<p>I tried with the <code>kubectl get sa default</code> command, but only see some very basic values. What's the command to view the permissions/roles associated with a specific service account in k8s?</p>

<p>The following command could help. It basically gets the RoleBindings and ClusterRoleBindings which .subjects[0] is the name of the ServiceAccount.</p>

<pre><code>$ kubectl get rolebinding,clusterrolebinding --all-namespaces -o jsonpath='{range .items[?(@.subjects[0].name=="SERVICE_ACCOUNT_NAME")]}[{.roleRef.kind},{.roleRef.name}]{end}'
</code></pre>

<p>Note: it will not list the RoleBindings / ClusterRoleBindings which contain several objects in the subject field</p>

<p>For instance, if weave-net is deployed as the network plugin, you can get the  Role and ClusterRole used by the weave-net ServiceAccount:</p>

<pre><code>$ kubectl get rolebinding,clusterrolebinding --all-namespaces -o jsonpath='{range .items[?(@.subjects[0].name=="weave-net")]}[{.roleRef.kind},{.roleRef.name}]{end}'
[Role,weave-net][ClusterRole,weave-net]
</code></pre>

<p>Hope this helps.</p>
