Question

我为普罗米修斯定义了一个ClusterRole：

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: prometheus
  labels:
    k8s-app: prometheus
rules:
- apiGroups: [""] # "" indicates the core API group
  resources:
  - namespaces
  - endpoints
  - services
  - nodes
  - pods
  verbs:
  - get
  - watch
  - list
- nonResourceURLs:
  - /metrics
  - /api/*
  verbs:
  - get

Prometheus能够访问API服务器/ metrics路由：

https://10.0.1.104:443/metrics
https://10.0.2.112:443/metrics

但是我在

上收到“服务器返回HTTP状态403禁止访问”

https://kubernetes.default.svc:443/api/v1/nodes/ip-10-0-0-219.eu-west-1.compute.internal/proxy/metrics

和

https://kubernetes.default.svc:443/api/v1/nodes/ip-10-0-0-219.eu-west-1.compute.internal/proxy/metrics/cadvisor

我以为我已将其覆盖

- nonResourceURLs:
  - /api/*

我想念什么？

Answer 1

我自己尝试过此操作，是的nodes/proxy丢失了。（添加后对我有用）

rules:
- apiGroups: [""]
  resources:
  - namespaces
  - endpoints
  - services
  - nodes
  - nodes/proxy <===
  - pods

# From my K8s master
$ curl -k -H 'Authorization: Bearer <redacted>' https://localhost:6443/api/v1/nodes/ip-x-x-x-x.us-west-2.compute.internal/proxy/stats/summary
{
  "node": {
   "nodeName": "ip-x-x-x-x.us-west-2.compute.internal",
   "systemContainers": [
    {
     "name": "kubelet",
     "startTime": "2018-10-19T21:02:19Z",
     "cpu": {
      "time": "2018-11-09T23:51:15Z",
      "usageNanoCores": 30779949,
      "usageCoreNanoSeconds": 59446529195638
     },
....

将其删除：

$ curl -k -H 'Authorization: Bearer <redacted>'  https://localhost:6443/api/v1/nodes/ip-x-x-x-x.us-west-2.compute.internal/proxy/stats/summary
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "nodes \"ip-x-x-x-x.us-west-2.compute.internal\" is forbidden: User \"system:serviceaccount:default:prometheus-k8s\" cannot get resource \"nodes/proxy\" in API group \"\" at the cluster scope",
  "reason": "Forbidden",
  "details": {
    "name": "ip-x-x-x-x.us-west-2.compute.internal",
    "kind": "nodes"
  },
  "code": 403
}

Answer 2

对于这两个端点，（子）资源的规则可能缺少nodes/metrics和nodes/proxy，甚至可能缺少proxy动词。

如果从安全角度来看可以接受，则将cluster-reader角色分配给Prometheus的服务帐户会容易得多。

禁止访问Kubernetes API服务器

2 个答案: