How do I use the can-i
command? It does not seem to be completely documented here:
https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-can-i-em- (no mention of --as
).
All the below results seem nonsensical:
kubectl auth can-i list pod --as=default3ueoaueo --as-group=system:authenticated --as-group=system:masters
yes
The above will return yes
for anything after --as=
- any user specified here.
On the other hand, the default user account (or any other I've tried) seems to have no permission at all:
kubectl auth can-i list pod --as=default
no
and
kubectl auth can-i list pod --as=default:serviceaccount:default
no
And according to https://github.com/kubernetes/kubernetes/issues/73123 we just add --as-group=system:authenticated
but that doesn't work either:
kubectl auth can-i list pod --as=serviceaccount:default --as-group=system:authenticated
no