Skip to content
Show who has RBAC permissions to perform actions on different resources in Kubernetes
Go Other
  1. Go 99.0%
  2. Other 1.0%
Branch: master
Clone or download
danielpacak and lizrice feat: Resolving API groups (#40)
* test: Add integration test scenario for resolving API group

* feat: Resolve resource API groups

Kubernetes assigns resources to API grups. So you can have pods
in the core group as well as pods in the groups.
With the changes introduced the plugin allows you to specify the
fully qualified resoruce name at the command line, for example:

$ kubect who-can get pods
$ kubect who-can get

Resolves: #35, #38
Latest commit 5ab9e06 Jul 8, 2019

GitHub release Build Status Coverage Status Go Report Card License


Shows which subjects have RBAC permissions to VERB [TYPE | TYPE/NAME | NONRESOURCEURL] in Kubernetes.



There are several ways to install kubectl-who-can. The recommended installation is via the kubectl plugin manager called krew.


I assume that you've already installed krew. Then run the following command:

kubectl krew install who-can

The plugin will be available as kubectl who-can.


Download a release distribution archive for your operating system, extract it, and add the kubectl-who-can executable to your $PATH. For example, to manually install kubectl-who-can on macOS run the following command:

VERSION=`git describe --abbrev=0`

mkdir -p /tmp/who-can/$VERSION && \
curl -L$VERSION/kubectl-who-can_darwin_x86_64.tar.gz \
  | tar xz -C /tmp/who-can/$VERSION && \
sudo mv -i /tmp/who-can/$VERSION/kubectl-who-can /usr/local/bin

Build from Source

This is a standard Go program. If you already know how to build and install Go code, you probably won't need these instructions.

Note that while the code is small, it has some rather big dependencies, and fetching + building these dependencies can take a few minutes.

Option 1 (if you have a Go compiler and want to tweak the code):

# Clone this repository (or your fork)
git clone
cd kubectl-who-can

The kubectl-who-can binary will be in the current directory.

Option 2 (if you have a Go compiler and just want the binary):

go get -v

The kubectl-who-can binary will be in $GOPATH/bin.

Option 3 (if you don't have a Go compiler, but have Docker installed):

docker run --rm -v /usr/local/bin:/go/bin golang go get -v

The kubectl-who-can binary will be in /usr/local/bin.

You can’t perform that action at this time.