k8s v1.14 metrics-server

metrics-server这里不详细介绍,可以参考metrics-server安装季

安装metrics-server

        这里安装和之前的metrics-server安装季稍微有点不一样,之前集群安装没有使用https证书,后面去各种生成的证书和踩坑,这里是在安装的时候一开始就使用了https全证书,所有稍微有一点区别,这里只列出有区别的地方,其他的完全可以参考metrics-server安装季,这里https证书不需要重新生成;

        配置文件也不需要添加,在v1.14安装的时候就已经吧配置文件添加进去了,所以这里配置文件也不需要增加

文件的修改

  • 修改 metrics-server-deployment.yaml

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    # cat metrics-server-deployment.yaml
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: metrics-server
    namespace: kube-system
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
    name: metrics-server
    namespace: kube-system
    labels:
    k8s-app: metrics-server
    spec:
    selector:
    matchLabels:
    k8s-app: metrics-server
    template:
    metadata:
    name: metrics-server
    labels:
    k8s-app: metrics-server
    spec:
    serviceAccountName: metrics-server
    hostNetwork: true 这个还是需要增加
    volumes:
    # mount in tmp so we can safely use from-scratch images and/or read-only containers
    - name: tmp-dir
    emptyDir: {}
    containers:
    - name: metrics-server
    image: mirrorgooglecontainers/metrics-server-amd64:v0.3.4
    imagePullPolicy: Always
    args: # 这里不一样
    - --metric-resolution=30s
    - --kubelet-preferred-address-types=InternalIP,Hostname,InternalDNS,ExternalDNS,ExternalIP
    volumeMounts:
    - name: tmp-dir
    mountPath: /tmp
  • –metric-resolution=30s:从 kubelet 采集数据的周期;

  • –kubelet-preferred-address-types:优先使用 InternalIP 来访问 kubelet,这样可以避免节点名称没有 DNS 解析记录时,通过节点名称调用节点 kubelet API 失败的情况(未配置时默认的情况);

  • hostNetwork: true: 这个不增加的会提示:

    1
    Error from server (ServiceUnavailable): the server is currently unable to handle the request
  • 修改 resource-reader.yaml

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    # cat resource-reader.yaml 
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
    name: system:metrics-server
    rules:
    - apiGroups:
    - ""
    resources:
    - pods
    - nodes
    - nodes/stats
    - namespaces
    verbs:
    - get
    - list
    - watch
    - apiGroups: # 增加
    - "extensions"
    resources:
    - deployments
    verbs:
    - get
    - list
    - update
    - watch
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
    name: system:metrics-server
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:metrics-server
    subjects:
    - kind: ServiceAccount
    name: metrics-server
    namespace: kube-system

执行创建

1
# kubectl apply -f ./

查看运行情况

1
2
3
4
5
6
7
# kubectl -n kube-system get pods -l k8s-app=metrics-server
NAME READY STATUS RESTARTS AGE
metrics-server-94ff5d4cc-b97l5 1/1 Running 0 21m

# kubectl get svc -n kube-system metrics-server
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
metrics-server ClusterIP 10.254.61.132 <none> 443/TCP 27m

获取v1beta1.metrics.k8s.io并验证

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# kubectl get apiservice
NAME SERVICE AVAILABLE AGE
v1. Local True 23h
v1.apps Local True 23h
v1.authentication.k8s.io Local True 23h
v1.authorization.k8s.io Local True 23h
v1.autoscaling Local True 23h
v1.batch Local True 23h
v1.coordination.k8s.io Local True 23h
v1.networking.k8s.io Local True 23h
v1.rbac.authorization.k8s.io Local True 23h
v1.scheduling.k8s.io Local True 23h
v1.storage.k8s.io Local True 23h
v1alpha1.auditregistration.k8s.io Local True 23h
v1alpha1.node.k8s.io Local True 23h
v1alpha1.rbac.authorization.k8s.io Local True 23h
v1alpha1.scheduling.k8s.io Local True 23h
v1alpha1.settings.k8s.io Local True 23h
v1alpha1.storage.k8s.io Local True 23h
v1beta1.admissionregistration.k8s.io Local True 23h
v1beta1.apiextensions.k8s.io Local True 23h
v1beta1.apps Local True 23h
v1beta1.authentication.k8s.io Local True 23h
v1beta1.authorization.k8s.io Local True 23h
v1beta1.batch Local True 23h
v1beta1.certificates.k8s.io Local True 23h
v1beta1.coordination.k8s.io Local True 23h
v1beta1.events.k8s.io Local True 23h
v1beta1.extensions Local True 23h
v1beta1.metrics.k8s.io kube-system/metrics-server True 27m
v1beta1.networking.k8s.io Local True 23h
v1beta1.node.k8s.io Local True 23h
v1beta1.policy Local True 23h
v1beta1.rbac.authorization.k8s.io Local True 23h
v1beta1.scheduling.k8s.io Local True 23h
v1beta1.storage.k8s.io Local True 23h
v1beta2.apps Local True 23h
v2alpha1.batch Local True 23h
v2beta1.autoscaling Local True 23h
v2beta2.autoscaling Local True 23h

metrics-server 的命令行参数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
# kubectl exec --namespace kube-system -it metrics-server-94ff5d4cc-b97l5 -- /metrics-server --help
Launch metrics-server

Usage:
[flags]

