kubectl auth can-i [page]deterministic

##

Check whether an action is allowed.

VERB is a logical Kubernetes API verb like 'get', 'list', 'watch', 'delete', etc. TYPE is a Kubernetes resource. Shortcuts and groups will be resolved. NONRESOURCEURL is a partial URL that starts with "/". NAME is the name of a particular Kubernetes resource. This command pairs nicely with impersonation. See --as global flag.

``` kubectl auth can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL] ```

##

``` # Check to see if I can create pods in any namespace kubectl auth can-i create pods --all-namespaces # Check to see if I can list deployments in my current namespace kubectl auth can-i list deployments.apps # Check to see if service account "foo" of namespace "dev" can list pods in the namespace "prod" # You must be allowed to use impersonation for the global option "--as" kubectl auth can-i list pods --as=system:serviceaccount:dev:foo -n prod # Check to see if I can do everything in my current namespace ("*" means all) kubectl auth can-i '*' '*' # Check to see if I can get the job named "bar" in namespace "foo" kubectl auth can-i list jobs.batch/bar -n foo # Check to see if I can read pod logs kubectl auth can-i get pods --subresource=log # Check to see if I can access the URL /logs/ kubectl auth can-i get /logs/ # Check to see if I can approve certificates.k8s.io kubectl auth can-i approve certificates.k8s.io # List all allowed actions in namespace "foo" kubectl auth can-i --list --namespace=foo ```

##

<table style="width: 100%; table-layout: fixed;"> <colgroup> <col span="1" style="width: 10px;" /> <col span="1" /> </colgroup> <tbody>

<tr> <td colspan="2">-A, --all-namespaces</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>If true, check the specified action in all namespaces.</p></td> </tr>

<tr> <td colspan="2">-h, --help</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>help for can-i</p></td> </tr>

<tr> <td colspan="2">--list</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>If true, prints all allowed actions.</p></td> </tr>

<tr> <td colspan="2">--no-headers</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>If true, prints allowed actions without headers</p></td> </tr>

<tr> <td colspan="2">-q, --quiet</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>If true, suppress output and just return the exit code.</p></td> </tr>

<tr> <td colspan="2">--subresource string</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>SubResource such as pod/log or deployment/scale</p></td> </tr>

</tbody> </table>

##

<table style="width: 100%; table-layout: fixed;"> <colgroup> <col span="1" style="width: 10px;" /> <col span="1" /> </colgroup> <tbody>

<tr> <td colspan="2">--as string</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>Username to impersonate for the operation. User could be a regular user or a service account in a namespace.</p></td> </tr>

<tr> <td colspan="2">--as-group strings</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>Group to impersonate for the operation, this flag can be repeated to specify multiple groups.</p></td> </tr>

<tr> <td colspan="2">--as-uid string</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>UID to impersonate for the operation.</p></td> </tr>

<tr> <td colspan="2">--as-user-extra strings</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.</p></td> </tr>

<tr> <td colspan="2">--cache-dir string&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Default: "$HOME/.kube/cache"</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>Default cach …(trimmed)