<p>Trying to figure out how to set up RBAC to read from the custom metrics API. Here's the context...</p>
<p>I've got a service that is exposing custom metrics to Kubernetes. These are available through the following endpoint</p>
<pre><code>/apis/custom.metrics.k8s.io/v1beta1/namespaces/{ns}/services/{svc}/{metric}
</code></pre>
<p>The endpoint works and it's not the issue.</p>
<p>I have another service which role is to retrieve those metrics and act upon them. This is working properly on a local machine where permissions aren't a problem, but when deployed it's not and that's the issue here.</p>
<p>To remove suspicion... the deployment does have a <code>ServiceAccount</code>, with a <code>ClusterRole</code> and a <code>ClusterRoleBinding</code>.</p>
<p>So... here's what my <code>ClusterRole</code> looks so far (I'm sure there are already unnecessary things in there)</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: the-thing
rules:
  - apiGroups:
      - apps
    resources:
      - deployments
    verbs:
      - get
      - list
      - patch
      - watch
  - apiGroups:
      - &quot;&quot;
    resources:
      - endpoints
      - namespaces
      - nodes
      - pods
      - services
    verbs: 
      - get
      - list
  - apiGroups:
      - custom.metrics.k8s.io
    resources:
      - &quot;*&quot;
    verbs:
      - &quot;*&quot;
</code></pre>
<p>I thought that it would come down to <code>custom.metrics.k8s.io</code> group, but apparently not...</p>
<p>If someone has any suggestions, help is much appreciated!</p>

Goncalo Oliveira
<p>Ok... answering my own question here...</p>
<p>I was testing the service account to see if I missed something, but it seems that it had indeed permissions for what I wanted. I checked that with <code>can-i</code> tool.</p>
<pre class="lang-bash prettyprint-override"><code>$ kubectl auth can-i get custom_metric_name --as=system:serviceaccount:my-namespace:my-service-account
yes
</code></pre>
<p>So this pointed out to something on the request itself, since I already confirmed the container was using the correct service account.</p>
<p>More context: I'm using the <a href="https://github.com/kubernetes-client/csharp" rel="nofollow noreferrer">dotnet client</a> for this. And to retrieve the metrics, one must use the generic <code>HttpClient</code> from the <code>Kubernetes</code> instance.</p>
<pre class="lang-cs prettyprint-override"><code>Kubernetes client = ...;

HttpClient httpClient = client.HttpClient;
</code></pre>
<p>Locally this works, because no credentials are required, but inside the cluster, the <a href="https://github.com/kubernetes-client/csharp/blob/2959174eb6e8ba85bdf4a17ea65e4c36ec84cd87/src/KubernetesClient/Kubernetes.cs#L149" rel="nofollow noreferrer">credentials have to be set</a> in the <code>HttpRequestMessage</code> before being processed and this part was missing.</p>
<p>Because I am using the <code>HttpClient</code> directly, I was not setting the credentials before doing the request. In fact, I as calling <code>GetAsync</code> directly instead of constructing the request message. After setting the credentials, the request works.</p>
<pre class="lang-cs prettyprint-override"><code>var httpRequest = new HttpRequestMessage( HttpMethod.Get, url );

if ( client.Credentials != null )
{
    await client.Credentials.ProcessHttpRequestAsync( httpRequest, cancellationToken );
}
</code></pre>
<p>Hope this helps someone...</p>
