update descriptions

Signed-off-by: Monis Khan <[email protected]>

Author: enj

pkg/cmd/server/bootstrappolicy/policy.go

@@ -100,7 +100,7 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
 			ObjectMeta: kapi.ObjectMeta{
 				Name: ClusterAdminRoleName,
 				Annotations: map[string]string{
-					oapi.OpenShiftDescription: "A super-user that can perform any action in the cluster. When granted to a user within a local policy, they have full control over quota and roles and every action on every resource in the project.",
+					oapi.OpenShiftDescription: "A super-user that can perform any action in the cluster. When granted to a user within a project, they have full control over quota and roles and every action on every resource in the project.",
 					roleSystemOnly:            roleIsSystemOnly,
 				},
 			},
@@ -262,7 +262,8 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
 			ObjectMeta: kapi.ObjectMeta{
 				Name: AdminRoleName,
 				Annotations: map[string]string{
-					oapi.OpenShiftDescription: "A project manager. If used in a local binding, an admin user will have rights to view any resource in the project and modify any resource in the project except for role creation and quota. If the cluster-admin wants to allow an admin to modify roles, the cluster-admin must create a project-scoped Policy object."},
+					oapi.OpenShiftDescription: "A user that has edit rights within the project and can change the project's membership.",
+				},
 			},
 			Rules: []authorizationapi.PolicyRule{
 				authorizationapi.NewRule(readWrite...).Groups(kapiGroup).Resources("pods", "pods/attach", "pods/proxy", "pods/exec", "pods/portforward").RuleOrDie(),
@@ -325,7 +326,8 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
 			ObjectMeta: kapi.ObjectMeta{
 				Name: EditRoleName,
 				Annotations: map[string]string{
-					oapi.OpenShiftDescription: "A user that can modify most objects in a project, but does not have the power to view or modify roles or bindings."},
+					oapi.OpenShiftDescription: "A user that can create and edit most objects in a project, but can not update the project's membership.",
+				},
 			},
 			Rules: []authorizationapi.PolicyRule{
 				authorizationapi.NewRule(readWrite...).Groups(kapiGroup).Resources("pods", "pods/attach", "pods/proxy", "pods/exec", "pods/portforward").RuleOrDie(),
@@ -379,7 +381,8 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
 			ObjectMeta: kapi.ObjectMeta{
 				Name: ViewRoleName,
 				Annotations: map[string]string{
-					oapi.OpenShiftDescription: "A user who cannot make any modifications, but can see most objects in a project. They cannot view or modify roles or bindings or secrets."},
+					oapi.OpenShiftDescription: "A user who can view but not edit any resources within the project. They can not view secrets or membership.",
+				},
 			},
 			Rules: []authorizationapi.PolicyRule{
 				// TODO add "replicationcontrollers/scale" here
@@ -430,7 +433,8 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
 			ObjectMeta: kapi.ObjectMeta{
 				Name: BasicUserRoleName,
 				Annotations: map[string]string{
-					oapi.OpenShiftDescription: "A user that can get basic information about projects."},
+					oapi.OpenShiftDescription: "A user that can get basic information about projects.",
+				},
 			},
 			Rules: []authorizationapi.PolicyRule{
 				authorizationapi.NewRule("get").Groups(userGroup).Resources("users").Names("~").RuleOrDie(),
@@ -499,6 +503,9 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
 		{
 			ObjectMeta: kapi.ObjectMeta{
 				Name: ImagePullerRoleName,
+				Annotations: map[string]string{
+					oapi.OpenShiftDescription: "Grants the right to pull images from within a project.",
+				},
 			},
 			Rules: []authorizationapi.PolicyRule{
 				// pull images
@@ -512,6 +519,9 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
 			// push an image to our registry
 			ObjectMeta: kapi.ObjectMeta{
 				Name: ImagePusherRoleName,
+				Annotations: map[string]string{
+					oapi.OpenShiftDescription: "Grants the right to push and pull images from within a project.",
+				},
 			},
 			Rules: []authorizationapi.PolicyRule{
 				// push and pull images
@@ -521,6 +531,9 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
 		{
 			ObjectMeta: kapi.ObjectMeta{
 				Name: ImageBuilderRoleName,
+				Annotations: map[string]string{
+					oapi.OpenShiftDescription: "Grants the right to build, push and pull images from within a project.  Used primarily with service accounts for builds.",
+				},
 			},
 			Rules: []authorizationapi.PolicyRule{
 				// push and pull images
@@ -564,6 +577,9 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
 		{
 			ObjectMeta: kapi.ObjectMeta{
 				Name: DeployerRoleName,
+				Annotations: map[string]string{
+					oapi.OpenShiftDescription: "Grants the right to deploy within a project.  Used primarily with service accounts for automated deployments.",
+				},
 			},
 			Rules: []authorizationapi.PolicyRule{
 				authorizationapi.NewRule("get", "list", "watch", "update").Groups(kapiGroup).Resources("replicationcontrollers").RuleOrDie(),