kubectl auth can-i

概要

检查某个动作是否被允许。

VERB 是一个逻辑上的 Kubernetes API 动词，例如 'get'、'list'、'watch'、'delete' 等。TYPE 是一个 Kubernetes 资源。快捷方式和组会被解析。NONRESOURCEURL 是以 "/" 开头的部分 URL。NAME 是特定 Kubernetes 资源的名称。此命令与模拟用户功能很好地配合使用。参见 --as 全局标志。

kubectl auth can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL]

示例

  # Check to see if I can create pods in any namespace
  kubectl auth can-i create pods --all-namespaces
  
  # Check to see if I can list deployments in my current namespace
  kubectl auth can-i list deployments.apps
  
  # Check to see if service account "foo" of namespace "dev" can list pods in the namespace "prod"
  # You must be allowed to use impersonation for the global option "--as"
  kubectl auth can-i list pods --as=system:serviceaccount:dev:foo -n prod
  
  # Check to see if I can do everything in my current namespace ("*" means all)
  kubectl auth can-i '*' '*'
  
  # Check to see if I can get the job named "bar" in namespace "foo"
  kubectl auth can-i list jobs.batch/bar -n foo
  
  # Check to see if I can read pod logs
  kubectl auth can-i get pods --subresource=log
  
  # Check to see if I can access the URL /logs/
  kubectl auth can-i get /logs/
  
  # Check to see if I can approve certificates.k8s.io
  kubectl auth can-i approve certificates.k8s.io
  
  # List all allowed actions in namespace "foo"
  kubectl auth can-i --list --namespace=foo

选项

继承的父选项

另请参阅

• kubectl auth - 检查授权