kube-state-metrics on EKS, GKE, AKS & OpenShift

kube-state-metrics installs the same way on every managed Kubernetes platform — but each cloud provider has platform-specific considerations for networking, RBAC, IAM, and security context. This guide covers kube-state-metrics on EKS, GKE, AKS, and OpenShift with platform-specific configurations.

kube-state-metrics on AWS EKS

On AWS EKS, kube-state-metrics is straightforward to install via Helm. The main consideration is IAM roles for service accounts (IRSA) if you want to forward metrics to CloudWatch or Amazon Managed Prometheus.

Standard EKS Installation

# Create monitoring namespace
kubectl create namespace monitoring

# Install via Helm (works identically to vanilla K8s)
helm install kube-state-metrics \
  prometheus-community/kube-state-metrics \
  --namespace monitoring \
  --set resources.requests.cpu=100m \
  --set resources.requests.memory=256Mi

EKS + Amazon Managed Prometheus

To forward kube-state-metrics data to Amazon Managed Service for Prometheus (AMP):

# Install Prometheus with AMP remote_write
helm install kube-prometheus-stack \
  prometheus-community/kube-prometheus-stack \
  --set prometheus.prometheusSpec.remoteWrite[0].url=\
    "https://aps-workspaces.us-east-1.amazonaws.com/workspaces/<workspace-id>/api/v1/remote_write" \
  --set prometheus.prometheusSpec.remoteWrite[0].sigv4.region=us-east-1

ℹ️

For eks kube-state-metrics deployments, note that EKS Fargate nodes don't support DaemonSets. kube-state-metrics (a Deployment) works on Fargate — but node-exporter (a DaemonSet) does not.

kube-state-metrics on Google GKE

On GKE, Google Cloud Monitoring (formerly Stackdriver) provides native Kubernetes metrics, but kube-state-metrics + Prometheus is preferred for teams wanting PromQL flexibility, long-term storage, and Grafana dashboards.

GKE Installation

# GKE Autopilot note: use resource requests that fit within Autopilot limits
helm install kube-state-metrics \
  prometheus-community/kube-state-metrics \
  --namespace monitoring \
  --set resources.requests.cpu=50m \
  --set resources.requests.memory=128Mi \
  --set resources.limits.cpu=500m \
  --set resources.limits.memory=512Mi

GKE Workload Identity

If using Google Managed Prometheus (GMP), bind the kube-state-metrics ServiceAccount to a GCP service account via Workload Identity:

kubectl annotate serviceaccount kube-state-metrics \
  --namespace monitoring \
  iam.gke.io/gcp-service-account=ksm-sa@PROJECT_ID.iam.gserviceaccount.com

💡

On GKE Autopilot, resources are enforced. Set explicit resources.requests and resources.limits in the Helm values — Autopilot rejects pods without both set.

kube-state-metrics on Azure AKS

On AKS, the installation is standard. Azure Monitor for Containers provides some overlapping functionality but kube-state-metrics + Prometheus is still the standard for teams using Grafana.

AKS Installation with Azure Monitor

helm install kube-state-metrics \
  prometheus-community/kube-state-metrics \
  --namespace monitoring

# Optional: enable Azure Monitor scraping of KSM
az aks update --resource-group myRG --name myAKS \
  --enable-azure-monitor-metrics

AKS Pod Security

AKS enforces Azure Policy for pod security. If kube-state-metrics fails to start due to a security policy violation:

kubectl describe pod -l app.kubernetes.io/name=kube-state-metrics -n monitoring
# Look for: Error from server (Forbidden): admission webhook denied the request

# Fix: ensure the Helm chart's securityContext is compatible
--set securityContext.runAsNonRoot=true \
--set securityContext.runAsUser=65534 \
--set securityContext.fsGroup=65534

kube-state-metrics on Red Hat OpenShift

OpenShift adds Security Context Constraints (SCCs) on top of standard Kubernetes RBAC. The kube-state-metrics pod needs permission to run with a specific UID.

OpenShift SCC Configuration

# Create a service account for KSM
oc create serviceaccount kube-state-metrics -n monitoring

# Grant the nonroot-v2 SCC (OpenShift 4.11+)
oc adm policy add-scc-to-user nonroot-v2 \
  -z kube-state-metrics -n monitoring

# Or use the anyuid SCC for older OpenShift versions
oc adm policy add-scc-to-user anyuid \
  -z kube-state-metrics -n monitoring

OpenShift Helm Install

helm install kube-state-metrics \
  prometheus-community/kube-state-metrics \
  --namespace monitoring \
  --set serviceAccount.name=kube-state-metrics \
  --set securityContext.runAsNonRoot=true \
  --set podSecurityContext.runAsUser=65534

⚠️

On OpenShift, the default restricted SCC blocks kube-state-metrics from reading cluster-wide resources. Always explicitly bind the ServiceAccount to an appropriate SCC before installing — otherwise the pod starts but generates continuous Forbidden watch errors.

Cross-Platform Comparison

Platform	Notable Consideration	Recommendation
AWS EKS	Fargate node compatibility	Use EC2 node group for KSM
Google GKE	Autopilot resource enforcement	Always set limits
Azure AKS	Azure Policy admission webhooks	Set nonroot securityContext
OpenShift	SCC required for cluster reads	Bind nonroot-v2 SCC
k3s / k0s	Not pre-installed	Standard Helm install works