kubernetes reference nolist true contenttype tool reference weight 30 title kubectl label autogenerated true

Answer:
---
title: kubectl label
content_type: tool-reference
weight: 30
auto_generated: true
no_list: true
---

##

Update the labels on a resource.

  *  A label key and value must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to 63 characters each.
  *  Optionally, the key can begin with a DNS subdomain prefix and a single '/', like example.com/my-app.
  *  If --overwrite is true, then existing labels can be overwritten, otherwise attempting to overwrite a label will result in an error.
  *  If --resource-version is specified, then updates will use this resource version, otherwise the existing resource-version will be used.

```
kubectl label [--overwrite] (-f FILENAME | TYPE NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--resource-version=version]
```

##

```
  # Update pod 'foo' with the label 'unhealthy' and the value 'true'
  kubectl label pods foo unhealthy=true

  # Update pod 'foo' with the label 'status' and the value 'unhealthy', overwriting any existing value
  kubectl label --overwrite pods foo status=unhealthy

  # Update all pods in the namespace
  kubectl label pods --all status=unhealthy

  # Update a pod identified by the type and name in "pod.json"
  kubectl label -f pod.json status=unhealthy

  # Update pod 'foo' only if the resource is unchanged from version 1
  kubectl label pods foo status=unhealthy --resource-version=1

  # Update pod 'foo' by removing a label named 'bar' if it exists
  # Does not require the --overwrite flag
  kubectl label pods foo bar-
```

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

--all

Select all resources, in the namespace of the specified resource types

-A, --all-namespaces

If true, check the specified action in all namespaces.

--allow-missing-template-keys     Default: true

If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.

--dry-run string[="unchanged"]     Default: "none"

Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.

--field-manager string     Default: "kubectl-label"

Name of the manager used to track field ownership.

--field-selector string

Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.

-f, --filename strings

Filename, directory, or URL to files identifying the resource to update the labels

-h, --help

help for label

-k, --kustomize string

Process the kustomization directory. This flag can't be used together with -f or -R.

--list

If true, display the labels for a given resource.

--local

If true, label will NOT contact api-server but run locally.

-o, --output string

Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).

--overwrite

If true, allow labels to be overwritten, otherwise reject label updates that overwrite existing labels.

-R, --recursive

Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.

--resource-version string

If non-empty, the labels update will only succeed if this is the current resource-version for the object. Only valid when specifying a single resource.

-l, --selector string

Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2). Matching objects must satisfy all of the specified label constraints.

--show-managed-fields

If true, keep the managedFields when printing objects in JSON or YAML format.

--template string

Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

--as string

Username to impersonate for the operation. User could be a regular user or a service account in a namespace.

--as-group strings

Group to impersonate for the operation, this flag can be repeated to specify multiple groups.

--as-uid string

UID to impersonate for the operation.

--cache-dir string     Default: "$HOME/.kube/cache"

Default cache directory

--certificate-authority string

Path to a cert file for the certificate authority

--client-certificate string

Path to a client certificate file for TLS

--client-key string

Path to a client key file for TLS

--cluster string

The name of the kubeconfig cluster to use

--context string

The name of the kubeconfig context to use

--default-not-ready-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for notReady:NoExecute that is added by default to every pod that does not already have such a toleration.

--default-unreachable-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for unreachable:NoExecute that is added by default to every pod that does not already have such a toleration.

--disable-compression

If true, opt-out of response compression for all requests to the server

--insecure-skip-tls-verify

If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure

--kubeconfig string

Path to the kubeconfig file to use for CLI requests.

--match-server-version

Require server version to match client version

-n, --namespace string

If present, the namespace scope for this CLI request

--password string

Password for basic authentication to the API server

--profile string     Default: "none"

Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)

--profile-output string     Default: "profile.pprof"

Name of the file to write the profile to

--request-timeout string     Default: "0"

The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.

-s, --server string

The address and port of the Kubernetes API server

--storage-driver-buffer-duration duration     Default: 1m0s

Writes in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction

--storage-driver-db string     Default: "cadvisor"

database name

--storage-driver-host string     Default: "localhost:8086"

database host:port

--storage-driver-password string     Default: "root"

database password

--storage-driver-secure

use secure connection with database

--storage-driver-table string     Default: "stats"

table name

--storage-driver-user string     Default: "root"

database username

--tls-server-name string

Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used

--token string

Bearer token for authentication to the API server

--user string

The name of the kubeconfig user to use

--username string

Username for basic authentication to the API server

--version version[=true]

--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version

--warnings-as-errors

Treat warnings received from the server as errors and exit with a non-zero exit code

