<p>I am trying to list permissions associated to a service account 'foobar-user' applied to my cluster in namespace 'kube-system':</p>
<pre><code>kubectl auth can-i --list --as=system:serviceaccount:kube-system:foobar-user --namespace=kube-system

Resources                                       Non-Resource URLs                     Resource Names     Verbs
clusterroles                                    []                                    []                 [create list update watch get]
deployments                                     []                                    []                 [create list update watch get]
endpoints                                       []                                    []                 [create list update watch get]
pods                                            []                                    []                 [create list update watch get]
rolebindings                                    []                                    []                 [create list update watch get]
roles                                           []                                    []                 [create list update watch get]
secrets                                         []                                    []                 [create list update watch get]
services                                        []                                    []                 [create list update watch get]
selfsubjectaccessreviews.authorization.k8s.io   []                                    []                 [create]
selfsubjectrulesreviews.authorization.k8s.io    []                                    []                 [create]
                                                [/.well-known/openid-configuration]   []                 [get]
                                                [/api/*]                              []                 [get]
                                                [/api]                                []                 [get]
                                                [/apis/*]                             []                 [get]
                                                [/apis]                               []                 [get]
                                                [/healthz]                            []                 [get]
                                                [/healthz]                            []                 [get]
                                                [/livez]                              []                 [get]
                                                [/livez]                              []                 [get]
                                                [/openapi/*]                          []                 [get]
                                                [/openapi]                            []                 [get]
                                                [/openid/v1/jwks]                     []                 [get]
                                                [/readyz]                             []                 [get]
                                                [/readyz]                             []                 [get]
                                                [/version/]                           []                 [get]
                                                [/version/]                           []                 [get]
                                                [/version]                            []                 [get]
                                                [/version]                            []                 [get]
nodes                                           []                                    []                 [list watch get]
</code></pre>
<p>What is an equivalent API to do this through Python client for kubernetes to list permissions associated to a service account? Appreciate your help, thanks!</p>

KGosalia
<p>The equivalent API to do this through Python client for kubernetes is:</p>
<p><a href="https://github.com/kubernetes-client/python/blob/master/kubernetes/docs/AuthorizationV1Api.md#create_self_subject_rules_review" rel="nofollow noreferrer">AuthorizationV1Api - create a SelfSubjectRulesReview</a></p>
<p>The official Kubernetes docs is as follows:</p>
<p><strong><code>SelfSubjectRulesReview</code></strong>: A review which returns the set of actions a user can perform within a namespace. Useful for users to quickly summarize their own access, or for UIs to hide/show actions.</p>
<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access" rel="nofollow noreferrer">Checking API Access</a></p>
