{"id":13521575,"url":"https://github.com/corneliusweig/rakkess","last_synced_at":"2025-05-16T06:04:57.374Z","repository":{"id":38361474,"uuid":"172054938","full_name":"corneliusweig/rakkess","owner":"corneliusweig","description":"Review Access - kubectl plugin to show an access matrix for k8s server resources","archived":false,"fork":false,"pushed_at":"2023-04-05T05:00:24.000Z","size":544,"stargazers_count":1334,"open_issues_count":14,"forks_count":58,"subscribers_count":12,"default_branch":"master","last_synced_at":"2025-04-08T16:01:50.656Z","etag":null,"topics":["authorization","k8s","kubectl","kubectl-plugin","kubectl-plugins","kubernetes","rbac","rbac-management"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/corneliusweig.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2019-02-22T11:28:24.000Z","updated_at":"2025-03-28T08:38:19.000Z","dependencies_parsed_at":"2023-10-20T19:32:18.247Z","dependency_job_id":null,"html_url":"https://github.com/corneliusweig/rakkess","commit_stats":null,"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corneliusweig%2Frakkess","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corneliusweig%2Frakkess/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corneliusweig%2Frakkess/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corneliusweig%2Frakkess/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corneliusweig","download_url":"https://codeload.github.com/corneliusweig/rakkess/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254478187,"owners_count":22077676,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authorization","k8s","kubectl","kubectl-plugin","kubectl-plugins","kubernetes","rbac","rbac-management"],"created_at":"2024-08-01T06:00:36.128Z","updated_at":"2025-05-16T06:04:57.355Z","avatar_url":"https://github.com/corneliusweig.png","language":"Go","funding_links":[],"categories":["Security","Go","Tools and Libraries","Repositories / Tools","kubernetes","kubectl Plugins","文章","Tools","Open Source Projects"],"sub_categories":["[Jenkins](#jenkins)","Security and Compliance","Defending","Installing plugins via awesome-kubectl-plugins","Kubernetes"],"readme":"# rakkess\n[![Build Status](https://travis-ci.com/corneliusweig/rakkess.svg?branch=master)](https://travis-ci.com/corneliusweig/rakkess)\n[![Code Coverage](https://codecov.io/gh/corneliusweig/rakkess/branch/master/graph/badge.svg)](https://codecov.io/gh/corneliusweig/rakkess)\n[![Go Report Card](https://goreportcard.com/badge/corneliusweig/rakkess)](https://goreportcard.com/report/corneliusweig/rakkess)\n[![LICENSE](https://img.shields.io/github/license/corneliusweig/rakkess.svg)](https://github.com/corneliusweig/rakkess/blob/master/LICENSE)\n[![Releases](https://img.shields.io/github/release-pre/corneliusweig/rakkess.svg)](https://github.com/corneliusweig/rakkess/releases)\n\nReview Access - kubectl plugin to show an access matrix for server resources\n\n## Intro\nHave you ever wondered what access rights you have on a provided kubernetes cluster?\nFor single resources you can use `kubectl auth can-i list deployments`, but maybe you are looking for a complete overview?\nThis is what `rakkess` is for.\nIt lists access rights for the current user and all server resources, similar to `kubectl auth can-i --list`.\n\nIt is also useful to find out who may interact with some server resource.\nCheck out the sub-command `rakkess resource` [below](#show-subjects-with-access-to-a-given-resource1).\n\n## Demo\n![rakkess demo](doc/demo-user-smaller.png \"rakkess --namespace default\")\n\n## Examples\n#### Show access for all resources\n- ... at cluster scope\n  ```bash\n  rakkess\n  ```\n\n- ... in some namespace\n  ```bash\n  rakkess --namespace default\n  ```\n\n- ... with verbs\n  ```bash\n  rakkess --verbs get,delete,watch,patch\n  ```\n\n- ... for another user\n  ```bash\n  rakkess --as other-user\n  ```\n\n- ... for another service-account\n  ```bash\n  rakkess --sa kube-system:namespace-controller\n  ```\n\n- ... and combine with common `kubectl` parameters\n  ```bash\n  KUBECONFIG=otherconfig rakkess --context other-context\n  ```\n  \n#### Show subjects with access to a given resource\u003csup\u003e[1](#credit-kubectl-who-can)\u003c/sup\u003e\n![rakkess demo](doc/demo-resource-smaller.png \"rakkess resource configmaps --namespace default\")\n- ...globally in all namespaces (only considers `ClusterRoleBindings`)\n  ```bash\n  rakkess resource configmaps\n  ```\n  \n- ...in a given namespace (considers `RoleBindings` and `ClusterRoleBindings`)\n  ```bash\n  rakkess resource configmaps -n default\n  ```\n\n- ...with shorthand notation\n  ```bash\n  rakkess r cm   # same as rakkess resource configmaps\n  ```\n\n- .. with custom verbs\n  ```bash\n  rakkess r cm --verbs get,delete,watch,patch\n  ```\n  \n##### Name-restricted roles\nSome roles only apply to resources with a specific name.