##

* [kubectl](../kubectl/)	 - kubectl controls the Kubernetes cluster manager

title  kubectl label content type  tool reference weight  30 auto generated  true no list  true            The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the  Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project              Update the labels on a resource        A label key and value must begin with a letter or number  and may contain letters  numbers  hyphens  dots  and underscores  up to 63 characters each       Optionally  the key can begin with a DNS subdomain prefix and a single      like example com my app       If   overwrite is true  then existing labels can be overwritten  otherwise attempting to overwrite a label will result in an error       If   resource version is specified  then updates will use this resource version  otherwise the existing resource version will be used       kubectl label    overwrite    f FILENAME   TYPE NAME  KEY 1 VAL 1     KEY N VAL N    resource version version                    Update pod  foo  with the label  unhealthy  and the value  true    kubectl label pods foo unhealthy true        Update pod  foo  with the label  status  and the value  unhealthy   overwriting any existing value   kubectl label   overwrite pods foo status unhealthy        Update all pods in the namespace   kubectl label pods   all status unhealthy        Update a pod identified by the type and name in  pod json    kubectl label  f pod json status unhealthy        Update pod  foo  only if the resource is unchanged from version 1   kubectl label pods foo status unhealthy   resource version 1        Update pod  foo  by removing a label named  bar  if it exists     Does not require the   overwrite flag   kubectl label pods foo bar                table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2    all  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Select all resources  in the namespace of the specified resource types  p   td    tr    tr   td colspan  2   A    all namespaces  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  check the specified action in all namespaces   p   td    tr    tr   td colspan  2    allow missing template keys nbsp  nbsp  nbsp  nbsp  nbsp Default  true  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  ignore any errors in templates when a field or map key is missing in the template  Only applies to golang and jsonpath output formats   p   td    tr    tr   td colspan  2    dry run string   unchanged   nbsp  nbsp  nbsp  nbsp  nbsp Default   none   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Must be  quot none quot    quot server quot   or  quot client quot   If client strategy  only print the object that would be sent  without sending it  If server strategy  submit server side request without persisting the resource   p   td    tr    tr   td colspan  2    field manager string nbsp  nbsp  nbsp  nbsp  nbsp Default   kubectl label   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of the manager used to track field ownership   p   td    tr    tr   td colspan  2    field selector string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Selector  field query  to filter on  supports            and       e g    field selector key1 value1 key2 value2   The server only supports a limited number of field queries per type   p   td    tr    tr   td colspan  2   f    filename strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Filename  directory  or URL to files identifying the resource to update the labels  p   td    tr    tr   td colspan  2   h    help  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p help for label  p   td    tr    tr   td colspan  2   k    kustomize string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Process the kustomization directory  This flag can t be used together with  f or  R   p   td    tr    tr   td colspan  2    list  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  display the labels for a given resource   p   td    tr    tr   td colspan  2    local  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  label will NOT contact api server but run locally   p   td    tr    tr   td colspan  2   o    output string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Output format  One of   json  yaml  name  go template  go template file  template  templatefile  jsonpath  jsonpath as json  jsonpath file    p   td    tr    tr   td colspan  2    overwrite  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  allow labels to be overwritten  otherwise reject label updates that overwrite existing labels   p   td    tr    tr   td colspan  2   R    recursive  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Process the directory used in  f    filename recursively  Useful when you want to manage related manifests organized within the same directory   p   td    tr    tr   td colspan  2    resource version string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If non empty  the labels update will only succeed if this is the current resource version for the object  Only valid when specifying a single resource   p   td    tr    tr   td colspan  2   l    selector string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Selector  label query  to filter on  supports            and       e g   l key1 value1 key2 value2   Matching objects must satisfy all of the specified label constraints   p   td    tr    tr   td colspan  2    show managed fields  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  keep the managedFields when printing objects in JSON or YAML format   p   td    tr    tr   td colspan  2    template string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Template string or path to template file to use when  o go template   o go template file  The template format is golang templates  http   golang org pkg text template  pkg overview    p   td    tr     tbody    table              table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2    as string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username to impersonate for the operation  User could be a regular user or a service account in a namespace   p   td    tr    tr   td colspan  2    as group strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Group to impersonate for the operation  this flag can be repeated to specify multiple groups   p   td    tr    tr   td colspan  2    as uid string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p UID to impersonate for the operation   p   td    tr    tr   td colspan  2    cache dir string nbsp  nbsp  nbsp  nbsp  nbsp Default    HOME  kube cache   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Default cache directory  p   td    tr    tr   td colspan  2    certificate authority string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a cert file for the certificate authority  p   td    tr    tr   td colspan  2    client certificate string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client certificate file for TLS  p   td    tr    tr   td colspan  2    client key string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client key file for TLS  p   td    tr    tr   td colspan  2    cluster string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig cluster to use  p   td    tr    tr   td colspan  2    context string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig context to use  p   td    tr    tr   td colspan  2    default not ready toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for notReady NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    default unreachable toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for unreachable NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    disable compression  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  opt out of response compression for all requests to the server  p   td    tr    tr   td colspan  2    insecure skip tls verify  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  the server s certificate will not be checked for validity  This will make your HTTPS connections insecure  p   td    tr    tr   td colspan  2    kubeconfig string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to the kubeconfig file to use for CLI requests   p   td    tr    tr   td colspan  2    match server version  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Require server version to match client version  p   td    tr    tr   td colspan  2   n    namespace string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If present  the namespace scope for this CLI request  p   td    tr    tr   td colspan  2    password string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Password for basic authentication to the API server  p   td    tr    tr   td colspan  2    profile string nbsp  nbsp  nbsp  nbsp  nbsp Default   none   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of profile to capture  One of  none cpu heap goroutine threadcreate block mutex   p   td    tr    tr   td colspan  2    profile output string nbsp  nbsp  nbsp  nbsp  nbsp Default   profile pprof   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of the file to write the profile to  p   td    tr    tr   td colspan  2    request timeout string nbsp  nbsp  nbsp  nbsp  nbsp Default   0   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The length of time to wait before giving up on a single server request  Non zero values should contain a corresponding time unit  e g  1s  2m  3h   A value of zero means don t timeout requests   p   td    tr    tr   td colspan  2   s    server string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The address and port of the Kubernetes API server  p   td    tr    tr   td colspan  2    storage driver buffer duration duration nbsp  nbsp  nbsp  nbsp  nbsp Default  1m0s  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Writes in the storage driver will be buffered for this duration  and committed to the non memory backends as a single transaction  p   td    tr    tr   td colspan  2    storage driver db string nbsp  nbsp  nbsp  nbsp  nbsp Default   cadvisor   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database name  p   td    tr    tr   td colspan  2    storage driver host string nbsp  nbsp  nbsp  nbsp  nbsp Default   localhost 8086   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database host port  p   td    tr    tr   td colspan  2    storage driver password string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database password  p   td    tr    tr   td colspan  2    storage driver secure  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p use secure connection with database  p   td    tr    tr   td colspan  2    storage driver table string nbsp  nbsp  nbsp  nbsp  nbsp Default   stats   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p table name  p   td    tr    tr   td colspan  2    storage driver user string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database username  p   td    tr    tr   td colspan  2    tls server name string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Server name to use for server certificate validation  If it is not provided  the hostname used to contact the server is used  p   td    tr    tr   td colspan  2    token string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Bearer token for authentication to the API server  p   td    tr    tr   td colspan  2    user string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig user to use  p   td    tr    tr   td colspan  2    username string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username for basic authentication to the API server  p   td    tr    tr   td colspan  2    version version  true   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p   version    version raw prints version information and quits    version vX Y Z    sets the reported version  p   td    tr    tr   td colspan  2    warnings as errors  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Treat warnings received from the server as errors and exit with a non zero exit code  p   td    tr     tbody    table             kubectl     kubectl      kubectl controls the Kubernetes cluster manager


kubernetes reference The file is auto generated from the Go source code of the component using a generic contenttype tool reference title kubectl auth whoami weight 30 autogenerated true

