Cloud Monitor Container Insight は、Prometheus Agent をクラスターにデプロイしてデータを収集します。エージェントがデプロイされると、ClusterRole が作成され、Prometheus Operator に特定名前空間内のリソースに対する読み取り権限とワークロードに対する操作権限が付与されます。このトピックでは、必要な権限について説明します。
権限
ClusterRole: cms-prometheus-operator-cluster-role (自己管理シナリオの場合) / cms-prometheus-operator-managed-role (マネージドシナリオの場合)。
目的: Prometheus Operator に、必要なリソースに対する読み取り権限と、限られたリソースセットに対する操作権限を付与します。これらの権限は、サービスディスカバリーなどの操作に使用されます。
権限チェックリスト:
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: cms-prometheus-operator-cluster-role rules: - apiGroups: - monitoring.coreos.com resources: - alertmanagers - prometheuses - prometheuses/finalizers - alertmanagers/finalizers - servicemonitors - podmonitors - prometheusrules - probes verbs: - '*' - apiGroups: - apiextensions.k8s.io resources: - customresourcedefinitions verbs: - "create" - "update" - "get" - "list" - apiGroups: - "" resources: - nodes/metrics - nodes/proxy verbs: - get - list - watch - nonResourceURLs: - /metrics verbs: - get - apiGroups: [""] resources: - nodes - pods - resourcequotas - replicationcontrollers verbs: ["list", "watch", "get"] - apiGroups: [""] resources: ["services","endpoints"] verbs: ["get", "list", "watch", "create", "update"] - apiGroups: ["batch"] resources: - cronjobs - jobs verbs: ["list", "watch", "get"] - apiGroups: ["policy"] resources: - poddisruptionbudgets verbs: ["list", "watch", "get"] - apiGroups: ["apps"] resources: ["services","endpoints"] verbs: ["get", "list", "watch", "create", "update"] - apiGroups: - discovery.k8s.io resources: - endpointslices verbs: - get - list - watch - create - update - apiGroups: ["apps"] resources: ["services/proxy"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["services/proxy"] verbs: ["get", "list", "watch"]Role: cms-prometheus-operator-role。
目的: Prometheus Operator に、特定名前空間およびリソース内のワークロードに対する操作権限を付与します。
権限チェックリスト:
kind: Role metadata: name: cms-prometheus-operator-role namespace: {{ .Release.Namespace }} rules: - apiGroups: - "" resources: - configmaps verbs: - get - list - watch - create - update - delete - deletecollection - patch - apiGroups: - "" resources: - pods verbs: - get - list - watch - apiGroups: ["apps"] resources: - deployments - replicasets resourceNames: [\"{{ template "fullname" . }}\"] verbs: - get - list - watch - update - patch - apiGroups: [""] resources: ["services","endpoints"] resourceNames: ["kubelet"] verbs: ["get", "list", "watch", "create", "update"]ClusterRole: cms-kube-meta-role (自己管理シナリオの場合) / cms-kube-meta-managed-role (マネージドシナリオの場合)。
目的: kube-state-metrics および Entity Collector コンポーネントに、リソースに対する必要な読み取り権限を付与します。
権限チェックリスト:
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: cms-kube-meta-role rules: - apiGroups: [""] resources: - configmaps - nodes - pods - services - resourcequotas - replicationcontrollers - limitranges - persistentvolumeclaims - persistentvolumes - namespaces - endpoints verbs: ["get", "list", "watch"] - apiGroups: ["extensions"] resources: - daemonsets - deployments - replicasets - ingresses verbs: ["get", "list", "watch"] - apiGroups: ["apps"] resources: - daemonsets - deployments - replicasets - statefulsets verbs: ["get", "list", "watch"] - apiGroups: ["batch"] resources: - cronjobs - jobs verbs: ["get", "list", "watch"] - apiGroups: ["autoscaling"] resources: - horizontalpodautoscalers verbs: ["get", "list", "watch"] - apiGroups: ["policy"] resources: - poddisruptionbudgets verbs: ["get", "list", "watch"] - apiGroups: ["certificates.k8s.io"] resources: - certificatesigningrequests verbs: ["get", "list", "watch"] - apiGroups: - certificates.k8s.io resources: - certificatesigningrequests verbs: - get - list - watch - apiGroups: - networking.k8s.io resources: - ingresses - networkpolicies verbs: - get - list - watch - apiGroups: - storage.k8s.io resources: - storageclasses - volumeattachments verbs: - get - list - watch - apiGroups: - admissionregistration.k8s.io resources: - mutatingwebhookconfigurations - validatingwebhookconfigurations verbs: - get - list - watch - apiGroups: - coordination.k8s.io resources: - leases verbs: - get - list - watch
参考
Cloud Monitor は、コンテナークラスターの管理権限も必要とします。詳細については、「Cloud Monitor によるコンテナークラスター管理のためのサービスアクセス権限付与」をご参照ください。