<p>We have a shared tenant cluster, and we want our developers to be able to run <code>kubectl top pods --namespace dev-namespace</code></p>
<p>But it seems to me that for top to be usable, you need to be able to run <code>kubectl get nodes</code>. But nodes are not namespaced.</p>
<p>Is there a solution?</p>
<p>We the namespace admin setup like this:</p>
<pre><code>roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: username@domain
</code></pre>
<p>And as a cluster admin I can run the top command, so metrics-server seems to be working fine.</p>

Paku
<p>Kubernetes has API group <code>metrics.k8s.io</code>, that you can use to give read permission for <code>kubectl top pods -n &lt;namespace&gt;</code>. If you grant <code>get</code> and <code>list</code> permissions for pods, you can run the command.</p>
<p>I tested the configuration below in a GKE cluster running Kubernetes 1.21 with <code>kubectl top pod --as=system:serviceaccount:monitoring:test-account -n monitoring</code>. With these permissions, I can only run <code>kubectl top pod</code> in the <code>monitoring</code> namespace, other commands will fail.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-account
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: monitoring
rules:
- apiGroups: [&quot;metrics.k8s.io&quot;]
  resources: [&quot;pods&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: monitoring
subjects:
- kind: ServiceAccount
  name: test-account
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io
</code></pre>