Answer:
---
title: kubectl auth whoami
content_type: tool-reference
weight: 30
auto_generated: true
---

##

Experimental: Check who you are and your attributes (groups, extra).

        This command is helpful to get yourself aware of the current user attributes,
        especially when dynamic authentication, e.g., token webhook, auth proxy, or OIDC provider,
        is enabled in the Kubernetes cluster.

```
kubectl auth whoami
```

##

```
  # Get your subject attributes
  kubectl auth whoami

  # Get your subject attributes in JSON format
  kubectl auth whoami -o json
```

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

--allow-missing-template-keys     Default: true

If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.

-h, --help

help for whoami

-o, --output string

Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).

--show-managed-fields

If true, keep the managedFields when printing objects in JSON or YAML format.

--template string

Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

--as string

Username to impersonate for the operation. User could be a regular user or a service account in a namespace.

--as-group strings

Group to impersonate for the operation, this flag can be repeated to specify multiple groups.

--as-uid string

UID to impersonate for the operation.

--cache-dir string     Default: "$HOME/.kube/cache"

Default cache directory

--certificate-authority string

Path to a cert file for the certificate authority

--client-certificate string

Path to a client certificate file for TLS

--client-key string

Path to a client key file for TLS

--cluster string

The name of the kubeconfig cluster to use

--context string

The name of the kubeconfig context to use

--default-not-ready-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for notReady:NoExecute that is added by default to every pod that does not already have such a toleration.

--default-unreachable-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for unreachable:NoExecute that is added by default to every pod that does not already have such a toleration.

--disable-compression

If true, opt-out of response compression for all requests to the server

--insecure-skip-tls-verify

If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure

--kubeconfig string

Path to the kubeconfig file to use for CLI requests.

--match-server-version

Require server version to match client version

-n, --namespace string

If present, the namespace scope for this CLI request

--password string

Password for basic authentication to the API server

--profile string     Default: "none"

Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)

--profile-output string     Default: "profile.pprof"

Name of the file to write the profile to

--request-timeout string     Default: "0"

The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.

-s, --server string

The address and port of the Kubernetes API server

--storage-driver-buffer-duration duration     Default: 1m0s

Writes in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction

--storage-driver-db string     Default: "cadvisor"

database name

--storage-driver-host string     Default: "localhost:8086"

database host:port

--storage-driver-password string     Default: "root"

database password

--storage-driver-secure

use secure connection with database

--storage-driver-table string     Default: "stats"

table name

--storage-driver-user string     Default: "root"

database username

--tls-server-name string

Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used

--token string

Bearer token for authentication to the API server

--user string

The name of the kubeconfig user to use

--username string

Username for basic authentication to the API server

--version version[=true]

--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version

--warnings-as-errors

Treat warnings received from the server as errors and exit with a non-zero exit code

