Bug 1723662

Summary:	User with cluster -reader role can't access metrics using `oc adm top <nodes>`
Product:	OpenShift Container Platform	Reporter:	Abhishek <aabhishe>
Component:	Monitoring	Assignee:	Sergiusz Urbaniak <surbania>
Status:	CLOSED ERRATA	QA Contact:	Junqi Zhao <juzhao>
Severity:	high	Docs Contact:
Priority:	high
Version:	3.11.0	CC:	alegrand, anpicker, aos-bugs, erooth, jokerman, mfojtik, mloibl, mmccomas, pkrupa, sttts, surbania
Target Milestone:	---
Target Release:	4.4.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Currently users having a binding against the cluster-reader role do not have the permission to view node or pod metrics, i.e. using `oc top node`. This is now fixed.	Story Points:	---
Clone Of:
Clones:	1793628 (view as bug list)		Environment:
Last Closed:	2020-05-13 21:51:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1793628

Description Abhishek 2019-06-25 06:05:44 UTC

Document URL: https://docs.openshift.com/container-platform/3.11/admin_guide/manage_nodes.html

Section: Note 1

# oc adm top nodes
Error from server (Forbidden): nodes.metrics.k8s.io is forbidden: User "tt" cannot list nodes.metrics.k8s.io at the cluster scope: no RBAC policy matched

# oc get clusterrolebinding | grep tt
cluster-reader-3                                                           /cluster-reader                                                         tt                                                                                                                                               

# oc describe clusterrole.rbac cluster-reader | grep metrics
  nodes/metrics                                                 []                 []              [get]


cluster-reader does not have `apis/metrics.k8s.io/v1beta1` API access

Comment 10 errata-xmlrpc 2020-05-13 21:51:49 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0581