<p>Is there a way with kubectl to find out which clusterroles or roles are bound to the service account?</p>

<p>You could do something like:</p>

<pre><code>kubectl get rolebindings,clusterrolebindings \
  --all-namespaces  \
  -o custom-columns='KIND:kind,NAMESPACE:metadata.namespace,NAME:metadata.name,SERVICE_ACCOUNTS:subjects[?(@.kind=="ServiceAccount")].name' | grep "&lt;SERVICE_ACCOUNT_NAME&gt;"
</code></pre>

<p>Replace the grep with then name of the service account you are looking for.</p>