Flags:
--alsologtostderr log to standard error as well as files
--authentication-kubeconfig string kubeconfig file pointing at the 'core' kubernetes server with enough rights to create tokenaccessreviews.authentication.k8s.io.
--authentication-skip-lookup If false, the authentication-kubeconfig will be used to lookup missing authentication configuration from the cluster.
--authentication-token-webhook-cache-ttl duration The duration to cache responses from the webhook token authenticator. (default 10s)
--authentication-tolerate-lookup-failure If true, failures to look up missing authentication configuration from the cluster are not considered fatal. Note that this can result in authentication that treats all requests as anonymous.
--authorization-always-allow-paths strings A list of HTTP paths to skip during authorization, i.e. these are authorized without contacting the 'core' kubernetes server.
--authorization-kubeconfig string kubeconfig file pointing at the 'core' kubernetes server with enough rights to create subjectaccessreviews.authorization.k8s.io.
--authorization-webhook-cache-authorized-ttl duration The duration to cache 'authorized' responses from the webhook authorizer. (default 10s)
--authorization-webhook-cache-unauthorized-ttl duration The duration to cache 'unauthorized' responses from the webhook authorizer. (default 10s)
--bind-address ip The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank, all interfaces will be used (0.0.0.0 for all IPv4 interfaces and :: for all IPv6 interfaces). (default 0.0.0.0)
--cert-dir string The directory where the TLS certs are located. If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored. (default "apiserver.local.config/certificates")
--client-ca-file string If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.
--contention-profiling Enable lock contention profiling, if profiling is enabled
-h, --help help for this command
--http2-max-streams-per-connection int The limit that the server gives to clients for the maximum number of streams in an HTTP/2 connection. Zero means to use golang's default.
--kubeconfig string The path to the kubeconfig used to connect to the Kubernetes API server and the Kubelets (defaults to in-cluster config)
--kubelet-certificate-authority string Path to the CA to use to validate the Kubelet's serving certificates.
--kubelet-insecure-tls Do not verify CA of serving certificates presented by Kubelets. For testing purposes only.
--kubelet-port int The port to use to connect to Kubelets. (default 10250)
--kubelet-preferred-address-types strings The priority of node address types to use when determining which address to use to connect to a particular node (default [Hostname,InternalDNS,InternalIP,ExternalDNS,ExternalIP])
--log-flush-frequency duration Maximum number of seconds between log flushes (default 5s)
--log_backtrace_at traceLocation when logging hits line file:N, emit a stack trace (default :0)
--log_dir string If non-empty, write log files in this directory
--log_file string If non-empty, use this log file
--logtostderr log to standard error instead of files (default true)
--metric-resolution duration The resolution at which metrics-server will retain metrics. (default 1m0s)
--profiling Enable profiling via web interface host:port/debug/pprof/ (default true)
--requestheader-allowed-names strings List of client certificate common names to allow to provide usernames in headers specified by --requestheader-username-headers. If empty, any client certificate validated by the authorities in --requestheader-client-ca-file is allowed.
--requestheader-client-ca-file string Root certificate bundle to use to verify client certificates on incoming requests before trusting usernames in headers specified by --requestheader-username-headers. WARNING: generally do not depend on authorization being already done for incoming requests.
--requestheader-extra-headers-prefix strings List of request header prefixes to inspect. X-Remote-Extra- is suggested. (default [x-remote-extra-])
--requestheader-group-headers strings List of request headers to inspect for groups. X-Remote-Group is suggested. (default [x-remote-group])
--requestheader-username-headers strings List of request headers to inspect for usernames. X-Remote-User is common. (default [x-remote-user])
--secure-port int The port on which to serve HTTPS with authentication and authorization.If 0, don't serve HTTPS at all. (default 443)
--skip_headers If true, avoid header prefixes in the log messages
--stderrthreshold severity logs at or above this threshold go to stderr
--tls-cert-file string File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to the directory specified by --cert-dir.
--tls-cipher-suites strings Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be use. Possible values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_RC4_128_SHA
--tls-min-version string Minimum TLS version supported. Possible values: VersionTLS10, VersionTLS11, VersionTLS12
--tls-private-key-file string File containing the default x509 private key matching --tls-cert-file.
--tls-sni-cert-key namedCertKey A pair of x509 certificate and private key file paths, optionally suffixed with a list of domain patterns which are fully qualified domain names, possibly with prefixed wildcard segments. If no domain patterns are provided, the names of the certificate are extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns trump over extracted names. For multiple key/certificate pairs, use the --tls-sni-cert-key multiple times. Examples: "example.crt,example.key" or "foo.crt,foo.key:*.foo.com,foo.com". (default [])
-v, --v Level number for the log level verbosity
--vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered logging

: 如果是使用metrics-server 源码安装的,metrics-server-deployment.yaml文件需要这样修改,其他修改不变

  • 修改1

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    - name: metrics-server
    image: mirrorgooglecontainers/metrics-server-amd64:v0.3.6
    args:
    - --cert-dir=/tmp
    - --secure-port=4443
    - --metric-resolution=30s
    - --kubelet-preferred-address-types=InternalIP,Hostname,InternalDNS,ExternalDNS,ExternalIP
    ports:
    - name: main-port
    containerPort: 4443
    protocol: TCP
  • 修改2
            除了上述修改,还可以用这种方式修改

    1
    2
    3
    4
    5
    6
    command:
    - /metrics-server
    - --cert-dir=/tmp
    - --kubelet-insecure-tls
    - --secure-port=4443
    - --kubelet-preferred-address-types=InternalIp,Hostname,InternalDNS,ExternalDNS,ExternalIP
坚持原创技术分享,您的支持将鼓励我继续创作!
0%