Prometheus / Grafana setup on kubernetes (gcloud)










0















I wanted to setup some monitoring and tried this: https://github.com/giantswarm/kubernetes-prometheus



It sets up all the Pods and services but I get an error message:



Error from server (Forbidden): error when creating
"https://raw.githubusercontent.com/giantswarm/kubernetes-prometheus/master/manifests-all.yaml":
clusterroles.rbac.authorization.k8s.io "prometheus" is forbidden:
attempt to grant extra privileges: [PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["configmaps"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/metrics"], Verbs:["get"]]
user=&xxx [system:authenticated]
map[user-assertion.cloud.google.com:[xxx]]
ownerrules=[PolicyRuleAPIGroups:["authorization.k8s.io"],
Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"],
Verbs:["create"] PolicyRuleNonResourceURLs:["/api" "/api/*" "/apis"
"/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json"
"/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi/*"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/version/"], Verbs:["get"]]
ruleResolutionErrors=


I would appreciate any help. I suppose I need to grant extra rights, but I dont know how.
Cluster version is: 1.10.9-gke.5



Thank you



EDIT:
With the changes @Rico proposed I am getting an slightly different error message:



Error from server (Forbidden): error when creating "manifests-all.yaml": clusterroles.rbac.authorization.k8s.io "prometheus" is forbidden: attempt to grant extra privileges: 
[PolicyRuleAPIGroups:["*"], Resources:["*"], Verbs:["*"] PolicyRuleNonResourceURLs:["/metrics"], Verbs:["get"]] user=&xxx [system:authenticated] map[user-assertion.cloud.google.com:[xxx]] ownerrules=
[PolicyRuleAPIGroups:["authorization.k8s.io"], Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], Verbs:["create"]
PolicyRuleNonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"] PolicyRuleNonResourceURLs:["/openapi"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi/*"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/version/"], Verbs:["get"]] ruleResolutionErrors=









share|improve this question
























  • What is the context that you are running as ? Do you have fill admin rights to the cluster right now ?

    – Jason Stanley
    Nov 14 '18 at 22:07















0















I wanted to setup some monitoring and tried this: https://github.com/giantswarm/kubernetes-prometheus



It sets up all the Pods and services but I get an error message:



Error from server (Forbidden): error when creating
"https://raw.githubusercontent.com/giantswarm/kubernetes-prometheus/master/manifests-all.yaml":
clusterroles.rbac.authorization.k8s.io "prometheus" is forbidden:
attempt to grant extra privileges: [PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["configmaps"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/metrics"], Verbs:["get"]]
user=&xxx [system:authenticated]
map[user-assertion.cloud.google.com:[xxx]]
ownerrules=[PolicyRuleAPIGroups:["authorization.k8s.io"],
Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"],
Verbs:["create"] PolicyRuleNonResourceURLs:["/api" "/api/*" "/apis"
"/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json"
"/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi/*"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/version/"], Verbs:["get"]]
ruleResolutionErrors=


I would appreciate any help. I suppose I need to grant extra rights, but I dont know how.
Cluster version is: 1.10.9-gke.5



Thank you



EDIT:
With the changes @Rico proposed I am getting an slightly different error message:



Error from server (Forbidden): error when creating "manifests-all.yaml": clusterroles.rbac.authorization.k8s.io "prometheus" is forbidden: attempt to grant extra privileges: 
[PolicyRuleAPIGroups:["*"], Resources:["*"], Verbs:["*"] PolicyRuleNonResourceURLs:["/metrics"], Verbs:["get"]] user=&xxx [system:authenticated] map[user-assertion.cloud.google.com:[xxx]] ownerrules=
[PolicyRuleAPIGroups:["authorization.k8s.io"], Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], Verbs:["create"]
PolicyRuleNonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"] PolicyRuleNonResourceURLs:["/openapi"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi/*"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/version/"], Verbs:["get"]] ruleResolutionErrors=









share|improve this question
























  • What is the context that you are running as ? Do you have fill admin rights to the cluster right now ?

