`sh view_rbac.sh system:serviceaccount:default:user-a`

view_rbac.sh

#!/bin/bash

USER=$1
NAMESPACE=$2

check_permissions() {
  resource=$1
  namespace=$2

  can_create=$(kubectl auth can-i create $resource --as=$USER --namespace=$namespace)
  can_get=$(kubectl auth can-i get $resource --as=$USER --namespace=$namespace)
  can_update=$(kubectl auth can-i update $resource --as=$USER --namespace=$namespace)
  can_delete=$(kubectl auth can-i delete $resource --as=$USER --namespace=$namespace)
  can_list=$(kubectl auth can-i list $resource --as=$USER --namespace=$namespace)

  printf "%s|%s|%s|%s|%s|%s\n" \
    "$resource" \
    "$(if [[ "$can_create" == "yes" ]]; then echo "✅"; else echo "❌"; fi)" \
    "$(if [[ "$can_get" == "yes" ]]; then echo "✅"; else echo "❌"; fi)" \
    "$(if [[ "$can_update" == "yes" ]]; then echo "✅"; else echo "❌"; fi)" \
    "$(if [[ "$can_delete" == "yes" ]]; then echo "✅"; else echo "❌"; fi)" \
    "$(if [[ "$can_list" == "yes" ]]; then echo "✅"; else echo "❌"; fi)"
}


echo "Resource | Create | Get | Update | Delete | List"
echo "-------- | ------ | --- | ------ | ------ | ----"

for resource in $(kubectl api-resources --verbs=list --namespaced -o name); do
  check_permissions $resource $NAMESPACE
done | column -s '|' -t | sed 's/|/ | /g'