How do I use the can-i command? It does not seem to be completely documented here:

https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-can-i-em- (no mention of --as).

All the below results seem nonsensical:

kubectl auth can-i list pod --as=default3ueoaueo --as-group=system:authenticated --as-group=system:masters
yes

The above will return yes for anything after --as= - any user specified here.

On the other hand, the default user account (or any other I've tried) seems to have no permission at all:

kubectl auth can-i list pod --as=default                                                                  
no

and

kubectl auth can-i list pod --as=default:serviceaccount:default
no

And according to https://github.com/kubernetes/kubernetes/issues/73123 we just add --as-group=system:authenticated but that doesn't work either:

kubectl auth can-i list pod --as=serviceaccount:default  --as-group=system:authenticated 
no