HPA cannot get metrics due to 403 errors

4/9/2020

I used the following metrics inside hpa

apiVersion: autoscaling/v2beta2
kind: HorizontalPodAutoscaler
metadata:
  name: app-svc-hpa
  namespace: default
spec:
  scaleTargetRef:
    apiVersion: extensions/v1beta1
    kind: Deployment
    name: app-svc
  minReplicas: 1
  maxReplicas: 1000
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 50
  - type: Pods
    pods:
      metric:
        name: packets-per-second
      target:
        type: AverageValue
        averageValue: 1k

But the hpa is unable to get the metrics

Warning FailedGetPodsMetric 14s (x6 over 1m) horizontal-pod-autoscaler unable to get metric packets-per-second: unable to fetch metrics from custom metrics API: the server could not find the descriptor for metric custom.googleapis.com/packets-per-second: googleapi: Error 403: Permission monitoring.metricDescriptors.get denied (or the resource may not exist)., forbidden

I am running the pods on a dedicated nodepool and each nodes is running under a service account.

The service account does have these iam roles

Monitoring Viewere, Monitoring Metrics Writer

Unsure how to fix this error. Any pointers are greatly appreciated. Thanks.

-- Varunkumar Manohar
google-kubernetes-engine
horizontal-pod-autoscaling
kubernetes

1 Answer

4/10/2020

I had a cluster with workload identity enabled. Apparently when a cluster has workload identity enabled, the metrics fetch was failing.

1) I had to install the custom stack driver adapter and create the custom metric as pointed by David Kruk in his comments

2) I had to add the hostNetwork:true in the custom stackdriver adapter deployment pod spec. The issue is mentioned here in github repository for csa

With these two updates, the autoscaler works as expected.

-- Varunkumar Manohar
Source: StackOverflow