Skip to content
This repository was archived by the owner on May 6, 2022. It is now read-only.

Commit e6a8321

Browse files
committed
Updated wording per review comment
1 parent d1adf88 commit e6a8321

1 file changed

Lines changed: 7 additions & 6 deletions

File tree

docs/namespaced-broker-resources.md

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -63,12 +63,13 @@ Service Catalog's cluster-scoped resources for brokers, services, and plans are
6363
only to the service and plans that they should. For these resources,
6464
application of RBAC is really centered around what is visible to them, but is
6565
not enforced when a provision request is issued. For example, a `ClusterRole`
66-
could be created to prohibit a given user or group to view classes and plans,
67-
but cannot at provisioning time to ensure that the user cannot create the
68-
resource. Namespace-scoped brokers, services and plans, however, can be
69-
effectively combined with Kubernetes role based access control and Service
70-
Catalog Catalog Restrictions in order to provide more granular control over
71-
service instance provisioning.
66+
could be created to prohibit a given user or group from viewing
67+
`ClusterServiceClass` and `ClusterServicePlan` resources, but this role cannot
68+
be used to prevent a user from creating a `ServiceInstance` using that
69+
`ClusterServiceClass` and `ClusterServicePlan`. Namespace-scoped brokers,
70+
services and plans, however, can be effectively combined with Kubernetes RBAC
71+
and Service Catalog Catalog Restrictions in order to provide more granular
72+
control over service instance provisioning.
7273

7374
## Enabling Namespace Scoped Broker Resources
7475

0 commit comments

Comments
 (0)