Step 3 needs to be changed/clarified.  It currently reads:

Remove the self-provisioner cluster role from the group system:authenticated:oauth.

    It should be this:

Remove the system:authenticatd:oauth group from the self-provisioner cluster role.

    The openshift admin is literally editing the clusterrolebinding.rbac object, removing the group.

You might call me pedantic, but I had the hardest time understanding this when I went through it *until* I realized the the clusterrolebinding object is being edited, *not* the group.

    all