##

* [kubectl auth](../)	 - Inspect authorization

title  kubectl auth whoami content type  tool reference weight  30 auto generated  true            The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the  Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project              Experimental  Check who you are and your attributes  groups  extra            This command is helpful to get yourself aware of the current user attributes          especially when dynamic authentication  e g   token webhook  auth proxy  or OIDC provider          is enabled in the Kubernetes cluster       kubectl auth whoami                   Get your subject attributes   kubectl auth whoami        Get your subject attributes in JSON format   kubectl auth whoami  o json               table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2    allow missing template keys nbsp  nbsp  nbsp  nbsp  nbsp Default  true  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  ignore any errors in templates when a field or map key is missing in the template  Only applies to golang and jsonpath output formats   p   td    tr    tr   td colspan  2   h    help  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p help for whoami  p   td    tr    tr   td colspan  2   o    output string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Output format  One of   json  yaml  name  go template  go template file  template  templatefile  jsonpath  jsonpath as json  jsonpath file    p   td    tr    tr   td colspan  2    show managed fields  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  keep the managedFields when printing objects in JSON or YAML format   p   td    tr    tr   td colspan  2    template string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Template string or path to template file to use when  o go template   o go template file  The template format is golang templates  http   golang org pkg text template  pkg overview    p   td    tr     tbody    table              table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2    as string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username to impersonate for the operation  User could be a regular user or a service account in a namespace   p   td    tr    tr   td colspan  2    as group strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Group to impersonate for the operation  this flag can be repeated to specify multiple groups   p   td    tr    tr   td colspan  2    as uid string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p UID to impersonate for the operation   p   td    tr    tr   td colspan  2    cache dir string nbsp  nbsp  nbsp  nbsp  nbsp Default    HOME  kube cache   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Default cache directory  p   td    tr    tr   td colspan  2    certificate authority string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a cert file for the certificate authority  p   td    tr    tr   td colspan  2    client certificate string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client certificate file for TLS  p   td    tr    tr   td colspan  2    client key string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client key file for TLS  p   td    tr    tr   td colspan  2    cluster string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig cluster to use  p   td    tr    tr   td colspan  2    context string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig context to use  p   td    tr    tr   td colspan  2    default not ready toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for notReady NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    default unreachable toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for unreachable NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    disable compression  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  opt out of response compression for all requests to the server  p   td    tr    tr   td colspan  2    insecure skip tls verify  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  the server s certificate will not be checked for validity  This will make your HTTPS connections insecure  p   td    tr    tr   td colspan  2    kubeconfig string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to the kubeconfig file to use for CLI requests   p   td    tr    tr   td colspan  2    match server version  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Require server version to match client version  p   td    tr    tr   td colspan  2   n    namespace string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If present  the namespace scope for this CLI request  p   td    tr    tr   td colspan  2    password string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Password for basic authentication to the API server  p   td    tr    tr   td colspan  2    profile string nbsp  nbsp  nbsp  nbsp  nbsp Default   none   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of profile to capture  One of  none cpu heap goroutine threadcreate block mutex   p   td    tr    tr   td colspan  2    profile output string nbsp  nbsp  nbsp  nbsp  nbsp Default   profile pprof   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of the file to write the profile to  p   td    tr    tr   td colspan  2    request timeout string nbsp  nbsp  nbsp  nbsp  nbsp Default   0   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The length of time to wait before giving up on a single server request  Non zero values should contain a corresponding time unit  e g  1s  2m  3h   A value of zero means don t timeout requests   p   td    tr    tr   td colspan  2   s    server string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The address and port of the Kubernetes API server  p   td    tr    tr   td colspan  2    storage driver buffer duration duration nbsp  nbsp  nbsp  nbsp  nbsp Default  1m0s  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Writes in the storage driver will be buffered for this duration  and committed to the non memory backends as a single transaction  p   td    tr    tr   td colspan  2    storage driver db string nbsp  nbsp  nbsp  nbsp  nbsp Default   cadvisor   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database name  p   td    tr    tr   td colspan  2    storage driver host string nbsp  nbsp  nbsp  nbsp  nbsp Default   localhost 8086   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database host port  p   td    tr    tr   td colspan  2    storage driver password string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database password  p   td    tr    tr   td colspan  2    storage driver secure  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p use secure connection with database  p   td    tr    tr   td colspan  2    storage driver table string nbsp  nbsp  nbsp  nbsp  nbsp Default   stats   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p table name  p   td    tr    tr   td colspan  2    storage driver user string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database username  p   td    tr    tr   td colspan  2    tls server name string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Server name to use for server certificate validation  If it is not provided  the hostname used to contact the server is used  p   td    tr    tr   td colspan  2    token string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Bearer token for authentication to the API server  p   td    tr    tr   td colspan  2    user string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig user to use  p   td    tr    tr   td colspan  2    username string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username for basic authentication to the API server  p   td    tr    tr   td colspan  2    version version  true   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p   version    version raw prints version information and quits    version vX Y Z    sets the reported version  p   td    tr    tr   td colspan  2    warnings as errors  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Treat warnings received from the server as errors and exit with a non zero exit code  p   td    tr     tbody    table             kubectl auth          Inspect authorization


kubernetes reference The file is auto generated from the Go source code of the component using a generic contenttype tool reference weight 30 autogenerated true title kubectl auth reconcile

Answer:
---
title: kubectl auth reconcile
content_type: tool-reference
weight: 30
auto_generated: true
---

##

Reconciles rules for RBAC role, role binding, cluster role, and cluster role binding objects.

 Missing objects are created, and the containing namespace is created for namespaced objects, if required.

 Existing roles are updated to include the permissions in the input objects, and remove extra permissions if --remove-extra-permissions is specified.

 Existing bindings are updated to include the subjects in the input objects, and remove extra subjects if --remove-extra-subjects is specified.

 This is preferred to 'apply' for RBAC resources so that semantically-aware merging of rules and subjects is done.

```
kubectl auth reconcile -f FILENAME
```

##

```
  # Reconcile RBAC resources from a file
  kubectl auth reconcile -f my-rbac-rules.yaml
```

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

--allow-missing-template-keys     Default: true

If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.

--dry-run string[="unchanged"]     Default: "none"

Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.

-f, --filename strings

Filename, directory, or URL to files identifying the resource to reconcile.

-h, --help

help for reconcile

-k, --kustomize string

Process the kustomization directory. This flag can't be used together with -f or -R.

-o, --output string

Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).

-R, --recursive

Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.

--remove-extra-permissions

If true, removes extra permissions added to roles

--remove-extra-subjects

If true, removes extra subjects added to rolebindings

--show-managed-fields

If true, keep the managedFields when printing objects in JSON or YAML format.

--template string

Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

--as string

Username to impersonate for the operation. User could be a regular user or a service account in a namespace.

--as-group strings

Group to impersonate for the operation, this flag can be repeated to specify multiple groups.

--as-uid string

UID to impersonate for the operation.

--cache-dir string     Default: "$HOME/.kube/cache"

Default cache directory

--certificate-authority string

Path to a cert file for the certificate authority

--client-certificate string

Path to a client certificate file for TLS

--client-key string

Path to a client key file for TLS

--cluster string

The name of the kubeconfig cluster to use

--context string

The name of the kubeconfig context to use

--default-not-ready-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for notReady:NoExecute that is added by default to every pod that does not already have such a toleration.

--default-unreachable-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for unreachable:NoExecute that is added by default to every pod that does not already have such a toleration.

--disable-compression

If true, opt-out of response compression for all requests to the server

--insecure-skip-tls-verify

If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure

--kubeconfig string

Path to the kubeconfig file to use for CLI requests.

--match-server-version

Require server version to match client version

-n, --namespace string

If present, the namespace scope for this CLI request

--password string

Password for basic authentication to the API server

--profile string     Default: "none"

Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)

--profile-output string     Default: "profile.pprof"

Name of the file to write the profile to

--request-timeout string     Default: "0"

The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.

