kubectl 1.37 reference · Access and Configuration
kubectl auth can-i Command (kubectl)
Check whether you, or another user or service account via --as, may perform an action; --list shows everything allowed.
kubectl 1.37
Syntax
kubectl auth can-i VERB RESOURCE [-n NAMESPACE] [--as USER] [--list]
Parameters
| Parameter | Description |
|---|---|
VERB RESOURCE |
e.g. create deployments, get secrets. |
--as USER |
Impersonate a user or system:serviceaccount:NS:NAME. |
--list |
List all allowed actions. |
Examples
kubectl create namespace rc-ref-can > /dev/null
trap 'kubectl delete namespace rc-ref-can --wait=false > /dev/null' EXIT
kubectl -n rc-ref-can create serviceaccount ci > /dev/null
kubectl -n rc-ref-can create rolebinding ci-edit --clusterrole=edit --serviceaccount=rc-ref-can:ci > /dev/null
for a in 'create deployments' 'get secrets' 'create rolebindings'; do echo "$a: $(kubectl -n rc-ref-can auth can-i $a --as=system:serviceaccount:rc-ref-can:ci)"; done
Output
create deployments: yes get secrets: yes create rolebindings: no
Run this on your computer — see “Get Started” for setup.
kubectl create namespace rc-ref-can2 > /dev/null
trap 'kubectl delete namespace rc-ref-can2 --wait=false > /dev/null' EXIT
kubectl -n rc-ref-can2 create serviceaccount viewer > /dev/null
kubectl -n rc-ref-can2 auth can-i get pods --as=system:serviceaccount:rc-ref-can2:viewer || true
Output
no
Run this on your computer — see “Get Started” for setup.
Related
kubectl create· Create resources imperatively from the command line: namespaces, deployments, configmaps, secrets, jobs and more.- RBAC: Who Can Do What · tutorial