From 3d438ff304665ff49b56ff8af9c019b180c1bbcf Mon Sep 17 00:00:00 2001
From: Jerome Petazzoni <jerome.petazzoni@gmail.com>
Date: Wed, 5 Sep 2018 02:49:49 -0500
Subject: [PATCH] Add kubectl auth can-i ...

---
 slides/k8s/authn-authz.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/slides/k8s/authn-authz.md b/slides/k8s/authn-authz.md
index e7974832..019537bc 100644
--- a/slides/k8s/authn-authz.md
+++ b/slides/k8s/authn-authz.md
@@ -506,3 +506,24 @@ It's important to note a couple of details in these flags ...
   ```
 
 ]
+
+---
+
+## Testing directly with `kubectl`
+
+- We can also check for permission with `kubectl auth can-i`:
+  ```bash
+  kubectl auth can-i list nodes
+  kubectl auth can-i create pods
+  kubectl auth can-i get pod/name-of-pod
+  kubectl auth can-i get /url-fragment-of-api-request/
+  kubectl auth can-i '*' services
+  ```
+
+- And we can check permissions on behalf of other users:
+  ```bash
+  kubectl auth can-i list nodes \
+          --as some-user
+  kubectl auth can-i list nodes \
+          --as system:serviceaccount:<namespace>:<name-of-service-account>
+  ```