-s, --server string

The address and port of the Kubernetes API server

--storage-driver-buffer-duration duration     Default: 1m0s

Writes in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction

--storage-driver-db string     Default: "cadvisor"

database name

--storage-driver-host string     Default: "localhost:8086"

database host:port

--storage-driver-password string     Default: "root"

database password

--storage-driver-secure

use secure connection with database

--storage-driver-table string     Default: "stats"

table name

--storage-driver-user string     Default: "root"

database username

--tls-server-name string

Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used

--token string

Bearer token for authentication to the API server

--user string

The name of the kubeconfig user to use

--username string

Username for basic authentication to the API server

--version version[=true]

--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version

--warnings-as-errors

Treat warnings received from the server as errors and exit with a non-zero exit code

##

* [kubectl auth](../)	 - Inspect authorization

title  kubectl auth reconcile content type  tool reference weight  30 auto generated  true            The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the  Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project              Reconciles rules for RBAC role  role binding  cluster role  and cluster role binding objects    Missing objects are created  and the containing namespace is created for namespaced objects  if required    Existing roles are updated to include the permissions in the input objects  and remove extra permissions if   remove extra permissions is specified    Existing bindings are updated to include the subjects in the input objects  and remove extra subjects if   remove extra subjects is specified    This is preferred to  apply  for RBAC resources so that semantically aware merging of rules and subjects is done       kubectl auth reconcile  f FILENAME                   Reconcile RBAC resources from a file   kubectl auth reconcile  f my rbac rules yaml               table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2    allow missing template keys nbsp  nbsp  nbsp  nbsp  nbsp Default  true  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  ignore any errors in templates when a field or map key is missing in the template  Only applies to golang and jsonpath output formats   p   td    tr    tr   td colspan  2    dry run string   unchanged   nbsp  nbsp  nbsp  nbsp  nbsp Default   none   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Must be  quot none quot    quot server quot   or  quot client quot   If client strategy  only print the object that would be sent  without sending it  If server strategy  submit server side request without persisting the resource   p   td    tr    tr   td colspan  2   f    filename strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Filename  directory  or URL to files identifying the resource to reconcile   p   td    tr    tr   td colspan  2   h    help  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p help for reconcile  p   td    tr    tr   td colspan  2   k    kustomize string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Process the kustomization directory  This flag can t be used together with  f or  R   p   td    tr    tr   td colspan  2   o    output string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Output format  One of   json  yaml  name  go template  go template file  template  templatefile  jsonpath  jsonpath as json  jsonpath file    p   td    tr    tr   td colspan  2   R    recursive  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Process the directory used in  f    filename recursively  Useful when you want to manage related manifests organized within the same directory   p   td    tr    tr   td colspan  2    remove extra permissions  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  removes extra permissions added to roles  p   td    tr    tr   td colspan  2    remove extra subjects  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  removes extra subjects added to rolebindings  p   td    tr    tr   td colspan  2    show managed fields  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  keep the managedFields when printing objects in JSON or YAML format   p   td    tr    tr   td colspan  2    template string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Template string or path to template file to use when  o go template   o go template file  The template format is golang templates  http   golang org pkg text template  pkg overview    p   td    tr     tbody    table              table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2    as string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username to impersonate for the operation  User could be a regular user or a service account in a namespace   p   td    tr    tr   td colspan  2    as group strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Group to impersonate for the operation  this flag can be repeated to specify multiple groups   p   td    tr    tr   td colspan  2    as uid string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p UID to impersonate for the operation   p   td    tr    tr   td colspan  2    cache dir string nbsp  nbsp  nbsp  nbsp  nbsp Default    HOME  kube cache   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Default cache directory  p   td    tr    tr   td colspan  2    certificate authority string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a cert file for the certificate authority  p   td    tr    tr   td colspan  2    client certificate string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client certificate file for TLS  p   td    tr    tr   td colspan  2    client key string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client key file for TLS  p   td    tr    tr   td colspan  2    cluster string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig cluster to use  p   td    tr    tr   td colspan  2    context string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig context to use  p   td    tr    tr   td colspan  2    default not ready toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for notReady NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    default unreachable toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for unreachable NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    disable compression  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  opt out of response compression for all requests to the server  p   td    tr    tr   td colspan  2    insecure skip tls verify  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  the server s certificate will not be checked for validity  This will make your HTTPS connections insecure  p   td    tr    tr   td colspan  2    kubeconfig string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to the kubeconfig file to use for CLI requests   p   td    tr    tr   td colspan  2    match server version  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Require server version to match client version  p   td    tr    tr   td colspan  2   n    namespace string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If present  the namespace scope for this CLI request  p   td    tr    tr   td colspan  2    password string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Password for basic authentication to the API server  p   td    tr    tr   td colspan  2    profile string nbsp  nbsp  nbsp  nbsp  nbsp Default   none   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of profile to capture  One of  none cpu heap goroutine threadcreate block mutex   p   td    tr    tr   td colspan  2    profile output string nbsp  nbsp  nbsp  nbsp  nbsp Default   profile pprof   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of the file to write the profile to  p   td    tr    tr   td colspan  2    request timeout string nbsp  nbsp  nbsp  nbsp  nbsp Default   0   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The length of time to wait before giving up on a single server request  Non zero values should contain a corresponding time unit  e g  1s  2m  3h   A value of zero means don t timeout requests   p   td    tr    tr   td colspan  2   s    server string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The address and port of the Kubernetes API server  p   td    tr    tr   td colspan  2    storage driver buffer duration duration nbsp  nbsp  nbsp  nbsp  nbsp Default  1m0s  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Writes in the storage driver will be buffered for this duration  and committed to the non memory backends as a single transaction  p   td    tr    tr   td colspan  2    storage driver db string nbsp  nbsp  nbsp  nbsp  nbsp Default   cadvisor   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database name  p   td    tr    tr   td colspan  2    storage driver host string nbsp  nbsp  nbsp  nbsp  nbsp Default   localhost 8086   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database host port  p   td    tr    tr   td colspan  2    storage driver password string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database password  p   td    tr    tr   td colspan  2    storage driver secure  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p use secure connection with database  p   td    tr    tr   td colspan  2    storage driver table string nbsp  nbsp  nbsp  nbsp  nbsp Default   stats   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p table name  p   td    tr    tr   td colspan  2    storage driver user string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database username  p   td    tr    tr   td colspan  2    tls server name string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Server name to use for server certificate validation  If it is not provided  the hostname used to contact the server is used  p   td    tr    tr   td colspan  2    token string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Bearer token for authentication to the API server  p   td    tr    tr   td colspan  2    user string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig user to use  p   td    tr    tr   td colspan  2    username string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username for basic authentication to the API server  p   td    tr    tr   td colspan  2    version version  true   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p   version    version raw prints version information and quits    version vX Y Z    sets the reported version  p   td    tr    tr   td colspan  2    warnings as errors  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Treat warnings received from the server as errors and exit with a non zero exit code  p   td    tr     tbody    table             kubectl auth          Inspect authorization


kubernetes reference The file is auto generated from the Go source code of the component using a generic contenttype tool reference weight 30 title kubectl auth can i autogenerated true

