8

How do I use the can-i command? It does not seem to be completely documented here:

https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-can-i-em- (no mention of --as).


All the below results seem nonsensical:

kubectl auth can-i list pod --as=default3ueoaueo --as-group=system:authenticated --as-group=system:masters
yes

The above will return yes for anything after --as= - any user specified here.

On the other hand, the default user account (or any other I've tried) seems to have no permission at all:

kubectl auth can-i list pod --as=default                                                                  
no

and

kubectl auth can-i list pod --as=default:serviceaccount:default
no

And according to https://github.com/kubernetes/kubernetes/issues/73123 we just add --as-group=system:authenticated but that doesn't work either:

kubectl auth can-i list pod --as=serviceaccount:default  --as-group=system:authenticated 
no

1 Answer 1

9

The usage of '--as' argument with kubectl command is known as "User impersonation", and it's documented in official documentation here.

If you are trying to impersonate user as an API resource like 'serviceaccounts',
the proper syntax is: '--as=system:serviceaccount:kube-system:default'

1
  • 1
    exanple '--as=system:serviceaccount:kube-system:default' Jan 14, 2020 at 5:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.