K8s Impersonation: Stepping Into Someone Else's Pods
Luke Hebert
- One minute read - 115 wordsKubernetes administrators can check their own permissions and also impersonate other users to perform tasks on their behalf. The kubectl auth can-i command, combined with the --as flag, makes it straightforward to verify what a specific user is allowed to do before actually acting as that user.
Check Access
kubectl auth can-i get podsImpersonate and Check Access
kubectl auth can-i create deployments --as devImpersonate
kubectl create deployment my-deployment --as dev
Important
The --as flag tells Kubernetes to execute the command as the specified user. The administrator performing the action must hold the impersonate permission on the target user’s role or service account. Without that permission, the request will be denied.