Answer:
---
title: kubectl auth can-i
content_type: tool-reference
weight: 30
auto_generated: true
---

##

Check whether an action is allowed.

 VERB is a logical Kubernetes API verb like 'get', 'list', 'watch', 'delete', etc. TYPE is a Kubernetes resource. Shortcuts and groups will be resolved. NONRESOURCEURL is a partial URL that starts with "/". NAME is the name of a particular Kubernetes resource. This command pairs nicely with impersonation. See --as global flag.

```
kubectl auth can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL]
```

##

```
  # Check to see if I can create pods in any namespace
  kubectl auth can-i create pods --all-namespaces

  # Check to see if I can list deployments in my current namespace
  kubectl auth can-i list deployments.apps

  # Check to see if service account "foo" of namespace "dev" can list pods in the namespace "prod"
  # You must be allowed to use impersonation for the global option "--as"
  kubectl auth can-i list pods --as=system:serviceaccount:dev:foo -n prod

  # Check to see if I can do everything in my current namespace ("*" means all)
  kubectl auth can-i '*' '*'

  # Check to see if I can get the job named "bar" in namespace "foo"
  kubectl auth can-i list jobs.batch/bar -n foo

  # Check to see if I can read pod logs
  kubectl auth can-i get pods --subresource=log

  # Check to see if I can access the URL /logs/
  kubectl auth can-i get /logs/

  # Check to see if I can approve certificates.k8s.io
  kubectl auth can-i approve certificates.k8s.io

  # List all allowed actions in namespace "foo"
  kubectl auth can-i --list --namespace=foo
```

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

-A, --all-namespaces

If true, check the specified action in all namespaces.

-h, --help

help for can-i

--list

If true, prints all allowed actions.

--no-headers

If true, prints allowed actions without headers

-q, --quiet

If true, suppress output and just return the exit code.

--subresource string

SubResource such as pod/log or deployment/scale

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

--as string

Username to impersonate for the operation. User could be a regular user or a service account in a namespace.

--as-group strings

Group to impersonate for the operation, this flag can be repeated to specify multiple groups.

--as-uid string

UID to impersonate for the operation.

--cache-dir string     Default: "$HOME/.kube/cache"

Default cache directory

--certificate-authority string

Path to a cert file for the certificate authority

--client-certificate string

Path to a client certificate file for TLS

--client-key string

Path to a client key file for TLS

--cluster string

The name of the kubeconfig cluster to use

--context string

The name of the kubeconfig context to use

--default-not-ready-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for notReady:NoExecute that is added by default to every pod that does not already have such a toleration.

--default-unreachable-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for unreachable:NoExecute that is added by default to every pod that does not already have such a toleration.

--disable-compression

If true, opt-out of response compression for all requests to the server

--insecure-skip-tls-verify

If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure

--kubeconfig string

Path to the kubeconfig file to use for CLI requests.

--match-server-version

Require server version to match client version

-n, --namespace string

If present, the namespace scope for this CLI request

--password string

Password for basic authentication to the API server

--profile string     Default: "none"

Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)

--profile-output string     Default: "profile.pprof"

Name of the file to write the profile to

--request-timeout string     Default: "0"

The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.

-s, --server string

The address and port of the Kubernetes API server

--storage-driver-buffer-duration duration     Default: 1m0s

Writes in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction

--storage-driver-db string     Default: "cadvisor"

database name

--storage-driver-host string     Default: "localhost:8086"

database host:port

--storage-driver-password string     Default: "root"

database password

--storage-driver-secure

use secure connection with database

--storage-driver-table string     Default: "stats"

table name

--storage-driver-user string     Default: "root"

database username

--tls-server-name string

Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used

--token string

Bearer token for authentication to the API server

--user string

The name of the kubeconfig user to use

--username string

Username for basic authentication to the API server

--version version[=true]

--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version

--warnings-as-errors

Treat warnings received from the server as errors and exit with a non-zero exit code

