<p>I am trying to access the metrics server for a k8s cluster without the use of <code>kubectl proxy</code>. After finding the tutorial at <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#without-kubectl-proxy" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#without-kubectl-proxy</a>, I've run into an issue.</p>
<p>When making the request <code>curl -X GET $APISERVER/apis/metrics.k8s.io/v1beta1/nodes --header &quot;Authorization: Bearer $TOKEN&quot; --insecure | jq</code> I get the following permissions error:</p>
<pre><code>curl -X GET $APISERVER/apis/metrics.k8s.io/v1beta1/nodes --header &quot;Authorization: Bearer $TOKEN&quot; --insecure | jq                                                                                       11:58AM
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   386  100   386    0     0   2064      0 --:--:-- --:--:-- --:--:--  2064
{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {},
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;nodes.metrics.k8s.io is forbidden: User \&quot;system:serviceaccount:default:default\&quot; cannot list resource \&quot;nodes\&quot; in API group \&quot;metrics.k8s.io\&quot; at the cluster scope&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {
    &quot;group&quot;: &quot;metrics.k8s.io&quot;,
    &quot;kind&quot;: &quot;nodes&quot;
  },
  &quot;code&quot;: 403
}
</code></pre>
<p>I've tried making a custom ServiceAccount <code>testaccount</code> with the following ClusterRoleBinding:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: test-admin
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;, &quot;nodes&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: test-rbac
subjects:
- kind: ServiceAccount
  name: testaccount
  namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>I've tried it with both the included ClusterRole, as well as the <code>cluster-admin</code> cluster role. With the token generated after those changes I still get the same curl error.</p>

<p>I figured out it was the <code>apiGroups</code> that needed to be modified. The following ClusterRole and ClusterRoleBinding worked:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: test-admin
rules:
- apiGroups: [&quot;*&quot;] # This was the change
  resources: [&quot;pods&quot;, &quot;nodes&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: test-rbac
subjects:
- kind: ServiceAccount
  name: testaccount
  namespace: default
roleRef:
  kind: ClusterRole
  name: test-admin
  apiGroup: rbac.authorization.k8s.io

</code></pre>
