AccountWithRBAC.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**This notebook is covered by the following [license](License.ipynb)  This note must not be removed**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Installing a restricted account\n",
    "\n",
    "# __WARNING__\n",
    "\n",
    "It is extremely easy to create a \n",
    "\n",
    "see [Jeff Geeling: Everyone might be cluster admin your kubernetes cluster](https://www.jeffgeerling.com/blog/2020/everyone-might-be-cluster-admin-your-kubernetes-cluster)\n",
    "\n",
    "\n",
    "Following [Armory Spinnaker Installation](https://docs.armory.io/spinnaker-install-admin-guides/manual-service-account/)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "SOURCENAMESPACE=my-namespace\n",
    "TARGETNAMESPACE=$SOURCENAMESPACE\n",
    "SERVICEACCOUNT=my-serviceaccount\n",
    "ROLE=my-role\n",
    "ROLEBINDING=my-rolebinding"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "namespace/my-namespace created\n"
     ]
    }
   ],
   "source": [
    "kubectl create namespace $TARGETNAMESPACE"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "serviceaccount/my-serviceaccount created\n"
     ]
    }
   ],
   "source": [
    "kubectl create serviceaccount --namespace=$SOURCENAMESPACE $SERVICEACCOUNT"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                SECRETS   AGE\n",
      "default             1         10s\n",
      "my-serviceaccount   1         5s\n"
     ]
    }
   ],
   "source": [
    "kubectl get  serviceaccount --namespace=$SOURCENAMESPACE"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Create ClusterAdmin Binding\n",
    "\n",
    "Creating a **ClusterRoleBinding** to the **ClusterRole** named **cluster-admin** is dangerous. \n",
    "\n",
    "Effectively the serviceaccount becomes allmighty\n",
    "\n",
    "**It it essential to have different accounts, otherwise the cannot be removed later**\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**don't**\n",
    "```yaml\n",
    "kubectl delete -f - <<EOF\n",
    "apiVersion: rbac.authorization.k8s.io/v1beta1\n",
    "kind: ClusterRoleBinding\n",
    "metadata:\n",
    "  name: my-admin\n",
    "roleRef:\n",
    "  apiGroup: rbac.authorization.k8s.io\n",
    "  kind: ClusterRole\n",
    "  name: cluster-admin\n",
    "subjects:\n",
    "- kind: ServiceAccount\n",
    "  name: $SERVICEACCOUNT\n",
    "  namespace: $SOURCENAMESPACE\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Namespace restricted roles\n",
    "\n",
    "Try to use only roles with **RoleBindings** to a certain namespace. The **Role** and their **rules** can be changed later.\n",
    "\n",
    "[Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "role.rbac.authorization.k8s.io/my-role created\n",
      "rolebinding.rbac.authorization.k8s.io/my-rolebinding created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "---\n",
    "apiVersion: rbac.authorization.k8s.io/v1\n",
    "kind: Role\n",
    "metadata:\n",
    "  name: ${ROLE}\n",
    "  namespace: ${TARGETNAMESPACE} # Should be namespace you are granting access to\n",
    "rules:\n",
    "- apiGroups: [\"\"]\n",
    "  resources: [\"pods\",\"pods/logs\",\"pods/exec\"]\n",
    "  verbs: [\"*\"]\n",
    "---\n",
    "apiVersion: rbac.authorization.k8s.io/v1\n",
    "kind: RoleBinding\n",
    "metadata:\n",
    "  name: ${ROLEBINDING}\n",
    "  namespace: $TARGETNAMESPACE # Should be namespace you are granting access to\n",
    "roleRef:\n",
    "  apiGroup: rbac.authorization.k8s.io\n",
    "  kind: Role\n",
    "  name: ${ROLE} # Should match name of Role\n",
    "subjects:\n",
    "- namespace: ${SOURCENAMESPACE} # Should match namespace where SA lives\n",
    "  kind: ServiceAccount\n",
    "  name: ${SERVICEACCOUNT} # Should match service account name, above\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Please edit to your needs\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: v1\n",
      "clusters:\n",
      "- cluster:\n",
      "    certificate-authority: /var/lib/minikube/certs/ca.crt\n",
      "    extensions:\n",
      "    - extension:\n",
      "        last-update: Thu, 02 Dec 2021 15:00:20 CET\n",
      "        provider: minikube.sigs.k8s.io\n",
      "        version: v1.23.2\n",
      "      name: cluster_info\n",
      "    server: https://localhost:8443\n",
      "  name: \"minikube\"\n",
      "contexts:\n",
      "- context:\n",
      "    cluster: \"minikube\"\n",
      "    extensions:\n",
      "    - extension:\n",
      "        last-update: Thu, 02 Dec 2021 15:00:20 CET\n",
      "        provider: minikube.sigs.k8s.io\n",
      "        version: v1.23.2\n",
      "      name: context_info\n",
      "    user: \"minikube\"\n",
      "  name: \"minikube\"\n",
      "current-context: \"minikube\"\n",
      "kind: Config\n",
      "preferences: {}\n",
      "users:\n",
      "- name: \"minikube\"\n",
      "  user:\n",
      "    client-certificate: /var/lib/minikube/certs/apiserver.crt\n",
      "    client-key: /var/lib/minikube/certs/apiserver.key\n"
     ]
    }
   ],
   "source": [
    "# fix kube config\n",
    "sed -i 's/\\\"\\\"/\\\"minikube\\\"/' /root/.kube/config\n",
    "cat /root/.kube/config"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "minikube\n"
     ]
    }
   ],
   "source": [
    "CONTEXT=$(kubectl config current-context)\n",
    "echo $CONTEXT\n",
    "NAMESPACE=$SOURCENAMESPACE\n",
    "\n",
    "NEW_CONTEXT=my-context\n",
    "KUBECONFIG=my-kubeconfig"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [],
   "source": [
    "SECRET=$(kubectl get serviceaccount ${SERVICEACCOUNT} \\\n",
    "  --context ${CONTEXT} \\\n",
    "  --namespace ${NAMESPACE} \\\n",
    "  -o jsonpath='{.secrets[0].name}')\n",
    "TOKEN_DATA=$(kubectl get secret ${SECRET} \\\n",
    "  --context ${CONTEXT} \\\n",
    "  --namespace ${NAMESPACE} \\\n",
    "  -o jsonpath='{.data.token}')\n",
    "\n",
    "TOKEN=$(echo ${TOKEN_DATA} | base64 --decode)\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNklqTlljM2g1U0ZVM2VGUnNZVkU1VVMwMVgzYzJVa3hVVVZGWFNsUkdVRkpRV0RkTlYwNVJjMUZWTXpnaWZRLmV5SnBjM01pT2lKcmRXSmxjbTVsZEdWekwzTmxjblpwWTJWaFkyTnZkVzUwSWl3aWEzVmlaWEp1WlhSbGN5NXBieTl6WlhKMmFXTmxZV05qYjNWdWRDOXVZVzFsYzNCaFkyVWlPaUp0ZVMxdVlXMWxjM0JoWTJVaUxDSnJkV0psY201bGRHVnpMbWx2TDNObGNuWnBZMlZoWTJOdmRXNTBMM05sWTNKbGRDNXVZVzFsSWpvaWJYa3RjMlZ5ZG1salpXRmpZMjkxYm5RdGRHOXJaVzR0YTNSaWFEZ2lMQ0pyZFdKbGNtNWxkR1Z6TG1sdkwzTmxjblpwWTJWaFkyTnZkVzUwTDNObGNuWnBZMlV0WVdOamIzVnVkQzV1WVcxbElqb2liWGt0YzJWeWRtbGpaV0ZqWTI5MWJuUWlMQ0pyZFdKbGNtNWxkR1Z6TG1sdkwzTmxjblpwWTJWaFkyTnZkVzUwTDNObGNuWnBZMlV0WVdOamIzVnVkQzUxYVdRaU9pSXdNV0l6TlRFek1pMDBNVE14TFRRME9UVXRZamhpTUMwNFlqZ3dNMk01WXpsbU5HRWlMQ0p6ZFdJaU9pSnplWE4wWlcwNmMyVnlkbWxqWldGalkyOTFiblE2YlhrdGJtRnRaWE53WVdObE9tMTVMWE5sY25acFkyVmhZMk52ZFc1MEluMC56UF9pMDJDUmc0eDl5MEh5OExuS0JTRDFuZjA0aWU5X2tDRnhCUDR6Y2JFeVBGX0VSMTJlR0VhSS1LVlAwQVpVS3htZnRhS0dJT0ttNHk3T2Jjc1pwZzE0OFptN3FlV0pac0pOXzAyVjFJb1lTbEFMWjRFQ2trTDFYNGk0SXhNTm5MWHFJZ0dDT1hyR0g1SUV0WGNReHRoZUlpdHlnZ2pLSVZDb3JEaWtfSDJQc1VINXNlWG9aNThjYVRMY1dvaUpGX1c3VjladFVCZ196dUpMM05WWWl2bTgxc0pwbFVXQXJsNlBMbXpadUJSM0I3ZWM1V19fdmM0alF0eExhOUZyWGtLanBKVGhtemU2YXhROUJaTEpvQkJKZy0taWJFaXRNWi1aQ3dCS3ROdkVQQy1SamFZQTdMTXJmNVdObnpmTV8wbmFfZ3BSNlA2YmVNMVBZWGw2X3c=\n"
     ]
    }
   ],
   "source": [
    "echo $TOKEN_DATA"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## **Create a dedicated kubeconfig**\n",
    "\n",
    "Starting with a full copy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "my-kubeconfig\n"
     ]
    }
   ],
   "source": [
    "echo $KUBECONFIG"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [],
   "source": [
    "\n",
    "kubectl config view --raw > ${KUBECONFIG}.full.tmp"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Switch working context to correct context"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Switched to context \"minikube\".\n"
     ]