    – Jason Stanley
    Nov 14 '18 at 22:07













0












0








0








I wanted to setup some monitoring and tried this: https://github.com/giantswarm/kubernetes-prometheus



It sets up all the Pods and services but I get an error message:



Error from server (Forbidden): error when creating
"https://raw.githubusercontent.com/giantswarm/kubernetes-prometheus/master/manifests-all.yaml":
clusterroles.rbac.authorization.k8s.io "prometheus" is forbidden:
attempt to grant extra privileges: [PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["configmaps"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/metrics"], Verbs:["get"]]
user=&xxx [system:authenticated]
map[user-assertion.cloud.google.com:[xxx]]
ownerrules=[PolicyRuleAPIGroups:["authorization.k8s.io"],
Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"],
Verbs:["create"] PolicyRuleNonResourceURLs:["/api" "/api/*" "/apis"
"/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json"
"/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi/*"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/version/"], Verbs:["get"]]
ruleResolutionErrors=


I would appreciate any help. I suppose I need to grant extra rights, but I dont know how.
Cluster version is: 1.10.9-gke.5



Thank you



EDIT:
With the changes @Rico proposed I am getting an slightly different error message:



Error from server (Forbidden): error when creating "manifests-all.yaml": clusterroles.rbac.authorization.k8s.io "prometheus" is forbidden: attempt to grant extra privileges: 
[PolicyRuleAPIGroups:["*"], Resources:["*"], Verbs:["*"] PolicyRuleNonResourceURLs:["/metrics"], Verbs:["get"]] user=&xxx [system:authenticated] map[user-assertion.cloud.google.com:[xxx]] ownerrules=
[PolicyRuleAPIGroups:["authorization.k8s.io"], Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], Verbs:["create"]
PolicyRuleNonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"] PolicyRuleNonResourceURLs:["/openapi"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi/*"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/version/"], Verbs:["get"]] ruleResolutionErrors=









share|improve this question
















I wanted to setup some monitoring and tried this: https://github.com/giantswarm/kubernetes-prometheus



It sets up all the Pods and services but I get an error message:



Error from server (Forbidden): error when creating
"https://raw.githubusercontent.com/giantswarm/kubernetes-prometheus/master/manifests-all.yaml":
clusterroles.rbac.authorization.k8s.io "prometheus" is forbidden:
attempt to grant extra privileges: [PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["nodes"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["nodes/proxy"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["services"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["endpoints"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["get"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["list"] PolicyRuleAPIGroups:[""],
Resources:["pods"], Verbs:["watch"] PolicyRuleAPIGroups:[""],
Resources:["configmaps"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/metrics"], Verbs:["get"]]
user=&xxx [system:authenticated]
map[user-assertion.cloud.google.com:[xxx]]
ownerrules=[PolicyRuleAPIGroups:["authorization.k8s.io"],
Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"],
Verbs:["create"] PolicyRuleNonResourceURLs:["/api" "/api/*" "/apis"
"/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json"
"/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi/*"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/version/"], Verbs:["get"]]
ruleResolutionErrors=


I would appreciate any help. I suppose I need to grant extra rights, but I dont know how.
Cluster version is: 1.10.9-gke.5



Thank you



EDIT:
With the changes @Rico proposed I am getting an slightly different error message:



Error from server (Forbidden): error when creating "manifests-all.yaml": clusterroles.rbac.authorization.k8s.io "prometheus" is forbidden: attempt to grant extra privileges: 
[PolicyRuleAPIGroups:["*"], Resources:["*"], Verbs:["*"] PolicyRuleNonResourceURLs:["/metrics"], Verbs:["get"]] user=&xxx [system:authenticated] map[user-assertion.cloud.google.com:[xxx]] ownerrules=
[PolicyRuleAPIGroups:["authorization.k8s.io"], Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], Verbs:["create"]
PolicyRuleNonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"] PolicyRuleNonResourceURLs:["/openapi"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/openapi/*"], Verbs:["get"]
PolicyRuleNonResourceURLs:["/version/"], Verbs:["get"]] ruleResolutionErrors=






kubernetes google-cloud-platform prometheus






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Nov 15 '18 at 9:26







Alex Tbk

















asked Nov 14 '18 at 21:59









Alex TbkAlex Tbk

621723




621723












  • What is the context that you are running as ? Do you have fill admin rights to the cluster right now ?

