Authorization

This topic contains authorization tasks for application developers and their capabilities, as dictated by the cluster administrator.

Using the scc-review and scc-subject-review options, you can see if an individual user, or a user under a specific service account, can create or update a pod.

Using the scc-review option, you can check if a service account can create or update a pod. The command outputs the security context constraints that admit the resource.

For example, to check if a user with the system:serviceaccount:projectname:default service account can a create a pod:

You can also use the scc-subject-review option to check whether a specific user can create or update a pod:

To check if a user belonging to a specific group can create a pod in a specific file:

From within your OKD project, you can determine what verbs you can perform against all namespace-scoped resources (including third-party resources).

The can-i command option tests scopes in terms of the user and role.

The output helps you to determine what API request to make to gather the information.

To receive information back in a user-readable format, run:

The output provides a full list.

To determine if you can perform specific verbs, run:

user scopes can provide more information about a given scope. For example: