<p>I'd like to grant a service account the ability to access the metrics exposed by the <code>metrics-server</code> service (<code>https://metrics-server.kube-system/metrics</code>). If I create a serviceaccount...</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-reader
  namespace: prometheus
</code></pre>
<p>...and then grant it <code>cluster-admin</code> privileges...</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: metrics-reader-crb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: metrics-reader
  namespace: prometheus
</code></pre>
<p>...it works! I can use the account token to access the metrics server:</p>
<pre><code>curl -k --header &quot;Authorization: Bearer $token&quot; https://metrics-server.kube-system/metrics
</code></pre>
<p>But I don't want to require <code>cluster-admin</code> access just to read
metrics. I tried to use the <code>view</code> cluster role instead of
<code>cluster-admin</code>, but that fails.</p>
<p>Is there an <em>existing</em> role that would grant the appropriate access?
If not, what are the specific permissions necessary to grant read-only
access to the metrics-server <code>/metrics</code> endpoint?</p>

larsks
<p>Interesting question. I've found some info for you, however i'm not sure that 100% helpful. It needs more research and reproduce.</p>
<ol>
<li>check <a href="https://github.com/kubernetes-sigs/metrics-server/issues/40#issuecomment-402395198" rel="nofollow noreferrer">RBAC Deny when requesting metrics</a>. Smth like below?</li>
</ol>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-reader
  namespace: prometheus

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: view-metrics
rules:
- apiGroups:
    - metrics.k8s.io
  resources:
    - pods
    - nodes
  verbs:
    - get
    - list
    - watch

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: view-metrics
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view-metrics
subjects:
- kind: ServiceAccount
  name: metrics-reader
  namespace: prometheus
</code></pre>
<hr />
<ol start="2">
<li>It seems, there is a <a href="https://github.com/kubernetes-sigs/metrics-server/issues/411#issuecomment-707525489" rel="nofollow noreferrer"><code>aggregated-metrics-reader</code> clusterrole</a> (or there was)</li>
</ol>
<blockquote>
<p>Aggregated ClusterRoles are documented in:
<a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles</a>.
<strong>The purpose of the system:aggregated-metrics-reader ClusterRole, is to
aggregate the rules, that grant permission to get the pod and node
metrics, to the view, edit and admin roles.</strong></p>
</blockquote>
<p>however I wasnt able to find any reference to <code>aggregated-metrics-reader</code> clusterrole in current version of that doc.</p>
<p>You can find huge example of using this clusterrole  in <a href="https://github.com/kubernetes-sigs/metrics-server/issues/537" rel="nofollow noreferrer">Metrics server unable to scrape</a></p>
<p>IN addition check <a href="https://github.com/helm/charts/pull/10737" rel="nofollow noreferrer">This adds the aggregated-metrics-reader ClusterRole which was missing</a> github PR:</p>
<blockquote>
<p>What this PR does / why we need it: This adds the
aggregated-metrics-reader ClusterRole which was missing, and seems to
be required for k8s 1.8+ per the metrics-server documentation and
default deploy manfiests</p>
</blockquote>
<p>Unfortunately link in that PR direct to nowhere. I start thinking this obsolete info for 1.8 clusters.. Will update answer in case find anything more relevant</p>
