diff --git a/ee/ucp/authorization/index.md b/ee/ucp/authorization/index.md index 5bef618736..29b2a9ce4a 100644 --- a/ee/ucp/authorization/index.md +++ b/ee/ucp/authorization/index.md @@ -90,7 +90,7 @@ together. Only an administrator can manage grants, subjects, roles, and access to resources. -> About administrators +> Note > > An administrator is a user who creates subjects, groups resources by moving them > into collections or namespaces, defines roles by selecting allowable operations, @@ -103,7 +103,14 @@ For cluster security, only UCP admin users and service accounts that are granted the `cluster-admin` ClusterRole for all Kubernetes namespaces via a ClusterRoleBinding can deploy pods with privileged options. This prevents a platform user from being able to bypass the Universal Control Plane Security -Model. These privileged options include: +Model. + +> Note +> +> Granting the `cluster admin` ClusterRole to normal users does not allow +> them to deploy privileged pods. + +These privileged options include: Pods with any of the following defined in the Pod Specification: