<p>Currently in my <code>kubernetes-nodes</code> job in Prometheus, The endpoint <code>/api/v1/nodes/gk3-&lt;cluster name&gt;-default-pool-&lt;something arbitrary&gt;/proxy/metrics</code> is being scraped</p>
<p>But the thing is I'm getting a 403 error which says <code>GKEAutopilot authz: cluster scoped resource &quot;nodes/proxy&quot; is managed and access is denied</code> when I try it manually on postman</p>
<p>How do I get around this on GKE Autopilot?</p>

<p>While the Autopilot docs don't mention the node proxy API specifically, this is in the limitations section:</p>
<blockquote>
<p>Most external monitoring tools require access that is restricted.
Solutions from several Google Cloud partners are available for
use on Autopilot, however not all are supported, and custom
monitoring tools cannot be installed on Autopilot clusters.</p>
</blockquote>
<p>Given that port-forward and all other node-level access is restricted it seems likely this is not available. It's not clear that Autopilot even uses Kubelet at all and they probably aren't going to tell you.</p>
<p><em>End of year update:</em></p>
<p>This mostly works now. Autopilot has added support for things like cluster-scope objects and webhooks. You do need to reconfigure any install manifests to not touch the <code>kube-system</code> namespace as that is still locked down but you can most of this working if you hammer on it a bunch.</p>