##

* [kubectl auth](../)	 - Inspect authorization

title  kubectl auth can i content type  tool reference weight  30 auto generated  true            The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the  Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project              Check whether an action is allowed    VERB is a logical Kubernetes API verb like  get    list    watch    delete   etc  TYPE is a Kubernetes resource  Shortcuts and groups will be resolved  NONRESOURCEURL is a partial URL that starts with      NAME is the name of a particular Kubernetes resource  This command pairs nicely with impersonation  See   as global flag       kubectl auth can i VERB  TYPE   TYPE NAME   NONRESOURCEURL                    Check to see if I can create pods in any namespace   kubectl auth can i create pods   all namespaces        Check to see if I can list deployments in my current namespace   kubectl auth can i list deployments apps        Check to see if service account  foo  of namespace  dev  can list pods in the namespace  prod      You must be allowed to use impersonation for the global option    as    kubectl auth can i list pods   as system serviceaccount dev foo  n prod        Check to see if I can do everything in my current namespace      means all    kubectl auth can i                Check to see if I can get the job named  bar  in namespace  foo    kubectl auth can i list jobs batch bar  n foo        Check to see if I can read pod logs   kubectl auth can i get pods   subresource log        Check to see if I can access the URL  logs    kubectl auth can i get  logs         Check to see if I can approve certificates k8s io   kubectl auth can i approve certificates k8s io        List all allowed actions in namespace  foo    kubectl auth can i   list   namespace foo               table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2   A    all namespaces  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  check the specified action in all namespaces   p   td    tr    tr   td colspan  2   h    help  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p help for can i  p   td    tr    tr   td colspan  2    list  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  prints all allowed actions   p   td    tr    tr   td colspan  2    no headers  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  prints allowed actions without headers  p   td    tr    tr   td colspan  2   q    quiet  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  suppress output and just return the exit code   p   td    tr    tr   td colspan  2    subresource string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p SubResource such as pod log or deployment scale  p   td    tr     tbody    table              table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2    as string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username to impersonate for the operation  User could be a regular user or a service account in a namespace   p   td    tr    tr   td colspan  2    as group strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Group to impersonate for the operation  this flag can be repeated to specify multiple groups   p   td    tr    tr   td colspan  2    as uid string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p UID to impersonate for the operation   p   td    tr    tr   td colspan  2    cache dir string nbsp  nbsp  nbsp  nbsp  nbsp Default    HOME  kube cache   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Default cache directory  p   td    tr    tr   td colspan  2    certificate authority string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a cert file for the certificate authority  p   td    tr    tr   td colspan  2    client certificate string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client certificate file for TLS  p   td    tr    tr   td colspan  2    client key string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client key file for TLS  p   td    tr    tr   td colspan  2    cluster string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig cluster to use  p   td    tr    tr   td colspan  2    context string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig context to use  p   td    tr    tr   td colspan  2    default not ready toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for notReady NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    default unreachable toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for unreachable NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    disable compression  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  opt out of response compression for all requests to the server  p   td    tr    tr   td colspan  2    insecure skip tls verify  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  the server s certificate will not be checked for validity  This will make your HTTPS connections insecure  p   td    tr    tr   td colspan  2    kubeconfig string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to the kubeconfig file to use for CLI requests   p   td    tr    tr   td colspan  2    match server version  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Require server version to match client version  p   td    tr    tr   td colspan  2   n    namespace string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If present  the namespace scope for this CLI request  p   td    tr    tr   td colspan  2    password string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Password for basic authentication to the API server  p   td    tr    tr   td colspan  2    profile string nbsp  nbsp  nbsp  nbsp  nbsp Default   none   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of profile to capture  One of  none cpu heap goroutine threadcreate block mutex   p   td    tr    tr   td colspan  2    profile output string nbsp  nbsp  nbsp  nbsp  nbsp Default   profile pprof   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of the file to write the profile to  p   td    tr    tr   td colspan  2    request timeout string nbsp  nbsp  nbsp  nbsp  nbsp Default   0   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The length of time to wait before giving up on a single server request  Non zero values should contain a corresponding time unit  e g  1s  2m  3h   A value of zero means don t timeout requests   p   td    tr    tr   td colspan  2   s    server string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The address and port of the Kubernetes API server  p   td    tr    tr   td colspan  2    storage driver buffer duration duration nbsp  nbsp  nbsp  nbsp  nbsp Default  1m0s  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Writes in the storage driver will be buffered for this duration  and committed to the non memory backends as a single transaction  p   td    tr    tr   td colspan  2    storage driver db string nbsp  nbsp  nbsp  nbsp  nbsp Default   cadvisor   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database name  p   td    tr    tr   td colspan  2    storage driver host string nbsp  nbsp  nbsp  nbsp  nbsp Default   localhost 8086   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database host port  p   td    tr    tr   td colspan  2    storage driver password string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database password  p   td    tr    tr   td colspan  2    storage driver secure  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p use secure connection with database  p   td    tr    tr   td colspan  2    storage driver table string nbsp  nbsp  nbsp  nbsp  nbsp Default   stats   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p table name  p   td    tr    tr   td colspan  2    storage driver user string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database username  p   td    tr    tr   td colspan  2    tls server name string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Server name to use for server certificate validation  If it is not provided  the hostname used to contact the server is used  p   td    tr    tr   td colspan  2    token string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Bearer token for authentication to the API server  p   td    tr    tr   td colspan  2    user string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig user to use  p   td    tr    tr   td colspan  2    username string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username for basic authentication to the API server  p   td    tr    tr   td colspan  2    version version  true   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p   version    version raw prints version information and quits    version vX Y Z    sets the reported version  p   td    tr    tr   td colspan  2    warnings as errors  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Treat warnings received from the server as errors and exit with a non zero exit code  p   td    tr     tbody    table             kubectl auth          Inspect authorization


kubernetes reference nolist true contenttype tool reference weight 30 title kubectl auth autogenerated true

Answer:
---
title: kubectl auth
content_type: tool-reference
weight: 30
auto_generated: true
no_list: true
---

##

Inspect authorization.

```
kubectl auth [flags]
```

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

-h, --help

help for auth

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

--as string

Username to impersonate for the operation. User could be a regular user or a service account in a namespace.

--as-group strings

Group to impersonate for the operation, this flag can be repeated to specify multiple groups.

--as-uid string

UID to impersonate for the operation.

--cache-dir string     Default: "$HOME/.kube/cache"

Default cache directory

--certificate-authority string

Path to a cert file for the certificate authority

--client-certificate string

Path to a client certificate file for TLS

--client-key string

Path to a client key file for TLS

--cluster string

The name of the kubeconfig cluster to use

--context string

The name of the kubeconfig context to use

--default-not-ready-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for notReady:NoExecute that is added by default to every pod that does not already have such a toleration.

--default-unreachable-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for unreachable:NoExecute that is added by default to every pod that does not already have such a toleration.

--disable-compression

If true, opt-out of response compression for all requests to the server

--insecure-skip-tls-verify

If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure

--kubeconfig string

Path to the kubeconfig file to use for CLI requests.

