vela auth revoke-privileges
Revoke privileges for user/group/serviceaccount
Synopsis
Revoke privileges for user
Revoke privileges previously granted to a user/group/serviceaccount by vela auth grant-privileges. By using --for-namespace and --for-cluster, you can revoke the privileges for all resources in the specified namespace and cluster. If --for-namespace is not set, the cluster-wide privileges will be revoked.
Set --readonly to match the readonly privileges granted by vela auth grant-privileges --readonly. This must match how the privileges were originally granted, otherwise the wrong RoleBinding/ClusterRoleBinding will be targeted.
If multiple identity information are set, all the identity information will be unbound from the intended privileges respectively.
If --kubeconfig is set, the user/serviceaccount information in the kubeconfig will be used as the identity to revoke privileges. Groups will be ignored.
vela auth revoke-privileges
Examples
# Revoke privileges for User alice in the namespace demo of the control plane
vela auth revoke-privileges --user alice --for-namespace demo
# Revoke privileges for User alice in the namespace demo in cluster-1
vela auth revoke-privileges --user alice --for-namespace demo --for-cluster cluster-1
# Revoke cluster-scoped privileges for Group org:dev-team in the control plane
vela auth revoke-privileges --group org:dev-team
# Revoke privileges for Group org:dev-team and org:test-team in the namespace test on the control plane and managed cluster example-cluster
vela auth revoke-privileges --group org:dev-team --group org:test-team --for-namespace test --for-cluster local --for-cluster example-cluster
# Revoke read privileges for ServiceAccount observer in test namespace on the control plane
vela auth revoke-privileges --serviceaccount observer -n test --for-namespace test --readonly
# Revoke privileges for identity in kubeconfig in cluster-1
vela auth revoke-privileges --kubeconfig ./example.kubeconfig --for-cluster cluster-1
Options
-e, --env string The environment name for the CLI request
--for-cluster strings The clusters privileges to revoke. If empty, the control plane will be used.
--for-namespace strings The namespaces privileges to revoke. If empty, cluster-scoped privileges will be revoked.
-g, --group strings The group to revoke privileges from.
-h, --help help for revoke-privileges
--kubeconfig string The kubeconfig to revoke privileges from. If set, it will override all the other identity flags.
-n, --namespace string The namespace of the serviceaccount. This flag only works when --serviceaccount is set.
--readonly If set, only the readonly privileges will be revoked. This must match how the privileges were granted.
--serviceaccount string The serviceaccount to revoke privileges from.
-u, --user string The user to revoke privileges from.
Options inherited from parent commands
-V, --verbosity Level number for the log level verbosity
-y, --yes Assume yes for all user prompts
SEE ALSO
- vela auth - Manage identity and authorizations.