diff --git a/docs/operator/use-cases/create-namespaces.md b/docs/operator/use-cases/create-namespaces.md index 62d2c2d5..acfc18f4 100644 --- a/docs/operator/use-cases/create-namespaces.md +++ b/docs/operator/use-cases/create-namespaces.md @@ -36,20 +36,20 @@ subjects: name: alice roleRef: kind: ClusterRole - name: namespace-deleter + name: capsule-namespace-deleter apiGroup: rbac.authorization.k8s.io ``` So Alice is the admin of the namespaces: ``` -kubectl get rolebindings -n oil-production -NAME ROLE AGE -namespace:admin ClusterRole/admin 9m5s -namespace-deleter ClusterRole/admin 9m5s +kubectl get rolebindings -n oil-development +NAME ROLE AGE +namespace:admin ClusterRole/admin 12s +namespace-deleter ClusterRole/capsule-namespace-deleter 12s ``` -The said Role Binding resources are automatically created by Capsule controller when Alice creates a namespace in the tenant. +The said Role Binding resources are automatically created by Capsule controller when the tenant owner Alice creates a namespace in the tenant. Alice can deploy any resource in the namespace, according to the predefined [`admin` cluster role](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles). diff --git a/docs/operator/use-cases/images-pullpolicy.md b/docs/operator/use-cases/images-pullpolicy.md index 0379715d..70490c93 100644 --- a/docs/operator/use-cases/images-pullpolicy.md +++ b/docs/operator/use-cases/images-pullpolicy.md @@ -25,7 +25,7 @@ EOF Allowed values are: `Always`, `IfNotPresent`, `Never`. -Any attempt of Alice to use a not allowed `imagePullPolicies` value is denied by the Validation Webhook enforcing it. +Any attempt of Alice to use a disallowed `imagePullPolicies` value is denied by the Validation Webhook enforcing it. # What’s next diff --git a/docs/operator/use-cases/onboarding.md b/docs/operator/use-cases/onboarding.md index 6f41974d..b3c00b8c 100644 --- a/docs/operator/use-cases/onboarding.md +++ b/docs/operator/use-cases/onboarding.md @@ -109,6 +109,7 @@ yes ``` ## Assign a robot account as tenant owner + As GitOps methodology is gaining more and more adoption everywhere, it's more likely that an application (Service Account) should act as Tenant Owner. In Capsule, a Tenant can also be owned by a Kubernetes _ServiceAccount_ identity. The tenant manifest is modified as in the following: @@ -123,7 +124,6 @@ spec: owners: - name: oil-users kind: Group - owners: - name: system:serviceaccount:default:robot kind: ServiceAccount EOF @@ -132,7 +132,7 @@ EOF Bill can create a Service Account called `robot`, for example, in the `default` namespace and leave it to act as Tenant Owner of the `oil` tenant ``` -kubectl --as system:serviceaccount:default:robot --as-group capsule.clastix.io auth can-i create namesapces +kubectl --as system:serviceaccount:default:robot --as-group capsule.clastix.io auth can-i create namespaces yes ``` diff --git a/docs/operator/use-cases/resources-quota-limits.md b/docs/operator/use-cases/resources-quota-limits.md index 73c0f640..a8bc91b4 100644 --- a/docs/operator/use-cases/resources-quota-limits.md +++ b/docs/operator/use-cases/resources-quota-limits.md @@ -238,12 +238,15 @@ Alice doesn't have permission to change or delete the resources according to the ``` kubectl -n oil-production auth can-i patch resourcequota -no - no RBAC policy matched - +no +kubectl -n oil-production auth can-i delete resourcequota +no kubectl -n oil-production auth can-i patch limitranges -no - no RBAC policy matched +no +kubectl -n oil-production auth can-i delete limitranges +no ``` # What’s next -See how Bill, the cluster admin, can enforce the PriorityClass of Pods running of Alice's tenant namespaces. [Enforce Pod Priority Classes](./pod-priority-class.md) +See how Bill, the cluster admin, can enforce the PriorityClass of Pods running of Alice's tenant namespaces. [Enforce Pod Priority Classes](./pod-priority-classes.md)