<p>The following says &quot;I can&quot; use <code>get</code> SubjectAccessReview, but then it returns a MethodNotAllowed error.  Why?</p>
<pre><code>❯ kubectl auth can-i get SubjectAccessReview
Warning: resource 'subjectaccessreviews' is not namespace scoped in group 'authorization.k8s.io'

yes
❯ kubectl get SubjectAccessReview
Error from server (MethodNotAllowed): the server does not allow this method on the requested resource
</code></pre>
<pre><code>❯ kubectl version --short
Flag --short has been deprecated, and will be removed in the future. The --short output will become the default.
Client Version: v1.25.2
Kustomize Version: v4.5.7
Server Version: v1.25.3+k3s1
</code></pre>
<p>If I cannot <code>get</code>, then can-i should NOT return <code>yes</code>.  Right?</p>

jersey bean
<p><code>kubectl auth can-i</code> is not wrong.</p>
<p>The <code>can-i</code> command is checking cluster RBAC (does there exist a role and rolebinding that grant you access to that operation). It doesn't know or care about &quot;supported methods&quot;. Somewhere there is a role that grants you the <code>get</code> verb on those resources...possibly implicitly e.g. via <code>resources: ['*']</code>.</p>
<p>For example, I'm accessing a local cluster with <code>cluster-admin</code> privileges, which means my access is controlled by this role:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-admin
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
- nonResourceURLs:
  - '*'
  verbs:
  - '*'
</code></pre>
<p>The answer to <code>kubectl auth can-i get &lt;anything&gt;</code> is going to be <code>yes</code>, regardless of whether or not that operation makes sense for a given resource.</p>
