如何调试或分析 Kubernetes RBAC 规则动词和 Api 组

Question

How can I debug all Rules with their Verbs and ApiGroups for a kubernetes ServiceAccount ?

Answer 1

kubectl supports testing the RBAC rights for a particular Service Account with the auth can-i sub-command. The syntax looks as follows:

kubectl auth can-i -n --as system:serviceaccount:<namespace>:<serviceaccount> <verb> <resource>

For example:

kubectl auth can-i --as system:serviceaccount:default:my-serviceaccount create deployments

More information can be found here .

Answer 2

k9s offer some nice views for this task:

1. Find Role Bindings

First you have to find the ClusterRoleBindings or RoleBindings for a ServiceAccount:

• Type : and clusterrolebindings or rolebindings
• Search for your ServiceAccount by / and name of ServiceAccount (eg monitor-kube-prometheus-st-operator )
• Now k9s lists all (Cluster)RoleBindings

2. Display Role Bindings

• Open (Cluster)RoleBindings
• All given and forbidden rules are displayed: