Kubernetes 从外部访问度量服务器 API

Question

I am trying to access the metrics server for a k8s cluster without the use of kubectl proxy . After finding the tutorial at https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#without-kubectl-proxy , I've run into an issue.

When making the request curl -X GET $APISERVER/apis/metrics.k8s.io/v1beta1/nodes --header "Authorization: Bearer $TOKEN" --insecure | jq curl -X GET $APISERVER/apis/metrics.k8s.io/v1beta1/nodes --header "Authorization: Bearer $TOKEN" --insecure | jq I get the following permissions error:

curl -X GET $APISERVER/apis/metrics.k8s.io/v1beta1/nodes --header "Authorization: Bearer $TOKEN" --insecure | jq                                                                                       11:58AM
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   386  100   386    0     0   2064      0 --:--:-- --:--:-- --:--:--  2064
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "nodes.metrics.k8s.io is forbidden: User \"system:serviceaccount:default:default\" cannot list resource \"nodes\" in API group \"metrics.k8s.io\" at the cluster scope",
  "reason": "Forbidden",
  "details": {
    "group": "metrics.k8s.io",
    "kind": "nodes"
  },
  "code": 403
}

I've tried making a custom ServiceAccount testaccount with the following ClusterRoleBinding:

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: test-admin
rules:
- apiGroups: [""]
  resources: ["pods", "nodes"]
  verbs: ["get", "watch", "list"]

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: test-rbac
subjects:
- kind: ServiceAccount
  name: testaccount
  namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

I've tried it with both the included ClusterRole, as well as the cluster-admin cluster role. With the token generated after those changes I still get the same curl error.

Answer 1

I figured out it was the apiGroups that needed to be modified. The following ClusterRole and ClusterRoleBinding worked:

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: test-admin
rules:
- apiGroups: ["*"] # This was the change
  resources: ["pods", "nodes"]
  verbs: ["get", "watch", "list"]

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: test-rbac
subjects:
- kind: ServiceAccount
  name: testaccount
  namespace: default
roleRef:
  kind: ClusterRole
  name: test-admin
  apiGroup: rbac.authorization.k8s.io