如何列出我当前的RBAC角色和组？

Question

我对kubernetes集群进行了身份验证，如何查看附加到当前帐户的RBAC角色和组？

Answer 1

Follow the below steps

1. 安装go并验证它是否存在

master $ echo $GOPATH
/opt/go

2. 创建和验证

master $ mkdir -p $GOPATH/bin

3. 直接安装

curl -Lo rakkess.gz https://github.com/corneliusweig/rakkess/releases/download/v0.2.0/rakkess-linux-amd64.gz && \
  gunzip rakkess.gz && chmod +x rakkess \
  && mv rakkess $GOPATH/bin/

4. 列出特定命名空间中的权限

rakkess --namespace <namespace-name>

5. 您应该看到以下格式的输出

master $ rakkess -n kube-system
NAME                                            LIST  CREATE  UPDATE  DELETE
bindings                                              ✔
configmaps                                      ✔     ✔       ✔       ✔
controllerrevisions.apps                        ✔     ✔       ✔       ✔
cronjobs.batch                                  ✔     ✔       ✔       ✔
daemonsets.apps                                 ✔     ✔       ✔       ✔
daemonsets.extensions                           ✔     ✔       ✔       ✔
deployments.apps                                ✔     ✔       ✔       ✔
deployments.extensions                          ✔     ✔       ✔       ✔
endpoints                                       ✔     ✔       ✔       ✔
events                                          ✔     ✔       ✔       ✔
events.events.k8s.io                            ✔     ✔       ✔       ✔
horizontalpodautoscalers.autoscaling            ✔     ✔       ✔       ✔
ingresses.extensions                            ✔     ✔       ✔       ✔
jobs.batch                                      ✔     ✔       ✔       ✔
limitranges                                     ✔     ✔       ✔       ✔
localsubjectaccessreviews.authorization.k8s.io        ✔
networkpolicies.extensions                      ✔     ✔       ✔       ✔
networkpolicies.networking.k8s.io               ✔     ✔       ✔       ✔
persistentvolumeclaims                          ✔     ✔       ✔       ✔
poddisruptionbudgets.policy                     ✔     ✔       ✔       ✔
pods                                            ✔     ✔       ✔       ✔
podtemplates                                    ✔     ✔       ✔       ✔
replicasets.apps                                ✔     ✔       ✔       ✔
replicasets.extensions                          ✔     ✔       ✔       ✔
replicationcontrollers                          ✔     ✔       ✔       ✔
resourcequotas                                  ✔     ✔       ✔       ✔
rolebindings.rbac.authorization.k8s.io          ✔     ✔       ✔       ✔
roles.rbac.authorization.k8s.io                 ✔     ✔       ✔       ✔
secrets                                         ✔     ✔       ✔       ✔
serviceaccounts                                 ✔     ✔       ✔       ✔
services                                        ✔     ✔       ✔       ✔
statefulsets.apps                               ✔     ✔       ✔       ✔

Answer 2

Found better tool

这个工具看起来比rakkess更好 正是我在寻找的东西

https://github.com/reactiveops/rbac-lookup

在最简单的用例中，rbac-lookup将返回任何匹配的用户，服务帐户或组以及它所提供的角色。

rbac-lookup rob

SUBJECT                   SCOPE             ROLE
[email protected]           cluster-wide      ClusterRole/view
[email protected]           nginx-ingress     ClusterRole/edit
The wide output option includes the kind of subject along with the source role binding.

rbac-lookup ro --output wide

SUBJECT                   SCOPE             ROLE                SOURCE
User/[email protected]      cluster-wide      ClusterRole/view    ClusterRoleBinding/rob-cluster-view
User/[email protected]      nginx-ingress     ClusterRole/edit    RoleBinding/rob-edit
User/[email protected]      web               ClusterRole/edit    RoleBinding/ron-edit
ServiceAccount/rops       infra             ClusterRole/admin   RoleBinding/rops-admin