not yet have.
To bootstrap initial roles and role bindings: To bootstrap initial roles and role bindings: