Metrics-server: aggregated-metrics-reader

[dudicoco]

What is the use for the aggregated-metrics-reader clusterrole?
It is not bound to a service.

[serathius]

Not my region of expertise, please read about aggregated api servers:

• https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/aggregated-api-servers.md
• https://kubernetes.io/docs/tasks/access-kubernetes-api/setup-extension-api-server/

[dudicoco]

@serathius I've went through the docs and didn't find a reference for such role.

@giner and @astefanutti since you are the main contributors for the file can you please explain the role's purpose?

[Chili-Man]

@giner @astefanutti @serathius I've also gone through the documentation, but it doesn't help clarify the point of the system:aggregated-metrics-reader ClusteRole, especially since it's not bound to anything (at least from what's provided in this repos manifests); it would be great if you could provide an explanation; In particular, I'm wondering if that cluster role is needed at all?

[astefanutti]

Aggregated ClusterRoles are documented in: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles. The purpose of the system:aggregated-metrics-reader ClusterRole, is to aggregate the rules, that grant permission to get the pod and node metrics, to the view, edit and admin roles.

[Chili-Man]

that makes much more sense now; thanks for the clarification @astefanutti