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}.full.tmp config use-context ${CONTEXT}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Minify and flatten the config"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}.full.tmp \\\n",
    "  config view --flatten --minify > ${KUBECONFIG}.tmp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: v1\n",
      "clusters:\n",
      "- cluster:\n",
      "    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCakNDQWU2Z0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwdGFXNXAKYTNWaVpVTkJNQjRYRFRJeE1ETXdNVEE1TlRRMU1Gb1hEVE14TURJeU9EQTVOVFExTUZvd0ZURVRNQkVHQTFVRQpBeE1LYldsdWFXdDFZbVZEUVRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTkh5Cm1SRm1qaG0wdWpKRXd4ZXp2VWZvL0o2Q1Mvbkk3MS9rQlZxVEVTY3ZoZFpkYjdUazl3T1Bueng3VW9UQUIwZXoKZ3AxUjdnVFBnZnJSNGNyKy9Lc08vWExydk9CNEFoOXM0RE1lL1B5OTVyZE1iNmlDUytZMDV1VldkQ3R0bGhrSwpjM3lmblhPS29teXFaVUw0dzJLTFQza1I2clBHVXZ6M3RMYU9lYlpYc2RYNklqZXBaOHVROXZkYldXYVVVS25uCk5jUHdLc3VCNmNra1hibnBmaXRXSWovVnEwbFdZWU5OOXVJZjg0TWFqY2ZjS2twRUpoY2g4SHd2aWdtZGRiWHkKL2hnNXd0VGF3RCtUUWp5d09MVFpIMkg5bEVodGNQMS9PeE9nOU56WitaQW1CcDZFelFJbmFJMCt0YVM2WW1FbQppQ0RzUVlEYnV0bXpFWnliVEJjQ0F3RUFBYU5oTUY4d0RnWURWUjBQQVFIL0JBUURBZ0trTUIwR0ExVWRKUVFXCk1CUUdDQ3NHQVFVRkJ3TUNCZ2dyQmdFRkJRY0RBVEFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVcKQkJRY004c25IMk10R1k3dU55UlZCQmdIY3hwd2hqQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFQdXVINzlKbgpRSHZUNTAyVk1YKzM5WVkyNzI3TCtYU3NOekc0cVYyVjUvakh3by94SDNDQ0svN2EzTTlyVVp6TlpIZytsSG9GCnZiVzZ0K2VvNmJmeE9iSHlMcjVoY1JBSVYxNWpaY0RhTVh4Zys3SjFrWExsb1ZaL2VVcmRqT2lLSEtJOURzU0QKY05DdXdwODRHYXNzdjRVMTBMSmFjd1EvcVRENThDT0UwelFSY0hibjJrMUFRK01BOThHTmlMRHQxTml2UDB6aApOb1hLcURFT1ZkWVE5Mi81VkVkT1o0TVZIOHF6RWw2YUhjZE0zR210WGVtZGlBZFdQV1hJY2JGbzNDVUJzOExVCkk5dzZKUDZvaGhKZysvUUtMaGdhQ1M5dUxVdjlqVnBucVRqUnNvbUtrQ0cyNmNGWGZYeDd5cmJBZG5Kb1p6Z1IKczFVNThZSS9PMm50UXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n",
      "    extensions:\n",
      "    - extension:\n",
      "        last-update: Thu, 02 Dec 2021 15:00:20 CET\n",
      "        provider: minikube.sigs.k8s.io\n",
      "        version: v1.23.2\n",
      "      name: cluster_info\n",
      "    server: https://localhost:8443\n",
      "  name: minikube\n",
      "contexts:\n",
      "- context:\n",
      "    cluster: minikube\n",
      "    extensions:\n",
      "    - extension:\n",
      "        last-update: Thu, 02 Dec 2021 15:00:20 CET\n",
      "        provider: minikube.sigs.k8s.io\n",
      "        version: v1.23.2\n",
      "      name: context_info\n",
      "    user: minikube\n",
      "  name: minikube\n",
      "current-context: minikube\n",
      "kind: Config\n",
      "preferences: {}\n",
      "users:\n",
      "- name: minikube\n",
      "  user:\n",
      "    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQzRENDQXNTZ0F3SUJBZ0lCQWpBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwdGFXNXAKYTNWaVpVTkJNQjRYRFRJeE1USXdNVEUwTURBeU1Gb1hEVEl5TVRJd01qRTBNREF5TUZvd0xERVhNQlVHQTFVRQpDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhFVEFQQmdOVkJBTVRDRzFwYm1scmRXSmxNSUlCSWpBTkJna3Foa2lHCjl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF4THZkSTNqai90NENVYnpMbms5ZGZVekwzZFJkQWdqenNJbmIKMXA0b1IxRUI1dG1lZGJqVjFmc1IvbklKaVBCNUJPU21HUTZaTmJzS1NublJOQ2E5VHUzUU9wb0hJRUgzMzdRNgpmU2pWeU1hbUlqeWxFc2VsQ3RFUi9vUTQwbjQveDJFbTZCNWx1bzBhY1hZYXRHVE80VTZBbVY5SWI1RVc0Q1FNCmJJNU1hOTRxVHRuNllvNU5hZ3FHMGpkVGNwUUFjY1NZMUtHZ3NkZmRoZkxUYjNLT1dDd2QxMDVFTjZzQkNrUDMKeGtFSytsYzFGYStqcHM5ZWRWanVXOTJPWldLVHd5ZHRDcmJpOC9Gb21KZ1VBK0xBSnNmZmk0WWI4dmk1ZUVoMgp3dVJqSlZMUnJyWHhCMm4wZnNHekE5bWVReGlaWVRaOFp5N2hRMGVOazlWcmpjaUZkd0lEQVFBQm80SUJIakNDCkFSb3dEZ1lEVlIwUEFRSC9CQVFEQWdXZ01CMEdBMVVkSlFRV01CUUdDQ3NHQVFVRkJ3TUJCZ2dyQmdFRkJRY0QKQWpBTUJnTlZIUk1CQWY4RUFqQUFNQjhHQTFVZEl3UVlNQmFBRkJ3enl5Y2ZZeTBaanU0M0pGVUVHQWR6R25DRwpNSUc1QmdOVkhSRUVnYkV3Z2E2Q0NtMXBibWxyZFdKbFEwR0NIMk52Ym5SeWIyd3RjR3hoYm1VdWJXbHVhV3QxClltVXVhVzUwWlhKdVlXeUNKR3QxWW1WeWJtVjBaWE11WkdWbVlYVnNkQzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmgKYklJV2EzVmlaWEp1WlhSbGN5NWtaV1poZFd4MExuTjJZNElTYTNWaVpYSnVaWFJsY3k1a1pXWmhkV3gwZ2dwcgpkV0psY201bGRHVnpnZ2xzYjJOaGJHaHZjM1NIQk1Db01RS0hCQXBnQUFHSEJIOEFBQUdIQkFvQUFBRXdEUVlKCktvWklodmNOQVFFTEJRQURnZ0VCQUJFcHlpQ3ZObkw0cDhDdmlTNTY0UDN1eDh4ZEU3OW9OdTRtb0IyL0NMSEYKOWJQSmd2bWplNWhBNzhXMjBKZEhoclkxcTRQSVN6UDB3WVNlUzc1eW1ncUF2ZVNEYytId0dtRTZvRWpWSUF4ZQp1NFdZNGw3bTMvS1VlbVFRUDRUdjZGbm5HV1lmTklNeXdKNWZvWm45RDFVaURMd3hzaVNjWUozVjdJbTRPWHR5CkRCb3huNkNRT2VJYTdBRzNsb2NDa3Mra21YNE5nOHZiUnZKUGd5ZVUvbElzVjIrK1lWRlF0R1k2RVExUGtJSysKMmFqUEV6ZXRScU5HaS9NNE9KemQ5dk1pbzczOXRFWnpod3RRTXpwRGlSWHNzY0N3SUtkM2kvZmp6YTk1NnJIbgo1eE90RzZMM2tKcVBPU1llZTFRY05UUWdhMGNoRW1nSmRFYTVsRVQwNHcwPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n",
      "    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBeEx2ZEkzamovdDRDVWJ6TG5rOWRmVXpMM2RSZEFnanpzSW5iMXA0b1IxRUI1dG1lCmRialYxZnNSL25JSmlQQjVCT1NtR1E2Wk5ic0tTbm5STkNhOVR1M1FPcG9ISUVIMzM3UTZmU2pWeU1hbUlqeWwKRXNlbEN0RVIvb1E0MG40L3gyRW02QjVsdW8wYWNYWWF0R1RPNFU2QW1WOUliNUVXNENRTWJJNU1hOTRxVHRuNgpZbzVOYWdxRzBqZFRjcFFBY2NTWTFLR2dzZGZkaGZMVGIzS09XQ3dkMTA1RU42c0JDa1AzeGtFSytsYzFGYStqCnBzOWVkVmp1VzkyT1pXS1R3eWR0Q3JiaTgvRm9tSmdVQStMQUpzZmZpNFliOHZpNWVFaDJ3dVJqSlZMUnJyWHgKQjJuMGZzR3pBOW1lUXhpWllUWjhaeTdoUTBlTms5VnJqY2lGZHdJREFRQUJBb0lCQUFiT0pORWtUbWF6a1VyNApoK2FiQWpYaVlTNzBPSjlvWmQyV2R6ZE9VMEJjU2YrTlNaRHk2dHF6QzZWTWxvM1pHNmFTcmpneHJCVVN1a0ZuClExaFZlcmp2T3dPNzdrRXNad0dpLzE3eSthb3ZUUEhrUFNXUUtHSmVad3Z4MFBGZkVwKzMrWnVQNlo3eFlKZksKS1JSU1pHR2cwSXY5b3NqUk1RUmgydGdxZC9SSE5JN2tOc2x1Qk1PaW5qQXBvcTYzcVNlcW9ib1grSFRPWkxKeQphT3NqVkRnSUMyUXQxVjd1SU9qWUJqNy93Nm1EVHh1SHhRbXp5YWhlYis0WlVjYjUzN0U3Q2ZidzdKRnpqNng0Cm51WmhFN1JaQ3pkVTJWOWNGWGJUSXZKRExRS29zRnozNUJMa3RucWs3YUpZUzkwOUhJUjA5dzBWMVNtbGNFRkMKZlplSE9Pa0NnWUVBNnBJVkRReUFwbWtGUU5CUk5QSjhhVVJmMXJhYWRqVDU3QWtjVEo0VXdqSlNGd2REK1ZhSApXSS9JL3Fhd0ZlZ2tTS0RLRFo4SmRPcnR1R2lnMDVsT1lla2M5MWRHTUhHOWttTXZ3MXNTbEdhMVNMU3kxNnFMCjkxR2Y2emN1aDFlRzdKV2hGa3E3dkgxU2VpU1lza0loeWZTYklyUC8rWlhPM3lpMGxZRG9wVjBDZ1lFQTFyVGoKNTU0Q0hMWGg4ckdoSThTWlBncjV4amF1QWFKZitiL0tTaDJRQWpLeUFPcFRoTGs0ZEU5MnEvNUFsK0NEN3ZXSQpJaDNRSmRNaHFjQU40VVZtTnlXN0RUOTZzS2pPM2pqODRjUjdkOUEvenV1WWxGS21RY1FlelkvRENqd0xlQTB5CkdONng1emxtS0NEZTRUY3JyNzIrd0ZlNk9kVW5LVE9aSGhnVE5PTUNnWUFDbDJLTUpsczFlMnVIYjhXMTVBZmoKMGRHTk9hOHpKeHFydE40UEtwL29GVTQ2MnVXeFYzZGZUeGRWV05vUkkrTml1Z1FCYW9SY09rd3VBVm5sZklnVgpKTkloR1dHNUgwaU0yWE9wb05QdnQ4TEE3dDRhNjlOb0JBclVPbVBWTXU1V3BzQ0Uwb2FJYW9vQ3QyeklhMXFjCk5JdVNNcExkV3Y1U0VNME42Y0tvTVFLQmdDV25BVlNzQkFqTzZMbnI1cXRrSGMrZ2t4N3NsZVZaZVdWTitnYTMKV25yWU14a3Yvc2VHeDl5MTFzVGd5S2taeVdsTmk3c1g2Vm5JeGQyRC9hc2t4WUVrVDhKS0FKVWNkWExKSWFmaQpFaGozMzBqRlRqT3NydFZYdEdNdU0vRUdpS2hjQUE0V2Q3SnFBWDFHRG5BR2dkWEcrNzIxWk1ZaG1FV0VjL1N3CkdpWXJBb0dCQUx0U05mR2V3Tmd3cGRQaVlmR2FVUGtiOW5CRHlUQlVmUHZ2M3ZUWDFINkthVFA1RW10eHdkVmcKUjdDTzBFd3VQWEFYMWlQUHNwV0hqMnA0NjJZaXBMRStER01UanZZTUVla0R1SWlRdzcxRHV5cW9zdTRndlBQUwovWnc4aHlsRlFQb29xK1FCdkFYT21zVHNMbStqL2tQcEZaWGUwQ1U2OElQZXV0OVhudFo3Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n"
     ]
    }
   ],
   "source": [
    "cat ${KUBECONFIG}.tmp"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Rename context"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Context \"minikube\" renamed to \"my-context\".\n"
     ]
    }
   ],
   "source": [
    "kubectl config --kubeconfig ${KUBECONFIG}.tmp \\\n",
    "  rename-context ${CONTEXT} ${NEW_CONTEXT}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Set the user credentials for the user created\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "User \"minikube-my-namespace-token-user\" set.\n"
     ]
    }
   ],
   "source": [
    "kubectl config --kubeconfig ${KUBECONFIG}.tmp \\\n",
    "  set-credentials ${CONTEXT}-${NAMESPACE}-token-user \\\n",
    "  --token ${TOKEN}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Set context to use token user"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Context \"my-context\" modified.\n"
     ]
    }
