K
Q

How to list my current RBAC roles and groups I belong to?

3/6/2019

I authenticated to kubernetes cluster, how can I view my RBAC roles and groups attached to my current account?

-- animekun
kubernetes
rbac

Similar Questions

Building a container with gcloud, kubectl and python3.6
How to find out to which 'user' I should add 'scc'?
Active-Passive Jenkins Setup in Kubernetes
Run 3 component of an app in 3 different pods

2 Answers

3/11/2019

Found better tool

this tool looks way better than rakkess
exactly what I was looking for

https://github.com/reactiveops/rbac-lookup

In the simplest use case, rbac-lookup will return any matching user, service account, or group along with the roles it has been given.

rbac-lookup rob

SUBJECT                   SCOPE             ROLE
rob@example.com           cluster-wide      ClusterRole/view
rob@example.com           nginx-ingress     ClusterRole/edit
The wide output option includes the kind of subject along with the source role binding.
rbac-lookup ro --output wide

SUBJECT                   SCOPE             ROLE                SOURCE
User/rob@example.com      cluster-wide      ClusterRole/view    ClusterRoleBinding/rob-cluster-view
User/rob@example.com      nginx-ingress     ClusterRole/edit    RoleBinding/rob-edit
User/ron@example.com      web               ClusterRole/edit    RoleBinding/ron-edit
ServiceAccount/rops       infra             ClusterRole/admin   RoleBinding/rops-admin
-- animekun
Source: StackOverflow
3/6/2019

Follow the below steps

  1. Install go and verify that it is present
master $ echo $GOPATH
/opt/go
  1. Create and Verify
master $ mkdir -p $GOPATH/bin
  1. Install rakkess
curl -Lo rakkess.gz https://github.com/corneliusweig/rakkess/releases/download/v0.2.0/rakkess-linux-amd64.gz && \
  gunzip rakkess.gz && chmod +x rakkess \
  && mv rakkess $GOPATH/bin/
  1. List the privileges in a specific namespace
rakkess --namespace <namespace-name>
  1. You should see the output in the below format
master $ rakkess -n kube-system
NAME                                            LIST  CREATE  UPDATE  DELETE
bindings                                              ✔
configmaps                                      ✔     ✔       ✔       ✔
controllerrevisions.apps                        ✔     ✔       ✔       ✔
cronjobs.batch                                  ✔     ✔       ✔       ✔
daemonsets.apps                                 ✔     ✔       ✔       ✔
daemonsets.extensions                           ✔     ✔       ✔       ✔
deployments.apps                                ✔     ✔       ✔       ✔
deployments.extensions                          ✔     ✔       ✔       ✔
endpoints                                       ✔     ✔       ✔       ✔
events                                          ✔     ✔       ✔       ✔
events.events.k8s.io                            ✔     ✔       ✔       ✔
horizontalpodautoscalers.autoscaling            ✔     ✔       ✔       ✔
ingresses.extensions                            ✔     ✔       ✔       ✔
jobs.batch                                      ✔     ✔       ✔       ✔
limitranges                                     ✔     ✔       ✔       ✔
localsubjectaccessreviews.authorization.k8s.io        ✔
networkpolicies.extensions                      ✔     ✔       ✔       ✔
networkpolicies.networking.k8s.io               ✔     ✔       ✔       ✔
persistentvolumeclaims                          ✔     ✔       ✔       ✔
poddisruptionbudgets.policy                     ✔     ✔       ✔       ✔
pods                                            ✔     ✔       ✔       ✔
podtemplates                                    ✔     ✔       ✔       ✔
replicasets.apps                                ✔     ✔       ✔       ✔
replicasets.extensions                          ✔     ✔       ✔       ✔
replicationcontrollers                          ✔     ✔       ✔       ✔
resourcequotas                                  ✔     ✔       ✔       ✔
rolebindings.rbac.authorization.k8s.io          ✔     ✔       ✔       ✔
roles.rbac.authorization.k8s.io                 ✔     ✔       ✔       ✔
secrets                                         ✔     ✔       ✔       ✔
serviceaccounts                                 ✔     ✔       ✔       ✔
services                                        ✔     ✔       ✔       ✔
statefulsets.apps                               ✔     ✔       ✔       ✔
-- P Ekambaram
Source: StackOverflow