anchor.diff:  metadata:
     name: admin
   ...
  -
   rules:
  -- attributeRestrictions: null
  -  resources:
  +- resources:
     - builds/custom
     - builds/docker <1>
     - builds/source
  -  - pods/exec
  -  - pods/portforward
  -
  +  ...
   ...
   ----
  -<1> Delete this line to disable Docker builds globally for users with the
  -*admin* role.
  +<1> Delete this line to disable Docker builds globally for users with the *admin* role.
   =====
   
   [[restricting-build-strategies-to-a-user-globally]]
   
   == Restricting Build Strategies to a User Globally
   
  -To allow only a set of specific users to create builds with a particular
  -strategy:
  +To allow only a set of specific users to create builds with a particular strategy:
   
  -. link:#disabling-a-build-strategy-globally[Remove the build strategy
  -subresource from the default *admin* and *edit* roles].
  +. link:#disabling-a-build-strategy-globally[Disable global access to the build strategy].
   
  -. [[create-separate-role]]Create a separate role for the build strategy. For
  -example, create a *_dockerstrategy.yaml_* file that defines a separate role for
  -the Docker build strategy:
  -+
  -====
  -
  -[source,yaml]
  -----
  -kind: ClusterRole
  -apiVersion: v1
  -metadata:
  -  name: dockerbuilder
  -rules:
  -- resources:
  -  - builds/docker
  -  verbs:
  -  - create
  -----
  -====
  -+
  -As cluster administrator, create the new cluster role:
  +. Assign the role corresponding to the build strategy to a specific user.
  +For example, to add the *system:build-strategy-docker* cluster role to the user *devuser*:
   +
   ====
   ----
  -$ oc create -f dockerstrategy.yaml
  -----
  -====
  -
  -. Assign the new cluster role to a specific user. For example, to add the new *dockerbuilder* cluster role to the user *devuser*:
  -+
  -====
  -
  -----
  -$ oadm policy add-cluster-role-to-user dockerbuilder devuser
  +$ oadm policy add-cluster-role-to-user system:build-strategy-docker devuser
   ----
   ====
   
  
positive.code: build] permission should also be granted with caution as a vulnerability in the Docker build 
  logic could result in a privileges being granted on the host node.
  
  By default, project administrators (the
  link:../architecture/additional_concepts/authorization.html#roles[*admin* role])
  and project editors (the
  link:../architecture/additional_concepts/authorization.html#roles[*edit* role])
  are granted permission to use all build strategies (Docker, Source-to-Image, and
  Custom).
  
  You can control who can build with what build strategy using an
  link:../architecture/additional_concepts/authorization.html[authorization
  policy]. Each build strategy has a corresponding build subresource. Granting
  permission to *create* on the build subresource allows the user to create builds
  of that type.
  
  .Build Strategy Subresources
  [cols="1,1",options="header"]
  |===
  
  |Strategy |Subresource
  
  |Docker
  |builds/docker
  
  |Source-to-Image
  |builds/source
  
  |Custom
  |builds/custom
  
  |===
  
  == Disabling a Build Strategy Globally
  To prevent access to a particular build strategy globally, log in as a user with
  link:../architecture/additional_concepts/authorization.html#roles[*cluster-admin*]
  privileges and edit each of the default roles:
  
  ----
  $ oc edit clusterrole admin
  $ oc edit clusterrole edit
  ----
  
  For each role, remove the line that corresponds to the resource of the strategy to disable:
  
  .Disable the Docker Build Strategy for *admin*
  =====
  
negative.code: set of specific users within a project to create builds with a particular
  strategy:
  
  . link:#disabling-a-build-strategy-globally[Disable global access to the build strategy].
  
  . Assign the role corresponding to the build strategy to a specific user within a project.
  For example, to add the *system:build-strategy-docker* role within the project *devproject* to the user *devuser*:
  +
  ====
  ----
  $ oadm policy add-role-to-user system:build-strategy-docker devuser -n devproject
  ----
  ====
  