{"id":13521587,"url":"https://github.com/aquasecurity/kubectl-who-can","last_synced_at":"2025-10-13T07:22:00.747Z","repository":{"id":34327225,"uuid":"175985633","full_name":"aquasecurity/kubectl-who-can","owner":"aquasecurity","description":"Show who has RBAC permissions to perform actions on different resources in Kubernetes","archived":false,"fork":false,"pushed_at":"2024-07-17T11:59:27.000Z","size":414,"stargazers_count":841,"open_issues_count":14,"forks_count":81,"subscribers_count":16,"default_branch":"main","last_synced_at":"2024-11-02T05:32:55.689Z","etag":null,"topics":["kubectl","kubernetes","kubernetes-rbac","rbac"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aquasecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-03-16T14:55:36.000Z","updated_at":"2024-10-28T14:55:56.000Z","dependencies_parsed_at":"2024-11-02T05:31:43.541Z","dependency_job_id":"f7605f7c-0cb3-4d2a-b49e-feaa09146101","html_url":"https://github.com/aquasecurity/kubectl-who-can","commit_stats":null,"previous_names":[],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Fkubectl-who-can","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Fkubectl-who-can/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Fkubectl-who-can/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Fkubectl-who-can/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aquasecurity","download_url":"https://codeload.github.com/aquasecurity/kubectl-who-can/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246536097,"owners_count":20793382,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kubectl","kubernetes","kubernetes-rbac","rbac"],"created_at":"2024-08-01T06:00:36.234Z","updated_at":"2025-10-13T07:21:55.709Z","avatar_url":"https://github.com/aquasecurity.png","language":"Go","funding_links":[],"categories":["Container Tools","Kubernetes tooling","Repositories / Tools","kubernetes","Go","kubectl Plugins","Security","Tools","Open Source Projects"],"sub_categories":["MultiCloud Governance","Defending","Installing plugins via awesome-kubectl-plugins","Kubernetes"],"readme":"[![GitHub Release][release-img]][release]\n[![GitHub Action][build-action-img]][build-action]\n[![Coverage Status][cov-img]][cov]\n[![Go Report Card][report-card-img]][report-card]\n[![License][license-img]][license]\n[![GitHub All Releases][github-all-releases-img]][release]\n\n# kubectl-who-can\n\nShows which subjects have RBAC permissions to VERB [TYPE | TYPE/NAME | NONRESOURCEURL] in Kubernetes.\n\n[![asciicast][asciicast-img]][asciicast]\n\n## Installation\n\nThere are several ways to install `kubectl-who-can`. The recommended installation is via the `kubectl` plugin manager\ncalled [`krew`](https://github.com/kubernetes-sigs/krew).\n\n### krew\n\nI assume that you've already [installed](https://github.com/kubernetes-sigs/krew#installation) `krew`. Then run the following command:\n\n```\nkubectl krew install who-can\n```\n\nThe plugin will be available as `kubectl who-can`.\n\n### Manual\n\nDownload a [release distribution archive][release] for your operating system, extract it, and add the `kubectl-who-can`\nexecutable to your `$PATH`. For example, to manually install `kubectl-who-can` on macOS run the following command:\n\n```\nVERSION=`git describe --abbrev=0`\n\nmkdir -p /tmp/who-can/$VERSION \u0026\u0026 \\\ncurl -L https://github.com/aquasecurity/kubectl-who-can/releases/download/$VERSION/kubectl-who-can_darwin_x86_64.tar.gz \\\n  | tar xz -C /tmp/who-can/$VERSION \u0026\u0026 \\\nsudo mv -i /tmp/who-can/$VERSION/kubectl-who-can /usr/local/bin\n```\n\n## Build from Source\n\nThis is a standard Go program. If you already know how to build\nand install Go code, you probably won't need these instructions.\n\nNote that while the code is small, it has some rather big\ndependencies, and fetching + building these dependencies can\ntake a few minutes.\n\nOption 1 (if you have a Go compiler and want to tweak the code):\n```bash\n# Clone this repository (or your fork)\ngit clone https://github.com/aquasecurity/kubectl-who-can\ncd kubectl-who-can\nmake\n```\nThe `kubectl-who-can` binary will be in the current directory.\n\nOption 2 (if you have a Go compiler and just want the binary):\n```\ngo install github.com/aquasecurity/kubectl-who-can/cmd/kubectl-who-can@latest\n```\nThe `kubectl-who-can` binary will be in `$GOPATH/bin`.\n\nOption 3 (if you don't have a Go compiler, but have Docker installed):\n```\ndocker run --rm -v /usr/local/bin:/go/bin golang:1.17 go install github.com/aquasecurity/kubectl-who-can/cmd/kubectl-who-can@latest\n```\nThe `kubectl-who-can` binary will be in `/usr/local/bin`.\n\n## Usage\n\n`$ kubectl who-can VERB (TYPE | TYPE/NAME | NONRESOURCEURL) [flags]`\n\n### Flags\n\nName             | Shorthand | Default | Usage\n-----------------|-----------|---------|----------------------------\nnamespace        | n         |         | If present, the namespace scope for this CLI request\nall-namespaces   | A         | false   | If true, check for users that can do the specified action in any of the available namespaces\nsubresource      |           |         | Specify a sub-resource such as pod/log or deployment/scale\n\nFor additional details on flags and usage, run `kubectl who-can --help`.\n\n[release-img]: https://img.shields.io/github/release/aquasecurity/kubectl-who-can.svg?logo=github\n[release]: https://github.com/aquasecurity/kubectl-who-can/releases\n\n[build-action-img]: https://github.com/aquasecurity/kubectl-who-can/workflows/build/badge.svg\n[build-action]: https://github.com/aquasecurity/kubectl-who-can/actions\n\n[cov-img]: https://codecov.io/github/aquasecurity/kubectl-who-can/branch/main/graph/badge.svg\n[cov]: https://codecov.io/github/aquasecurity/kubectl-who-can\n\n[report-card-img]: https://goreportcard.com/badge/github.com/aquasecurity/kubectl-who-can\n[report-card]: https://goreportcard.com/report/github.com/aquasecurity/kubectl-who-can\n\n[license-img]: https://img.shields.io/github/license/aquasecurity/kubectl-who-can.svg\n[license]: https://github.com/aquasecurity/kubectl-who-can/blob/main/LICENSE\n[github-all-releases-img]: https://img.shields.io/github/downloads/aquasecurity/kubectl-who-can/total?logo=github\n\n[asciicast-img]: https://asciinema.org/a/ccqqYwA5L5rMV9kd1tgzyZJ2j.svg\n[asciicast]: https://asciinema.org/a/ccqqYwA5L5rMV9kd1tgzyZJ2j\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faquasecurity%2Fkubectl-who-can","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faquasecurity%2Fkubectl-who-can","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faquasecurity%2Fkubectl-who-can/lists"}