kubernetes.rbac.can_i

Check whether the connection's identity can perform a verb on a resource (kubectl auth can-i equivalent)

Check whether the connection's identity can perform a verb on a resource (kubectl auth can-i equivalent).

Inputs:

• connection_uuid: Cloud connection UUID (required)
• verb: Action to check — get/list/create/update/patch/delete/watch/deletecollection (required)
• resource: Resource type, e.g. "deployments", "pods" (required)
• group: API group, e.g. "apps"; empty/None for core API (optional)
• namespace: Namespace scope; omit for cluster-scoped check (optional)
• name: Specific resource instance name (optional)

Outputs:

• allowed: bool — True if the server authorises the action
• reason: str|None — the authorizer's evaluation message (may be None)

Overview

Property	Value
Workflow type	Atomic
Library	App-kubernetes
Version	1.0

Input Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	Yes	—	—
verb	string	Yes	—	—
resource	string	Yes	—	—
group	string	No	—	—
namespace	string	No	—	—
name	string	No	—	—
organization_uuid	uuid	No	—	—

Output Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	No	—	—
organization_uuid	uuid	No	—	—
verb	string	No	—	—
resource	string	No	—	—
group	string	No	—	—
namespace	string	No	—	—
name	string	No	—	—
allowed	boolean	Yes	—	—
reason	string	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
failed_step	string	No	—	—
failed_layer	string	No	—	—
error	string	No	—	—
error_type	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "kubernetes.rbac.can_i",
  "initial_data": {
    "connection_uuid": "value",
    "verb": "value",
    "resource": "value"
  }
}