Forbidden (user=system:node, verb=get, resource=nodes, subresource=metrics)
原因分析
當(dāng)前用戶(hù)（kubectl指令使用的證書(shū)代表的用戶(hù)窒悔，即 system:node）沒(méi)有足夠的權(quán)限去獲取 /metrics 端點(diǎn)的數(shù)據(jù)宛徊， Kubernetes 集群的權(quán)限設(shè)置（Role-Based Access Control, RBAC）阻止了這種訪(fǎng)問(wèn)焊切。
查看現(xiàn)有ClusterRole的權(quán)限：kubectl describe clusterrole system:node
解決措施
新建ClusterRole和ClusterRoleBinding，添加訪(fǎng)問(wèn) /metrics 的權(quán)限
cat <<EOF > node-metrics-access.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: node-metrics-access
rules:
- apiGroups: [""]
resources: ["nodes/metrics"]
verbs: ["get", "list", "watch"]
EOF
cat <<EOF > node-metrics-access-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: node-metrics-access-binding
subjects:
- kind: Group
name: system:nodes
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: node-metrics-access
apiGroup: rbac.authorization.k8s.io
EOF
kubectl apply -f node-metrics-access.yaml
kubectl apply -f node-metrics-access-binding.yaml
kubectl get clusterrole | grep metrics
kubectl describe clusterrole node-metrics-access
查詢(xún)指令
sudo curl -s -k --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem https://127.0.0.1:10250/metrics | grep kubelet_pleg_relist_interval
