<p>I have a secret which contains very sensitive information.
I want to make sure that this secret can only be accessed by a certain service account and nobody else.</p>
<p>Using RBAC, I can tell which user can access which resources. But is there some way where I can tell that this secret can only be accessed by this user?</p>

<ul>
<li><p>as far as i know , There is no straight forward way to get that info (might require write a script to that iterates through rolebindings &amp; clusterrolebindings).</p>
</li>
<li><p>Recently found a plugin called <code>kubectl who-can</code> on <a href="https://github.com/aquasecurity/kubectl-who-can" rel="nofollow noreferrer">kubectl-who-can</a> that fetches those kind details with one command.</p>
</li>
</ul>
