<p>I'm trying to provision a user so that Grafana is able to monitor my cluster's resources. I've followed the Bitnami guide <a href="https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/" rel="nofollow noreferrer">here</a>. And implemented the steps as an Ansible playbook found <a href="https://github.com/zimmertr/Kubernetes-Manifests/blob/master/Grafana/provision.yml" rel="nofollow noreferrer">here</a>.</p>

<p><a href="https://github.com/zimmertr/Kubernetes-Manifests/blob/master/Grafana/manifests/cr_prometheus.yml.j2" rel="nofollow noreferrer">Here</a> is the ClusterRole that the user uses and <a href="https://github.com/zimmertr/Kubernetes-Manifests/blob/master/Grafana/manifests/crb_prometheus.yml.j2" rel="nofollow noreferrer">here</a> is how it is bound to the user. </p>

<p>However, despite this, Grafana throws <a href="https://i.stack.imgur.com/4sedv.png" rel="nofollow noreferrer">this</a> error when I configure it with the generated certificates.</p>

<p>Furthermore, if I attempt to run any command with the user context, it says I'm unauthorized.</p>

<pre><code>$&gt; kubectl --context=grafana-prometheus-scraper get pods -n grafana
error: You must be logged in to the server (Unauthorized)
</code></pre>

<p>Any ideas?</p>

TJ Zimmerman
<p>This is how your ServiceAccount, <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding" rel="nofollow noreferrer">ClusterRole and ClusterRoleBinding</a> should look like.</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: grafana-prometheus-scraper

---

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: grafana-prometheus-scraper
rules:
  - apiGroups: [""]
    resources:
      - configmaps
      - secrets
      - nodes
      - pods
      - services
      - resourcequotas
      - replicationcontrollers
      - limitranges
      - persistentvolumeclaims
      - persistentvolumes
      - namespaces
      - endpoints
    verbs: ["list", "watch"]
  - apiGroups: ["extensions"]
    resources:
      - daemonsets
      - deployments
      - replicasets
      - ingresses
    verbs: ["list", "watch"]
  - apiGroups: ["apps"]
    resources:
      - daemonsets
      - deployments
      - replicasets
      - statefulsets
    verbs: ["list", "watch"]
  - apiGroups: ["batch"]
    resources:
      - cronjobs
      - jobs
    verbs: ["list", "watch"]
  - apiGroups: ["autoscaling"]
    resources:
      - horizontalpodautoscalers
    verbs: ["list", "watch"]
  - apiGroups: ["policy"]
    resources:
      - poddisruptionbudgets
    verbs: ["list", "watch"]
  - apiGroups: ["certificates.k8s.io"]
    resources:
      - certificatesigningrequests
    verbs: ["list", "watch"]
  - apiGroups: ["storage.k8s.io"]
    resources:
      - storageclasses
    verbs: ["list", "watch"]
  - apiGroups: ["autoscaling.k8s.io"]
    resources:
      - verticalpodautoscalers
    verbs: ["list", "watch"]

---

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: grafana-prometheus-scraper
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: grafana-prometheus-scraper
subjects:
- kind: ServiceAccount
  name: grafana-prometheus-scraper
</code></pre>

<p>You don't have to specify the namespace when you are creating Cluster roles as this applies to the whole cluster. If you want to limit the access to a particular namespace you should use Role and RoleBinding.</p>

<p>There is really good article on Medium regarding <a href="https://medium.com/@lestrrat/configuring-rbac-for-your-kubernetes-service-accounts-c348b64eb242" rel="nofollow noreferrer">Configuring RBAC For Your Kubernetes Service Accounts</a> that I strongly recommend.</p>
