Answers: <p>Thanks to arghya-sadhu's comments on stackoverflow, I've got it working:</p>
  
  <pre><code>apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: get-pod-and-node
    labels:
      rbac.authorization.k8s.io/aggregate-to-view: "true"
  rules:
  - apiGroups: ["metrics.k8s.io"]
    resources: ["pods", "nodes"]
    verbs: ["get", "watch", "list"]
  </code></pre>
  
  <p>(I'm aggregating to the standard 'view' role)</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-02-05T08:36:06.070Z
Answers: 2020-02-05T08:36:06.070Z
Answers: Ludo
Body: <p>Hoping for some pointers, I have a question: what role/permissions do I need to bind to a user that has ClusterRole=view in order to let that user use <code>top node</code> and <code>top pod</code> commands in kubectl? </p>
  
  <p>My team are using kubectl version 1.15.x (client) on a 1.15.7 cluster (AKS), although I'm not sure if that's relevant information. I tried to find this in the k8s documentation, but could not find the permission-reference description, only some examples and guidelines. If you know where to get the full k8s reference, I'm equally glad and will post the solution.</p>
  
  <p>Note, I also posted this on StackOverflow, but they pointed me here, which indeed looks much more suited.</p>
  
  <p>Thanks in advance!</p>
  
  <p>Regards, Ludo</p>
  
Comments: CC BY-SA 4.0
Comments: 2020-02-04T03:22:13.267Z
Comments: Are you using RBAC to define what your users are allowed to do? I use `kubectl top node` and `kubectl  top pod --all-namespaces` with no special permissions all the time across multiple AKS Clusters. (Our deployments are not using RBAC yet.)
Comments: Steven K7FAQ
Comments: CC BY-SA 4.0
Comments: 2020-02-04T10:40:26.900Z
Comments: Yes, we have rbac enabled, coupled to Azure Active Directory. btw, I found the way to do it, will post below.
Comments: Ludo
Tags: <kubernetes><permissions><role-based-access-control>
Title: kubernetes: how to set "top node" and "top pod" permissions?
UserDisplayName: Ludo
ThreadText: # kubernetes: how to set "top node" and "top pod" permissions?
  
  (Asked by: username_0 on 2020-02-03)
  
  Hoping for some pointers, I have a question: what role/permissions do I need to bind to a user that has ClusterRole=view in order to let that user use `top node` and `top pod` commands in kubectl?
  
  My team are using kubectl version 1.15.x (client) on a 1.15.7 cluster (AKS), although I'm not sure if that's relevant information. I tried to find this in the k8s documentation, but could not find the permission-reference description, only some examples and guidelines. If you know where to get the full k8s reference, I'm equally glad and will post the solution.
  
  Note, I also posted this on StackOverflow, but they pointed me here, which indeed looks much more suited.
  
  Thanks in advance!
  
  Regards, username_0
  
  **Tags:** kubernetes, permissions, role-based-access-control
  
  > **Comments:**
  > **username_1**: Are you using RBAC to define what your users are allowed to do? I use `kubectl top node` and `kubectl  top pod --all-namespaces` with no special permissions all the time across multiple AKS Clusters. (Our deployments are not using RBAC yet.)  
  > **username_0**: Yes, we have rbac enabled, coupled to Azure Active Directory. btw, I found the way to do it, will post below.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2020-02-05. Score: 3
  
  Thanks to arghya-sadhu's comments on stackoverflow, I've got it working:
  
  ```
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: get-pod-and-node
    labels:
      rbac.authorization.k8s.io/aggregate-to-view: "true"
  rules:
  - apiGroups: ["metrics.k8s.io"]
    resources: ["pods", "nodes"]
    verbs: ["get", "watch", "list"]
  
  ```
  
  (I'm aggregating to the standard 'view' role)
  
  
  ---
  
  