使用prometheus-operator监控 etcd状态

一、查看 Etcd 信息

获取 Etcd Pod 名称

$ kubectl get pods -n kube-system | grep etcd
etcd-k8s-master-2-11                      1/1     Running   9          55d

查看 Etcd 描述信息

$ kubectl describe pod etcd-k8s-master-2-11 -n kube-system ...... Containers:  Command: etcd  --advertise-client-urls=https://192.168.2.11:2379  --cert-file=/etc/kubernetes/pki/etcd/server.crt  --client-cert-auth=true  --data-dir=/var/lib/etcd  --initial-advertise-peer-urls=https://192.168.2.11:2380  --initial-cluster=k8s-master-2-11=https://192.168.2.11:2380  --key-file=/etc/kubernetes/pki/etcd/server.key  --listen-client-urls=https://127.0.0.1:2379,https://192.168.2.11:2379  --listen-peer-urls=https://192.168.2.11:2380  --name=k8s-master-2-11  --peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt  --peer-client-cert-auth=true  --peer-key-file=/etc/kubernetes/pki/etcd/peer.key  --peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt  --snapshot-count=10000  --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt ......

可以看到 ETCD 的证书文件在 Kubernetes Master 节点的 “/etc/kubernetes/pki/etcd/” 文件夹下。

二、将证书存入 Kubernetes

利用 kubectl 命令将三个证书文件存入 Kubernetes 的 Secret 资源下。

$ kubectl create secret generic etcd-certs --from-file=/etc/kubernetes/pki/etcd/healthcheck-client.crt --from-file=/etc/kubernetes/pki/etcd/healthcheck-client.key --from-file=/etc/kubernetes/pki/etcd/ca.crt -n monitoring

查看刚刚创建的资源

$ kubectl get secret etcd-certs -n monitoring 

NAME         TYPE     DATA   AGE
etcd-certs   Opaque   3      1m

三、将证书挂入 Prometheus

编译 prometheus 资源

$ kubectl edit prometheus k8s -n monitoring

将证书挂入

apiVersion: monitoring.coreos.com/v1
kind: Prometheus
metadata:  annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"monitoring.coreos.com/v1","kind":"Prometheus","metadata":{"annotations":{},"labels":{"prometheus":"k8s"},"name":"k8s","namespace":"monitoring"},"spec":{"alerting":{"alertmanagers":[{"name":"alertmanager-main","namespace":"monitoring","port":"web"}]},"baseImage":"quay-mirror.qiniu.com/prometheus/prometheus","nodeSelector":{"beta.kubernetes.io/os":"linux"},"replicas":2,"resources":{"requests":{"memory":"400Mi"}},"ruleSelector":{"matchLabels":{"prometheus":"k8s","role":"alert-rules"}},"securityContext":{"fsGroup":2000,"runAsNonRoot":true,"runAsUser":1000},"serviceAccountName":"prometheus-k8s","serviceMonitorNamespaceSelector":{},"serviceMonitorSelector":{},"storage":{"volumeClaimTemplate":{"spec":{"resources":{"requests":{"storage":"8Gi"}},"storageClassName":"fast"}}},"version":"v2.7.2"}}  creationTimestamp: "2019-06-07T22:15:37Z"  generation: 5  labels:  prometheus: k8s  name: k8s  namespace: monitoring  resourceVersion: "2128109"  selfLink: /apis/monitoring.coreos.com/v1/namespaces/monitoring/prometheuses/k8s  uid: c6daa0a1-8971-11e9-bc01-000c29d98697 spec:  alerting:  alertmanagers:  - name: alertmanager-main  namespace: monitoring  port: web  baseImage: quay-mirror.qiniu.com/prometheus/prometheus  nodeSelector: beta.kubernetes.io/os: linux  replicas: 2  resources:  requests:  memory: 400Mi  ruleSelector:  matchLabels:  prometheus: k8s  role: alert-rules  secrets: #------新增证书配置，将etcd证书挂入  - etcd-certs

更新完成后就可以在 Prometheus Pod 中看到上面挂入的 etcd 证书，我们可以进入 Pod 中查看：

$ kubectl exec -it prometheus-k8s-0 /bin/sh -n monitoring

/prometheus $ ls /etc/prometheus/secrets/etcd-certs/
ca.crt                  healthcheck-client.crt  healthcheck-client.key

四、创建 Etcd Service & Endpoints

因为 ETCD 是独立于集群之外的，所以我们需要创建一个 Endpoints 将其代理到 Kubernetes 集群，然后创建一个 Service 绑定 Endpoints，然后 Kubernetes 集群的应用就可以访问 ETCD 了。

etcd-service.yaml

apiVersion: v1
kind: Service
metadata:  name: etcd-k8s  namespace: kube-system  labels:  k8s-app: etcd spec:  type: ClusterIP  clusterIP: None #设置为None，不分配Service IP  ports:  - name: port  port: 2379  protocol: TCP --- apiVersion: v1 kind: Endpoints metadata:  name: etcd-k8s  namespace: kube-system  labels:  k8s-app: etcd subsets: - addresses:  - ip: 192.168.2.11 #Etcd 所在节点的IP  ports:  - port: 2379 #Etcd 端口号

创建 Service & Endpoints

$ kubectl apply -f etcd-service.yaml

五、创建 ServiceMonitor

创建 Prometheus 监控资源，配置用于监控 Etcd 参数。

etcd-monitor.yaml

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:  name: etcd-k8s  namespace: monitoring  labels:  k8s-app: etcd-k8s spec:  jobLabel: k8s-app  endpoints:  - port: port  interval: 30s  scheme: https  tlsConfig:  caFile: /etc/prometheus/secrets/etcd-certs/ca.crt  certFile: /etc/prometheus/secrets/etcd-certs/healthcheck-client.crt  keyFile: /etc/prometheus/secrets/etcd-certs/healthcheck-client.key  insecureSkipVerify: true  selector:  matchLabels:  k8s-app: etcd  namespaceSelector:  matchNames:  - kube-system