Try `--as=system:serviceaccount:default:cka-testing` if im correct

Kubernetes-Slack Discussions
#1

Gennway:
try --as=system:serviceaccount:default:cka-testing if im correct

#2

Basavraj Nilkanthe:

kubectl get pods --as=system:serviceaccount:default:cka-testing
NAME                  READY   STATUS    RESTARTS   AGE
red-c898cbdc6-q7jhw   1/1     Running   0          56m
red-c898cbdc6-qbzb7   1/1     Running   0          56m
#3

Basavraj Nilkanthe:
now, I can list pods

#4

Basavraj Nilkanthe:
but I cant still list nodes

#5

Gennway:
check this :

#6

Basavraj Nilkanthe:

 kubectl get nodes --as=system:serviceaccount:default:cka-testing
Error from server (Forbidden): nodes is forbidden: User "system:serviceaccount:default:cka-testing" cannot list resource "nodes" in API group "" at the cluster scope
#7

Basavraj Nilkanthe:
Also, where I can find --as=system:serviceaccount:default:sa-name

#8

Basavraj Nilkanthe:
in http://kubernetes.io|kubernetes.io

#9

Gennway:
my mistake

#10

Gennway:
I thought u’re using kubectl auth

#11

Gennway:
check this

#12

Gennway:
kubectl auth can-i list nodes --as=system:serviceaccount:default:cka-testing

#13

Gennway:
thats the way I always check if specific service account has right permissions

#14

Gennway:
whenever I play with RBAC

#15

Basavraj Nilkanthe:
okay

#16

Gennway:
im not sure if u can list resources as specific SA, but u definietly can check it the specific SA has rigt permissions set

#17

Basavraj Nilkanthe:
Also, I bit confused SA is namespace scoped resource and how it will bind to clusterrole to get permissions from other namespace… Do you know this work

#18

Basavraj Nilkanthe:
I can understand users/groups they are not either namespace or clusterrole scoped resource

#19

Gennway:
https://kubernetes.io/docs/reference/access-authn-authz/rbac/#clusterrole-example

#20

Gennway:
I think there is a good explanation