search

corneliusweig / rakkess

Review Access - kubectl plugin to show an access matrix for k8s server resources
Apache License 2.0
1.3k stars 56 forks source link

Simplify access matrix for service-account #19

Closed corneliusweig closed 5 years ago

corneliusweig commented 5 years ago

Overview

Currently, the access matrix for a service account has to be generated by

rakkess --as system:serviceaccount:ingress-nginx:nginx-ingress-serviceaccount -n ingress-nginx

The user string system:serviceaccout:<namespace>:<service-account> is quite complicated and makes it hard to use.

Goal

Make it possible to specify the service-account in a simplified way, e.g.

rakkess --as-service-account nginx-ingress-serviceaccount -n ingress-nginx

It should be an error to specify --as-service-account without the --namespace option, because SAs are namespaced.