E-RAK
rakkess
kubectl plugin that renders a full access matrix — every resource type against every verb — for the current or an impersonated identity.
OVERVIEW
rakkess (corneliusweig/rakkess, "review access") is a kubectl plugin that answers "what can this identity do" as a single readable matrix instead of a long list of kubectl auth can-i calls: it queries every resource type the API server knows about against a fixed set of verbs (get, list, create, update, delete, and more) and prints a grid of what is allowed, using the same SelfSubjectAccessReview machinery kubectl auth can-i relies on.
With --as or --sa it can render that matrix for a different user, group, or service account rather than just the currently authenticated identity, which makes it the fast way to check how far a specific service account could actually reach after finding it through kubectl-who-can or a leaked token, without hand-running dozens of individual permission checks.
USE CASES
Practical use cases
- 01
Getting a complete permission overview for the current credential in one command instead of scripting many auth can-i calls.
- 02
Impersonating (--as, --sa) a discovered service account or user to map exactly what a stolen credential could reach.
- 03
Narrowing the matrix to a specific resource (`rakkess resource <type>`) to see cluster-wide who can touch a sensitive resource like secrets or configmaps.
- 04
Comparing the access matrix before and after an RBAC change to confirm a fix actually narrowed permissions as intended.
QUICK START
After discovering a service account or user, to see its full effective permissions across every resource type in a single readable grid.
- Confirm kubectl is configured against the in-scope cluster with the credential to be reviewed.
- Install rakkess via krew (`kubectl krew install access-matrix`) or a release binary.
- Run it with no arguments for the current identity's full matrix, or --as/--sa to check a different one.
- Narrow to a namespace or specific resource once the full matrix flags something worth a closer look.
kubectl access-matrix --as=system:serviceaccount:default:defaultBEFORE YOU RUN IT
What to check before running it
Like any RBAC-only tool, its matrix reflects what the Kubernetes authorizer allows — admission controllers (OPA/Gatekeeper, Kyverno, Pod Security Admission) can still block an action the matrix marks as permitted, so treat a "yes" cell as worth testing, not as guaranteed access.
Impersonation via --as itself requires the impersonate verb on the running credential — a low-privilege token may only be able to render its own matrix, not another identity's.
Querying every resource type against every verb generates a burst of SelfSubjectAccessReview calls against the API server; on a very large cluster or a tightly rate-limited API server, scope it to specific resources rather than repeatedly running the full matrix.