Configure Kubernetes Metrics Collection Using the PulseNode Agent

Kubernetes metrics collection in Pulse requires cluster-scoped RBAC permissions. Namespace-scoped Role and RoleBinding are not sufficient for Kubernetes metrics retrieval.

Kubernetes metrics require ClusterRole access.
Namespace-scoped RBAC does not enable Kubernetes metrics collection.
Without ClusterRole, Pulse collects only base system metrics.
Configure ServiceAccount, ClusterRole, and ClusterRoleBinding for full Kubernetes observability.

Info

Ensure to deploy the Pulse Node Agent on Kubernetes. For details, see Deploy PulseNode Agent on Kubernetes.

PulseNode collects Kubernetes metrics using cluster-level endpoints such as:

nodes
nodes/stats
nodes/proxy
pods
events
persistentvolumes
persistentvolumeclaims

These endpoints require a ClusterRole and ClusterRoleBinding. Without cluster-level access, Kubernetes API endpoints are not accessible.

Behavior Without ClusterRole

If ClusterRole access is not granted:

Kubernetes metrics (node, pod, event, and volume metrics) are not collected
Namespace-level Kubernetes metrics are not collected
Only base system metrics from the host are collected

The following system metrics are still collected (no Kubernetes RBAC required):

# ================================ # Base System Metrics (No RBAC required) # ================================ [[inputs.mem]] [[inputs.system]] [[inputs.swap]] [[inputs.net]] [[inputs.cpu]] percpu = false totalcpu = true fielddrop = [ "time_*" ] [[inputs.disk]] ignore_fs = [ "tmpfs", "devtmpfs", "devfs", "iso9660", "overlay", "aufs", "squashfs" ] [[inputs.diskio]] skip_serial_number = true [[inputs.linux_sysctl_fs]] [[processors.rename]] [[processors.rename.replace]] field = "aio-max-nr" dest = "aio_max_nr" [[processors.rename.replace]] field = "aio-nr" dest = "aio_nr" [[processors.rename.replace]] field = "dentry-age-limit" dest = "dentry_age_limit" [[processors.rename.replace]] field = "dentry-nr" dest = "dentry_nr" [[processors.rename.replace]] field = "dentry-unused-nr" dest = "dentry_unused_nr" [[processors.rename.replace]] field = "dentry-want-pages" dest = "dentry_want_pages" [[processors.rename.replace]] field = "file-max" dest = "file_max" [[processors.rename.replace]] field = "file-nr" dest = "file_nr" [[processors.rename.replace]] field = "inode-free-nr" dest = "inode_free_nr" [[processors.rename.replace]] field = "inode-nr" dest = "inode_nr" [[processors.rename.replace]] field = "inode-preshrink-nr" dest = "inode_preshrink_nr" [[inputs.kernel]] [[inputs.processes]]

These metrics are collected directly from the host and do not require Kubernetes API access.

Required RBAC Configuration for Full Kubernetes Metrics

To enable Kubernetes metrics collection, configure the following RBAC resources.

apiVersion: v1 kind: ServiceAccount metadata: name: ad-pulsenode namespace: pulse # CHANGE THIS: Set to the namespace where ad-pulsenode is deployed --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ad-pulsenode-role rules: # Required for inputs.kubernetes (Kubelet API) - apiGroups: [""] resources: ["nodes", "nodes/stats", "nodes/proxy"] verbs: ["get", "list", "watch"] # Required for inputs.kube_event (Events API) - apiGroups: [""] resources: ["events"] verbs: ["get", "list", "watch"] # Required for inputs.kubernetes (Pod/Container discovery) - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch"] # Required for inputs.kubernetes (Volume metrics) - apiGroups: [""] resources: ["persistentvolumes", "persistentvolumeclaims"] verbs: ["get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: ad-pulsenode-binding subjects: - kind: ServiceAccount name: ad-pulsenode # Ensure this matches your ServiceAccount name namespace: pulse # CHANGE THIS: Set to the namespace where ad-pulsenode is deployed roleRef: kind: ClusterRole name: ad-pulsenode-role apiGroup: rbac.authorization.k8s.io

Last updated on

Was this page helpful?