kubectl-who-can

Show who has RBAC permissions to perform actions on different resources in Kubernetes

Github stars Tracking Chart

GitHub release
Build Status
Coverage Status
Go Report Card
License

kubectl-who-can

Shows which subjects have RBAC permissions to VERB [TYPE, TYPE/NAME, NONRESOURCEURL] in Kubernetes.

asciicast

Installation

There are several ways to install kubectl-who-can. The recommended installation is via the kubectl plugin manager
called krew.

krew

I assume that you've already installed krew. Then run the following command:

kubectl krew install who-can

The plugin will be available as kubectl who-can.

Manual

Download a release distribution archive for your operating system, extract it, and add the kubectl-who-can
executable to your $PATH. For example, to manually install kubectl-who-can on macOS run the following command:

VERSION=`git describe --abbrev=0`

mkdir -p /tmp/who-can/$VERSION && \
curl -L https://github.com/aquasecurity/kubectl-who-can/releases/download/$VERSION/kubectl-who-can_darwin_x86_64.tar.gz \, tar xz -C /tmp/who-can/$VERSION && \
sudo mv -i /tmp/who-can/$VERSION/kubectl-who-can /usr/local/bin

Build from Source

This is a standard Go program. If you already know how to build
and install Go code, you probably won't need these instructions.

Note that while the code is small, it has some rather big
dependencies, and fetching + building these dependencies can
take a few minutes.

Option 1 (if you have a Go compiler and want to tweak the code):

# Clone this repository (or your fork)
git clone https://github.com/aquasecurity/kubectl-who-can
cd kubectl-who-can
make

The kubectl-who-can binary will be in the current directory.

Option 2 (if you have a Go compiler and just want the binary):

go get -v github.com/aquasecurity/kubectl-who-can/cmd/kubectl-who-can

The kubectl-who-can binary will be in $GOPATH/bin.

Option 3 (if you don't have a Go compiler, but have Docker installed):

docker run --rm -v /usr/local/bin:/go/bin golang go get -v github.com/aquasecurity/kubectl-who-can/cmd/kubectl-who-can

The kubectl-who-can binary will be in /usr/local/bin.

Usage

$ kubectl who-can VERB (TYPE, TYPE/NAME, NONRESOURCEURL) [flags]

Flags

Name, Shorthand, Default, Usage
-----------------, -----------, ---------, ----------------------------
namespace, n, If present, the namespace scope for this CLI request
all-namespaces, A, false, If true, check for users that can do the specified action in any of the available namespaces
subresource, Specify a sub-resource such as pod/log or deployment/scale

For additional details on flags and usage, run kubectl who-can --help.

License

This repository is available under the Apache License 2.0.

Main metrics

Overview
Name With Owneraquasecurity/kubectl-who-can
Primary LanguageGo
Program languageGo (Language Count: 2)
Platform
License:Apache License 2.0
所有者活动
Created At2019-03-16 14:55:36
Pushed At2024-07-17 11:59:27
Last Commit At
Release Count11
Last Release Namev0.4.0 (Posted on 2022-02-15 09:33:31)
First Release Namev0.1.0-alpha.1 (Posted on 2019-06-26 11:16:10)
用户参与
Stargazers Count866
Watchers Count16
Fork Count81
Commits Count84
Has Issues Enabled
Issues Count37
Issue Open Count9
Pull Requests Count48
Pull Requests Open Count5
Pull Requests Close Count13
项目设置
Has Wiki Enabled
Is Archived
Is Fork
Is Locked
Is Mirror
Is Private