   ],
   "source": [
    "kubectl config --kubeconfig ${KUBECONFIG}.tmp \\\n",
    "  set-context ${NEW_CONTEXT} --user ${CONTEXT}-${NAMESPACE}-token-user"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Set context to correct namespace"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Context \"my-context\" modified.\n"
     ]
    }
   ],
   "source": [
    "kubectl config --kubeconfig ${KUBECONFIG}.tmp \\\n",
    "  set-context ${NEW_CONTEXT} --namespace ${NAMESPACE}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Flatten/minify kubeconfig\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl config --kubeconfig ${KUBECONFIG}.tmp \\\n",
    "  view --flatten --minify > ${KUBECONFIG}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "cleanup"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "rm ${KUBECONFIG}.full.tmp\n",
    "rm ${KUBECONFIG}.tmp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME     READY   STATUS    RESTARTS   AGE\n",
      "nginx2   1/1     Running   0          26m\n"
     ]
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG} get pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Error from server (Forbidden): pods is forbidden: User \"system:serviceaccount:my-namespace:my-serviceaccount\" cannot list resource \"pods\" in API group \"\" at the cluster scope\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG} get pods -A"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 51,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Error from server (Forbidden): services is forbidden: User \"system:serviceaccount:my-namespace:my-serviceaccount\" cannot list resource \"services\" in API group \"\" in the namespace \"my-namespace\"\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG} get svc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: v1\n",
      "clusters:\n",
      "- cluster:\n",
      "    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCakNDQWU2Z0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwdGFXNXAKYTNWaVpVTkJNQjRYRFRJeE1ETXdNVEE1TlRRMU1Gb1hEVE14TURJeU9EQTVOVFExTUZvd0ZURVRNQkVHQTFVRQpBeE1LYldsdWFXdDFZbVZEUVRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTkh5Cm1SRm1qaG0wdWpKRXd4ZXp2VWZvL0o2Q1Mvbkk3MS9rQlZxVEVTY3ZoZFpkYjdUazl3T1Bueng3VW9UQUIwZXoKZ3AxUjdnVFBnZnJSNGNyKy9Lc08vWExydk9CNEFoOXM0RE1lL1B5OTVyZE1iNmlDUytZMDV1VldkQ3R0bGhrSwpjM3lmblhPS29teXFaVUw0dzJLTFQza1I2clBHVXZ6M3RMYU9lYlpYc2RYNklqZXBaOHVROXZkYldXYVVVS25uCk5jUHdLc3VCNmNra1hibnBmaXRXSWovVnEwbFdZWU5OOXVJZjg0TWFqY2ZjS2twRUpoY2g4SHd2aWdtZGRiWHkKL2hnNXd0VGF3RCtUUWp5d09MVFpIMkg5bEVodGNQMS9PeE9nOU56WitaQW1CcDZFelFJbmFJMCt0YVM2WW1FbQppQ0RzUVlEYnV0bXpFWnliVEJjQ0F3RUFBYU5oTUY4d0RnWURWUjBQQVFIL0JBUURBZ0trTUIwR0ExVWRKUVFXCk1CUUdDQ3NHQVFVRkJ3TUNCZ2dyQmdFRkJRY0RBVEFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVcKQkJRY004c25IMk10R1k3dU55UlZCQmdIY3hwd2hqQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFQdXVINzlKbgpRSHZUNTAyVk1YKzM5WVkyNzI3TCtYU3NOekc0cVYyVjUvakh3by94SDNDQ0svN2EzTTlyVVp6TlpIZytsSG9GCnZiVzZ0K2VvNmJmeE9iSHlMcjVoY1JBSVYxNWpaY0RhTVh4Zys3SjFrWExsb1ZaL2VVcmRqT2lLSEtJOURzU0QKY05DdXdwODRHYXNzdjRVMTBMSmFjd1EvcVRENThDT0UwelFSY0hibjJrMUFRK01BOThHTmlMRHQxTml2UDB6aApOb1hLcURFT1ZkWVE5Mi81VkVkT1o0TVZIOHF6RWw2YUhjZE0zR210WGVtZGlBZFdQV1hJY2JGbzNDVUJzOExVCkk5dzZKUDZvaGhKZysvUUtMaGdhQ1M5dUxVdjlqVnBucVRqUnNvbUtrQ0cyNmNGWGZYeDd5cmJBZG5Kb1p6Z1IKczFVNThZSS9PMm50UXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n",
      "    extensions:\n",
      "    - extension:\n",
      "        last-update: Thu, 02 Dec 2021 15:00:20 CET\n",
      "        provider: minikube.sigs.k8s.io\n",
      "        version: v1.23.2\n",
      "      name: cluster_info\n",
      "    server: https://localhost:8443\n",
      "  name: minikube\n",
      "contexts:\n",
      "- context:\n",
      "    cluster: minikube\n",
      "    extensions:\n",
      "    - extension:\n",
      "        last-update: Thu, 02 Dec 2021 15:00:20 CET\n",
      "        provider: minikube.sigs.k8s.io\n",
      "        version: v1.23.2\n",
      "      name: context_info\n",
      "    namespace: my-namespace\n",
      "    user: minikube-my-namespace-token-user\n",
      "  name: my-context\n",
      "current-context: my-context\n",
      "kind: Config\n",
      "preferences: {}\n",
      "users:\n",
      "- name: minikube-my-namespace-token-user\n",
      "  user:\n",
      "    token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjNYc3h5SFU3eFRsYVE5US01X3c2UkxUUVFXSlRGUFJQWDdNV05Rc1FVMzgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJteS1uYW1lc3BhY2UiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoibXktc2VydmljZWFjY291bnQtdG9rZW4ta3RiaDgiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoibXktc2VydmljZWFjY291bnQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIwMWIzNTEzMi00MTMxLTQ0OTUtYjhiMC04YjgwM2M5YzlmNGEiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6bXktbmFtZXNwYWNlOm15LXNlcnZpY2VhY2NvdW50In0.zP_i02CRg4x9y0Hy8LnKBSD1nf04ie9_kCFxBP4zcbEyPF_ER12eGEaI-KVP0AZUKxmftaKGIOKm4y7ObcsZpg148Zm7qeWJZsJN_02V1IoYSlALZ4ECkkL1X4i4IxMNnLXqIgGCOXrGH5IEtXcQxtheIityggjKIVCorDik_H2PsUH5seXoZ58caTLcWoiJF_W7V9ZtUBg_zuJL3NVYivm81sJplUWArl6PLmzZuBR3B7ec5W__vc4jQtxLa9FrXkKjpJThmze6axQ9BZLJoBBJg--ibEitMZ-ZCwBKtNvEPC-RjaYA7LMrf5WNnzfM_0na_gpR6P6beM1PYXl6_w\n"
     ]
    }
   ],
   "source": [
    "cat ${KUBECONFIG}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG} get pods "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pod/nginx2 created\n"
     ]
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}  run nginx2 --image=nginx --port=80"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAMESPACE       NAME                                        READY   STATUS              RESTARTS      AGE\n",
      "default         opa-69c9967959-6b6kl                        0/1     ContainerCreating   0             46m\n",
      "ingress-nginx   ingress-nginx-admission-create--1-r9glx     0/1     Completed           0             48m\n",
      "ingress-nginx   ingress-nginx-admission-patch--1-jmxgb      0/1     Completed           0             48m\n",
      "ingress-nginx   ingress-nginx-controller-69bdbc4d57-n9hnq   1/1     Running             0             48m\n",
      "kube-system     coredns-78fcd69978-txbhl                    1/1     Running             0             50m\n",
      "kube-system     etcd-minikube                               1/1     Running             0             50m\n",
      "kube-system     kube-apiserver-minikube                     1/1     Running             0             50m\n",
      "kube-system     kube-controller-manager-minikube            1/1     Running             0             50m\n",
      "kube-system     kube-proxy-5hs49                            1/1     Running             0             50m\n",
      "kube-system     kube-scheduler-minikube                     1/1     Running             0             50m\n",
      "kube-system     storage-provisioner                         1/1     Running             1 (49m ago)   50m\n",
      "my-namespace    nginx2                                      0/1     ContainerCreating   0             5s\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods -A"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Error from server (Forbidden): pods is forbidden: User \"system:serviceaccount:my-namespace:my-serviceaccount\" cannot list resource \"pods\" in API group \"\" in the namespace \"my-namespace\"\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG} get pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Error from server (Forbidden): secrets is forbidden: User \"system:serviceaccount:my-namespace:my-serviceaccount\" cannot list resource \"secrets\" in API group \"\" in the namespace \"my-namespace\"\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG} get secrets"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Error from server (Forbidden): deployments.apps is forbidden: User \"system:serviceaccount:my-namespace:my-serviceaccount\" cannot list resource \"deployments\" in API group \"apps\" in the namespace \"default\"\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG} --namespace default get deployment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Error from server (Forbidden): pods is forbidden: User \"system:serviceaccount:my-namespace:my-serviceaccount\" cannot create resource \"pods\" in API group \"\" in the namespace \"default\"\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}  --namespace default run nginx2 --image=nginx --port=80 "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: v1\n",
