Question

A developer reports that their CI pipeline, which authenticates as the ServiceAccount 'deployer' in the 'build' namespace, is failing when it tries to create Deployments. Before modifying any RBAC objects, you want to confirm exactly whether that ServiceAccount currently has permission to create Deployments in the 'build' namespace. Which command lets you verify this most directly?

Accepted Answer

kubectl auth can-i create deployments --namespace build --as=system:serviceaccount:build:deployer

Answer

kubectl get rolebindings -n build --field-selector subject=deployer

Answer

kubectl describe serviceaccount deployer -n build

Answer

kubectl auth can-i create deployments --as=deployer -n build