解决二进制K8S布署的metrics-server查看集群资源报错权限问题

Posted 2023-02-22 ~~~~~~~~~~~~~~

布署完metircs-server后，查看已成功注册apiservices：

使用kubectl top nodes及kubectl top pods均报错：

Error from server (Forbidden): nodes.metrics.k8s.io is forbidden: User "kubernetes" cannot list resource "nodes" in API group "metrics.k8s.io" at the cluster scope

Error from server (Forbidden): pods.metrics.k8s.io is forbidden: User "kubernetes" cannot list resource "pods" in API group "metrics.k8s.io" in the namespace "default"

报错提示为RBAC权限问题，给kubernetes用户授权如下：

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: metrics-reader
rules:
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["nodes"]
  verbs: ["get", "watch", "list"]

---

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: kubernetes
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: metrics-reader
  apiGroup: rbac.authorization.k8s.io


---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: metrics-reader
rules:
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["nodes"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: metrics
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metrics-reader
subjects:
- kind: User
  name: kubernetes
  apiGroup: rbac.authorization.k8s.io

问题解决：