<p>Hoping for some pointers, I have a question: what role/permissions do I need to add to a user that has Clusterrole:view in order to let that user use 'top node' and 'top pod' command in kubectl? We're using kubectl version 1.15.x (client) on a 1.15.7 cluster (AKS), although I'm not sure if that's relevant information. 
I tried to find this in the k8s documentation, but could not find the permission-reference descrption, only some examples and guidelines.</p>

<p>Thanks in advance!</p>

<p>Regards, Ludo</p>

<p>There is no specific permission for <code>top node</code> and <code>top pod</code>. The permission is on whether you can do <code>get nodes</code> and <code>get pods</code>. If permission is there to do <code>get nodes</code> and <code>get pods</code> then you should be able to <code>top nodes</code> and <code>top pods</code> as well. Permission to perform <code>get nodes</code> or <code>get pods</code> is defined via RBAC in kubernetes.</p>

<p>The metric server just exposes metrics of different resources such as pods, nodes by collecting and aggregating it from different sources such as kubelet. That's the reason there is no permission for the metrics itself rather the permission is on the resources of which you want to see the metrics.</p>

<p>The API that is being invoked when you do <code>kubectl top pods</code> is this</p>

<pre><code>GET https://API-SERVER-IP:6443/apis/metrics.k8s.io/v1beta1/namespaces/default/pods
</code></pre>

<p>So you can only see metrics for pods in the default namespace when you are targeted to default namespace. Now whether you can get pods in default namespace is governed by RBAC.</p>
