1KUBERNETES(1) Jan 2015 KUBERNETES(1)
2
6 kubectl set subject - Update User, Group or ServiceAccount in a
7 RoleBinding/ClusterRoleBinding
8
12 kubectl set subject [OPTIONS]
13
17 Update User, Group or ServiceAccount in a
18 RoleBinding/ClusterRoleBinding.
19
23 --all=false
24 Select all resources, including uninitialized ones, in the
25 namespace of the specified resource types
26 --allow-missing-template-keys=true
29 If true, ignore any errors in templates when a field or map key is
30 missing in the template. Only applies to golang and jsonpath output
31 formats.
32 --dry-run="none"
35 Must be "none", "server", or "client". If client strategy, only
36 print the object that would be sent, without sending it. If server
37 strategy, submit server-side request without persisting the resource.
38 -f, --filename=[]
41 Filename, directory, or URL to files the resource to update the
42 subjects
43 --group=[]
46 Groups to bind to the role
47 -k, --kustomize=""
50 Process the kustomization directory. This flag can't be used
51 together with -f or -R.
52 --local=false
55 If true, set subject will NOT contact api-server but run locally.
56 -o, --output=""
59 Output format. One of:
60 json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-file.
61 -R, --recursive=false
64 Process the directory used in -f, --filename recursively. Useful
65 when you want to manage related manifests organized within the same
66 directory.
67 -l, --selector=""
70 Selector (label query) to filter on, not including uninitialized
71 ones, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)
72 --serviceaccount=[]
75 Service accounts to bind to the role
76 --template=""
79 Template string or path to template file to use when
80 -o=go-template, -o=go-template-file. The template format is golang
81 templates [ ⟨http://golang.org/pkg/text/template/#pkg-overview⟩].
82
86 --add-dir-header=false
87 If true, adds the file directory to the header
88 --alsologtostderr=false
91 log to standard error as well as files
92 --application-metrics-count-limit=100
95 Max number of application metrics to store (per container)
96 --as=""
99 Username to impersonate for the operation
100 --as-group=[]
103 Group to impersonate for the operation, this flag can be repeated
104 to specify multiple groups.
105 --azure-container-registry-config=""
108 Path to the file containing Azure container registry configuration
109 information.
110 --boot-id-file="/proc/sys/kernel/random/boot_id"
113 Comma-separated list of files to check for boot-id. Use the first
114 one that exists.
115 --cache-dir="/builddir/.kube/http-cache"
118 Default HTTP cache directory
119 --certificate-authority=""
122 Path to a cert file for the certificate authority
123 --client-certificate=""
126 Path to a client certificate file for TLS
127 --client-key=""
130 Path to a client key file for TLS
131 --cloud-provider-gce-l7lb-src-cidrs=130.211.0.0/22,35.191.0.0/16
134 CIDRs opened in GCE firewall for L7 LB traffic proxy health checks
135 --cloud-provider-gce-lb-src-cidrs=130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16
138 CIDRs opened in GCE firewall for L4 LB traffic proxy health checks
139 --cluster=""
142 The name of the kubeconfig cluster to use
143 --container-hints="/etc/cadvisor/container_hints.json"
146 location of the container hints file
147 --containerd="/run/containerd/containerd.sock"
150 containerd endpoint
151 --containerd-namespace="k8s.io"
154 containerd namespace
155 --context=""
158 The name of the kubeconfig context to use
159 --default-not-ready-toleration-seconds=300
162 Indicates the tolerationSeconds of the toleration for
163 notReady:NoExecute that is added by default to every pod that does not
164 already have such a toleration.
165 --default-unreachable-toleration-seconds=300
168 Indicates the tolerationSeconds of the toleration for
169 unreachable:NoExecute that is added by default to every pod that does
170 not already have such a toleration.
