From 15626e45fe0ad65ab6b9605d461750c020b1d095 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Thu, 27 Sep 2018 23:31:20 -0700 Subject: [PATCH] improved note --- .../v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md | 2 +- .../v2.x/en/k8s-in-rancher/projects-and-namespaces/_index.md | 2 +- .../projects-and-namespaces/editing-projects/_index.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md index 559d38ed8c1..f593fdb9701 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -61,7 +61,7 @@ _Project roles_ are roles that can be used to grant users access to a project. T These users can view everything in the project but cannot create, update, or delete anything. - > **Note:** Because of how Kubernetes handles permissions, if you add a user to a project and assign them the `Owner` or `Member` role within its scope, that user can create namespaces in _any_ project they hold membership in, even as a `Read Only` member. + > **Note:** Because the `namespace creation` role is a Kubernetes cluster-level permission, it cannot be controlled per project. Therefore, if you add a user to a project and assign them the `Owner` or `Member` role within its scope, that user can create namespaces in _any_ project they hold membership in, even as a `Read Only` member. #### Custom Project Roles diff --git a/content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/_index.md b/content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/_index.md index 0009d0da5ac..41235a7fec4 100644 --- a/content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/_index.md +++ b/content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/_index.md @@ -105,7 +105,7 @@ Rancher extends Kubernetes to allow the application of [Pod Security Policies](h > **Notes:** > - >- Because of how Kubernetes handles permissions, if you add a user to a project and assign them the `Owner` or `Member` role within its scope, that user can create namespaces in _any_ project they hold membership in, even as a `Read Only` member. + >- Because the `namespace creation` role is a Kubernetes cluster-level permission, it cannot be controlled per project. Therefore, if you add a user to a project and assign them the `Owner` or `Member` role within its scope, that user can create namespaces in _any_ project they hold membership in, even as a `Read Only` member. >- Choose `Custom` to create a custom role on the fly: [Custom Project Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#custom-project-roles). 1. To add more members, repeat substeps a—c. diff --git a/content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/editing-projects/_index.md b/content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/editing-projects/_index.md index 4e12d2d229e..455f24528f5 100644 --- a/content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/editing-projects/_index.md +++ b/content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/editing-projects/_index.md @@ -37,7 +37,7 @@ Following project creation, you can add users as project members so that they ca > **Notes:** > - >- Because of how Kubernetes handles permissions, if you add a user to a project and assign them the `Owner` or `Member` role within its scope, that user can create namespaces in _any_ project they hold membership in, even as a `Read Only` member. + >- Because the `namespace creation` role is a Kubernetes cluster-level permission, it cannot be controlled per project. Therefore, if you add a user to a project and assign them the `Owner` or `Member` role within its scope, that user can create namespaces in _any_ project they hold membership in, even as a `Read Only` member. >- For `Custom` roles, you can modify the list of individual roles available for assignment. > > - To add roles to the list, [Add a Custom Role]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles).