From 82480f3afd742ca8f364e8c01cedf5da769e5695 Mon Sep 17 00:00:00 2001
From: bsctl <adriano@clastix.io>
Date: Fri, 23 Jul 2021 18:38:45 +0200
Subject: [PATCH] docs: fix minor issues

---
 ...-service-management-of-network-policies.md |  2 +-
 .../mtb/block-access-to-cluster-resources.md  | 65 +++++++++++++++++++
 .../block-access-to-multitenant-resources.md  |  9 +--
 3 files changed, 71 insertions(+), 5 deletions(-)

diff --git a/docs/operator/mtb/allow-self-service-management-of-network-policies.md b/docs/operator/mtb/allow-self-service-management-of-network-policies.md
index 50ff37ad..94e1ff61 100644
--- a/docs/operator/mtb/allow-self-service-management-of-network-policies.md
+++ b/docs/operator/mtb/allow-self-service-management-of-network-policies.md
@@ -26,7 +26,7 @@ spec:
     name: alice
   networkPolicies:
     items:
-      ingress:
+    - ingress:
       - from:
         - namespaceSelector:
             matchLabels:
diff --git a/docs/operator/mtb/block-access-to-cluster-resources.md b/docs/operator/mtb/block-access-to-cluster-resources.md
index 62b1353f..65606509 100644
--- a/docs/operator/mtb/block-access-to-cluster-resources.md
+++ b/docs/operator/mtb/block-access-to-cluster-resources.md
@@ -40,6 +40,71 @@ kubectl --kubeconfig alice auth can-i <verb> <resource>
 ```
 Each command must return `no`
 
+**Exception:**
+
+It should, but it does not:
+
+```bash 
+kubectl --kubeconfig alice auth can-i create selfsubjectaccessreviews
+yes
+kubectl --kubeconfig alice auth can-i create selfsubjectrulesreviews
+yes
+kubectl --kubeconfig alice auth can-i create namespaces
+yes
+```
+
+Any kubernetes user can create `SelfSubjectAccessReview` and `SelfSubjectRulesReviews` to checks whether he/she can perform an action. First two exceptions are not an issue.
+
+```bash 
+kubectl --anyuser auth can-i --list
+Resources                                       Non-Resource URLs   Resource Names   Verbs
+selfsubjectaccessreviews.authorization.k8s.io   []                  []               [create]
+selfsubjectrulesreviews.authorization.k8s.io    []                  []               [create]
+                                                [/api/*]            []               [get]
+                                                [/api]              []               [get]
+                                                [/apis/*]           []               [get]
+                                                [/apis]             []               [get]
+                                                [/healthz]          []               [get]
+                                                [/healthz]          []               [get]
+                                                [/livez]            []               [get]
+                                                [/livez]            []               [get]
+                                                [/openapi/*]        []               [get]
+                                                [/openapi]          []               [get]
+                                                [/readyz]           []               [get]
+                                                [/readyz]           []               [get]
+                                                [/version/]         []               [get]
+                                                [/version/]         []               [get]
+                                                [/version]          []               [get]
+                                                [/version]          []               [get]
+```
+
+In order to enable namespace self-service provisioning, Capsule intentionally gives permissions to create namespaces to all users belonging to the Capsule group:
+
+```bash
+kubectl describe clusterrolebindings capsule-namespace-provisioner
+Name:         capsule-namespace-provisioner
+Labels:       <none>
+Annotations:  <none>
+Role:
+  Kind:  ClusterRole
+  Name:  capsule-namespace-provisioner
+Subjects:
+  Kind   Name                Namespace
+  ----   ----                ---------
+  Group  capsule.clastix.io  
+
+kubectl describe clusterrole capsule-namespace-provisioner
+Name:         capsule-namespace-provisioner
+Labels:       <none>
+Annotations:  <none>
+PolicyRule:
+  Resources   Non-Resource URLs  Resource Names  Verbs
+  ---------   -----------------  --------------  -----
+  namespaces  []                 []              [create]
+```
+
+Capsule controls self-service namespace creation by limiting the number of namespaces the user can create by the `tenant.spec.namespaceQuota option`. 
+
 **Cleanup:**
 As cluster admin, delete all the created resources
 
diff --git a/docs/operator/mtb/block-access-to-multitenant-resources.md b/docs/operator/mtb/block-access-to-multitenant-resources.md
index f3ca91e9..9db18e5a 100644
--- a/docs/operator/mtb/block-access-to-multitenant-resources.md
+++ b/docs/operator/mtb/block-access-to-multitenant-resources.md
@@ -116,12 +116,13 @@ As tenant owner, try to change/delete  the rolebindings in order to escalate per
 kubectl --kubeconfig alice edit/delete rolebinding namespace:admin
 ```
 
-You must receive an error message:
+The rolebindings is immediately recreated by Capsule:
 
 ```
-error: rolebindings.rbac.authorization.k8s.io "namespace:admin" could not be patched:
-rolebindings.rbac.authorization.k8s.io "namespace:admin" is forbidden:
-...
+kubectl --kubeconfig alice get rolebindings
+NAME                ROLE                                    AGE
+namespace-deleter   ClusterRole/capsule-namespace-deleter   11h
+namespace:admin     ClusterRole/admin                       2s
 ```
 
 However, the tenant owner can create and assign permissions inside namespace she owns