# Metricbeat vs k8s Clusterwide Stats Collection by a ServiceAccount
**URL:** https://discuss.elastic.co/t/metricbeat-vs-k8s-clusterwide-stats-collection-by-a-serviceaccount/231309
**Category:** Beats
**Tags:** metricbeat
**Created:** [May 6, 2020, 9:46am UTC](https://discuss.elastic.co/t/metricbeat-vs-k8s-clusterwide-stats-collection-by-a-serviceaccount/231309 "2020-05-06T09:46:44Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@stefws](https://discuss.elastic.co/u/stefws)
#### Post date: [May 6, 2020, 9:46am UTC](https://discuss.elastic.co/t/metricbeat-vs-k8s-clusterwide-stats-collection-by-a-serviceaccount/231309/1 "2020-05-06T09:46:44Z")
Attempting to grasp how to collect various stats from a k8s cluster as a newbie k8s admin...
Got a Linux host running a k8s cluster with a metricbeat running collecting various modules.d/system.yml datasets, would like this to also if possible to collect various cluster wide stats from k8s through modules.d/kubernetes.yml.
So I've created a new serviceaccount, fetch it's token: metricbeat like this:
```
kubectl create serviceaccount metricbeat
kubectl get secret `kubectl get serviceaccounts metricbeat -o yaml | awk '/^- name: /{print $3}'` -o yaml | awk '/ token: /{print $2}' > /etc/metricbeat/sa.token
```
Set these into my kubernetes.yml:
```
- module: kubernetes
metricsets:
- node
- system
- pod
- container
period: 1m
hosts: ["https://localhost:6443"]
bearer_token_file: /etc/metricbeat//sa.token
```
Only to get 401:
```
"error":{"message":"error doing HTTP request to fetch 'node' Metricset data: HTTP error 401 in : 401 Unauthorized"}
```
So I'm wondering what ClusterRole + Binding my ServiceAccount would need to have permission to collect the various cluster wide stats about pods,nodes,namespaces,events.
Found these samples [here](https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-kubernetes.html) if running a metricbeat as pod on every cluster node, but not sure they'll cut it for me:
```
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: metricbeat
subjects:
- kind: ServiceAccount
name: metricbeat
namespace: kube-system
roleRef:
kind: ClusterRole
name: metricbeat
apiGroup: rbac.authorization.k8s.io
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: metricbeat
labels:
k8s-app: metricbeat
rules:
- apiGroups: [""]
resources:
- nodes
- namespaces
- events
- pods
verbs: ["get", "list", "watch"]
- apiGroups: ["extensions"]
resources:
- replicasets
verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
resources:
- statefulsets
- deployments
verbs: ["get", "list", "watch"]
- apiGroups:
- ""
resources:
- nodes/stats
verbs:
- get
```
Any hints appreciated, TIA!
---
### Author:  [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [May 7, 2020, 8:19am UTC](https://discuss.elastic.co/t/metricbeat-vs-k8s-clusterwide-stats-collection-by-a-serviceaccount/231309/2 "2020-05-07T08:19:20Z")
Hi @stefws!
Those metricsets (`node`, `pod` etc) collecting metrics from Kubelet API. So this is why you cannot access the metrics clusterwide. See [https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-kubernetes.html#\_example\_configuration\_27](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-kubernetes.html#_example_configuration_27).
There are other Metricsets that can collect cluster wide metrics (retrieved from `kube-state-metrics`). Please have a look at the Module's documentation [here](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-kubernetes.html), and let me know if you have questions!
---
### Author:  [@stefws](https://discuss.elastic.co/u/stefws)
#### Post date: [May 7, 2020, 8:23am UTC](https://discuss.elastic.co/t/metricbeat-vs-k8s-clusterwide-stats-collection-by-a-serviceaccount/231309/3 "2020-05-07T08:23:14Z")
Thanks, will look into State Metrics, but assume my service account still needs some permission/role assignment for some apiGroups/namespace(s) to be allowed to get such data?
---
### Author:  [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [May 7, 2020, 9:14am UTC](https://discuss.elastic.co/t/metricbeat-vs-k8s-clusterwide-stats-collection-by-a-serviceaccount/231309/4 "2020-05-07T09:14:49Z")
Well, `kube-state-metrics` is like a side-car project which runs on k8s, collects metrics and exposes them in Prometheus format. So you will be collecting metrics from this project and not k8s itself.
> **[kubernetes/kube-state-metrics](https://github.com/kubernetes/kube-state-metrics)**
>
> Add-on agent to generate and expose cluster-level metrics. - kubernetes/kube-state-metrics
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 4, 2020, 9:15am UTC](https://discuss.elastic.co/t/metricbeat-vs-k8s-clusterwide-stats-collection-by-a-serviceaccount/231309/5 "2020-06-04T09:15:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.