opened
bjornryden
username_0
**Is this a BUG REPORT or FEATURE REQUEST?** (choose one):
Bug

**Anything else do we need to know**:
When using the recently added metrics-server, it will not work, with the pod logging the following:
```
E1206 10:19:25.729247       1 manager.go:102] unable to fully collect metrics: [unable to fully scrape metrics from source kubelet_summary:k8s-06: unable to fetch metrics from Kubelet k8s-06 (192.168.236.6): request failed - "403 Forbidden", response: "Forbidden (user=system:serviceaccount:kube-system:metrics-server, verb=get, resource=nodes, subresource=stats)", unable to fully scrape metrics from source kubelet_summary:k8s-01: unable to fetch metrics from Kubelet k8s-01 (192.168.236.1): request failed - "403 Forbidden", response: "Forbidden (user=system:serviceaccount:kube-system:metrics-server, verb=get, resource=nodes, subresource=stats)", unable to fully scrape metrics from source kubelet_summary:k8s-05: unable to fetch metrics from Kubelet k8s-05 (192.168.236.5): request failed - "403 Forbidden", response: "Forbidden (user=system:serviceaccount:kube-system:metrics-server, verb=get, resource=nodes, subresource=stats)", unable to fully scrape metrics from source kubelet_summary:k8s-02: unable to fetch metrics from Kubelet k8s-02 (192.168.236.2): request failed - "403 Forbidden", response: "Forbidden (user=system:serviceaccount:kube-system:metrics-server, verb=get, resource=nodes, subresource=stats)", unable to fully scrape metrics from source kubelet_summary:k8s-03: unable to fetch metrics from Kubelet k8s-03 (192.168.236.3): request failed - "403 Forbidden", response: "Forbidden (user=system:serviceaccount:kube-system:metrics-server, verb=get, resource=nodes, subresource=stats)", unable to fully scrape metrics from source kubelet_summary:k8s-04: unable to fetch metrics from Kubelet k8s-04 (192.168.236.4): request failed - "403 Forbidden", response: "Forbidden (user=system:serviceaccount:kube-system:metrics-server, verb=get, resource=nodes, subresource=stats)"]
```

This can be fixed by adding the following to the ClusterRole `system:metrics-server`:
rules:
```
- apiGroups:
  - ""
  resources:
  ...
  - nodes/stats
```
Missing RBAC rights for metrics-server
issue
created
woopstar
username_1
@username_2
comment
created
okamototk
username_2
@username_0 

Thanks for reporting. Could you test following branch?

https://github.com/username_2/kubespray/tree/fix_metrics_server_rbac

If it works, I'll send pull request.
comment
created
bjornryden
username_0
Hi @username_2 
This is the exact same change I did in my local branch to fix the problem, so I can confirm this works.
I would do the PR myself, but still need to do my CLA. Sorry.
comment
created
okamototk
username_2
@username_0

OK, please send PR by yourself:)

But if you need my help, please tell me.
comment
created
bjornryden
username_0
@username_2 thanks for pushing me to get it done :) PR is open.
comment