    – Jason Stanley
    Nov 14 '18 at 22:07

















  • What is the context that you are running as ? Do you have fill admin rights to the cluster right now ?

    – Jason Stanley
    Nov 14 '18 at 22:07
















What is the context that you are running as ? Do you have fill admin rights to the cluster right now ?

– Jason Stanley
Nov 14 '18 at 22:07





What is the context that you are running as ? Do you have fill admin rights to the cluster right now ?

– Jason Stanley
Nov 14 '18 at 22:07












1 Answer
1






active

oldest

votes


















1














You need to set up your prometheus ClusterRole to be more permissive. You can start with full permissions to see if it works initially and then work your way down:



cat <<EOF
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: prometheus
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
EOF | kubectl apply -f -





share|improve this answer























  • Thank you Rico. Im still getting an error with the config you proposed. I edited the new error message into the original question

    – Alex Tbk
    Nov 15 '18 at 9:24











  • Change all the verbs in your role that say "get" to "*"

    – Rico
    Nov 15 '18 at 20:44










Your Answer






StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53309367%2fprometheus-grafana-setup-on-kubernetes-gcloud%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









1














You need to set up your prometheus ClusterRole to be more permissive. You can start with full permissions to see if it works initially and then work your way down:



cat <<EOF
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: prometheus
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
EOF | kubectl apply -f -





share|improve this answer























  • Thank you Rico. Im still getting an error with the config you proposed. I edited the new error message into the original question

    – Alex Tbk
    Nov 15 '18 at 9:24











  • Change all the verbs in your role that say "get" to "*"

    – Rico
    Nov 15 '18 at 20:44















1














You need to set up your prometheus ClusterRole to be more permissive. You can start with full permissions to see if it works initially and then work your way down:



cat <<EOF
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: prometheus
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
EOF | kubectl apply -f -





share|improve this answer























  • Thank you Rico. Im still getting an error with the config you proposed. I edited the new error message into the original question

    – Alex Tbk
    Nov 15 '18 at 9:24











  • Change all the verbs in your role that say "get" to "*"

    – Rico
    Nov 15 '18 at 20:44













1












1








1







You need to set up your prometheus ClusterRole to be more permissive. You can start with full permissions to see if it works initially and then work your way down:



cat <<EOF
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: prometheus
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
EOF | kubectl apply -f -





share|improve this answer













You need to set up your prometheus ClusterRole to be more permissive. You can start with full permissions to see if it works initially and then work your way down:



cat <<EOF
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: prometheus
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
EOF | kubectl apply -f -






share|improve this answer












share|improve this answer



share|improve this answer










answered Nov 15 '18 at 1:58









RicoRico

29.1k95369




29.1k95369












  • Thank you Rico. Im still getting an error with the config you proposed. I edited the new error message into the original question

    – Alex Tbk
    Nov 15 '18 at 9:24











  • Change all the verbs in your role that say "get" to "*"

    – Rico
    Nov 15 '18 at 20:44

















  • Thank you Rico. Im still getting an error with the config you proposed. I edited the new error message into the original question

    – Alex Tbk
    Nov 15 '18 at 9:24











  • Change all the verbs in your role that say "get" to "*"

    – Rico
    Nov 15 '18 at 20:44
















Thank you Rico. Im still getting an error with the config you proposed. I edited the new error message into the original question

– Alex Tbk
Nov 15 '18 at 9:24





Thank you Rico. Im still getting an error with the config you proposed. I edited the new error message into the original question

– Alex Tbk
Nov 15 '18 at 9:24













Change all the verbs in your role that say "get" to "*"

– Rico
Nov 15 '18 at 20:44





Change all the verbs in your role that say "get" to "*"

– Rico
Nov 15 '18 at 20:44



















draft saved

draft discarded
















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53309367%2fprometheus-grafana-setup-on-kubernetes-gcloud%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Darth Vader #20

How to how show current date and time by default on contact form 7 in WordPress without taking input from user in datetimepicker

Ondo