Kubernetes 实战：从零到一创建监控 Token

# 1. 创建一个名为 "monitoring" 的命名空间
kubectl create namespace monitoring

# 2. 在新命名空间中创建一个服务账户
kubectl create serviceaccount monitoring-sa -n monitoring

# 使用 curl 测试访问 Kubelet 的 Summary API
$ curl -k -H "Authorization: Bearer $TOKEN" $APISERVER/stats/summary

# 返回的错误
{ "error": "https://127.0.0.1:6443/stats/summary returned HTTP status 403 Forbidden" }

{
  "status": "Failure",
  "message": "nodes \"vbox\" is forbidden: User \"system:serviceaccount:monitoring:monitoring-sa\" cannot get resource \"nodes/proxy\" ...",
  "code": 403
}

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: monitoring-clusterrole
rules:
- apiGroups: [""]
  resources:
  - nodes
  - nodes/metrics
  - nodes/stats      # 允许访问 Kubelet 统计数据
  - nodes/proxy      # 允许使用 API Server 作为代理访问节点
  - services
  - endpoints
  - pods
  - replicationcontrollers
  - persistentvolumes
  - persistentvolumeclaims
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources:
  - daemonsets
  - deployments
  - replicasets
  - statefulsets
  verbs: ["get", "list", "watch"]
- apiGroups: ["extensions", "networking.k8s.io"]
  resources:
  - ingresses
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics", "/metrics/cadvisor"]
  verbs: ["get"]

#!/bin/bash

# =============================================================================
#
#  脚本名称: create-monitoring-token.sh
#  功能描述: 为 Kubernetes 监控创建一个拥有正确只读权限的 ServiceAccount 和 Bearer Token。
#
# =============================================================================

set -e

# --- 配置变量 ---
NAMESPACE="monitoring"
SERVICE_ACCOUNT_NAME="monitoring-sa"
CLUSTER_ROLE_NAME="monitoring-clusterrole"
CLUSTER_ROLE_BINDING_NAME="monitoring-clusterrole-binding"

# --- 美化输出 ---
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo -e "${YELLOW}Starting script to create monitoring token...${NC}"

# --- 步骤 1: 创建 Namespace (如果不存在) ---
echo "--> Checking/Creating Namespace: ${NAMESPACE}"
kubectl get namespace ${NAMESPACE} &> /dev/null || kubectl create namespace ${NAMESPACE}

# --- 步骤 2: 创建 ServiceAccount (如果不存在) ---
echo "--> Checking/Creating ServiceAccount: ${SERVICE_ACCOUNT_NAME}"
kubectl get serviceaccount ${SERVICE_ACCOUNT_NAME} -n ${NAMESPACE} &> /dev/null || kubectl create serviceaccount ${SERVICE_ACCOUNT_NAME} -n ${NAMESPACE}

# --- 步骤 3: 创建/更新 ClusterRole 和 ClusterRoleBinding ---
echo "--> Applying ClusterRole and ClusterRoleBinding..."
cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ${CLUSTER_ROLE_NAME}
rules:
- apiGroups: [""]
  resources:
  - nodes
  - nodes/metrics
  - nodes/stats
  - nodes/proxy
  - services
  - endpoints
  - pods
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources:
  - deployments
  - replicasets
  - statefulsets
  - daemonsets
  verbs: ["get", "list", "watch"]
- apiGroups: ["extensions", "networking.k8s.io"]
  resources:
  - ingresses
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ${CLUSTER_ROLE_BINDING_NAME}
subjects:
- kind: ServiceAccount
  name: ${SERVICE_ACCOUNT_NAME}
  namespace: ${NAMESPACE}
roleRef:
  kind: ClusterRole
  name: ${CLUSTER_ROLE_NAME}
  apiGroup: rbac.authorization.k8s.io
EOF

# --- 步骤 4: 生成 Bearer Token ---
echo "--> Generating Bearer Token for ServiceAccount: ${SERVICE_ACCOUNT_NAME}"
TOKEN=$(kubectl create token ${SERVICE_ACCOUNT_NAME} -n ${NAMESPACE})

# --- 步骤 5: 打印 Token ---
echo -e "\n${YELLOW}======================[ MONITORING BEARER TOKEN ]======================${NC}"
echo -e "${GREEN}${TOKEN}${NC}"
echo -e "${YELLOW}=======================================================================${NC}"
echo -e "\n${YELLOW}Script finished successfully. Store this token securely!${NC}\n"

# 1. 测试基本访问权限
curl -k -H "Authorization: Bearer $TOKEN" $APISERVER/api/v1/nodes

# 2. 测试 Pod 列表访问
curl -k -H "Authorization: Bearer $TOKEN" $APISERVER/api/v1/pods

# 3. 测试节点指标访问
curl -k -H "Authorization: Bearer $TOKEN" $APISERVER/api/v1/nodes/$(hostname)/proxy/metrics

# !! 警告: 这将删除所有相关资源，请谨慎操作 !!

# 定义变量 (与脚本中保持一致)
NAMESPACE="monitoring"
SERVICE_ACCOUNT_NAME="monitoring-sa"
CLUSTER_ROLE_NAME="monitoring-clusterrole"
CLUSTER_ROLE_BINDING_NAME="monitoring-clusterrole-binding"

echo "Deleting monitoring RBAC resources and Namespace..."

# 删除 ClusterRoleBinding
kubectl delete clusterrolebinding ${CLUSTER_ROLE_BINDING_NAME} --ignore-not-found=true

# 删除 ClusterRole
kubectl delete clusterrole ${CLUSTER_ROLE_NAME} --ignore-not-found=true

# 删除整个 Namespace (这将同时删除其中的 ServiceAccount)
kubectl delete namespace ${NAMESPACE} --ignore-not-found=true

echo "Cleanup complete."

apiVersion: v1
kind: Secret
metadata:
  name: prometheus-k8s-token
  namespace: monitoring
type: Opaque
stringData:
  token: ${TOKEN}
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: k8s
  namespace: monitoring
spec:
  endpoints:
  - port: https
    scheme: https
    tlsConfig:
      insecureSkipVerify: true
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token

apiVersion: v1
kind: Secret
metadata:
  name: grafana-agent-token
  namespace: monitoring
type: Opaque
stringData:
  token: ${TOKEN}
---
apiVersion: monitoring.grafana.com/v1alpha1
kind: GrafanaAgent
metadata:
  name: k8s-agent
  namespace: monitoring
spec:
  metrics:
    instances:
    - name: k8s
      scrapeConfigs:
      - jobName: kubernetes-apiservers
        kubernetes_sd_configs:
        - role: endpoints
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "Unauthorized",
  "reason": "Expired",
  "code": 401
}

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "nodes \"node-1\" is forbidden: User \"system:serviceaccount:monitoring:monitoring-sa\" cannot get resource \"nodes/proxy\" in API group \"\" at the cluster scope",
  "reason": "Forbidden",
  "code": 403
}