在 kubernetes (gcloud) 上设置 Prometheus / Grafana

Question

我想设置一些监控并尝试了这个：https://github.com/giantswarm/kubernetes-prometheus

它设置了所有 Pod 和服务，但我收到一条错误消息：

Error from server (Forbidden): error when creating
"https://raw.githubusercontent.com/giantswarm/kubernetes-prometheus/master/manifests-all.yaml":
clusterroles.rbac.authorization.k8s.io "prometheus" is forbidden:
attempt to grant extra privileges: [PolicyRule{APIGroups:[""],
Resources:["nodes"], Verbs:["get"]} PolicyRule{APIGroups:[""],
Resources:["nodes"], Verbs:["list"]} PolicyRule{APIGroups:[""],
Resources:["nodes"], Verbs:["watch"]} PolicyRule{APIGroups:[""],
Resources:["nodes/proxy"], Verbs:["get"]} PolicyRule{APIGroups:[""],
Resources:["nodes/proxy"], Verbs:["list"]} PolicyRule{APIGroups:[""],
Resources:["nodes/proxy"], Verbs:["watch"]} PolicyRule{APIGroups:[""],
Resources:["services"], Verbs:["get"]} PolicyRule{APIGroups:[""],
Resources:["services"], Verbs:["list"]} PolicyRule{APIGroups:[""],
Resources:["services"], Verbs:["watch"]} PolicyRule{APIGroups:[""],
Resources:["endpoints"], Verbs:["get"]} PolicyRule{APIGroups:[""],
Resources:["endpoints"], Verbs:["list"]} PolicyRule{APIGroups:[""],
Resources:["endpoints"], Verbs:["watch"]} PolicyRule{APIGroups:[""],
Resources:["pods"], Verbs:["get"]} PolicyRule{APIGroups:[""],
Resources:["pods"], Verbs:["list"]} PolicyRule{APIGroups:[""],
Resources:["pods"], Verbs:["watch"]} PolicyRule{APIGroups:[""],
Resources:["configmaps"], Verbs:["get"]}
PolicyRule{NonResourceURLs:["/metrics"], Verbs:["get"]}]
user=&{xxx  [system:authenticated]
map[user-assertion.cloud.google.com:[xxx]]}
ownerrules=[PolicyRule{APIGroups:["authorization.k8s.io"],
Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"],
Verbs:["create"]} PolicyRule{NonResourceURLs:["/api" "/api/*" "/apis"
"/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json"
"/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"]}
PolicyRule{NonResourceURLs:["/openapi"], Verbs:["get"]}
PolicyRule{NonResourceURLs:["/openapi/*"], Verbs:["get"]}
PolicyRule{NonResourceURLs:["/version/"], Verbs:["get"]}]
ruleResolutionErrors=[]

如果有任何帮助，我将不胜感激。我想我需要授予额外的权利，但我不知道如何。 集群版本为：1.10.9-gke.5

谢谢

编辑： 随着@Rico 提议的更改，我收到一条略有不同的错误消息：

Error from server (Forbidden): error when creating "manifests-all.yaml": clusterroles.rbac.authorization.k8s.io "prometheus" is forbidden: attempt to grant extra privileges: 
[PolicyRule{APIGroups:["*"], Resources:["*"], Verbs:["*"]} PolicyRule{NonResourceURLs:["/metrics"], Verbs:["get"]}] user=&{xxx  [system:authenticated] map[user-assertion.cloud.google.com:[xxx]]} ownerrules= 
[PolicyRule{APIGroups:["authorization.k8s.io"], Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], Verbs:["create"]} 
PolicyRule{NonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"]} PolicyRule{NonResourceURLs:["/openapi"], Verbs:["get"]} 
PolicyRule{NonResourceURLs:["/openapi/*"], Verbs:["get"]} 
PolicyRule{NonResourceURLs:["/version/"], Verbs:["get"]}] ruleResolutionErrors=[]

Answer 1

您需要将prometheus ClusterRole 设置为更加宽容。您可以从完全权限开始，看看它最初是否有效，然后逐步进行：

cat <<EOF
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: prometheus
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
EOF | kubectl apply -f -