<p>I want to display the allowed permissions for users and service accounts in my Kubernetes cluster. To achive this, I use the <code>kubectl auth can-i --list --namespace=default --as=&lt;user&gt;</code> command.</p>

<p>However, for any user, except my current <code>docker-desktop</code> user, it displays the same set of permissions: </p>

<pre><code>$ kubectl auth can-i --list --namespace=default --as='foo'
Resources                                       Non-Resource URLs   Resource Names   Verbs
selfsubjectaccessreviews.authorization.k8s.io   []                  []               [create]
selfsubjectrulesreviews.authorization.k8s.io    []                  []               [create]
                                                [/api/*]            []               [get]
                                                [/api]              []               [get]
                                                [/apis/*]           []               [get]
                                                [/apis]             []               [get]
                                                [/healthz]          []               [get]
                                                [/healthz]          []               [get]
                                                [/openapi/*]        []               [get]
                                                [/openapi]          []               [get]
                                                [/version/]         []               [get]
                                                [/version/]         []               [get]
                                                [/version]          []               [get]
                                                [/version]          []               [get]


$ kubectl auth can-i --list --namespace=default --as='bar'
Resources                                       Non-Resource URLs   Resource Names   Verbs
selfsubjectaccessreviews.authorization.k8s.io   []                  []               [create]
selfsubjectrulesreviews.authorization.k8s.io    []                  []               [create]
                                                [/api/*]            []               [get]
                                                [/api]              []               [get]
                                                [/apis/*]           []               [get]
                                                [/apis]             []               [get]
                                                [/healthz]          []               [get]
                                                [/healthz]          []               [get]
                                                [/openapi/*]        []               [get]
                                                [/openapi]          []               [get]
                                                [/version/]         []               [get]
                                                [/version/]         []               [get]
                                                [/version]          []               [get]
                                                [/version]          []               [get]
</code></pre>

<p>This is true both for existing service accounts, specified as <code>system:serviceaccount:&lt;namespace&gt;:&lt;serviceaccount&gt;</code> as well as non-existing user accounts, like <code>foo</code> and <code>bar</code> (see above).</p>

<p>What can be the issue?</p>

Shuzheng
<p>This is a weird caveat of using this command.It does not error out but fallback to show same permission for nonexistent user/service accounts and existing service accounts/users which does not have any permission.</p>
