Question

A monitoring team needs a ServiceAccount named 'prom-scraper' in the 'monitoring' namespace to be able to perform HTTP GET requests against the API server's '/metrics' endpoint. You create a ClusterRole with 'resources: ["pods"]' and 'verbs: ["get"]', then bind it via a ClusterRoleBinding, but requests to '/metrics' return 403 Forbidden. What change is required to grant the necessary access?

Accepted Answer

Add a rule to the ClusterRole using 'nonResourceURLs: ["/metrics"]' with 'verbs: ["get"]'.

Answer

Change the ClusterRoleBinding to a RoleBinding in the 'monitoring' namespace so the SA can reach cluster-scoped endpoints.

Answer

Add 'resources: ["metrics"]' and 'apiGroups: ["metrics.k8s.io"]' to the existing ClusterRole rule.

Answer

Grant the ServiceAccount the built-in 'view' ClusterRole, which includes access to all API server URLs.