World map

 

BM

World K6: Guards

Ask first: kubectl auth can-i

You will learn: to ask the cluster what you, or a bot, may do, before anything breaks.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

Your CI job crashed at 2 a.m. Here is the error.

Error from server (Forbidden): secrets is forbidden: User "system:serviceaccount:default:ci-bot" cannot list resource "secrets" in API group "" in the namespace "default"

How could you have known before the run?

Watch

You are here: cluster kind-dev namespace default

kubectl auth can-i asks gate 2 a yes or no question. It changes nothing. --as lets you impersonate the bot: ask as if you were it.

Try it

Build the question: may the bot patch deployments?

Tap the pieces in the right order.

…

Predict

The bot’s RoleBinding lives in the default zone. May it patch deployments in kube-system?

Try it

Now check your guess. Ask the cluster, as the bot, about kube-system.

You are here: cluster kind-dev namespace default
Time: +0s (sped up)

Check

Read the wires. Will Kubernetes say yes or no?

Read the wires. Will Kubernetes say yes or no?

Who (plugs)

  • ci-bot (ServiceAccount · ci)
  • mei (user)

Roles (sockets)

  • Role deployer · shop
    • get, list, patch · deployments
  • ClusterRole pod-reader · whole cluster
    • get, list · pods, pods/log

Wires (bindings)

  • ci-botdeployerRoleBinding · in namespace shop
    Show ci-bot-deployer as YAML
    apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ci-bot-deployer
  namespace: shop
subjects:
  - kind: ServiceAccount
    name: ci-bot
    namespace: ci
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: deployer
  • meipod-readerClusterRoleBinding · everywhere (ClusterRoleBinding)
    Show mei-pod-reader as YAML
    apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: mei-pod-reader
subjects:
  - kind: User
    name: mei
    apiGroup: rbac.authorization.k8s.io
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: pod-reader

Can they? (kubectl auth can-i)

  1. kubectl auth can-i patch deployments -n shop --as=system:serviceaccount:ci:ci-bot
  2. kubectl auth can-i patch deployments -n default --as=system:serviceaccount:ci:ci-bot
  3. kubectl auth can-i list pods -n ci --as=mei
  4. kubectl auth can-i delete pods -n shop --as=mei
Ask your own question
kubectl auth can-i get pods -n shop --as=system:serviceaccount:ci:ci-botno

You did it!

You can now ask the cluster before you act, as anyone.

Go deeper (optional)

kubectl auth can-i --list --as=… lists everything that identity may do. can-i exits with 0 for yes and 1 for no, so scripts can use it. To use --as, you need the impersonate right yourself. Cluster admins have it.

Real mission

  1. kubectl auth can-i create deployments
  2. kubectl auth can-i list pods --as=system:serviceaccount:default:default
  3. kubectl auth can-i --list --as=system:serviceaccount:default:default

0 of 3 steps done · Your ticks are saved.