\nTo review such configurations, provide the resource name as additional argument.\nFor example, show access rights for the `ConfigMap` called `ingress-controller-leader-nginx` in namespace `ingress-nginx` (note the subtle difference for `nginx-ingress-serviceaccount` to the previous example):\n\n![rakkess demo](doc/demo-named-resource-smaller.png \"rakkess resource configmap ingress-controller-leader-nginx --namespace ingress-nginx\")\n  \nAs `rakkess resource` needs to query `Roles`, `ClusterRoles`, and their bindings, it usually requires administrative cluster access.\n\nAlso see [Usage](doc/USAGE.md).\n\n## Installation\nThere are several ways to install `rakkess`. The recommended installation method is via `krew`.\n\n### Via krew\nKrew is a `kubectl` plugin manager. If you have not yet installed `krew`, get it at\n[https://github.com/kubernetes-sigs/krew](https://github.com/kubernetes-sigs/krew).\nThen installation is as simple as\n```bash\nkubectl krew install access-matrix\n```\nThe plugin will be available as `kubectl access-matrix`, see [doc/USAGE](doc/USAGE.md) for further details.\n\n### Binaries\nWhen using the binaries for installation, also have a look at [doc/USAGE](doc/USAGE.md).\n\n#### Linux\n```bash\ncurl -LO https://github.com/corneliusweig/rakkess/releases/download/v0.5.0/rakkess-amd64-linux.tar.gz \\\n  \u0026\u0026 tar xf rakkess-amd64-linux.tar.gz rakkess-amd64-linux \\\n  \u0026\u0026 chmod +x rakkess-amd64-linux \\\n  \u0026\u0026 mv -i rakkess-amd64-linux $GOPATH/bin/rakkess\n```\n\n#### OSX\n```bash\ncurl -LO https://github.com/corneliusweig/rakkess/releases/download/v0.5.0/rakkess-amd64-darwin.tar.gz \\\n  \u0026\u0026 tar xf rakkess-amd64-darwin.tar.gz rakkess-amd64-darwin \\\n  \u0026\u0026 chmod +x rakkess-amd64-darwin \\\n  \u0026\u0026 mv -i rakkess-amd64-darwin $GOPATH/bin/rakkess\n```\n\n#### Windows\n[https://github.com/corneliusweig/rakkess/releases/download/v0.5.0/rakkess-windows-amd64.zip](https://github.com/corneliusweig/rakkess/releases/download/v0.5.0/rakkess-windows-amd64.zip)\n\n### From source\n\n#### Build on host\n\nRequirements:\n - go 1.16 or newer\n - GNU make\n - git\n\nCompiling:\n```bash\nexport PLATFORMS=$(go env GOOS)\nmake all   # binaries will be placed in out/\n```\n\n#### Build in docker\nRequirements:\n - docker\n\nCompiling:\n```bash\nmkdir rakkess \u0026\u0026 chdir rakkess\ncurl -Lo Dockerfile https://raw.githubusercontent.com/corneliusweig/rakkess/master/Dockerfile\ndocker build . -t rakkess-builder\ndocker run --rm -v $PWD:/go/bin/ --env PLATFORMS=$(go env GOOS) rakkess\ndocker rmi rakkess-builder\n```\nBinaries will be placed in the current directory.\n\n## Users\n\n| What are others saying about rakkess? |\n| ---- |\n| _“Well, that looks handy! `rakkess`, a kubectl plugin to show an access matrix for all available resources.”_ – [@mhausenblas](https://twitter.com/mhausenblas/status/1100673166303739905) |\n| _“that's indeed pretty helpful. `rakkess --as system:serviceaccount:my-ns:my-sa -n my-ns` prints the access matrix of a service account in a namespace”_ – [@fakod](https://twitter.com/fakod/status/1100764745957658626) |\n| _“THE BOMB. Love it.”_ – [@ralph_squillace](https://twitter.com/ralph_squillace/status/1100844255830896640) |\n| _“This made my day. Well, not actually today but I definitively will use it a lot.”_ – [@Soukron](https://twitter.com/Soukron/status/1100690060129775617) |\n\n---\n\n\u003ca name=\"credit-kubectl-who-can\"\u003e[1]\u003c/a\u003e: This mode was inspired by [kubectl-who-can](https://github.com/aquasecurity/kubectl-who-can)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcorneliusweig%2Frakkess","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcorneliusweig%2Frakkess","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcorneliusweig%2Frakkess/lists"}