'kubectl auth can-i --list' 有 Python 客戶端 API

Question

我正在嘗試列出與應用於命名空間“kube-system”中的集群的服務帳戶“foobar-user”關聯的權限：

kubectl auth can-i --list --as=system:serviceaccount:kube-system:foobar-user --namespace=kube-system

Resources                                       Non-Resource URLs                     Resource Names     Verbs
clusterroles                                    []                                    []                 [create list update watch get]
deployments                                     []                                    []                 [create list update watch get]
endpoints                                       []                                    []                 [create list update watch get]
pods                                            []                                    []                 [create list update watch get]
rolebindings                                    []                                    []                 [create list update watch get]
roles                                           []                                    []                 [create list update watch get]
secrets                                         []                                    []                 [create list update watch get]
services                                        []                                    []                 [create list update watch get]
selfsubjectaccessreviews.authorization.k8s.io   []                                    []                 [create]
selfsubjectrulesreviews.authorization.k8s.io    []                                    []                 [create]
                                                [/.well-known/openid-configuration]   []                 [get]
                                                [/api/*]                              []                 [get]
                                                [/api]                                []                 [get]
                                                [/apis/*]                             []                 [get]
                                                [/apis]                               []                 [get]
                                                [/healthz]                            []                 [get]
                                                [/healthz]                            []                 [get]
                                                [/livez]                              []                 [get]
                                                [/livez]                              []                 [get]
                                                [/openapi/*]                          []                 [get]
                                                [/openapi]                            []                 [get]
                                                [/openid/v1/jwks]                     []                 [get]
                                                [/readyz]                             []                 [get]
                                                [/readyz]                             []                 [get]
                                                [/version/]                           []                 [get]
                                                [/version/]                           []                 [get]
                                                [/version]                            []                 [get]
                                                [/version]                            []                 [get]
nodes                                           []                                    []                 [list watch get]

什么是等效的 API 通過 kube.netes 客戶端 Python 列出與服務帳戶關聯的權限？ 感謝您的幫助，謝謝！

Answer 1

通過 kube.netes 的 Python 客戶端執行此操作的等效 API 是：

AuthorizationV1Api - 創建一個 SelfSubjectRulesReview

Kube.netes 官方文檔如下：

SelfSubjectRulesReview ：返回用戶可以在命名空間內執行的一組操作的審查。 對用戶快速總結他們自己的訪問或對 UI 隱藏/顯示操作很有用。

檢查API訪問