      "clusters:\n",
      "- cluster:\n",
      "    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCakNDQWU2Z0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwdGFXNXAKYTNWaVpVTkJNQjRYRFRJeE1ETXdNVEE1TlRRMU1Gb1hEVE14TURJeU9EQTVOVFExTUZvd0ZURVRNQkVHQTFVRQpBeE1LYldsdWFXdDFZbVZEUVRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTkh5Cm1SRm1qaG0wdWpKRXd4ZXp2VWZvL0o2Q1Mvbkk3MS9rQlZxVEVTY3ZoZFpkYjdUazl3T1Bueng3VW9UQUIwZXoKZ3AxUjdnVFBnZnJSNGNyKy9Lc08vWExydk9CNEFoOXM0RE1lL1B5OTVyZE1iNmlDUytZMDV1VldkQ3R0bGhrSwpjM3lmblhPS29teXFaVUw0dzJLTFQza1I2clBHVXZ6M3RMYU9lYlpYc2RYNklqZXBaOHVROXZkYldXYVVVS25uCk5jUHdLc3VCNmNra1hibnBmaXRXSWovVnEwbFdZWU5OOXVJZjg0TWFqY2ZjS2twRUpoY2g4SHd2aWdtZGRiWHkKL2hnNXd0VGF3RCtUUWp5d09MVFpIMkg5bEVodGNQMS9PeE9nOU56WitaQW1CcDZFelFJbmFJMCt0YVM2WW1FbQppQ0RzUVlEYnV0bXpFWnliVEJjQ0F3RUFBYU5oTUY4d0RnWURWUjBQQVFIL0JBUURBZ0trTUIwR0ExVWRKUVFXCk1CUUdDQ3NHQVFVRkJ3TUNCZ2dyQmdFRkJRY0RBVEFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVcKQkJRY004c25IMk10R1k3dU55UlZCQmdIY3hwd2hqQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFQdXVINzlKbgpRSHZUNTAyVk1YKzM5WVkyNzI3TCtYU3NOekc0cVYyVjUvakh3by94SDNDQ0svN2EzTTlyVVp6TlpIZytsSG9GCnZiVzZ0K2VvNmJmeE9iSHlMcjVoY1JBSVYxNWpaY0RhTVh4Zys3SjFrWExsb1ZaL2VVcmRqT2lLSEtJOURzU0QKY05DdXdwODRHYXNzdjRVMTBMSmFjd1EvcVRENThDT0UwelFSY0hibjJrMUFRK01BOThHTmlMRHQxTml2UDB6aApOb1hLcURFT1ZkWVE5Mi81VkVkT1o0TVZIOHF6RWw2YUhjZE0zR210WGVtZGlBZFdQV1hJY2JGbzNDVUJzOExVCkk5dzZKUDZvaGhKZysvUUtMaGdhQ1M5dUxVdjlqVnBucVRqUnNvbUtrQ0cyNmNGWGZYeDd5cmJBZG5Kb1p6Z1IKczFVNThZSS9PMm50UXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n",
      "    extensions:\n",
      "    - extension:\n",
      "        last-update: Thu, 02 Dec 2021 15:00:20 CET\n",
      "        provider: minikube.sigs.k8s.io\n",
      "        version: v1.23.2\n",
      "      name: cluster_info\n",
      "    server: https://localhost:8443\n",
      "  name: minikube\n",
      "contexts:\n",
      "- context:\n",
      "    cluster: minikube\n",
      "    extensions:\n",
      "    - extension:\n",
      "        last-update: Thu, 02 Dec 2021 15:00:20 CET\n",
      "        provider: minikube.sigs.k8s.io\n",
      "        version: v1.23.2\n",
      "      name: context_info\n",
      "    namespace: my-namespace\n",
      "    user: minikube-my-namespace-token-user\n",
      "  name: my-context\n",
      "current-context: my-context\n",
      "kind: Config\n",
      "preferences: {}\n",
      "users:\n",
      "- name: minikube-my-namespace-token-user\n",
      "  user:\n",
      "    token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjNYc3h5SFU3eFRsYVE5US01X3c2UkxUUVFXSlRGUFJQWDdNV05Rc1FVMzgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJteS1uYW1lc3BhY2UiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoibXktc2VydmljZWFjY291bnQtdG9rZW4ta3RiaDgiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoibXktc2VydmljZWFjY291bnQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIwMWIzNTEzMi00MTMxLTQ0OTUtYjhiMC04YjgwM2M5YzlmNGEiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6bXktbmFtZXNwYWNlOm15LXNlcnZpY2VhY2NvdW50In0.zP_i02CRg4x9y0Hy8LnKBSD1nf04ie9_kCFxBP4zcbEyPF_ER12eGEaI-KVP0AZUKxmftaKGIOKm4y7ObcsZpg148Zm7qeWJZsJN_02V1IoYSlALZ4ECkkL1X4i4IxMNnLXqIgGCOXrGH5IEtXcQxtheIityggjKIVCorDik_H2PsUH5seXoZ58caTLcWoiJF_W7V9ZtUBg_zuJL3NVYivm81sJplUWArl6PLmzZuBR3B7ec5W__vc4jQtxLa9FrXkKjpJThmze6axQ9BZLJoBBJg--ibEitMZ-ZCwBKtNvEPC-RjaYA7LMrf5WNnzfM_0na_gpR6P6beM1PYXl6_w\n"
     ]
    }
   ],
   "source": [
    "cat  ${KUBECONFIG} "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Name:                default\n",
      "Namespace:           my-namespace\n",
      "Labels:              <none>\n",
      "Annotations:         <none>\n",
      "Image pull secrets:  <none>\n",
      "Mountable secrets:   default-token-552fm\n",
      "Tokens:              default-token-552fm\n",
      "Events:              <none>\n",
      "\n",
      "\n",
      "Name:                my-serviceaccount\n",
      "Namespace:           my-namespace\n",
      "Labels:              <none>\n",
      "Annotations:         <none>\n",
      "Image pull secrets:  <none>\n",
      "Mountable secrets:   my-serviceaccount-token-ktbh8\n",
      "Tokens:              my-serviceaccount-token-ktbh8\n",
      "Events:              <none>\n"
     ]
    }
   ],
   "source": [
    "kubectl describe serviceaccount -n  my-namespace"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "no\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}  auth can-i get pod --namespace default"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "no\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}  auth can-i create pod --namespace default"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 53,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "yes\n"
     ]
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}  auth can-i create pod --namespace $TARGETNAMESPACE"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Warning: resource 'clusterroles' is not namespace scoped in group 'rbac.authorization.k8s.io'\n",
      "no\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}  auth can-i create clusterroles"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 54,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "no\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}  auth can-i create roles"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 55,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Resources                                       Non-Resource URLs                     Resource Names   Verbs\n",
      "pods/exec                                       []                                    []               [*]\n",
      "pods/logs                                       []                                    []               [*]\n",
      "pods                                            []                                    []               [*]\n",
      "selfsubjectaccessreviews.authorization.k8s.io   []                                    []               [create]\n",
      "selfsubjectrulesreviews.authorization.k8s.io    []                                    []               [create]\n",
      "                                                [/.well-known/openid-configuration]   []               [get]\n",
      "                                                [/api/*]                              []               [get]\n",
      "                                                [/api]                                []               [get]\n",
      "                                                [/apis/*]                             []               [get]\n",
      "                                                [/apis]                               []               [get]\n",
      "                                                [/healthz]                            []               [get]\n",
      "                                                [/healthz]                            []               [get]\n",
      "                                                [/livez]                              []               [get]\n",
      "                                                [/livez]                              []               [get]\n",
