<p>I have created a service account to get a list of pods in minikube.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: demo-sa
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: list-pods
  namespace: default
rules:
  - apiGroups:
    - ''
    resources:
      - pods
    verbs:
      - list
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
 name: list-pods_demo-sa
 namespace: default
roleRef:
 kind: Role
 name: list-pods
 apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: demo-sa
    namespace: default
</code></pre>
<p>The problem is, that I get an error message if I use the service account to get the list of pods. <code>kubectl auth can-i list pod --as demo-sa</code> answers always with <code>no</code>.</p>

<p>You cannot use:</p>
<pre><code>kubectl auth can-i list pod --as &lt;something&gt;
</code></pre>
<p>to impersonate ServiceAccounts. You can only impersonate users <code>--as</code> and impersonate groups <code>--as-group</code></p>
<p>A workaround is to use the <a href="https://success.docker.com/article/how-to-troubleshoot-kubernetes-serviceaccount-permissions" rel="nofollow noreferrer">service account token</a>.</p>
<pre class="lang-sh prettyprint-override"><code>kubectl get secret demo-sa-token-7fx44 -o=jsonpath='{.data.token}' | base64 -d
</code></pre>
<p>You can use the output here and any <code>kubectl</code> request. However, I checked with <code>kubectl auth can-i list pod</code> and I don't think <code>auth</code> works with a token (you always get a yes)</p>
