Hoping for some pointers, I have a question: what role/permissions do I need to bind to a user that has ClusterRole=view in order to let that user use top node and top pod commands in kubectl?

My team are using kubectl version 1.15.x (client) on a 1.15.7 cluster (AKS), although I'm not sure if that's relevant information. I tried to find this in the k8s documentation, but could not find the permission-reference description, only some examples and guidelines. If you know where to get the full k8s reference, I'm equally glad and will post the solution.

Note, I also posted this on StackOverflow, but they pointed me here, which indeed looks much more suited.

Thanks in advance!

Regards, Ludo

  • 1
    Are you using RBAC to define what your users are allowed to do? I use kubectl top node and kubectl top pod --all-namespaces with no special permissions all the time across multiple AKS Clusters. (Our deployments are not using RBAC yet.) Feb 4, 2020 at 3:22
  • Yes, we have rbac enabled, coupled to Azure Active Directory. btw, I found the way to do it, will post below.
    – Ludo
    Feb 4, 2020 at 10:40

1 Answer 1


Thanks to arghya-sadhu's comments on stackoverflow, I've got it working:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
  name: get-pod-and-node
    rbac.authorization.k8s.io/aggregate-to-view: "true"
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods", "nodes"]
  verbs: ["get", "watch", "list"]

(I'm aggregating to the standard 'view' role)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.