      "                                                [/openapi/*]                          []               [get]\n",
      "                                                [/openapi]                            []               [get]\n",
      "                                                [/openid/v1/jwks]                     []               [get]\n",
      "                                                [/readyz]                             []               [get]\n",
      "                                                [/readyz]                             []               [get]\n",
      "                                                [/version/]                           []               [get]\n",
      "                                                [/version/]                           []               [get]\n",
      "                                                [/version]                            []               [get]\n",
      "                                                [/version]                            []               [get]\n"
     ]
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}  auth can-i --list"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 52,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "no\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}  auth can-i create deployments"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.\n",
      "Error from server (Forbidden): services is forbidden: User \"system:serviceaccount:my-namespace:my-serviceaccount\" cannot list resource \"services\" in API group \"\" in the namespace \"kube-system\"\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl  --kubeconfig ${KUBECONFIG} cluster-info"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[0;32mKubernetes control plane\u001b[0m is running at \u001b[0;33mhttps://localhost:8443\u001b[0m\n",
      "\u001b[0;32mCoreDNS\u001b[0m is running at \u001b[0;33mhttps://localhost:8443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy\u001b[0m\n",
      "\n",
      "To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.\n"
     ]
    }
   ],
   "source": [
    "kubectl  cluster-info"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl  --kubeconfig ${KUBECONFIG} cluster-info"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Graphical View"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 59,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "go: downloading github.com/mhausenblas/rback v0.3.0\n",
      "go: downloading github.com/emicklei/dot v0.10.0\n",
      "go: downloading github.com/mhausenblas/kubecuddler v0.0.0-20181012110128-5836f3e4e7d0\n",
      "github.com/mhausenblas/kubecuddler\n",
      "github.com/emicklei/dot\n",
      "github.com/mhausenblas/rback\n"
     ]
    }
   ],
   "source": [
    "go install -v github.com/mhausenblas/rback@latest"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 70,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[94m/usr/bin/kubectl get sa --all-namespaces --output json\u001b[0m\n",
      "\u001b[94m/usr/bin/kubectl get roles --all-namespaces --output json\u001b[0m\n",
      "\u001b[94m/usr/bin/kubectl get rolebindings --all-namespaces --output json\u001b[0m\n",
      "\u001b[94m/usr/bin/kubectl get clusterroles --output json\u001b[0m\n",
      "\u001b[94m/usr/bin/kubectl get clusterrolebindings --output json\u001b[0m\n"
     ]
    }
   ],
   "source": [
    "kubectl get sa,roles -n my-namespace -o json |\\\n",
    "rback  -ignore-prefixes none > minikube.dot"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 68,
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Reading package lists... Done\n",
      "Building dependency tree       \n",
      "Reading state information... Done\n",
      "graphviz is already the newest version (2.42.2-3build2).\n",
      "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n"
     ]
    }
   ],
   "source": [
    "apt install graphviz -y"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 71,
   "metadata": {},
   "outputs": [],
   "source": [
    "dot -Tpng -Grankdir=LR minikube.dot -o minikube.png"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "![Minikube](minikube.png)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 63,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Resources                                       Non-Resource URLs                     Resource Names   Verbs\n",
      "pods/exec                                       []                                    []               [*]\n",
      "pods/logs                                       []                                    []               [*]\n",
      "pods                                            []                                    []               [*]\n",
      "selfsubjectaccessreviews.authorization.k8s.io   []                                    []               [create]\n",
      "selfsubjectrulesreviews.authorization.k8s.io    []                                    []               [create]\n",
      "                                                [/.well-known/openid-configuration]   []               [get]\n",
      "                                                [/api/*]                              []               [get]\n",
      "                                                [/api]                                []               [get]\n",
      "                                                [/apis/*]                             []               [get]\n",
      "                                                [/apis]                               []               [get]\n",
      "                                                [/healthz]                            []               [get]\n",
      "                                                [/healthz]                            []               [get]\n",
      "                                                [/livez]                              []               [get]\n",
      "                                                [/livez]                              []               [get]\n",
      "                                                [/openapi/*]                          []               [get]\n",
      "                                                [/openapi]                            []               [get]\n",
      "                                                [/openid/v1/jwks]                     []               [get]\n",
      "                                                [/readyz]                             []               [get]\n",
      "                                                [/readyz]                             []               [get]\n",
      "                                                [/version/]                           []               [get]\n",
      "                                                [/version/]                           []               [get]\n",
      "                                                [/version]                            []               [get]\n",
      "                                                [/version]                            []               [get]\n"
     ]
    }
   ],
   "source": [
    "kubectl --kubeconfig ${KUBECONFIG}  auth can-i --list"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 64,
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "  rolebindings.rbac.authorization.k8s.io          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection get list patch update watch]\n",
      "  roles.rbac.authorization.k8s.io                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection get list patch update watch]\n",
