Home / server / Questions / 862728
Accepted
tlo
Asked: 2017-07-19 00:35:36 +0800 CST

How to list users with role cluster-admin in OpenShift?

  • 772

I can add users to the cluster-role "cluster-admin" with:

oc adm policy add-cluster-role-to-user cluster-admin <user>

But how can I list all users with the role cluster-admin?

Environment: OpenShift 3.x

openshift-origin

4 Answers

  1. Best Answer

    Found it myself:

    It's in the RoleBinding[cluster-admins]: section of:

    oc describe clusterPolicyBindings :default

    With jq you can get the list of users in one command:

    oc get --all-namespaces --output json clusterPolicyBindings | jq '.items[].roleBindings[] | select(.name=="cluster-admins") | .roleBinding.userNames'

    For OpenShift 3.7 and newer:

    oc get clusterrolebindings -o json | jq '.items[] | select(.metadata.name=="cluster-admins") | .userNames'
    • 10

  2. in openshift 3.9 the cluster admins are located in different dictionaries(cluster-admin-0,cluster-admin-1, and so on). To list them: 

    oc get clusterrolebinding -o json | jq '.items[] | select(.metadata.name |  startswith("cluster-admin")) | .userNames'
    • 2

  3. From my side command for Openshift 3.7+ is for cluster-admins :

    oc get --all-namespaces --output json clusterPolicyBindings | jq '.items[].roleBindings[] | select(.name=="cluster-admin") | .roleBinding.userNames'

    For cluster-reader role :

    oc get clusterrolebindings -o json | jq '.items[] | select(.metadata.name=="cluster-readers") | .userNames'
    • 0

  4. Openshift 4.8

    oc get clusterrolebindings -o json |
  jq '.items[] | select(.metadata.name=="cluster-admins") | .subjects[].name'
    • 0