<p>Thanks to arghya-sadhu's comments on stackoverflow, I've got it working:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: get-pod-and-node
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods", "nodes"]
  verbs: ["get", "watch", "list"]
</code></pre>

<p>(I'm aggregating to the standard 'view' role)</p>

CC BY-SA 4.0
2020-02-05T08:36:06.070Z
2020-02-05T08:36:06.070Z
Ludo
<p>Hoping for some pointers, I have a question: what role/permissions do I need to bind to a user that has ClusterRole=view in order to let that user use <code>top node</code> and <code>top pod</code> commands in kubectl? </p>

<p>My team are using kubectl version 1.15.x (client) on a 1.15.7 cluster (AKS), although I'm not sure if that's relevant information. I tried to find this in the k8s documentation, but could not find the permission-reference description, only some examples and guidelines. If you know where to get the full k8s reference, I'm equally glad and will post the solution.</p>

<p>Note, I also posted this on StackOverflow, but they pointed me here, which indeed looks much more suited.</p>

<p>Thanks in advance!</p>

<p>Regards, Ludo</p>

CC BY-SA 4.0
2020-02-04T03:22:13.267Z
Are you using RBAC to define what your users are allowed to do? I use `kubectl top node` and `kubectl  top pod --all-namespaces` with no special permissions all the time across multiple AKS Clusters. (Our deployments are not using RBAC yet.)
Steven K7FAQ
CC BY-SA 4.0
2020-02-04T10:40:26.900Z
Yes, we have rbac enabled, coupled to Azure Active Directory. btw, I found the way to do it, will post below.
Ludo
<kubernetes><permissions><role-based-access-control>
kubernetes: how to set "top node" and "top pod" permissions?
Ludo
# kubernetes: how to set "top node" and "top pod" permissions?

(Asked by: username_0 on 2020-02-03)

Hoping for some pointers, I have a question: what role/permissions do I need to bind to a user that has ClusterRole=view in order to let that user use `top node` and `top pod` commands in kubectl?

My team are using kubectl version 1.15.x (client) on a 1.15.7 cluster (AKS), although I'm not sure if that's relevant information. I tried to find this in the k8s documentation, but could not find the permission-reference description, only some examples and guidelines. If you know where to get the full k8s reference, I'm equally glad and will post the solution.

Note, I also posted this on StackOverflow, but they pointed me here, which indeed looks much more suited.

Thanks in advance!

Regards, username_0

**Tags:** kubernetes, permissions, role-based-access-control

> **Comments:**
> **username_1**: Are you using RBAC to define what your users are allowed to do? I use `kubectl top node` and `kubectl  top pod --all-namespaces` with no special permissions all the time across multiple AKS Clusters. (Our deployments are not using RBAC yet.)  
> **username_0**: Yes, we have rbac enabled, coupled to Azure Active Directory. btw, I found the way to do it, will post below.  

---

## 1 answers

### Answer by username_0 on 2020-02-05. Score: 3

Thanks to arghya-sadhu's comments on stackoverflow, I've got it working:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: get-pod-and-node
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods", "nodes"]
  verbs: ["get", "watch", "list"]

(I'm aggregating to the standard 'view' role)


---

