kubectl RBAC commands
44 commands in 4 groups: Manage Roles & Bindings, ServiceAccounts, Check Permissions, List & Inspect. Click or tap any command to copy it. Official documentation: kubernetes.io.
Open in the interactive cheat sheet search, stars and every other section
Manage Roles & Bindings
Create and delete namespaced and cluster-wide roles, then bind them to users, groups, or service accounts.
kubectl create clusterrole <name> --verb=get,list,watch --resource=pods
Create a ClusterRole
kubectl create clusterrolebinding <name> --clusterrole=<role> --serviceaccount=<ns>:<sa>
Bind ClusterRole to ServiceAccount
kubectl create clusterrolebinding <name> --clusterrole=<role> --user=<user>
Bind ClusterRole to a user
kubectl create role <name> --verb=get,list,watch --resource=pods
Create a namespaced Role
kubectl create rolebinding <name> --role=<role> --serviceaccount=<ns>:<sa>
Bind Role to a ServiceAccount
kubectl create rolebinding <name> --role=<role> --user=<user>
Bind Role to a user
kubectl create rolebinding <name> --clusterrole=<role> --user=<user> -n <namespace>
Bind ClusterRole in namespace scope
kubectl delete clusterrole <name>
Delete a ClusterRole
kubectl delete clusterrolebinding <name>
Delete a ClusterRoleBinding
kubectl delete role <name> -n <namespace>
Delete a namespaced Role
kubectl delete rolebinding <name> -n <namespace>
Delete a RoleBinding
ServiceAccounts
Manage pod identities used for authenticating to the Kubernetes API.
kubectl create serviceaccount <name>
Create a ServiceAccount
kubectl create token <name>
Create a short-lived API token for a ServiceAccount
kubectl create serviceaccount <name> -n <namespace>
Create a ServiceAccount in a namespace
kubectl create token <name> --duration=24h
Create a token with custom expiry
kubectl create token <name> --bound-object-kind=Pod --bound-object-name=<pod>
Bound token tied to a specific pod lifetime
kubectl delete serviceaccount <name>
Delete a ServiceAccount
kubectl describe sa <name>
ServiceAccount details, image pull secrets, tokens
kubectl edit serviceaccount <name>
Edit ServiceAccount in $EDITOR
kubectl get serviceaccounts
List ServiceAccounts in namespace
kubectl get sa -A
All ServiceAccounts across namespaces
kubectl get sa -n <namespace>
ServiceAccounts in a namespace
kubectl get sa <name> -o yaml
Get ServiceAccount manifest as YAML
Check Permissions
Identify yourself and verify what actions a user, group, or service account is allowed to perform.
kubectl auth can-i <verb> <resource>
Check your own permission
kubectl auth whoami
Show current user identity (k8s 1.28+)
kubectl auth can-i --list
List all your current permissions
kubectl auth can-i <verb> <resource> --as=<user>
Check permission as another user
kubectl auth can-i <verb> <resource> -n <namespace>
Check permission in a specific namespace
kubectl auth can-i create pods --as=system:serviceaccount:<ns>:<sa>
Check ServiceAccount permission
kubectl auth can-i --list --as=<user>
List all permissions as another user
kubectl auth can-i --list -n <namespace>
List your permissions in a namespace
kubectl auth can-i get pods --subresource=log --as=<user>
Check subresource permission
List & Inspect
Inspect existing roles, bindings, and the permissions they grant.
kubectl describe clusterrole <name>
ClusterRole details and rules
kubectl describe clusterrolebinding <name>
ClusterRoleBinding subjects and role ref
kubectl describe role <name> -n <namespace>
Role details and allowed verbs/resources
kubectl describe rolebinding <name> -n <namespace>
RoleBinding subjects and role ref
kubectl get clusterrolebindings
List ClusterRoleBindings
kubectl get clusterroles
List ClusterRoles (cluster-wide)
kubectl get clusterrole <name> -o yaml
Get ClusterRole manifest as YAML
kubectl get clusterrolebindings -o wide
ClusterRoleBindings with subjects
kubectl get role <name> -o yaml
Get Role manifest as YAML
kubectl get rolebindings -A
All RoleBindings across namespaces
kubectl get rolebindings -n <namespace>
RoleBindings in a namespace
kubectl get roles -n <namespace>
Roles in a namespace