Kubernetes check serviceaccount permissions : <p>When deploying a service via a Helm Chart, the installation failed because the <code>tiller</code> serviceaccount was not allowed to create a <code>ServiceMonitor</code> resource.</p>

<p>Note:</p>

<ul>
<li><code>ServiceMonitor</code> is a CRD defined by the Prometheus Operator to automagically get metrics of running containers in Pods.</li>
<li>Helm Tiller is installed in a single namespace and the RBAC has been setup using Role and RoleBinding.</li>
</ul>

<p>I wanted to verify the permissions of the <code>tiller</code> serviceaccount.<br>
<code>kubectl</code> has the <code>auth can-i</code> command, queries like these (see below) always return <code>no</code>.</p>

<ul>
<li><code>kubectl auth can-i list deployment --as=tiller</code></li>
<li><code>kubectl auth can-i list deployment --as=staging:tiller</code></li>
</ul>

<p>What is the proper way to check permissions for a serviceaccount?<br>
How to enable the <code>tiller</code> account to create a ServiceMonitor resource?</p>
