<p>In kubernetes, is there a way to find the <code>RoleBinding/ClusterRoleBinding</code> related to a serviceAccount without traversing all of the bindings?</p>

<p>This is very helpful when trying to solve problems related to authentication a Pod uses to request APIServer.</p>

<p>As mentioned, there is no simple way to do this with <code>kubectl</code> but it is technically supported. You can pass Custom Columns to control the resultant STDOUT to produce the information you're interested in. Then you can either specify the <code>-A</code> argument to search all namespaces or use the <code>-n specificNamespace</code> argument. Lastly, you can then <code>grep</code> the resultant STDOUT of the command to filter it accordingly if necessary. </p>

<p>For example, if I grab all of the bindings from the <code>kubernetes-dashboard</code> I could run this command:</p>

<pre><code>$&gt; kubectl get rolebindings,clusterrolebindings \
      -n kubernetes-dashboard \
      -o custom-columns='KIND:kind,NAMESPACE:metadata.namespace,NAME:metadata.name,SERVICE_ACCOUNTS:subjects[?(@.kind=="ServiceAccount")].name' | wc -l
64

</code></pre>

<p>As you can see, I piped it in <code>wc</code> because over 60 results were returned and that would be awful to post on StackOverflow. However, if you use <code>grep</code> instead then you can easily retrieve more granular results. For example, this tweaked command shows that there is one CRB for the <code>tj</code> ServiceAccount resource. </p>

<pre><code>$&gt; kubectl get rolebindings,clusterrolebindings \
     -n kubernetes-dashboard \
     -o custom-columns='KIND:kind,NAMESPACE:metadata.namespace,NAME:metadata.name,SERVICE_ACCOUNTS:subjects[?(@.kind=="ServiceAccount")].name' | grep tj
ClusterRoleBinding   &lt;none&gt;                 tj                                                     tj
</code></pre>

<p>You could then set up a shell alias to simplify this going forward:</p>

<pre><code>$&gt; alias getbindings="kubectl get rolebindings,clusterrolebindings   -n kubernetes-dashboard    -o custom-columns='KIND:kind,NAMESPACE:metadata.namespace,NAME:metadata.name,SERVICE_ACCOUNTS:subjects[?(@.kind==\"ServiceAccount\")].name' | grep"
</code></pre>

<pre><code>$&gt; getbindings tj
ClusterRoleBinding   &lt;none&gt;                 tj                                                     tj
</code></pre>

<p>Alternatively, you could even turn it into a function which accepts two arguments, one Namespace and one ServiceAccount. Which then effectively creates your own solution to the feature request you have made. For example:</p>

<pre><code>$&gt; tail -n 6 ~/.bashrc
function get_bindings(){

    kubectl get rolebindings,clusterrolebindings \
      -n $1 \
      -o custom-columns='KIND:kind,NAMESPACE:metadata.namespace,NAME:metadata.name,SERVICE_ACCOUNTS:subjects[?(@.kind=="ServiceAccount")].name' | grep $2
}
</code></pre>

<pre><code>$&gt; get_bindings "kubernetes-dashboard" "tj"
ClusterRoleBinding   &lt;none&gt;                 tj                                                     tj
</code></pre>

<p>Hope this helps. </p>
