<p>One can create <code>Role</code> or <code>ClusterRole</code> and assign it to user via <code>RoleBinding</code> or <code>ClusterRoleBinding</code>.</p>

<p>from user view that have a token, how to get all granted permissions or roles\rolebindings applied to him via <code>kubectl</code>?</p>

<pre><code>  # Check to see if I can do everything in my current namespace ("*" means all)
  kubectl auth can-i '*' '*'

  # Check to see if I can create pods in any namespace
  kubectl auth can-i create pods --all-namespaces

  # Check to see if I can list deployments in my current namespace
  kubectl auth can-i list deployments.extensions

</code></pre>

<p>you can get further information with <code>kubectl auth --help</code> command </p>

<p>You can also  impersonate as a different user to check their permission with the following flag <code>--as</code> or <code>--as-group</code></p>

<pre><code>kubectl auth can-i create deployments --namespace default --as john.cena
</code></pre>
