<p>In Kubernetes you can use the <code>auth can-i</code> command to check if you have permissions to some resource.<br>
For example, I can use this command like that on the worker:  </p>

<pre><code>kubectl --kubeconfig /etc/kubernetes/kubelet.conf auth can-i get pods -v 9  
</code></pre>

<p>It will check if you have permissions to view pods, and when you add the <code>-v</code> flag it show the verbose output:  </p>

<pre><code>...
curl -k -v -XPOST  -H "Accept: application/json, */*" -H "Content-Type: application/json" -H "User-Agent: kubectl/v1.18.0 (linux/amd64) kubernetes/9e99141" 'https://&lt;master_ip&gt;:6443/apis/authorization.k8s.io/v1/selfsubjectaccessreviews'  
</code></pre>

<p>I wanted to use this REST API with <code>curl</code> and it doesn't work:  </p>

<pre><code>curl --cacert /etc/kubernetes/pki/ca.crt \
     --cert /var/lib/kubelet/pki/kubelet-client-current.pem \
     --key /var/lib/kubelet/pki/kubelet-client-current.pem \
     -d @- \
     -H "Content-Type: application/json" \
     -H "Accept: application/json, */*" \
     -XPOST https://&lt;master_ip&gt;:6443/apis/authorization.k8s.io/v1/selfsubjectrulesreviews &lt;&lt;'EOF'
{
   "kind":"SelfSubjectAccessReview",
   "apiVersion":"authorization.k8s.io/v1",
   "metadata":{
      "creationTimestamp":null
   },
   "spec":{
      "namespace":"default"
   },
   "status":{
      "allowed":true
   }
}
EOF
</code></pre>

<p>If failed with the error:  </p>

<pre><code>  "status": "Failure",
  "message": "SelfSubjectAccessReview in version \"v1\" cannot be handled as a SelfSubjectRulesReview: converting (v1.SelfSubjectAccessReview).v1.SelfSubjectAccessReviewSpec to (authorization.SelfSubjectRulesReview).authorization.SelfSubjectRulesReviewSpec: Namespace not present in src",
  "reason": "BadRequest",
  "code": 400
</code></pre>

<p>How can I use SelfSubjectRulesReview API with curl to view resource permissions?</p>

<hr>

<p>Thanks to @HelloWorld I found the problem, the issue was with the different between selfsubjectaccessreviews vs selfsubjectrulesreviews. I will put 2 working <code>curl</code> examples.  </p>

<p>1) <strong>selfsubjectaccessreviews</strong> example to see if the account has permissions for</p>

<pre><code>curl --cacert /etc/kubernetes/pki/ca.crt \
     --cert /var/lib/kubelet/pki/kubelet-client-current.pem \
     --key /var/lib/kubelet/pki/kubelet-client-current.pem \
     -d @- \
     -H "Content-Type: application/json" \
     -H 'Accept: application/json, */*' \
     -XPOST https://&lt;master_ip&gt;:6443/apis/authorization.k8s.io/v1/selfsubjectaccessreviews &lt;&lt;'EOF'
{
   "kind":"SelfSubjectAccessReview",
   "apiVersion":"authorization.k8s.io/v1",
   "metadata":{
      "creationTimestamp":null
   },
   "spec":{
      "resourceAttributes":{
         "namespace":"default",
         "verb":"get",
         "resource":"pods"
      }
   },
   "status":{
   }
}
EOF
</code></pre>

<p>2) <strong>selfsubjectrulesreviews</strong> example to see all the permissions of the account on the default namespace:  </p>

<pre><code>curl --cacert /etc/kubernetes/pki/ca.crt \
     --cert /var/lib/kubelet/pki/kubelet-client-current.pem \
     --key /var/lib/kubelet/pki/kubelet-client-current.pem \
     -d @- \
     -H "Content-Type: application/json" \
     -H 'Accept: application/json, */*' \
     -XPOST https://&lt;master_ip&gt;:6443/apis/authorization.k8s.io/v1/selfsubjectrulesreviews &lt;&lt;'EOF'
{
   "kind":"SelfSubjectRulesReview",
   "apiVersion":"authorization.k8s.io/v1",
   "metadata":{
      "creationTimestamp":null
   },
   "spec":{
     "namespace":"default"
   },
   "status":{
   }
}
EOF
</code></pre>

E235
<p>Notice that kubectl verbose shows this url in output:</p>

<pre><code>https://&lt;master_ip&gt;:6443/apis/authorization.k8s.io/v1/selfsubjectaccessreviews
</code></pre>

<p>and you are curling:</p>

<pre><code>https://&lt;master_ip&gt;:6443/apis/authorization.k8s.io/v1/selfsubjectrulesreviews
</code></pre>

<p>Can you notice the difference? selfsubject<strong>accessreviews</strong> vs selfsubject<strong>rulesreviews</strong>.</p>

<p>Change the url to correct one and it will work.</p>
