We need to document our service account and roles story

[n3wscott]

I am fairly confused on how we eventing plans to use service accounts and roles. This came up because I was unable to get broker to work without creating a service account and role in my namespace but there was already a cluster role for a service account that does not get installed as part of the normal process.

We need to give a story how we are managing these and when we make a new one.

[n3wscott]

There is a better option for adding roles: https://github.com/knative/serving/blob/070c82894b8b4ed24447012d7c0f10fc40e611c8/test/config/200-clusterrole.yaml#L24

Role based label selector.

[Harwayne]

I think this needs to be more specific. What do you want documented and where?

I believe this came from working with #788 (specifically this comment), so the way Broker & Trigger use ServiceAccounts and RBAC.

You are correct that this is a bug that the Broker says it is ready before its constituent pieces say they are ready, that should be fixed.

But for documentation, that PR did include documentation about exactly what was needed and why: manual setup. Given that the readiness bug needs to be fixed in addition, where would you like to see the ServiceAccount and RBAC documentation put?

[evankanderson]

Here's a user story and a success test for the contributor persona:

• I can read a document in knative-eventing's /docs subtree and understand how ServiceAccounts and Roles are used by knative-eventing.
• From the document, I can correctly predict for a given set of component installs: the number of ServiceAccounts, their names, and what permissions they have.

[evankanderson]

/kind feature-request

[vaikas]

Make this part of the required documentation overhaul for 0.6 release

[akashrv]

/milestone v0.10.0