      "  configmaps                                      []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  events                                          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  persistentvolumeclaims                          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  pods                                            []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicationcontrollers/scale                    []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicationcontrollers                          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  services                                        []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  daemonsets.apps                                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  deployments.apps/scale                          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  deployments.apps                                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicasets.apps/scale                          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicasets.apps                                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  statefulsets.apps/scale                         []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  statefulsets.apps                               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  horizontalpodautoscalers.autoscaling            []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  cronjobs.batch                                  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  jobs.batch                                      []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  daemonsets.extensions                           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  deployments.extensions/scale                    []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  deployments.extensions                          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  ingresses.extensions                            []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  networkpolicies.extensions                      []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicasets.extensions/scale                    []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicasets.extensions                          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicationcontrollers.extensions/scale         []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  ingresses.networking.k8s.io                     []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  networkpolicies.networking.k8s.io               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  poddisruptionbudgets.policy                     []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  deployments.apps/rollback                       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  deployments.extensions/rollback                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  localsubjectaccessreviews.authorization.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  pods/attach                                     []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/exec                                       []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/portforward                                []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/proxy                                      []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  secrets                                         []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  services/proxy                                  []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  serviceaccounts                                 []                 []              [impersonate \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  configmaps                                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  events                                       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  persistentvolumeclaims                       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  pods                                         []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicationcontrollers/scale                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicationcontrollers                       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  services                                     []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  daemonsets.apps                              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  deployments.apps/scale                       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  deployments.apps                             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicasets.apps/scale                       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicasets.apps                             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  statefulsets.apps/scale                      []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  statefulsets.apps                            []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  horizontalpodautoscalers.autoscaling         []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  cronjobs.batch                               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  jobs.batch                                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  daemonsets.extensions                        []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  deployments.extensions/scale                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  deployments.extensions                       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  ingresses.extensions                         []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  networkpolicies.extensions                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicasets.extensions/scale                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicasets.extensions                       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  replicationcontrollers.extensions/scale      []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  ingresses.networking.k8s.io                  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  networkpolicies.networking.k8s.io            []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  poddisruptionbudgets.policy                  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  deployments.apps/rollback                    []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  deployments.extensions/rollback              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/attach                                  []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/exec                                    []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/portforward                             []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/proxy                                   []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  secrets                                      []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  services/proxy                               []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  serviceaccounts                              []                 []              [impersonate \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update get list watch]\n",
      "  events                              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch]\n",
      "  rolebindings.rbac.authorization.k8s.io          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection get list patch update watch]\n",
      "  roles.rbac.authorization.k8s.io                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection get list patch update watch]\n",
