<p>I am able to <code>list</code>, <code>get</code> pods, secrets, deployments and many other resources. I have cluster wide access for many resources. Is there some way to see the consolidated list of all permissions that I have in a kubernetes cluster?</p>
<p>The result of <code>kubectl auth can-i '*' '*'</code> is <code>no</code> though.</p>

Surya
<p>I don't think it is possible to get a consolidated list of all permissions that you have in a k8s cluster.</p>
<p>Looking at the <code>help</code> &amp; <code>examples</code> for the <code>kubectl auth can-i</code> command it needs a <code>VERB</code> which is a logical Kubernetes API verb like <code>'get'</code>, <code>'list'</code>, <code>'watch'</code>, <code>'delete'</code>, etc. and a <code>TYPE</code> which is a Kubernetes resource.</p>
<p>The result of <code>kubectl auth can-i '*' '*'</code> is understandably <code>no</code> as it checks if you can do everything in your current namespace - which evidently is not true in your case and thus the <code>no</code> response.</p>
<p>You will need to run <code>kubectl auth can-i</code> for each resource and each action that you want to check (of course you would be able to use <code>-A</code> or <code>--all-namespaces</code> flag for all namespaces) but I would imagine you can write a script to run a loop on this command for all/some resources to check permissions for all/some actions.</p>
<p><strong>Update:</strong></p>
<p>If you'd really want to, you could run a script to loop through certain <code>kubectl</code> cmds to achieve this.</p>
<p>The script would (could) look like:</p>
<pre><code>#!/bin/bash
for namespace in $(kubectl get namespaces | awk '{ print $1 }' | tail -n +2); do
  echo &quot;Current namespace: $namespace&quot;
  for resource in $(kubectl api-resources --verbs=list --namespaced -o name); do
    for action in get list watch create update patch delete; do
      echo &quot;- $action $resource&quot;
      kubectl auth can-i &quot;$action&quot; &quot;$resource&quot; --namespace=&quot;$namespace&quot;
    done
  done
done
</code></pre>
<p>Note: There could be variations of how you do this in <code>bash</code>.</p>
<p>I'll explain a bit:</p>
<ul>
<li>Firstly, we're fetching all the namespaces, printing only the 1st column, and <code>-n +2</code> basically means “start passing through on the second line of output”.</li>
<li>Next, we're fetching most (if not all) resource types available in your cluster. Picked up from <a href="https://stackoverflow.com/a/53016918/1722326">here</a>.</li>
<li>Iterating through a few common actions supported in K8s. Found most (if not all) on <a href="https://kubernetes.io/docs/reference/using-api/api-concepts/" rel="nofollow noreferrer">this</a> page.</li>
<li>And then just run <code>kubectl auth can-i</code> cmd on each resource, action, and namespace we got in the earlier commands.</li>
</ul>
<p>While it works, it takes a lot of time as we have a lot of namespaces and you'd have to go through a lot of output to find something or you would end up redirecting the output to a file and searching for fields.</p>
<p>Realistically, you would wanna run it only on a few namespaces at a time to check on a few actions on a few resources.</p>
<p>Something like this:</p>
<pre><code>#!/bin/bash
for namespace in default calico-system; do
  echo &quot;Current namespace: $namespace&quot;
  for resource in pods deployments.apps; do
    for action in get create; do
      echo &quot;- $action $resource&quot;
      kubectl auth can-i &quot;$action&quot; &quot;$resource&quot; --namespace=&quot;$namespace&quot;
    done
  done
done
</code></pre>
<p>It is a lot faster and would help you easily find what you're looking for.</p>
<p>Sample output:</p>
<pre><code>Current namespace: default
- get pods
yes
- create pods
no
- get deployments.apps
yes
- create deployments.apps
no
Current namespace: calico-system
- get pods
yes
- create pods
no
- get deployments.apps
yes
- create deployments.apps
no 
</code></pre>
<p>Hope it helps!</p>
