Getting issue with node-exporter because of PSP (pod security policy)

3/11/2020

Im getting this error

Error creating: pods "node-exporter" is forbidden: unable to validate against any pod security policy: [spec.secur
ityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used spec.securityContext.hostPID: Invalid value: true: Host PID is not allowed to be used spec.contain
ers[0].hostPort: Invalid value: 9100: Host port 9100 is not allowed to be used. Allowed ports: [0-8000]]

But i checked in another cluster in GCP, its not giving me any issue. Does anyone knows why i'm getting this issue

-- Soju George
google-cloud-platform
kubernetes

2 Answers

3/11/2020

According to documentation default port for node-exporter is 9100 which is outside of the range [0 - 8000] specified by Your Pod security policy. You can see that in the error You provided.

Like coderanger mentioned in his answer. You need to make new policy for the node-exporter.

The simplest way to fix that is to install Prometheus from helm chart which will automatically create PSP from the template that can be found here.

In the other GCP cluster You can try to look for existing PodSecurityPolicy that enables the node-exporter to work correctly. Make sure to look in all namespaces kubectl get psp --all-namespaces.

Hope it helps.

-- Piotr Malec
Source: StackOverflow

3/11/2020

node-exporter needs direct access to the node-level network namespace to be able to gather statistics on this. You have a default security policy that blocks this access. You'll need to make a new policy which allows it, and assign that policy to node-exporter.

-- coderanger
Source: StackOverflow