Clarify minimum perms required for k8s auto-join

website/source/docs/agent/cloud-auto-join.html.md

@@ -373,3 +373,6 @@ $ consul agent -retry-join "provider=k8s label_selector=\"app=consul,component=s
   set, it defaults to all namespaces.
 - `label_selector` (optional) - the label selector for matching pods.
 - `field_selector` (optional) - the field selector for matching pods.
+
+The Kubernetes token used by the provider needs to have permissions to list pods
+in the desired namespace.

website/source/docs/platform/k8s/out-of-cluster-nodes.html.md

@@ -19,7 +19,9 @@ use the ["k8s" cloud auto-join provider](/docs/agent/cloud-auto-join.html#kubern
 The auto-join provider dynamically discovers IP addresses to join using
 the Kubernetes API. It authenticates with Kubernetes using a standard
 `kubeconfig` file. This works with all major hosted Kubernetes offerings
-as well as self-hosted installations.
+as well as self-hosted installations. The token in the `kubeconfig` file
+needs to have permissions to list pods in the namespace where Consul servers
+are deployed.
 
 The auto-join string below will join a Consul server cluster that is
 started using the [official Helm chart](/docs/platform/k8s/helm.html):