PodMonitor列出Pod所需的Kubernetes角色权限咨询

部署Prometheus Operator后，prometheus-pf1prom-0 Pod出现如下权限错误：

ts=2023-07-04T17:23:40.085Z caller=klog.go:116 level=error component=k8s_client_runtime func=ErrorDepth msg="pkg/mod/k8s.io/client-go@v0.26.2/tools/cache/reflector.go:169: Failed to watch *v1.Pod: failed to list *v1.Pod: pods is forbidden: User "system:serviceaccount:pf1ns:pf1promsvcacc" cannot list resource "pods" in API group "" in the namespace "pf1ns""

你已配置的权限规则本身是正确的，但需要确保规则通过完整的RBAC链路绑定到目标ServiceAccount，以下是排查和解决步骤：

1. 确认RBAC资源的完整性 #

你的规则需要封装在Role（命名空间级）或ClusterRole（集群级）中，并通过RoleBinding或ClusterRoleBinding关联到pf1promsvcacc服务账户。

正确的Role配置示例（Terraform） #

resource "kubernetes_role" "prometheus_role" {
  metadata {
    name      = "prometheus-role"
    namespace = "pf1ns"
  }

  rule {
    api_groups = [""]
    resources  = ["services", "endpoints", "pods"]
    verbs      = ["get", "list", "watch"]
  }
}

对应的RoleBinding配置示例（Terraform） #

resource "kubernetes_role_binding" "prometheus_role_binding" {
  metadata {
    name      = "prometheus-role-binding"
    namespace = "pf1ns"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "Role"
    name      = kubernetes_role.prometheus_role.metadata[0].name
  }

  subject {
    kind      = "ServiceAccount"
    name      = "pf1promsvcacc"
    namespace = "pf1ns"
  }
}

2. 验证权限是否生效 #

用kubectl直接测试服务账户的权限：

kubectl auth can-i list pods -n pf1ns --as=system:serviceaccount:pf1ns:pf1promsvcacc

如果返回no，说明RBAC绑定未生效，需检查：

• Role、RoleBinding与ServiceAccount的命名空间是否完全一致
• RoleBinding中role_ref的name和kind是否与实际Role匹配
• Terraform配置是否正确应用（可重新执行terraform apply）

3. 检查Prometheus CR的服务账户配置 #

确保Prometheus自定义资源（CR）中指定了正确的服务账户名：

apiVersion: monitoring.coreos.com/v1
kind: Prometheus
metadata:
  name: pf1prom
  namespace: pf1ns
spec:
  serviceAccountName: pf1promsvcacc
  # 其他Prometheus配置项...

内容的提问来源于stack exchange，提问作者Kokizzu