kubectl auth can-i

概要

檢查是否允許某個動作。

VERB 是一個邏輯 Kubernetes API 動詞，例如 'get'、'list'、'watch'、'delete' 等。TYPE 是一個 Kubernetes 資源。捷徑與群組將會被解析。NONRESOURCEURL 是一個以 "/" 開頭的部分 URL。NAME 是一個特定 Kubernetes 資源的名稱。此命令與模擬搭配使用效果良好。請參閱 --as 全域標誌。

kubectl auth can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL]

範例

  # Check to see if I can create pods in any namespace
  kubectl auth can-i create pods --all-namespaces
  
  # Check to see if I can list deployments in my current namespace
  kubectl auth can-i list deployments.apps
  
  # Check to see if service account "foo" of namespace "dev" can list pods in the namespace "prod"
  # You must be allowed to use impersonation for the global option "--as"
  kubectl auth can-i list pods --as=system:serviceaccount:dev:foo -n prod
  
  # Check to see if I can do everything in my current namespace ("*" means all)
  kubectl auth can-i '*' '*'
  
  # Check to see if I can get the job named "bar" in namespace "foo"
  kubectl auth can-i list jobs.batch/bar -n foo
  
  # Check to see if I can read pod logs
  kubectl auth can-i get pods --subresource=log
  
  # Check to see if I can access the URL /logs/
  kubectl auth can-i get /logs/
  
  # Check to see if I can approve certificates.k8s.io
  kubectl auth can-i approve certificates.k8s.io
  
  # List all allowed actions in namespace "foo"
  kubectl auth can-i --list --namespace=foo

選項

另請參閱

• kubectl auth - 檢查授權