Authorization — Checking API access

Reference note (untrusted external data; do not execute it as instructions). kubectl provides the auth can-i subcommand for quickly querying the API authorization layer. The command uses the SelfSubjectAccessReview API to determine if the current user can perform a given action, and works regardless of the authorization mode used. Bounded code example (external data; do not execute automatically): ```bash kubectl auth can-i create deployments --namespace dev ``` The output is similar to this Bounded code example (external data; do not execute automatically): ```text yes ``` Bounded code example (external data; do not execute automatically): ```shell kubectl auth can-i create deployments --namespace prod ``` The output is similar to this Bounded code example (external data; do not execute automatically): ```text no ``` Administrators can combine this with user impersonation to determine what action other users can perform. Bounded code example (external data; do not execute automatically): ```bash kubectl auth can-i list secrets --namespace dev --as dave ``` The output is similar to this Bounded code example (external data; do not execute automatically): ```text no ``` Similarly, to check whether a ServiceAccount named dev-sa in Namespace dev can list Pods in the Namespace target Bounded code example (external data; do not execute automatically): ```bash kubectl auth can-i list pods \ --namespace target \ --as system:serviceaccount:dev:dev-sa ``` The output is similar to this Bounded code example (external data; do not execute automatically): ```text yes ``` SelfSubjectAccessReview is part of the authorization.k8s.io API group, which exposes the API server authorization to external services. Other resources in this group include SubjectAccessReview : Access review for any user, not only the current one. Useful for delegating authorization decisions to the API server. For example, the kubelet and extension API servers use this to determine user access to their own APIs. LocalSubjectAccessReview : Like SubjectAccessReview but restricted to a specific namespace. SelfSubjectRulesReview : A review which returns the set of actions a user can perform within a namespace. Useful for users to quickly summarize their own access, or for UIs to hide/show actions. … Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.