是否可以在没有 RBAC 的情况下从 prometheus 获取 pod 指标？

Question

I have a Kubernetes namespace with limited privileges which excludes the creation of ClusterRole and ClusterRoleBinding . I want to monitor the resource consumption and pod-related metrics on the namespace level.

Eg, pod health and status, new pod creation, pod restarts, etc.

Although I can create an application-level metrics endpoint for custom metrics by exposing /metrics and adding the annotation prometheus.io/scrape: 'true' .

But is there a way to get resource consumption and pod-related metrics on the namespace level without Cluster Role and ClusterRoleBinding ?

Answer 1

It is possible to get namespace level entities from kube-state-metrics.

1. Pull the helm chart for kube-state-metrics: https://bitnami.com/stack/kube-state-metrics/helm

2. Edit the values.yaml file and make the following changes:

    rbac: create: false useClusterRole: false collectors: - configmaps - cronjobs - daemonsets - deployments - endpoints - horizontalpodautoscalers - ingresses - jobs - limitranges - networkpolicies - poddisruptionbudgets - pods - replicasets - resourcequotas - services - statefulsets namespace: <current-namespace>

3. In the prometheus ConfigMap, add a job with the following configurations:

    - job_name: 'kube-state-metrics' scrape_interval: 1s scrape_timeout: 500ms static_configs: - targets: ['{{.Values.kube_state_metrics.service.name }}:8080']

4. Create a role binding:

    apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: kube-state-metrics namespace: <current-namespace> roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: view subjects: - kind: ServiceAccount name: kube-state-metrics namespace: <current-namespace>