# Rakkess | Kubectl Plugin To Show An Access Matrix For K8S Server Resources **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools\ **Created:** [September 10, 2020, 2:36pm UTC](https://onehack.st/t/rakkess-kubectl-plugin-to-show-an-access-matrix-for-k8s-server-resources/105549 "2020-09-10T14:36:20Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\ **Post date:** [September 10, 2020, 2:36pm UTC](https://onehack.st/t/rakkess-kubectl-plugin-to-show-an-access-matrix-for-k8s-server-resources/105549/1 "2020-09-10T14:36:20Z")
![image](https://onehack.st/uploads/default/original/3X/0/0/009dba6b7908a7036f36178bcc00b935aff5df40.png) # akkess [![Build Status](https://camo.githubusercontent.com/e6fd0b559707bd9ee1978df3addb1197374aa5f5/68747470733a2f2f7472617669732d63692e636f6d2f636f726e656c697573776569672f72616b6b6573732e7376673f6272616e63683d6d6173746572)](https://travis-ci.com/corneliusweig/rakkess) [![Code Coverage](https://camo.githubusercontent.com/b56b654f0e1a4b58e9e109d7d85d1a4dfd5ab543/68747470733a2f2f636f6465636f762e696f2f67682f636f726e656c697573776569672f72616b6b6573732f6272616e63682f6d61737465722f67726170682f62616467652e737667)](https://codecov.io/gh/corneliusweig/rakkess) [![Go Report Card](https://camo.githubusercontent.com/dd12297164d370b6eb4329af8b631388206e16af/68747470733a2f2f676f7265706f7274636172642e636f6d2f62616467652f636f726e656c697573776569672f72616b6b657373)](https://goreportcard.com/report/corneliusweig/rakkess) [![LICENSE](https://camo.githubusercontent.com/977a6e525958e7db285431ba36f7cb66985e0f31/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f636f726e656c697573776569672f72616b6b6573732e737667)](https://github.com/corneliusweig/rakkess/blob/master/LICENSE) [![Releases](https://camo.githubusercontent.com/78dffcbb2d2ecc4988952fc92d63af47b23131ee/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652d7072652f636f726e656c697573776569672f72616b6b6573732e737667)](https://github.com/corneliusweig/rakkess/releases) Review Access - kubectl plugin to show an access matrix for server resources ## Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use `kubectl auth can-i list deployments` , but maybe you are looking for a complete overview? This is what `rakkess` is for. It lists access rights for the current user and all server resources, similar to `kubectl auth can-i --list` . It is also useful to find out who may interact with some server resource. Check out the sub-command `rakkess resource`[below](https://github.com/corneliusweig/rakkess#show-subjects-with-access-to-a-given-resource1). ## Demo [![rakkess demo](https://github.com/corneliusweig/rakkess/raw/master/doc/demo-user-smaller.png "rakkess --namespace default")](https://github.com/corneliusweig/rakkess/blob/master/doc/demo-user-smaller.png) ## Examples #### Show access for all resources - … at cluster scope rakkess - … in some namespace rakkess --namespace default - … with verbs rakkess --verbs get,delete,watch,patch - … for another user rakkess --as other-user - … for another service-account rakkess --sa kube-system:namespace-controller - … and combine with common `kubectl` parameters KUBECONFIG=otherconfig rakkess --context other-context #### Show subjects with access to a given resource[1](https://github.com/corneliusweig/rakkess#credit-kubectl-who-can) [![rakkess demo](https://github.com/corneliusweig/rakkess/raw/master/doc/demo-resource-smaller.png "rakkess resource configmaps --namespace default")](https://github.com/corneliusweig/rakkess/blob/master/doc/demo-resource-smaller.png) - …globally in all namespaces (only considers `ClusterRoleBindings` ) rakkess resource configmaps - …in a given namespace (considers `RoleBindings` and `ClusterRoleBindings` ) rakkess resource configmaps -n default - …with shorthand notation rakkess r cm # same as rakkess resource configmaps - .. with custom verbs rakkess r cm --verbs get,delete,watch,patch ##### Name-restricted roles Some roles only apply to resources with a specific name. To review such configurations, provide