171 --disable-root-cgroup-stats=false
174 Disable collecting root Cgroup stats
175 --docker="unix:///var/run/docker.sock"
178 docker endpoint
179 --docker-env-metadata-whitelist=""
182 a comma-separated list of environment variable keys that needs to
183 be collected for docker containers
184 --docker-only=false
187 Only report docker containers in addition to root stats
188 --docker-root="/var/lib/docker"
191 DEPRECATED: docker root is read from docker info (this is a
192 fallback, default: /var/lib/docker)
193 --docker-tls=false
196 use TLS to connect to docker
197 --docker-tls-ca="ca.pem"
200 path to trusted CA
201 --docker-tls-cert="cert.pem"
204 path to client certificate
205 --docker-tls-key="key.pem"
208 path to private key
209 --enable-load-reader=false
212 Whether to enable cpu load reader
213 --event-storage-age-limit="default=0"
216 Max length of time for which to store events (per type). Value is a
217 comma separated list of key values, where the keys are event types
218 (e.g.: creation, oom) or "default" and the value is a duration. Default
219 is applied to all non-specified event types
220 --event-storage-event-limit="default=0"
223 Max number of events to store (per type). Value is a comma
224 separated list of key values, where the keys are event types (e.g.:
225 creation, oom) or "default" and the value is an integer. Default is
226 applied to all non-specified event types
227 --global-housekeeping-interval=1m0s
230 Interval between global housekeepings
231 --housekeeping-interval=10s
234 Interval between container housekeepings
235 --insecure-skip-tls-verify=false
238 If true, the server's certificate will not be checked for validity.
239 This will make your HTTPS connections insecure
240 --kubeconfig=""
243 Path to the kubeconfig file to use for CLI requests.
244 --log-backtrace-at=:0
247 when logging hits line file:N, emit a stack trace
248 --log-cadvisor-usage=false
251 Whether to log the usage of the cAdvisor container
252 --log-dir=""
255 If non-empty, write log files in this directory
256 --log-file=""
259 If non-empty, use this log file
260 --log-file-max-size=1800
263 Defines the maximum size a log file can grow to. Unit is megabytes.
264 If the value is 0, the maximum file size is unlimited.
265 --log-flush-frequency=5s
268 Maximum number of seconds between log flushes
269 --logtostderr=true
272 log to standard error instead of files
273 --machine-id-file="/etc/machine-id,/var/lib/dbus/machine-id"
276 Comma-separated list of files to check for machine-id. Use the
277 first one that exists.
278 --match-server-version=false
281 Require server version to match client version
282 -n, --namespace=""
285 If present, the namespace scope for this CLI request
286 --password=""
289 Password for basic authentication to the API server
290 --profile="none"
293 Name of profile to capture. One of
294 (none|cpu|heap|goroutine|threadcreate|block|mutex)
295 --profile-output="profile.pprof"
298 Name of the file to write the profile to
299 --request-timeout="0"
302 The length of time to wait before giving up on a single server
303 request. Non-zero values should contain a corresponding time unit (e.g.
304 1s, 2m, 3h). A value of zero means don't timeout requests.
305 -s, --server=""
308 The address and port of the Kubernetes API server
309 --skip-headers=false
312 If true, avoid header prefixes in the log messages
313 --skip-log-headers=false
316 If true, avoid headers when opening log files
317 --stderrthreshold=2
320 logs at or above this threshold go to stderr
321 --storage-driver-buffer-duration=1m0s
324 Writes in the storage driver will be buffered for this duration,
325 and committed to the non memory backends as a single transaction
326 --storage-driver-db="cadvisor"
329 database name
330 --storage-driver-host="localhost:8086"
333 database host:port
334 --storage-driver-password="root"
337 database password
338 --storage-driver-secure=false
341 use secure connection with database
342 --storage-driver-table="stats"
345 table name
346 --storage-driver-user="root"
349 database username
350 --tls-server-name=""
353 Server name to use for server certificate validation. If it is not
354 provided, the hostname used to contact the server is used
355 --token=""
358 Bearer token for authentication to the API server
359 --update-machine-info-interval=5m0s
362 Interval between machine info updates.
363 --user=""
366 The name of the kubeconfig user to use
367 --username=""
370 Username for basic authentication to the API server
371 -v, --v=0
374 number for the log level verbosity
375 --version=false
378 Print version information and quit
379 --vmodule=
382 comma-separated list of pattern=N settings for file-filtered
383 logging
384
388 # Update a ClusterRoleBinding for serviceaccount1
389 kubectl set subject clusterrolebinding admin --serviceaccount=namespace:serviceaccount1
390 # Update a RoleBinding for user1, user2, and group1
392 kubectl set subject rolebinding admin --user=user1 --user=user2 --group=group1
393 # Print the result (in yaml format) of updating rolebinding subjects from a local, without hitting the server
395 kubectl create rolebinding admin --role=admin --user=admin -o yaml --dry-run=client | kubectl set subject --local -f - --user=foo -o yaml
396
401 kubectl-set(1),
402
406 January 2015, Originally compiled by Eric Paris (eparis at redhat dot
407 com) based on the kubernetes source material, but hopefully they have
408 been automatically generated since!
409Eric Paris kubernetes User Manuals KUBERNETES(1)