Auditing Permissions with kubectl auth can-i

Verify your RBAC configurations by testing specific user or ServiceAccount permissions against cluster resources using the command line.

In this lesson, you will learn how to verify your RBAC configurations by testing specific user or ServiceAccount permissions against cluster resources using kubectl auth can-i.

After defining complex Roles, ClusterRoles, and Bindings, it is easy to lose track of exactly what a specific entity can—or cannot—do. Instead of waiting for a "Forbidden" error during deployment, you can proactively audit your security posture using the auth can-i command.

Verifying User Access

If you want to check if your current user has permission to perform a specific action, such as deleting pods in a particular namespace, you run:

kubectl auth can-i delete pods --namespace=production

If the command returns yes, your current context has the necessary permissions. If it returns no, you know your RBAC configuration is missing the required rule.

Testing ServiceAccount Permissions

When working with operators or automated CI/CD pipelines, you often assign specific ServiceAccounts to your pods. To verify that a ServiceAccount has the correct privileges, use the --as flag to impersonate that account:

kubectl auth can-i create deployments \
  --as=system:serviceaccount:default:my-operator-sa \
  --namespace=default

This command acts as a simulator, allowing you to test the Principle of Least Privilege without actually executing the resource creation. You can also add the --list flag to see a comprehensive table of every resource and verb that specific identity is authorized to access.

Why Audit?

Using kubectl auth can-i is the gold standard for troubleshooting "Access Denied" issues. It bridges the gap between your YAML manifest definitions and the actual enforcement performed by the Kubernetes API server. By integrating this into your workflow, you ensure that your operators and CI/CD agents have exactly the permissions they need—and nothing more—before they reach the production environment.

Key Takeaway: Use kubectl auth can-i to simulate permission checks for specific users or ServiceAccounts, ensuring your RBAC policies effectively enforce the principle of least privilege.