Is it possible to get pod metrics from prometheus without RBAC?

user_10260337 0
Viewed 63

I have a Kubernetes namespace with limited privileges which excludes the creation of ClusterRole and ClusterRoleBinding. I want to monitor the resource consumption and pod-related metrics on the namespace level.

E.g., pod health and status, new pod creation, pod restarts, etc.

Although I can create an application-level metrics endpoint for custom metrics by exposing /metrics and adding the annotation prometheus.io/scrape: 'true'.

But is there a way to get resource consumption and pod-related metrics on the namespace level without Cluster Role and ClusterRoleBinding?

prometheus-operator prometheus-alertmanager prometheus kubernetes
1 Answers

It is possible to get namespace level entities from kube-state-metrics.

  1. Pull the helm chart for kube-state-metrics: https://bitnami.com/stack/kube-state-metrics/helm

  2. Edit the values.yaml file and make the following changes:

           rbac:
           create: false
           useClusterRole: false
         collectors:
           - configmaps
           - cronjobs
           - daemonsets
           - deployments
           - endpoints
           - horizontalpodautoscalers
           - ingresses
           - jobs
           - limitranges
           - networkpolicies
           - poddisruptionbudgets
           - pods
           - replicasets
           - resourcequotas
           - services
           - statefulsets
         namespace: <current-namespace>

  3. In the prometheus ConfigMap, add a job with the following configurations:

     - job_name: 'kube-state-metrics'
     scrape_interval: 1s
     scrape_timeout: 500ms
     static_configs:
          - targets: ['{{ .Values.kube_state_metrics.service.name }}:8080']

  4. Create a role binding:

         apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
       name: kube-state-metrics
       namespace: <current-namespace>
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: ClusterRole
       name: view
     subjects:
       - kind: ServiceAccount
         name: kube-state-metrics
     namespace: <current-namespace>
user_102603370
Related