how to check whether RBAC is enabled, using kubectl


Kubernetes Problem Overview

I'm trying to install a helm package on a kubernetes cluster which allegedly has RBAC disabled. I'm getting a permission error mentioning, which is what I'd expect if RBAC was enabled.

Is there a way to check with kubectl whether RBAC really is disabled?

What I've tried:

  • kubectl describe nodes --all-namespaces | grep -i rbac : nothing comes up
  • kubectl describe rbac --all-namespaces | grep -i rbac : nothing comes up
  • kubectl config get-contexts | grep -i rbac : nothing comes up
  • k get clusterroles it says "No resources found", not an error message. So does that mean that RBAC is enabled?
  • kuebctl describe cluster isn't a thing

I'm aware that maybe this is the x-y problem because it's possible the helm package I'm installing is expecting RBAC to be enabled. But still, I'd like to know how to check whether or not it is enabled/disabled.

Kubernetes Solutions

Solution 1 - Kubernetes

You can check this by executing the command kubectl api-versions; if RBAC is enabled you should see the API version

In AKS, the best way is to check the cluster's resource details at If you can spot "enableRBAC": true, your cluster has RBAC enabled. Please note that existing non-RBAC enabled AKS clusters cannot currently be updated for RBAC use. (thanks @DennisAmeling for the clarification)

Solution 2 - Kubernetes

I wish there was a better way but what I use is:

$ kubectl cluster-info dump | grep authorization-mode

If you can execute it you should either see RBAC listed there or not, and if you don't have the permissions to do it, well, chances are that RBAC is enabled.

Solution 3 - Kubernetes

For Azure (AKS) this is a bit more tricky. While the kubectl api-versions command indeed returns, the kubectl get clusterroles command doesn't return the default system: prefixed roles.

The best way to check for AKS is to check the cluster's resource details, e.g. at If "enableRBAC": true, your cluster has RBAC enabled. Existing non-RBAC enabled AKS clusters cannot currently be updated for RBAC use. So if you want to enable RBAC on AKS, you'll have to create a new cluster.

Solution 4 - Kubernetes

For Azure (AKS) I think Azure CLI works well.

az resource show -g <resource group name> -n <cluster name> --resource-type Microsoft.ContainerService/ManagedClusters --query properties.enableRBAC

It is basically the same thing as using, but I find it quicker to use the Azure CLI

Solution 5 - Kubernetes

Option #1: If you have access to master node then login into and check below

ps -aef | grep -i apiserver
The options should have --authorization-mode=RBAC otherwise RBAC not enabled.

Option #2:

kubectl get clusterroles | grep -i rbac

Hope this helps

Rgds Sudhakar

Solution 6 - Kubernetes

ps -aef | grep -i apiserver is the easiest way to find out.


All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionfalsePocketsView Question on Stackoverflow
Solution 1 - KubernetesdanielepolencicView Answer on Stackoverflow
Solution 2 - KubernetesMichael HausenblasView Answer on Stackoverflow
Solution 3 - KubernetesDennis AmelingView Answer on Stackoverflow
Solution 4 - KubernetesOlav NybøView Answer on Stackoverflow
Solution 5 - KubernetesSudhakar MNSRView Answer on Stackoverflow
Solution 6 - Kubernetesdevops84ukView Answer on Stackoverflow