      "  localsubjectaccessreviews.authorization.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  configmaps                               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  events                                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  persistentvolumeclaims                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods                                     []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  replicationcontrollers/scale             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  replicationcontrollers                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  services                                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  daemonsets.apps                          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  deployments.apps/rollback                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  deployments.apps/scale                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  deployments.apps                         []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  replicasets.apps/scale                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  replicasets.apps                         []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  statefulsets.apps/scale                  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  statefulsets.apps                        []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  horizontalpodautoscalers.autoscaling     []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  cronjobs.batch                           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  jobs.batch                               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  daemonsets.extensions                    []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  deployments.extensions/rollback          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  deployments.extensions/scale             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  deployments.extensions                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  ingresses.extensions                     []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  networkpolicies.extensions               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  replicasets.extensions/scale             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  replicasets.extensions                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  replicationcontrollers.extensions/scale  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  ingresses.networking.k8s.io              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  networkpolicies.networking.k8s.io        []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  poddisruptionbudgets.policy              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/attach                              []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/exec                                []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/portforward                         []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  pods/proxy                               []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  secrets                                  []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  services/proxy                           []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  serviceaccounts                          []                 []              [impersonate \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete deletecollection patch update]\n",
      "  tokenreviews.authentication.k8s.io         []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  subjectaccessreviews.authorization.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  selfsubjectaccessreviews.authorization.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  selfsubjectrulesreviews.authorization.k8s.io   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  certificatesigningrequests.certificates.k8s.io/nodeclient  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  certificatesigningrequests.certificates.k8s.io/selfnodeclient  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  volumeattachments.storage.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list watch]\n",
      "  events                            []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                                                   []                 []                                             [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io                                     []                 []                                             [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  subjectaccessreviews.authorization.k8s.io                []                 []                                             [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  jobs.batch                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list patch update watch]\n",
      "  events                     []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  controllerrevisions.apps          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list patch update watch]\n",
      "  pods                              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete list patch watch]\n",
      "  events                            []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  pods/binding                      []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  replicasets.apps                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list patch update watch]\n",
      "  replicasets.extensions             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list patch update watch]\n",
      "  events                             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  endpoints             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list update]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  endpoints/restricted  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  endpointslices.discovery.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list update]\n",
      "  events                           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  endpointslices.discovery.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list update]\n",
      "  events                           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  persistentvolumeclaims  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K get list watch]\n",
      "  events                  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io    []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                         []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                                       []                 []                 [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io                         []                 []                 [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  pods                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete list patch watch]\n",
      "  events                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  persistentvolumes              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list update watch]\n",
      "  pods                           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list watch]\n",
      "  endpoints                      []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get update]\n",
      "  services                       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get]\n",
      "  events.events.k8s.io           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                         []                 []              [watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io    []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  pods                               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete list patch watch]\n",
