<p>There is a default <code>ClusterRoleBinding</code> named <code>cluster-admin</code>.<br>
When I run <code>kubectl get clusterrolebindings cluster-admin -o yaml</code> I get:  </p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: 2018-06-13T12:19:26Z
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: cluster-admin
  resourceVersion: "98"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-admin
  uid: 0361e9f2-6f04-11e8-b5dd-000c2904e34b
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:masters
</code></pre>

<p>In the <code>subjects</code> field I have:  </p>

<pre><code>- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:masters
</code></pre>

<p>How can I see the members of the group <code>system:masters</code> ?<br>
I read <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-subjects" rel="noreferrer">here</a> about groups but I don't understand how can I see who is inside the groups as the example above with <code>system:masters</code>.  </p>

<p>I noticed that when I decoded <code>/etc/kubernetes/pki/apiserver-kubelet-client.crt</code> using the command: <code>
openssl x509 -in apiserver-kubelet-client.crt -text -noout</code> it contained the subject <code>system:masters</code> but I still didn't understand who are the users in this group:  </p>

<pre><code>Issuer: CN=kubernetes
Validity
    Not Before: Jul 31 19:08:36 2018 GMT
    Not After : Jul 31 19:08:37 2019 GMT
Subject: O=system:masters, CN=kube-apiserver-kubelet-client
Subject Public Key Info:
    Public Key Algorithm: rsaEncryption
        Public-Key: (2048 bit)
        Modulus:
</code></pre>

<p><strong>Answer updated</strong>:</p>

<p>It seems that there is no way to do it using <code>kubectl</code>. There is no object like Group that you can "get" inside the Kubernetes configuration. </p>

<p>Group information in Kubernetes is currently provided by the Authenticator modules and usually it's just string in the user property. </p>

<p>Perhaps you can get the list of group from the subject of user certificate or if you use GKE, EKS or AKS the group attribute is stored in a cloud user management system. </p>

<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/</a>
<a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/authentication/</a></p>

<p>Information about ClusterRole membership in system groups can be requested from ClusterRoleBinding objects. (for example for "system:masters" it shows only cluster-admin ClusterRole):</p>

<p>Using jq:</p>

<pre><code>kubectl get clusterrolebindings -o json | jq -r '.items[] | select(.subjects[0].kind=="Group") | select(.subjects[0].name=="system:masters")'
</code></pre>

<p>If you want to list the names only:</p>

<pre><code>kubectl get clusterrolebindings -o json | jq -r '.items[] | select(.subjects[0].kind=="Group") | select(.subjects[0].name=="system:masters") | .metadata.name'
</code></pre>

<p>Using go-templates:</p>

<pre><code>kubectl get clusterrolebindings -o go-template='{{range .items}}{{range .subjects}}{{.kind}}-{{.name}} {{end}} {{" - "}} {{.metadata.name}} {{"\n"}}{{end}}' | grep "^Group-system:masters"
</code></pre>

<p>Some additional information about system groups can be found in <a href="https://github.com/kubernetes/kubernetes/issues/44418" rel="noreferrer">GitHub issue #44418</a> or in <a href="https://github.com/oracle/kubernetes-website/blob/master/docs/admin/authorization/rbac.md#referring-to-subjects" rel="noreferrer">RBAC document</a>:</p>
