Verify RBAC permissions

Check what a ServiceAccount is allowed to do

kubectl auth can-i list pods --as=system:serviceaccount:<ns>:<sa> -n <ns>
tool
kubectl73 commands
tags
rbacdebug

More kubectl commands

  • Get resource with custom columns
    kubectl get pods -n <ns> -o custom-columns='NAME:.metadata.name,NODE:.spec.nodeName,STATUS:.status.phase'

    Print only the fields you care about without jq

  • Patch resource field
    kubectl patch deployment <name> -n <ns> -p '{"spec":{"replicas":2}}'

    Inline JSON patch without editing the whole manifest

  • Annotate resource
    kubectl annotate pod <pod> -n <ns> key=value --overwrite

    Set or update an annotation; --overwrite replaces existing value

  • Label resource
    kubectl label node <node> role=worker --overwrite

    Add or change a label on any resource

  • Add taint to node
    kubectl taint nodes <node> key=value:NoSchedule

    Prevent pods without matching toleration from scheduling on node

all 73 kubectl commands