<p>How can I debug all <code>Rules</code> with their <code>Verbs</code> and <code>ApiGroups</code> for a kubernetes <code>ServiceAccount</code>?</p>

<p><code>kubectl</code> supports testing the RBAC rights for a particular Service Account with the <code>auth can-i</code> sub-command. The syntax looks as follows:</p>
<pre><code>kubectl auth can-i -n --as system:serviceaccount:&lt;namespace&gt;:&lt;serviceaccount&gt; &lt;verb&gt; &lt;resource&gt;
</code></pre>
<p>For example:</p>
<pre><code>kubectl auth can-i --as system:serviceaccount:default:my-serviceaccount create deployments
</code></pre>
<p>More information can be found <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access" rel="nofollow noreferrer">here</a>.</p>