      "  events                             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  pods                               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete list patch watch]\n",
      "  events                             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io               []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                 []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  configmaps            []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K update]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  serviceaccounts       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  controllerrevisions.apps      []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list patch update watch]\n",
      "  persistentvolumeclaims        []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K get]\n",
      "  events                        []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  pods                          []                 []              [list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get patch update]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  secrets                                    []                 []                         [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get update]\n",
      "  serviceaccounts                            []                 []                         [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K get update]\n",
      "  events                                     []                 []                         [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io                       []                 []                         [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  endpoints                                  []                 []                         [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  serviceaccounts/token                      []                 []                         [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  tokenreviews.authentication.k8s.io         []                 []                         [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  subjectaccessreviews.authorization.k8s.io  []                 []                         [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  leases.coordination.k8s.io                 []                 []                         [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  events                                     []                 []                [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io                       []                 []                [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  bindings                                   []                 []                [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  endpoints                                  []                 []                [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  pods/binding                               []                 []                [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  tokenreviews.authentication.k8s.io         []                 []                [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  subjectaccessreviews.authorization.k8s.io  []                 []                [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  leases.coordination.k8s.io                 []                 []                [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  leases.coordination.k8s.io                      []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get patch update]\n",
      "  csinodes.storage.k8s.io                         []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get patch update]\n",
      "  nodes                                           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K get list watch patch update]\n",
      "  certificatesigningrequests.certificates.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K get list watch]\n",
      "  events                                          []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  pods/eviction                                   []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  serviceaccounts/token                           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  tokenreviews.authentication.k8s.io              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  localsubjectaccessreviews.authorization.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  subjectaccessreviews.authorization.k8s.io       []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K]\n",
      "  pods                                            []                 []              [get list watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete]\n",
      "  certificatesigningrequests.certificates.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K get list watch]\n",
      "  events                []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io  []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events.events.k8s.io             []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  persistentvolumes              []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K delete get list watch]\n",
      "  events.events.k8s.io           []                 []              [\u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n",
      "  events                         []                 []              [watch \u001b[01;31m\u001b[Kcreate\u001b[m\u001b[K patch update]\n"
     ]
    }
   ],
   "source": [
    "kubectl describe clusterrole.rbac  | grep --color=always -E '(create)'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 65,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[94m/usr/bin/kubectl get sa --all-namespaces --output json\u001b[0m\n",
      "\u001b[94m/usr/bin/kubectl get roles --all-namespaces --output json\u001b[0m\n",
      "\u001b[94m/usr/bin/kubectl get rolebindings --all-namespaces --output json\u001b[0m\n",
      "\u001b[94m/usr/bin/kubectl get clusterroles --output json\u001b[0m\n",
      "\u001b[94m/usr/bin/kubectl get clusterrolebindings --output json\u001b[0m\n"
     ]
    }
   ],
   "source": [
    "kubectl get sa,roles,clusterroles,clusterrolebindings -n my-namespace -o json | \\\n",
    "rback vis --include-namespaces=my-namespace --outformat dot > my-namespace-rbac.dot\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 66,
   "metadata": {},
   "outputs": [],
   "source": [
    "dot -Tpng -Grankdir=LR  my-namespace-rbac.dot -o  my-namespace-rbac.png"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "![ my-namespace-rbac.png](my-namespace-rbac.png)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl auth can-i --list "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl get sa,roles,clusterroles,clusterrolebindings  -o json | \\\n",
    "rback vis --include-namespaces=my-namespace --outformat dot > defaut-rbac.dot"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "dot -Tpng -Grankdir=LR  defaut-rbac.dot -o  default-rbac.png"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "ls *png"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl  -n my-namespace get sa -o yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "echo $KUBECONFIG"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl get rolebinding -A -o yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# cleanup\n",
    "#rm minikube.dot minikube.png my-namespace-rbac.dot my-namespace-rbac.png my-kubeconfig\n",
    "kubectl config current-context"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "go get -v github.com/thomasfricke/rbac-tool"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}