T2system:monitoringcluster
Monitoring role for scraping component, node, and API-server metrics.
Low direct write risk, but metrics can leak version, topology, and workload metadata.
- →
Metrics endpoints can expose sensitive operational data: request rates, error rates, resource names, and label values.
- →
Verify only monitoring ServiceAccounts (Prometheus, Datadog, etc.) are bound to this role.
- →
Reads Node objects cluster-wide, which is T2 rather than pure recon: node annotations can carry overlay network details, so the role is bounded by what those objects hold rather than by being read-only.
Permissions (2)
| apiGroup | resources / urls | verbs |
|---|---|---|
| (non-resource) | /flagz, /healthz, /healthz/*, /livez, /livez/*, /metrics, /metrics/slis, /readyz, /readyz/*, /statusz | get |
| "" | nodes/metrics | get |
Audit: MetadataK8s docs ↗