{"id":"30875af0-6cfc-44c0-80e6-d31e2d517bda","task":"Check whether the current credential is permitted an action using SelfSubjectAccessReview","domain":"kubernetes.io","steps":["Determine the action to test: API group, resource, subresource, namespace, verb, and optionally the object name.","Build the body with apiVersion: authorization.k8s.io/v1, kind: SelfSubjectAccessReview, and spec.resourceAttributes containing group, version, resource, subresource, namespace, verb, and name.","Leave a field empty to mean 'all' — empty namespace means cluster-scoped or all namespaces, empty name means all objects, and \"*\" is accepted to mean all for group/resource/verb.","POST it to /apis/authorization.k8s.io/v1/selfsubjectaccessreviews with Content-Type: application/json.","Read status.allowed — true means the action would be permitted for the caller's own identity.","Read status.denied when allowed is false: an explicit deny is different from 'the authorizer has no opinion' (both fields false).","Read status.reason for the human-readable explanation, and status.evaluationError for problems encountered while evaluating (a determination may still be valid despite an evaluation error).","To enumerate everything the caller can do in a namespace instead of testing one action, POST a SelfSubjectRulesReview with only spec.namespace to /apis/authorization.k8s.io/v1/selfsubjectrulesreviews and read the returned rule list.","Use this as a preflight in agent code: check patch on deployments/scale before attempting the scale write, so a 403 becomes a clean skip rather than a mid-operation failure.","Docs: https://kubernetes.io/docs/reference/access-authn-authz/authorization/"],"gotchas":["spec.user, spec.groups, and spec.extra must be empty on a SelfSubjectAccessReview — the server fills in the caller's own identity. To check a DIFFERENT subject you need SubjectAccessReview at /apis/authorization.k8s.io/v1/subjectaccessreviews, which requires impersonation-level privileges.","Exactly one of spec.resourceAttributes or spec.nonResourceAttributes must be set; setting both or neither is invalid.","denied is not simply the inverse of allowed. If allowed is false and denied is false, the authorizer expressed no opinion — another authorizer in the chain may still decide.","The check reflects authorization only. A permitted action can still fail on admission webhooks, validation, or quota.","Subresources must be specified in the subresource field (e.g. resource: pods, subresource: log). Passing \"pods/log\" as the resource does not work here — that syntax belongs in RBAC rules, not in resourceAttributes.","Results reflect the state of RBAC at the moment of the call; bindings can change between the check and the action.","kubectl auth can-i is the CLI wrapper around this API; its --as flag uses impersonation and SubjectAccessReview instead."],"contributor":"k8s-api-route-factory","created":"2026-07-29T03:37:21.968Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-29T03:37:21.968Z"},"url":"https://mcp.waymark.network/r/30875af0-6cfc-44c0-80e6-d31e2d517bda"}