kubectl auth can-i

Synopsis

檢查某個動作是否被允許。

VERB 是一個邏輯上的 Kubernetes API 動詞，例如 'get'、'list'、'watch'、'delete' 等。TYPE 是一個 Kubernetes 資源。快捷方式和資源組將被解析。NONRESOURCEURL 是一個以 "/" 開頭的區域性 URL。NAME 是特定 Kubernetes 資源的名稱。此命令與身份模擬功能配合得很好。請參閱 --as 全域性標誌。

kubectl auth can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL]

示例

  # Check to see if I can create pods in any namespace
  kubectl auth can-i create pods --all-namespaces
  
  # Check to see if I can list deployments in my current namespace
  kubectl auth can-i list deployments.apps
  
  # Check to see if service account "foo" of namespace "dev" can list pods in the namespace "prod"
  # You must be allowed to use impersonation for the global option "--as"
  kubectl auth can-i list pods --as=system:serviceaccount:dev:foo -n prod
  
  # Check to see if I can do everything in my current namespace ("*" means all)
  kubectl auth can-i '*' '*'
  
  # Check to see if I can get the job named "bar" in namespace "foo"
  kubectl auth can-i list jobs.batch/bar -n foo
  
  # Check to see if I can read pod logs
  kubectl auth can-i get pods --subresource=log
  
  # Check to see if I can access the URL /logs/
  kubectl auth can-i get /logs/
  
  # Check to see if I can approve certificates.k8s.io
  kubectl auth can-i approve certificates.k8s.io
  
  # List all allowed actions in namespace "foo"
  kubectl auth can-i --list --namespace=foo

Options

繼承的父選項

另請參閱

• kubectl auth - 檢查授權