Configure Kubernetes Metrics Collection Using the PulseNode Agent

Kubernetes metrics collection in Pulse requires cluster-scoped RBAC permissions. Namespace-scoped Role and RoleBinding are not sufficient for Kubernetes metrics retrieval.

Kubernetes metrics require ClusterRole access.
Namespace-scoped RBAC does not enable Kubernetes metrics collection.
Without ClusterRole, Pulse collects only base system metrics.
Configure ServiceAccount, ClusterRole, and ClusterRoleBinding for full Kubernetes observability.

Ensure to deploy the Pulse Node Agent on Kubernetes. For details, see Deploy PulseNode Agent on Kubernetes.

PulseNode collects Kubernetes metrics using cluster-level endpoints such as:

nodes
nodes/stats
nodes/proxy
pods
events
persistentvolumes
persistentvolumeclaims

These endpoints require a ClusterRole and ClusterRoleBinding. Without cluster-level access, Kubernetes API endpoints are not accessible.

Behavior Without ClusterRole

If ClusterRole access is not granted:

Kubernetes metrics (node, pod, event, and volume metrics) are not collected
Namespace-level Kubernetes metrics are not collected
Only base system metrics from the host are collected

The following system metrics are still collected (no Kubernetes RBAC required):

Bash
    
​x
 
# ================================# Base System Metrics (No RBAC required)# ================================​[[inputs.mem]][[inputs.system]][[inputs.swap]][[inputs.net]][[inputs.cpu]]    percpu = false    totalcpu = true    fielddrop = [ "time_*" ][[inputs.disk]]    ignore_fs = [ "tmpfs", "devtmpfs", "devfs", "iso9660", "overlay", "aufs", "squashfs" ][[inputs.diskio]]    skip_serial_number = true[[inputs.linux_sysctl_fs]]  [[processors.rename]]    [[processors.rename.replace]]      field = "aio-max-nr"      dest = "aio_max_nr"    [[processors.rename.replace]]      field = "aio-nr"      dest = "aio_nr"    [[processors.rename.replace]]      field = "dentry-age-limit"      dest = "dentry_age_limit"    [[processors.rename.replace]]      field = "dentry-nr"      dest = "dentry_nr"    [[processors.rename.replace]]      field = "dentry-unused-nr"      dest = "dentry_unused_nr"    [[processors.rename.replace]]      field = "dentry-want-pages"      dest = "dentry_want_pages"    [[processors.rename.replace]]      field = "file-max"      dest = "file_max"    [[processors.rename.replace]]      field = "file-nr"      dest = "file_nr"    [[processors.rename.replace]]      field = "inode-free-nr"      dest = "inode_free_nr"    [[processors.rename.replace]]      field = "inode-nr"      dest = "inode_nr"    [[processors.rename.replace]]      field = "inode-preshrink-nr"      dest = "inode_preshrink_nr"​[[inputs.kernel]][[inputs.processes]]
Copy

These metrics are collected directly from the host and do not require Kubernetes API access.

Required RBAC Configuration for Full Kubernetes Metrics

To enable Kubernetes metrics collection, configure the following RBAC resources.

Bash
    
 
apiVersion: v1kind: ServiceAccountmetadata:  name: ad-pulsenode  namespace: pulse # CHANGE THIS: Set to the namespace where ad-pulsenode is deployed---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:  name: ad-pulsenode-rolerules:  # Required for inputs.kubernetes (Kubelet API)  - apiGroups: [""]    resources: ["nodes", "nodes/stats", "nodes/proxy"]    verbs: ["get", "list", "watch"]​  # Required for inputs.kube_event (Events API)  - apiGroups: [""]    resources: ["events"]    verbs: ["get", "list", "watch"]  # Required for inputs.kubernetes (Pod/Container discovery)  - apiGroups: [""]    resources: ["pods"]    verbs: ["get", "list", "watch"]  # Required for inputs.kubernetes (Volume metrics)  - apiGroups: [""]    resources: ["persistentvolumes", "persistentvolumeclaims"]    verbs: ["get", "list", "watch"]---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:  name: ad-pulsenode-bindingsubjects:  - kind: ServiceAccount    name: ad-pulsenode  # Ensure this matches your ServiceAccount name    namespace: pulse  # CHANGE THIS: Set to the namespace where ad-pulsenode is deployedroleRef:  kind: ClusterRole  name: ad-pulsenode-role  apiGroup: rbac.authorization.k8s.io
Copy

Last updated on

Was this page helpful?