title: Kubernetes check serviceaccount permissions
body: <p>When deploying a service via a Helm Chart, the installation failed because the <code>tiller</code> serviceaccount was not allowed to create a <code>ServiceMonitor</code> resource.</p>
  
  <p>Note:</p>
  
  <ul>
  <li><code>ServiceMonitor</code> is a CRD defined by the Prometheus Operator to automagically get metrics of running containers in Pods.</li>
  <li>Helm Tiller is installed in a single namespace and the RBAC has been setup using Role and RoleBinding.</li>
  </ul>
  
  <p>I wanted to verify the permissions of the <code>tiller</code> serviceaccount.<br>
  <code>kubectl</code> has the <code>auth can-i</code> command, queries like these (see below) always return <code>no</code>.</p>
  
  <ul>
  <li><code>kubectl auth can-i list deployment --as=tiller</code></li>
  <li><code>kubectl auth can-i list deployment --as=staging:tiller</code></li>
  </ul>
  
  <p>What is the proper way to check permissions for a serviceaccount?<br>
  How to enable the <code>tiller</code> account to create a ServiceMonitor resource?</p>