Should I really have the ability to delete that pod? In one of the <https://kode . . .

Kubernetes-Slack Discussions
#1

Kishore Puvvada:
Should I really have the ability to delete that pod? In one of the https://kodekloud.com/topic/practice-test-role-based-access-controls-2/|labs, I tested using auth can-i whether the user dev-user can delete pods. But, when I actually pressed on to do the delete, it seems to have gone through just fine. I could swear some other operations did not behave this way. So, I am missing an option on the auth can-i command? Pl say yes.

>

controlplane ~ ✖ k auth can-i delete pod -n blue --as dev-user
&gt; no
&gt; 
&gt; controlplane ~ ✖ k get pods -n blue
&gt; NAME            READY   STATUS    RESTARTS   AGE
&gt; blue-app        1/1     Running   0          6m59s
&gt; dark-blue-app   1/1     Running   0          6m59s
&gt; 
&gt; controlplane ~ ➜  k delete pod blue-app -n blue --as dev-user
&gt; pod "blue-app" deleted
&gt; W0223 03:24:34.511707    9445 reflector.go:424] vendor/k8s.io/client-go/tools/watch/informerwatcher.go:146: failed to list *unstructured.Unstructured: pods "blue-app" is forbidden: User "dev-user" cannot list resource "pods" in API group "" in the namespace "blue"
&gt; E0223 03:24:34.511899    9445 reflector.go:140] vendor/k8s.io/client-go/tools/watch/informerwatcher.go:146: Failed to watch *unstructured.Unstructured: failed to list *unstructured.Unstructured: pods "blue-app" is forbidden: User "dev-user" cannot list resource "pods" in API group "" in the namespace "blue"
&gt; W0223 03:24:35.369727    9445 reflector.go:424] vendor/k8s.io/client-go/tools/watch/informerwatcher.go:146: failed to list *unstructured.Unstructured: pods "blue-app" is forbidden: User "dev-user" cannot list resource "pods" in API group "" in the namespace "blue"
&gt; E0223 03:24:35.369772    9445 reflector.go:140] vendor/k8s.io/client-go/tools/watch/informerwatcher.go:146: Failed to watch *unstructured.Unstructured: failed to list *unstructured.Unstructured: pods "blue-app" is forbidden: User "dev-user" cannot list resource "pods" in API group "" in the namespace "blue"
#2

Santosh Kaluskar:
--as is an option available on kubectl auth command. When you run the kubectl delete ... it doesn’t consider the --as option and is run as admin user with default credentials available at ~/.kube/config which is Cluster Admin.

#3

Kishore Puvvada:
Awww, that totally makes sense. Otherwise, as a system, tracking end user actions could be meaningless!