the resource name as additional argument. For example, show access rights for the `ConfigMap` called `ingress-controller-leader-nginx` in namespace `ingress-nginx` (note the subtle difference for `nginx-ingress-serviceaccount` to the previous example): [![rakkess demo](https://github.com/corneliusweig/rakkess/raw/master/doc/demo-named-resource-smaller.png "rakkess resource configmap ingress-controller-leader-nginx --namespace ingress-nginx")](https://github.com/corneliusweig/rakkess/blob/master/doc/demo-named-resource-smaller.png) As `rakkess resource` needs to query `Roles` , `ClusterRoles` , and their bindings, it usually requires administrative cluster access. Also see [Usage](https://github.com/corneliusweig/rakkess/blob/master/doc/USAGE.md). ## Installation There are several ways to install `rakkess` . The recommended installation method is via `krew` . ### Via krew Krew is a `kubectl` plugin manager. If you have not yet installed `krew` , get it at [https://github.com/kubernetes-sigs/krew](https://github.com/kubernetes-sigs/krew). Then installation is as simple as kubectl krew install access-matrix The plugin will be available as `kubectl access-matrix` , see [doc/USAGE](https://github.com/corneliusweig/rakkess/blob/master/doc/USAGE.md) for further details. ### Binaries When using the binaries for installation, also have a look at [doc/USAGE](https://github.com/corneliusweig/rakkess/blob/master/doc/USAGE.md). #### Linux curl -LO [https://github.com/corneliusweig/rakkess/releases/download/v0.4.5/rakkess-amd64-linux.tar.gz](https://github.com/corneliusweig/rakkess/releases/download/v0.4.5/rakkess-amd64-linux.tar.gz) \ && tar xf rakkess-amd64-linux.tar.gz rakkess-amd64-linux \ && chmod +x rakkess-amd64-linux \ && mv -i rakkess-amd64-linux $GOPATH/bin/rakkess #### OSX curl -LO [https://github.com/corneliusweig/rakkess/releases/download/v0.4.5/rakkess-amd64-darwin.tar.gz](https://github.com/corneliusweig/rakkess/releases/download/v0.4.5/rakkess-amd64-darwin.tar.gz) \ && tar xf rakkess-amd64-darwin.tar.gz rakkess-amd64-darwin \ && chmod +x rakkess-amd64-darwin \ && mv -i rakkess-amd64-darwin $GOPATH/bin/rakkess #### Windows [https://github.com/corneliusweig/rakkess/releases/download/v0.4.5/rakkess-windows-amd64.zip](https://github.com/corneliusweig/rakkess/releases/download/v0.4.5/rakkess-windows-amd64.zip) ### From source #### Build on host Requirements: - go 1.14 or newer - GNU make - git Compiling: export PLATFORMS=$(go env GOOS) make all # binaries will be placed in out/ #### Build in docker Requirements: - docker Compiling: mkdir rakkess && chdir rakkess curl -Lo Dockerfile [https://raw.githubusercontent.com/corneliusweig/rakkess/master/Dockerfile](https://raw.githubusercontent.com/corneliusweig/rakkess/master/Dockerfile) docker build . -t rakkess-builder docker run --rm -v $PWD:/go/bin/ --env PLATFORMS=$(go env GOOS) rakkess docker rmi rakkess-builder Binaries will be placed in the current directory. ## Users What are others saying about rakkess? _“Well, that looks handy! `rakkess` , a kubectl plugin to show an access matrix for all available resources.”_ – [@mhausenblas](https://twitter.com/mhausenblas/status/1100673166303739905) _“that’s indeed pretty helpful. `rakkess --as system:serviceaccount:my-ns:my-sa -n my-ns` prints the access matrix of a service account in a namespace”_ – [@fakod](https://twitter.com/fakod/status/1100764745957658626) _“THE BOMB. Love it.”_ – [@ralph\_squillace](https://twitter.com/ralph_squillace/status/1100844255830896640) _“This made my day. Well, not actually today but I definitively will use it a lot.”_ – [@Soukron](https://twitter.com/Soukron/status/1100690060129775617) [1]: This mode was inspired by [kubectl-who-can](https://github.com/aquasecurity/kubectl-who-can) ## GitHub: > **[GitHub - corneliusweig/rakkess: Review Access - kubectl plugin to show an access...](https://github.com/corneliusweig/rakkess)** > > Review Access - kubectl plugin to show an access matrix for k8s server resources