From 5ad9b58df9398a6358fd1646c317c24c79307f83 Mon Sep 17 00:00:00 2001
From: yaraskm <62650344+yaraskm@users.noreply.github.com>
Date: Tue, 6 Jul 2021 10:43:57 -0400
Subject: [PATCH] Remove unnecessary API groups in sample Role (#821)

- The resource requirements listed by component are all members of the
  core API group. There is no need to include the `extensions` and
  `apps` groups. This Role will currently try to grant permissions on
  types that do not exist, such a `pod.extensions` and `pod.apps`.

- If you are a member of a multitenant cluster, there's a good chance
  that you are running with either the `admin` or `edit` built-in
  Clusterroles scoped down to your namespace(s). Since certain types
  such as `pod.extensions` do not exist, your binding to a built-in Role
  will not contain permissions on these types. As such, you will get a
  permission error when trying to create the Role (trying to grant
  permissions you do not hold). The Role as written could only currently
  be created in a cluster by someone who has a higher permission level,
  (such as an admin).
---
 docs/src/main/asciidoc/security-service-accounts.adoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/src/main/asciidoc/security-service-accounts.adoc b/docs/src/main/asciidoc/security-service-accounts.adoc
index 499297cc..ddd5da50 100644
--- a/docs/src/main/asciidoc/security-service-accounts.adoc
+++ b/docs/src/main/asciidoc/security-service-accounts.adoc
@@ -55,7 +55,7 @@ metadata:
   namespace: YOUR-NAME-SPACE
   name: namespace-reader
 rules:
-  - apiGroups: ["", "extensions", "apps"]
+  - apiGroups: [""]
     resources: ["configmaps", "pods", "services", "endpoints", "secrets"]
     verbs: ["get", "list", "watch"]