1OC POLICY(1)                       June 2016                      OC POLICY(1)
2
3
4

NAME

6       oc policy can-i - Check whether an action is allowed
7
8
9

SYNOPSIS

11       oc policy can-i [OPTIONS]
12
13
14

DESCRIPTION

16       Check whether an action is allowed
17
18
19

OPTIONS

21       --all-namespaces=false
22           If true, check the specified action in all namespaces.
23
24
25       --allow-missing-template-keys=true
26           If  true, ignore any errors in templates when a field or map key is
27       missing in the template. Only applies to  golang  and  jsonpath  output
28       formats.
29
30
31       --groups=[]
32           Check  the  specified  action  using  these  groups instead of your
33       groups.
34
35
36       --ignore-scopes=false
37           If true, disregard any scopes present on this request and  evaluate
38       considering full permissions.
39
40
41       --list=false
42           If  true, list all the actions you can perform in a namespace, can‐
43       not be specified with --all-namespaces or a VERB RESOURCE
44
45
46       --no-headers=false
47           When using the default or custom-column output format, don't  print
48       headers (default print headers).
49
50
51       -o, --output=""
52           Output  format. One of: json|yaml|wide|name|custom-columns=...|cus‐
53       tom-columns-file=...|go-template=...|go-template-file=...|json‐
54       path=...|jsonpath-file=...   See   custom   columns   [  ⟨http://kuber
55       netes.io/docs/user-guide/kubectl-overview/#custom-columns⟩],     golang
56       template   [  ⟨http://golang.org/pkg/text/template/#pkg-overview⟩]  and
57       jsonpath template [ ⟨http://kubernetes.io/docs/user-guide/jsonpath⟩].
58
59
60       -q, --quiet=false
61           If true, suppress output and just return the exit code.
62
63
64       --scopes=[]
65           Check the specified action using these  scopes.   By  default,  the
66       scopes on the current token will be used.
67
68
69       --show-labels=false
70           When  printing,  show  all  labels as the last column (default hide
71       labels column)
72
73
74       --sort-by=""
75           If non-empty, sort list types using this field specification.   The
76       field  specification  is  expressed  as  a  JSONPath  expression  (e.g.
77       '{.metadata.name}'). The field in the API resource  specified  by  this
78       JSONPath expression must be an integer or a string.
79
80
81       --template=""
82           Template  string  or  path  to template file to use when -o=go-tem‐
83       plate, -o=go-template-file. The template format is golang  templates  [
84http://golang.org/pkg/text/template/#pkg-overview⟩].
85
86
87

