From d5cc2b55a970575ec4a9136dc9803823991aeb06 Mon Sep 17 00:00:00 2001 From: DongHyeonka Date: Fri, 4 Sep 2026 09:14:51 +0900 Subject: [PATCH] fix: grant nodes/proxy so kubelet metrics can be scraped Co-Authored-By: Claude Opus 5 --- deploy/lab/k8s/observability.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/deploy/lab/k8s/observability.yaml b/deploy/lab/k8s/observability.yaml index 499d2e2..d23202f 100644 --- a/deploy/lab/k8s/observability.yaml +++ b/deploy/lab/k8s/observability.yaml @@ -33,7 +33,12 @@ metadata: name: prometheus rules: - apiGroups: [""] - resources: [nodes, nodes/metrics, services, endpoints, pods] + # nodes/proxy is required in addition to nodes/metrics: the kubelet job + # reaches each node through the API server's proxy subresource + # (/api/v1/nodes//proxy/metrics). Without it every kubelet target + # fails with 403 Forbidden while the other jobs stay green — a partial + # failure that is easy to miss unless the target list is checked. + resources: [nodes, nodes/metrics, nodes/proxy, services, endpoints, pods] verbs: [get, list, watch] - nonResourceURLs: ["/metrics"] verbs: [get]