--match-server-version

Require server version to match client version

-n, --namespace string

If present, the namespace scope for this CLI request

--password string

Password for basic authentication to the API server

--profile string     Default: "none"

Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)

--profile-output string     Default: "profile.pprof"

Name of the file to write the profile to

--request-timeout string     Default: "0"

The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.

-s, --server string

The address and port of the Kubernetes API server

--storage-driver-buffer-duration duration     Default: 1m0s

Writes in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction

--storage-driver-db string     Default: "cadvisor"

database name

--storage-driver-host string     Default: "localhost:8086"

database host:port

--storage-driver-password string     Default: "root"

database password

--storage-driver-secure

use secure connection with database

--storage-driver-table string     Default: "stats"

table name

--storage-driver-user string     Default: "root"

database username

--tls-server-name string

Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used

--token string

Bearer token for authentication to the API server

--user string

The name of the kubeconfig user to use

--username string

Username for basic authentication to the API server

--version version[=true]

--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version

--warnings-as-errors

Treat warnings received from the server as errors and exit with a non-zero exit code

##

* [kubectl](../kubectl/)	 - kubectl controls the Kubernetes cluster manager
* [kubectl auth can-i](kubectl_auth_can-i/)	 - Check whether an action is allowed
* [kubectl auth reconcile](kubectl_auth_reconcile/)	 - Reconciles rules for RBAC role, role binding, cluster role, and cluster role binding objects
* [kubectl auth whoami](kubectl_auth_whoami/)	 - Experimental: Check self subject attributes

title  kubectl auth content type  tool reference weight  30 auto generated  true no list  true            The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the  Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project              Inspect authorization       kubectl auth  flags                table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2   h    help  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p help for auth  p   td    tr     tbody    table              table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2    as string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username to impersonate for the operation  User could be a regular user or a service account in a namespace   p   td    tr    tr   td colspan  2    as group strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Group to impersonate for the operation  this flag can be repeated to specify multiple groups   p   td    tr    tr   td colspan  2    as uid string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p UID to impersonate for the operation   p   td    tr    tr   td colspan  2    cache dir string nbsp  nbsp  nbsp  nbsp  nbsp Default    HOME  kube cache   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Default cache directory  p   td    tr    tr   td colspan  2    certificate authority string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a cert file for the certificate authority  p   td    tr    tr   td colspan  2    client certificate string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client certificate file for TLS  p   td    tr    tr   td colspan  2    client key string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client key file for TLS  p   td    tr    tr   td colspan  2    cluster string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig cluster to use  p   td    tr    tr   td colspan  2    context string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig context to use  p   td    tr    tr   td colspan  2    default not ready toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for notReady NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    default unreachable toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for unreachable NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    disable compression  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  opt out of response compression for all requests to the server  p   td    tr    tr   td colspan  2    insecure skip tls verify  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  the server s certificate will not be checked for validity  This will make your HTTPS connections insecure  p   td    tr    tr   td colspan  2    kubeconfig string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to the kubeconfig file to use for CLI requests   p   td    tr    tr   td colspan  2    match server version  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Require server version to match client version  p   td    tr    tr   td colspan  2   n    namespace string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If present  the namespace scope for this CLI request  p   td    tr    tr   td colspan  2    password string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Password for basic authentication to the API server  p   td    tr    tr   td colspan  2    profile string nbsp  nbsp  nbsp  nbsp  nbsp Default   none   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of profile to capture  One of  none cpu heap goroutine threadcreate block mutex   p   td    tr    tr   td colspan  2    profile output string nbsp  nbsp  nbsp  nbsp  nbsp Default   profile pprof   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of the file to write the profile to  p   td    tr    tr   td colspan  2    request timeout string nbsp  nbsp  nbsp  nbsp  nbsp Default   0   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The length of time to wait before giving up on a single server request  Non zero values should contain a corresponding time unit  e g  1s  2m  3h   A value of zero means don t timeout requests   p   td    tr    tr   td colspan  2   s    server string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The address and port of the Kubernetes API server  p   td    tr    tr   td colspan  2    storage driver buffer duration duration nbsp  nbsp  nbsp  nbsp  nbsp Default  1m0s  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Writes in the storage driver will be buffered for this duration  and committed to the non memory backends as a single transaction  p   td    tr    tr   td colspan  2    storage driver db string nbsp  nbsp  nbsp  nbsp  nbsp Default   cadvisor   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database name  p   td    tr    tr   td colspan  2    storage driver host string nbsp  nbsp  nbsp  nbsp  nbsp Default   localhost 8086   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database host port  p   td    tr    tr   td colspan  2    storage driver password string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database password  p   td    tr    tr   td colspan  2    storage driver secure  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p use secure connection with database  p   td    tr    tr   td colspan  2    storage driver table string nbsp  nbsp  nbsp  nbsp  nbsp Default   stats   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p table name  p   td    tr    tr   td colspan  2    storage driver user string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database username  p   td    tr    tr   td colspan  2    tls server name string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Server name to use for server certificate validation  If it is not provided  the hostname used to contact the server is used  p   td    tr    tr   td colspan  2    token string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Bearer token for authentication to the API server  p   td    tr    tr   td colspan  2    user string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig user to use  p   td    tr    tr   td colspan  2    username string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username for basic authentication to the API server  p   td    tr    tr   td colspan  2    version version  true   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p   version    version raw prints version information and quits    version vX Y Z    sets the reported version  p   td    tr    tr   td colspan  2    warnings as errors  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Treat warnings received from the server as errors and exit with a non zero exit code  p   td    tr     tbody    table             kubectl     kubectl      kubectl controls the Kubernetes cluster manager    kubectl auth can i  kubectl auth can i      Check whether an action is allowed    kubectl auth reconcile  kubectl auth reconcile      Reconciles rules for RBAC role  role binding  cluster role  and cluster role binding objects    kubectl auth whoami  kubectl auth whoami      Experimental  Check self subject attributes