<blockquote>
  <p>How to assign RBAC permissions to system:anonymous service account in Kubernetes?</p>
</blockquote>

<p>To understand Kubernetes, I want to assign permissions to the <code>system:anonymous</code> service account to review permissions using <code>kubectl auth can-i --list</code>.</p>

<p>I have created the following role and rolebinding:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole 
metadata:
  name: anonymous-review-access
rules:
- apiGroups:
  - authorization.k8s.io
  resources:
  - selfsubjectaccessreviews
  - selfsubjectrulesreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
   name: anonymous-review-access
roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: anonymous-review-access
subjects:
- kind: ServiceAccount
  name: anonymous
  namespace: default
</code></pre>

<p>After <code>kubectl apply -f ...</code> the above, I'm still not allowed to review access permissions anonymously:</p>

<pre><code>$ kubectl auth can-i --list --as=system:anonymous -n default
Error from server (Forbidden): selfsubjectrulesreviews.authorization.k8s.io is forbidden: User "system:anonymous" cannot create resource "selfsubjectrulesreviews" in API group "authorization.k8s.io" at the cluster scope
</code></pre>

<p>How can I create proper role and rolebinding to view permissions as <code>system:anonymous</code> service account?</p>

<p><code>system:anonymous</code> is not a service account.Requests that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of <code>system:anonymous</code> and a group of <code>system:unauthenticated</code></p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anonymous-review-access
rules:
- apiGroups:
  - authorization.k8s.io
  resources:
  - selfsubjectaccessreviews
  - selfsubjectrulesreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
   name: anonymous-review-access
roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: anonymous-review-access
subjects:
- kind: User
  name: system:anonymous
  namespace: default
</code></pre>

<hr>

<pre><code>    kubectl auth can-i --list --as=system:anonymous -n default
Resources                                       Non-Resource URLs   Resource Names   Verbs
selfsubjectaccessreviews.authorization.k8s.io   []                  []               [create]
selfsubjectrulesreviews.authorization.k8s.io    []                  []               [create]
</code></pre>
