Solly, PTAL.  Seems to be a HPA service account permissions issue.

yeah looks like someone changed the name of the proxy subresource, but didn't update the HPA RBAC rules...

Rebalancing bugs.  Andrew, PTAL.

Debugging and investigating with Solly yields what might be the root cause:

  https://github.com/openshift/origin/issues/16710

We also found this (unrelated) HPA issue (an update to the controller initialization borked RBAC for the HPA controller, again): https://github.com/openshift/origin/pull/16711

An easy way to reproduce this is to issue:

 $ curl -k -H "Authorization: Bearer $(oc whoami -t)" \
     https://<<<HOSTNAME>>>:8443/api/v1/namespaces/openshift-infra/services/https:heapster:/proxy/apis/metrics/v1/alpha1/nodes

Fixed in https://github.com/openshift/origin/pull/16741

I spent some time validating the tip of Origin @ 9f5c91e050 now that:

 - https://github.com/openshift/origin/pull/16741
 - https://github.com/openshift/origin/pull/16711

have been merged.

Given a deployment I was able to add the HPA and then edit metrics  for CPU Request and Limit to small values. Previously this wasn't possible (fixed by 16711). Given very small request and limit values I saw the pod scale out to 3.

Using curl, I now get: 

curl -H "Authorization: Bearer $(oc whoami -t)" \
  https://fedora-dev-vm-2:8443/api/v1/namespaces/openshift-infra/services/https:heapster:/proxy/apis/metrics/v1alpha1/nodes -k

User "test-admin" cannot get services/proxy in the namespace "openshift-infra".

Tested the bug on the env openshift v3.7.0-0.158.0, now hpav2 can get the metrics correctly. verify the bug

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:3188