Find clusterroles with permissions to create/edit namespaces

find-clusterroles.sh

#!/bin/bash

set -euo pipefail

kubectl --as=cluster-admin get clusterrole -ojson | jq '[ .items[]
        | select(
            .rules[]?
                | select(
                        (.apiGroups[]? == "" or .apiGroups[]? == "*")
                    and
                        (.resources[]? == "namespaces" or .resources[]? == "*")
                    and
                        (.verbs[]? == "create" or .verbs[]? == "update" or .verbs[]? == "patch" or .verbs[]? == "*")
                    )
            > 0
        )
        | .metadata.name
    ] | unique'