fix: grant nodes/proxy so kubelet metrics can be scraped

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-04 09:14:51 +09:00
parent 0bb0e0ac49
commit d5cc2b55a9
1 changed files with 6 additions and 1 deletions
@@ -33,7 +33,12 @@ metadata:
  name: prometheus
 rules:
  - apiGroups: [""]
-    resources: [nodes, nodes/metrics, services, endpoints, pods]
+    # nodes/proxy is required in addition to nodes/metrics: the kubelet job
+    # reaches each node through the API server's proxy subresource
+    # (/api/v1/nodes/<name>/proxy/metrics). Without it every kubelet target
+    # fails with 403 Forbidden while the other jobs stay green — a partial
+    # failure that is easy to miss unless the target list is checked.
+    resources: [nodes, nodes/metrics, nodes/proxy, services, endpoints, pods]
    verbs: [get, list, watch]
  - nonResourceURLs: ["/metrics"]
    verbs: [get]