kubectl auth can-i

概要

检查操作是否允许。

VERB 是一个逻辑的 Kubernetes API 动词，如 'get'、'list'、'watch'、'delete' 等。TYPE 是一个 Kubernetes 资源。快捷方式和组将被解析。NONRESOURCEURL 是一个以 "/" 开头的部分 URL。NAME 是特定 Kubernetes 资源的名称。此命令与模拟配合使用效果很好。参见 --as 全局标志。

kubectl auth can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL]

示例

  # Check to see if I can create pods in any namespace
  kubectl auth can-i create pods --all-namespaces
  
  # Check to see if I can list deployments in my current namespace
  kubectl auth can-i list deployments.apps
  
  # Check to see if service account "foo" of namespace "dev" can list pods
  # in the namespace "prod".
  # You must be allowed to use impersonation for the global option "--as".
  kubectl auth can-i list pods --as=system:serviceaccount:dev:foo -n prod
  
  # Check to see if I can do everything in my current namespace ("*" means all)
  kubectl auth can-i '*' '*'
  
  # Check to see if I can get the job named "bar" in namespace "foo"
  kubectl auth can-i list jobs.batch/bar -n foo
  
  # Check to see if I can read pod logs
  kubectl auth can-i get pods --subresource=log
  
  # Check to see if I can access the URL /logs/
  kubectl auth can-i get /logs/
  
  # List all allowed actions in namespace "foo"
  kubectl auth can-i --list --namespace=foo

选项

另请参见

• kubectl auth - 检查授权