<p>I have this repo <a href="https://github.com/kokizzu/terraform1/pull/1" rel="nofollow noreferrer">terraform1#prometheus-operator</a>, got it working previously with normal prometheus (without operator), now testing for prometheus-operator so if pod scaled horizontally, it would still can scrape correctly all metrics for all pods, not just from 1 pod.</p>
<p>This <a href="//kokizzu.blogspot.com/2023/07/keda-kubernetes-event-driven-autoscaling.html" rel="nofollow noreferrer">article</a> step by step how to run the minikube and terraform.</p>
<p>After deployed, it shows properly:</p>
<pre><code>k get pods -n pf1ns -w                                                                    1 ↵
NAME                                               READY   STATUS    RESTARTS   AGE
keda-admission-webhooks-76cd6c4b59-6b59r           1/1     Running   0          20h
keda-operator-5bb494667b-bb2bl                     1/1     Running   0          20h
keda-operator-metrics-apiserver-68d9f78869-d65vj   1/1     Running   0          20h
prometheus-pf1prom-0                               2/2     Running   0          3m9s
promfiberdeploy-868697d555-2jfgv                   1/1     Running   0          20h
</code></pre>
<p>but there's error on <code>prometheus-pf1prom-0</code>:</p>
<pre><code>ts=2023-07-04T17:23:40.085Z caller=klog.go:116 level=error component=k8s_client_runtime func=ErrorDepth msg=&quot;pkg/mod/k8s.io/client-go@v0.26.2/tools/cache/reflector.go:169: Failed to watch *v1.Pod: failed to list *v1.Pod: pods is forbidden: User \&quot;system:serviceaccount:pf1ns:pf1promsvcacc\&quot; cannot list resource \&quot;pods\&quot; in API group \&quot;\&quot; in the namespace \&quot;pf1ns\&quot;&quot;
</code></pre>
<p>What roles required to list pods?
there's already pod permission:</p>
<pre><code>  rule {
    api_groups = [&quot;&quot;]
    resources  = [&quot;services&quot;, &quot;endpoints&quot;, &quot;pods&quot;]
    verbs      = [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]
  }
</code></pre>

Kokizzu
<p>Make sure you attach the created <code>Role</code> to the <code>ServiceAccount</code> using a <code>RoleBinding</code>.</p>
