<p>The following error is returned:</p>
<pre><code>error: you must specify two or three arguments: verb, resource, and optional resourceName
</code></pre>
<p>when I executed:</p>
<pre><code>kubectl auth --as=system:serviceaccount:mytest1:default can-i use psp 00-mytest1
</code></pre>
<p>I already have following manifests for <code>podsecuritypolicy</code> (psp.yaml), <code>role</code> (role.yaml) and <code>rolebinding</code> (rb.yaml) and deployed in the namespace <code>mytest1</code>.</p>
<p>psp.yaml</p>
<pre><code>    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: 00-mytest1
      labels: {}
      annotations:
        seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
        seccomp.security.alpha.kubernetes.io/defaultProfileName:  'runtime/default'
    spec:
      privileged: false
      allowPrivilegeEscalation: false
      requiredDropCapabilities:
      - ALL
      runAsUser:
        rule: 'MustRunAsNonRoot'
      runAsGroup:
        rule: 'MustRunAs'
        ranges:
        - min: 1000 
          max: 1000
        - min: 1
          max: 65535
      supplementalGroups:
        rule: 'MayRunAs'
        ranges:
        - min: 1
          max: 65535
      fsGroup:
        rule: 'MayRunAs'
        ranges:
        - min: 1
          max: 65535
      seLinux:
        rule: 'RunAsAny'
      hostNetwork: false
      hostIPC: false
      hostPID: false
      hostPorts: []
      volumes:
      - configMap
      - downwardAPI
      - emptyDir
      - projected
      - secret
</code></pre>
<p>role.yaml</p>
<pre><code>    apiVersion: rbac.authorization.k8s.io/v1
    kind: Role
    metadata:
      name: mytest1
      namespace: &quot;mytest1&quot;
      labels: {}
    rules:
    - apiGroups: ['policy']
      resources: ['podsecuritypolicies']
      verbs:     ['use']
      resourceNames: ['00-mytest1']
</code></pre>
<p>and rb.yaml</p>
<pre><code>    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      name: mytest1
      namespace: &quot;mytest1&quot;
      labels: {}
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: mytest1
    subjects:
    - kind: ServiceAccount
      name: default
      namespace: &quot;mytest1&quot;
</code></pre>
<p>I expect the return <code>yes</code> or <code>no</code> for <code>kubectl auth can-i ...</code> check and not the above mentioned error. Is the use-case for auth check correct? I appreciate he correction.</p>

jack_t
<p>You are missing the flag <code>--subresource</code>. If I execute</p>
<pre><code>kubectl auth --as=system:serviceaccount:mytest1:default can-i use psp --subresource=00-mytest1
</code></pre>
<p>I have clear answer. In my situation:</p>
<pre><code>no
</code></pre>
<p>You can also get an warning like this:</p>
<pre><code>Warning: resource 'podsecuritypolicies' is not namespace scoped in group 'policy'
</code></pre>
<p>But it is related directly to your config.</p>
<p>For more information about kubectl auth can-i command check</p>
<pre><code>kubectl auth can-i --help
</code></pre>
<p>in your terminal.
You can also read <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/" rel="nofollow noreferrer">this doc</a>.</p>
