<p>How do I use the <code>can-i</code> command? It does not seem to be completely documented here: </p>

<p><a href="https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-can-i-em-" rel="noreferrer">https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-can-i-em-</a> (no mention of <code>--as</code>).</p>

<hr>

<p>All the below results seem nonsensical: </p>

<pre><code>kubectl auth can-i list pod --as=default3ueoaueo --as-group=system:authenticated --as-group=system:masters
yes
</code></pre>

<p>The above will return <code>yes</code> for anything after <code>--as=</code> - any user specified here.</p>

<p>On the other hand, the default user account (or any other I've tried) seems to have no permission at all:</p>

<pre><code>kubectl auth can-i list pod --as=default                                                                  
no
</code></pre>

<p>and</p>

<pre><code>kubectl auth can-i list pod --as=default:serviceaccount:default
no
</code></pre>

<p>And according to <a href="https://github.com/kubernetes/kubernetes/issues/73123" rel="noreferrer">https://github.com/kubernetes/kubernetes/issues/73123</a> we just add <code>--as-group=system:authenticated</code> but that doesn't work either:</p>

<pre><code>kubectl auth can-i list pod --as=serviceaccount:default  --as-group=system:authenticated 
no
</code></pre>

<p>The usage of <code>'--as'</code> argument with <code>kubectl</code> command is known as "User impersonation", and it's documented in official documentation <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation" rel="noreferrer">here</a>.</p>

<p>If you are trying to impersonate user as an API resource like 'serviceaccounts', <br >the proper syntax is: <code>'--as=system:serviceaccount:kube-system:default</code>'</p>
