OC-AUTH-CAN-I(1)

🌸 oc auth can-i — OC AUTH(1) 🌸

Hey bestie, welcome to the OC AUTH(1) manual 💖 this is the page for oc auth can-i, and it’s literally your permission vibe check. Let’s get into it 🫶

---

✨ NAME ✨

oc auth can-i — check whether an action is allowed 💅

---

🦋 SYNOPSIS 🦋

oc auth can-i [OPTIONS]

---

💖 DESCRIPTION 💖

Okay so this command checks whether an action is allowed. That’s the whole main character job ✨

Here’s the cast of characters you might pass in:

• VERB is a logical Kubernetes API verb like 'get', 'list', 'watch', 'delete', etc.
• TYPE is a Kubernetes resource. Shortcuts and groups will be resolved.
• NONRESOURCEURL is a partial URL that starts with "/".
• NAME is the name of a particular Kubernetes resource.

This command pairs nicely with impersonation. See the --as global flag 👀

---

💅 OPTIONS 💅

• -A, --all-namespaces=false — if true, check the specified action in all namespaces.
• --list=false — if true, prints all allowed actions.
• --no-headers=false — if true, prints allowed actions without headers.
• -q, --quiet=false — if true, suppress output and just return the exit code.
• --subresource="" — SubResource such as pod/log or deployment/scale.

---

🎀 OPTIONS INHERITED FROM PARENT COMMANDS 🎀

These are the parent-command flags you also get, because inheritance is a thing and she ate 💅

• --as="" — Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
• --as-group=[] — Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
• --as-uid="" — UID to impersonate for the operation.
• --as-user-extra=[] — User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.
• --cache-dir="/homeless-shelter/.kube/cache" — Default cache directory.
• --certificate-authority="" — Path to a cert file for the certificate authority.
• --client-certificate="" — Path to a client certificate file for TLS.
• --client-key="" — Path to a client key file for TLS.
• --cluster="" — The name of the kubeconfig cluster to use.
• --context="" — The name of the kubeconfig context to use.
• --disable-compression=false — If true, opt-out of response compression for all requests to the server.
• --insecure-skip-tls-verify=false — If true, the server’s certificate will not be checked for validity. ⚠️ This will make your HTTPS connections insecure.
• --kubeconfig="" — Path to the kubeconfig file to use for CLI requests.
• --kuberc="" — Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
• --match-server-version=false — Require server version to match client version.
• -n, --namespace="" — If present, the namespace scope for this CLI request.
• --profile="none" — Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex).
• --profile-output="profile.pprof" — Name of the file to write the profile to.
• --request-timeout="0" — The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don’t timeout requests.
• -s, --server="" — The address and port of the Kubernetes API server.
• --tls-server-name="" — Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used.
• --token="" — Bearer token for authentication to the API server.
• --user="" — The name of the kubeconfig user to use.
• --warnings-as-errors=false — Treat warnings received from the server as errors and exit with a non-zero exit code.

---

🔥 EXAMPLE 🔥

Demo time, bestie — here are the exact commands, no cap 🧚

# Check to see if I can create pods in any namespace
oc auth can-i create pods --all-namespaces

# Check to see if I can list deployments in my current namespace
oc auth can-i list deployments.apps

# Check to see if service account "foo" of namespace "dev" can list pods in the namespace "prod"
# You must be allowed to use impersonation for the global option "--as"
oc auth can-i list pods --as=system:serviceaccount:dev:foo -n prod

# Check to see if I can do everything in my current namespace ("*" means all)
oc auth can-i '*' '*'

# Check to see if I can get the job named "bar" in namespace "foo"
oc auth can-i list jobs.batch/bar -n foo

# Check to see if I can read pod logs
oc auth can-i get pods --subresource=log

# Check to see if I can access the URL /logs/
oc auth can-i get /logs/

# Check to see if I can approve certificates.k8s.io
oc auth can-i approve certificates.k8s.io

# List all allowed actions in namespace "foo"
oc auth can-i --list --namespace=foo

---

👑 SEE ALSO 👑

• oc-auth(1), — the related manual page, bestie 🫶

---

🌈 HISTORY 🌈

June 2016, Ported from the Kubernetes man-doc generator ✨ iconic origin story, honestly.

---

🫶 that’s the whole page — source/version: Openshift · Openshift CLI User Manuals · OC AUTH(1) · date: June 2016 🫶