# 403 Error when scraping kubernetes API (nodes and cadvisor)

**URL:** <https://discuss.prometheus.io/t/403-error-when-scraping-kubernetes-api-nodes-and-cadvisor/230>\
**Category:** General Help/Support\
**Created:** [May 17, 2021, 1:07pm UTC](https://discuss.prometheus.io/t/403-error-when-scraping-kubernetes-api-nodes-and-cadvisor/230 "2021-05-17T13:07:28Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![stevensim226](https://dub1.discourse-cdn.com/flex017/user_avatar/discuss.prometheus.io/stevensim226/32/133_2.png) [@stevensim226](https://discuss.prometheus.io/u/stevensim226)\
**Post date:** [May 17, 2021, 1:07pm UTC](https://discuss.prometheus.io/t/403-error-when-scraping-kubernetes-api-nodes-and-cadvisor/230/1 "2021-05-17T13:07:28Z")

</div>

Currently my setup is as below:

```auto
# ClusterRole for the deployment
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: prometheus
rules:
- apiGroups: [""]
  resources:
  - nodes
  - nodes/proxy
  - nodes/metrics
  - services
  - endpoints
  - pods
  verbs: ["get", "list", "watch"]
- apiGroups:
  - extensions
  resources:
  - ingresses
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]

```

And below are the prometheus.yml config for the nodes and cadvisor

```auto
- job_name: 'kubernetes-cadvisor'

      scheme: https

      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token

      kubernetes_sd_configs:
      - role: node

      relabel_configs:
      - action: labelmap
        regex: __meta_kubernetes_node_label_(.+)
      - target_label: __address__
        replacement: kubernetes.default.svc:443
      - source_labels: [__meta_kubernetes_node_name]
        regex: (.+)
        target_label: __metrics_path__
        replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor

- job_name: 'kubernetes-nodes'

      scheme: https

      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token

      kubernetes_sd_configs:
      - role: node

      relabel_configs:
      - action: labelmap
        regex: __meta_kubernetes_node_label_(.+)
      - target_label: __address__
        replacement: kubernetes.default.svc:443
      - source_labels: [__meta_kubernetes_node_name]
        regex: (.+)
        target_label: __metrics_path__
        replacement: /api/v1/nodes/${1}/proxy/metrics

```

I have already checked the Service Account and the ClusterRoleBinding, it’s already pointing to the `prometheus` ClusterRole above, but it seems that I’m still getting a 403 error on Prometheus when scraping the `kubernetes-nodes` and `kubernetes-cadvisor`

I’m running my environment on GKE Autopilot FYI