OPTIONS INHERITED FROM PARENT COMMANDS

89       --allow_verification_with_non_compliant_keys=false
90           Allow  a  SignatureVerifier  to  use  keys  which  are  technically
91       non-compliant with RFC6962.
92
93
94       --alsologtostderr=false
95           log to standard error as well as files
96
97
98       --application_metrics_count_limit=100
99           Max number of application metrics to store (per container)
100
101
102       --as=""
103           Username to impersonate for the operation
104
105
106       --as-group=[]
107           Group to impersonate for the operation, this flag can  be  repeated
108       to specify multiple groups.
109
110
111       --azure-container-registry-config=""
112           Path  to the file containing Azure container registry configuration
113       information.
114
115
116       --boot_id_file="/proc/sys/kernel/random/boot_id"
117           Comma-separated list of files to check for boot-id. Use  the  first
118       one that exists.
119
120
121       --cache-dir="/builddir/.kube/http-cache"
122           Default HTTP cache directory
123
124
125       --certificate-authority=""
126           Path to a cert file for the certificate authority
127
128
129       --client-certificate=""
130           Path to a client certificate file for TLS
131
132
133       --client-key=""
134           Path to a client key file for TLS
135
136
137       --cloud-provider-gce-lb-src-cidrs=130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16
138           CIDRs opened in GCE firewall for LB traffic proxy  health checks
139
140
141       --cluster=""
142           The name of the kubeconfig cluster to use
143
144
145       --container_hints="/etc/cadvisor/container_hints.json"
146           location of the container hints file
147
148
149       --containerd="unix:///var/run/containerd.sock"
150           containerd endpoint
151
152
153       --context=""
154           The name of the kubeconfig context to use
155
156
157       --default-not-ready-toleration-seconds=300
158           Indicates   the   tolerationSeconds   of   the    toleration    for
159       notReady:NoExecute  that is added by default to every pod that does not
160       already have such a toleration.
161
162
163       --default-unreachable-toleration-seconds=300
164           Indicates the tolerationSeconds  of  the  toleration  for  unreach‐
165       able:NoExecute  that  is  added  by  default to every pod that does not
166       already have such a toleration.
167
168
169       --docker="unix:///var/run/docker.sock"
170           docker endpoint
171
172
173       --docker-tls=false
174           use TLS to connect to docker
175
176
177       --docker-tls-ca="ca.pem"
178           path to trusted CA
179
180
181       --docker-tls-cert="cert.pem"
182           path to client certificate
183
184
185       --docker-tls-key="key.pem"
186           path to private key
187
188
189       --docker_env_metadata_whitelist=""
190           a comma-separated list of environment variable keys that  needs  to
191       be collected for docker containers
192
193
194       --docker_only=false
195           Only report docker containers in addition to root stats
196
197
198       --docker_root="/var/lib/docker"
199           DEPRECATED:  docker  root is read from docker info (this is a fall‐
200       back, default: /var/lib/docker)
201
202
203       --enable_load_reader=false
204           Whether to enable cpu load reader
205
206
207       --event_storage_age_limit="default=24h"
208           Max length of time for which to store events (per type). Value is a
209       comma  separated  list  of  key  values, where the keys are event types
210       (e.g.: creation, oom) or "default" and the value is a duration. Default
211       is applied to all non-specified event types
212
213
214       --event_storage_event_limit="default=100000"
215           Max  number  of  events to store (per type). Value is a comma sepa‐
216       rated list of key values, where the keys are event  types  (e.g.:  cre‐
217       ation,  oom)  or  "default"  and  the  value  is an integer. Default is
218       applied to all non-specified event types
219
220
221       --global_housekeeping_interval=0
222           Interval between global housekeepings
223
224
225       --housekeeping_interval=0
226           Interval between container housekeepings
227
228
229       --insecure-skip-tls-verify=false
230           If true, the server's certificate will not be checked for validity.
231       This will make your HTTPS connections insecure
232
233
234       --kubeconfig=""
235           Path to the kubeconfig file to use for CLI requests.
236
237
238       --log-flush-frequency=0
239           Maximum number of seconds between log flushes
240
241
242       --log_backtrace_at=:0
243           when logging hits line file:N, emit a stack trace
244
245
246       --log_cadvisor_usage=false
247           Whether to log the usage of the cAdvisor container
248
249
250       --log_dir=""
251           If non-empty, write log files in this directory
252
253
254       --logtostderr=true
255           log to standard error instead of files
256
257
258       --machine_id_file="/etc/machine-id,/var/lib/dbus/machine-id"
259           Comma-separated  list  of  files  to  check for machine-id. Use the
260       first one that exists.
261
262
263       --match-server-version=false
264           Require server version to match client version
265
266
267       -n, --namespace=""
268           If present, the namespace scope for this CLI request
269
270
271       --request-timeout="0"
272           The length of time to wait before giving  up  on  a  single  server
273       request. Non-zero values should contain a corresponding time unit (e.g.
274       1s, 2m, 3h). A value of zero means don't timeout requests.
275
276
277       -s, --server=""
278           The address and port of the Kubernetes API server
279
280
281       --stderrthreshold=2
282           logs at or above this threshold go to stderr
283
284
285       --storage_driver_buffer_duration=0
286           Writes in the storage driver will be buffered  for  this  duration,
287       and committed to the non memory backends as a single transaction
288
289
290       --storage_driver_db="cadvisor"
291           database name
292
293
294       --storage_driver_host="localhost:8086"
295           database host:port
296
297
298       --storage_driver_password="root"
299           database password
300
301
302       --storage_driver_secure=false
303           use secure connection with database
304
305
306       --storage_driver_table="stats"
307           table name
308
309
310       --storage_driver_user="root"
311           database username
312
313
314       --token=""
315           Bearer token for authentication to the API server
316
317
318       --user=""
319           The name of the kubeconfig user to use
320
321
322       -v, --v=0
323           log level for V logs
324
325
326       --version=false
327           Print version information and quit
328
329
330       --vmodule=
331           comma-separated  list  of pattern=N settings for file-filtered log‐
332       ging
333
334
335

SEE ALSO

337       oc-policy(1),
338
339
340

HISTORY

342       June 2016, Ported from the Kubernetes man-doc generator
343
344
345
346Openshift                  Openshift CLI User Manuals             OC POLICY(1)
Impressum