虚拟化平台与集群

1. Open Datacenter → Permissions → Users → Add, enter the user name dumbmonit, choose the realm Proxmox VE authentication server, then click Add.

   dumbmonit@pve

2. Open Datacenter → Permissions → Add → User Permission: path /, user dumbmonit@pve, role PVEAuditor, then click Add.

3. Open Datacenter → Permissions → API Tokens → Add: user dumbmonit@pve, Token ID monitor, untick Privilege Separation, then click Add.

   dumbmonit@pve!monitor

4. Copy the Token ID and the Secret into DumbMonit's Token ID and Secret fields. The secret is shown only once.

5. Optional, for the pending-updates count: Datacenter → Permissions → Roles → Create a role with only Sys.Modify, then add it as a User Permission on path /nodes.

6. In DumbMonit, enter the address of any node (port 8006 by default).

注意. Proxmox VE uses a self-signed certificate by default: tick "Accept an unverifiable certificate" in the options if the connection is refused. On Proxmox VE 8, guest agent details also need VM.Monitor (see the guide).

1. Open Configuration → Access Control → Users → Add, enter the user name dumbmonit with the realm pdm and no password, then click Add.

   dumbmonit@pdm

2. Open Configuration → Access Control → API Tokens → Add, pick that user and name the token monitor. Copy the Secret now, it is shown only once.

   dumbmonit@pdm!monitor

3. Open Configuration → Access Control → Permissions → Add → User Permission: path /, user dumbmonit@pdm, role Auditor.

4. Add a second permission with Add → API Token Permission: path /, token dumbmonit@pdm!monitor, role Auditor. A token has its own permissions, so both are needed.

5. In DumbMonit, enter the console address (for example dc.lan:8443), the Token ID and the Secret.

注意. The console uses a self-signed certificate by default: tick "Accept an unverifiable certificate" in the options if the connection is refused.

1. On a vCenter, open Administration → Single Sign On → Users and Groups → Users, choose the domain vsphere.local, click Add and enter this user name with a long random password.

   dumbmonit

2. Open Administration → Access Control → Global Permissions → Add: pick that user, role Read-only, tick Propagate to children.

3. On a standalone ESXi host instead: in the host client, Manage → Security & users → Users → Add user dumbmonit, then Host → Actions → Permissions → Add user with role Read-only.

4. In DumbMonit, enter the vCenter or host address, with the user [email protected] on a vCenter or dumbmonit on a host. Add only the vCenter when one manages the hosts.

注意. vCenter and ESXi use a self-signed certificate by default: enable "Accept an unverifiable certificate" unless the DumbMonit host trusts their certificate authority.

1. On every host of the pool, create a local account with a long random password.

   useradd -M -s /sbin/nologin dumbmonit
   passwd dumbmonit

2. On the pool coordinator, turn on PAM authentication once.

   xe pool-enable-external-auth auth-type=PAM service-name=pam

3. Register the account as a subject and note the UUID it prints.

   xe subject-add subject-name=dumbmonit

4. Give that subject the built-in read-only role, with the UUID.

   xe subject-role-add uuid=SUBJECT_UUID role-name=read-only

5. In DumbMonit, enter the address of the pool coordinator (for example xcp01.lan) with that user name and password.

注意. If the pool already uses Active Directory, create the account there and skip steps 1 and 2. XCP-ng uses a self-signed certificate: enable "Accept an unverifiable certificate" unless the DumbMonit host trusts it.

1. In Prism Central, open Admin Center → IAM → Identities and add a local user with a long random password.

   dumbmonit

2. Open Admin Center → IAM → Authorization Policies and create a policy with the Prism Viewer role, for all entities, assigned to that user.

3. In DumbMonit, enter the Prism Central address (for example prism-central.lan) with that user name and password.

注意. Needs Prism Central pc.2024.3 or later (v4 API); Prism Element alone is not supported. Prism Central uses a self-signed certificate: enable "Accept an unverifiable certificate" unless DumbMonit trusts it.

1. Create the service account.

   kubectl create serviceaccount dumbmonit -n kube-system

2. Create a ClusterRole that can only get and list what DumbMonit reads.

   kubectl create clusterrole dumbmonit-read --verb=get,list --resource=nodes,pods,persistentvolumeclaims,events,deployments.apps,statefulsets.apps,daemonsets.apps

3. Bind the role to the service account.

   kubectl create clusterrolebinding dumbmonit-read --clusterrole=dumbmonit-read --serviceaccount=kube-system:dumbmonit

4. Create a token that does not expire, then print the token and the cluster CA in base64.

   echo '{"apiVersion":"v1","kind":"Secret","metadata":{"name":"dumbmonit-token","namespace":"kube-system","annotations":{"kubernetes.io/service-account.name":"dumbmonit"}},"type":"kubernetes.io/service-account-token"}' | kubectl apply -f -
   kubectl -n kube-system get secret dumbmonit-token -o jsonpath='{.data.token}' | base64 -d
   kubectl -n kube-system get secret dumbmonit-token -o jsonpath='{.data.ca\.crt}'

5. In DumbMonit, enter the API server address (for example https://k3s.lan:6443), paste the token as Service account token and the CA as Cluster CA certificate.

注意. On k3s, run each command as sudo k3s kubectl. The API server certificate only lists its own names and addresses: use one it lists, or tick Accept an unverifiable certificate.