heapster
此模块，在1.8版本以后由metricserver替代
wget https://github.com/kubernetes/heapster/archive/v1.5.4.tar.gz
tar -zxf v1.5.4.tar.gz
cd heapster-1.5.4/
kubectl create -f deploy/kube-config/rbac/heapster-rbac.yaml ##授权
kubectl create -f deploy/kube-config/standalone/heapster-controller.yaml
#####说明问题点
kubectl get pod --namespace=kube-system
kubectl logs -f pods/heapster-75c97b8594-qgs5v -n kube-system ##查看日志信息
1 reflector.go:190] k8s.io/heapster/metrics/util/util.go:30: Failed to list *v1.Node: nodes is forbidden: User "system:serviceaccount:kube-system:heapster" cannot list nodes at the cluster scope
kubectl create -f deploy/kube-config/rbac/heapster-rbac.yaml
kubectl delete -f deploy/kube-config/standalone/heapster-controller.yaml
metrics-server
metrics-server 替换heapster
生成证书：
cat > metrics-server-csr.json <<EOF
{
"CN": "aggregator",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "4Paradigm"
}
]
}
EOFcfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes metrics-server-csr.json | cfssljson -bare metrics-serverkube-apiserver increase the allocation, open the relevant configuration
--requestheader-allowed-names=aggregator \
--requestheader-client-ca-file=/etc/kubernetes/ssl/ca.pem \
--requestheader-allowed-names=aggregator \
--requestheader-extra-headers-prefix=X-Remote-Extra- \
--requestheader-group-headers=X-Remote-Group \
--requestheader-username-headers=X-Remote-User \
--proxy-client-cert-file=/etc/kubernetes/ssl/metrics-server.pem \
--proxy-client-key-file=/etc/kubernetes/ssl/metrics-server-key.pem \
--enable-aggregator-routing=true \--advertise-address: apiserver Foreign advertised IP (kubernetes service backend node the IP);
--default- -toleration-seconds The: abnormality threshold value of the node;
--max- -REQUESTS-Inflight: maximum threshold value associated with the request ;
--etcd- : access etcd certificates and etcd server address;
--experimental-encryption-Provider-config: Specifies etcd configured in secret encryption;
--bind-address: HTTPS listening IP, not 127.0. 0.1, otherwise it can not be accessed outside the secure port 6443;
--secret-port: HTTPS listening port;
--insecure-port = 0: turn off listening non-secure http port (8080);
--tls- -file: use designated apiserver certificates, private keys, and CA files;
--audit- : configure audit strategy and audit log file related parameters;
--client-CA-file: verify client (kue-controller-manager, kube-scheduler, kubelet, kube- proxy, etc.) carried by requesting a certificate;
--enable-on Bootstrap the auth-token-: kubelet bootstrap enable the authentication token;
--requestheader-: Kube-apiserver the aggregator layer configuration parameters related to, proxy-client & HPA required;
--requestheader-Client-CA-File: signature for --proxy-client-cert-file and --proxy-client-key -file specified certificate; used when the metric aggregator is enabled;
--requestheader-allowed-names: not empty, the value CN name --proxy-client-cert-file certificate comma-separated, set here to "aggregator ";
--service-the Account-Key-file: ServiceAccount Token signature public key file, kube-controller-manager of --service-account-private-key- file to specify the private key file, both paired;
--runtime -config = api / all = true: Enables all versions of APIs, such as AutoScaling / v2alpha1;
--authorization-mODE = Node, RBAC, - the auth = Anonymous to false-: open Node and authorization RBAC model, against unauthorized request ;
--enable-plugins-admission number: enable some off by default plugins;
--allow-privileged: container runs execute privileged rights;
--apiserver-COUNT = 3: Specifies the number of apiserver instance;
--event-ttl: Specifies the event s storage time;
--kubelet-: If specified, use https access kubelet APIs; prompt unauthorized needed for the certificate corresponding user (user kubernetes.pem certificate above to kubernetes) RBAC user-defined rules, or API access kubelet;
--proxy- client - *: apiserver metrics-server access to the certificate used;
--service-Cluster-ip-the range: Specifies the Service Cluster IP addresses;
--service-the Node-port-the range: the specified port range NodePort;
Kube-apiserver of --requestheader-allowed-names parameter needs to be consistent with the metric certificate CN field, otherwise it will prompt follow-up access permissions metrics.
If the machine is not running kube-apiserver kube-proxy, you need to add --enable-aggregator-routing = true parameter;
on --requestheader-XXX-related parameters, refer to:
https://github.com/kubernetes-incubator/apiserver-builder/blob/master/docs/concepts
https://docs.bitnami.com/kubernetes/how-to/configure-autoscaling-custom-metrics/
Note:
requestheader-client-ca-file 指定的 CA 证书，必须具有 client auth and server auth；
如果 --requestheader-allowed-names 为空，或者 --proxy-client-cert-file 证书的 CN 名称不在 allowed-names 中，则后续查看 node 或 pods 的 metrics 失败，提示：
###### Error from server (Forbidden): nodes.metrics.k8s.io is forbidden..
kube-controller-manager增加如下参数
--horizontal-pod-autoscaler-use-rest-clients=true
部署：
git clone https://github.com/kubernetes-incubator/metrics-server
cd metrics-server/deploy/1.8+/
修改metrics-server-deployment.yaml
imagePullPolicy: Always
command:
- /metrics-server
- --metric-resolution=30s
- --kubelet-insecure-tls
- --kubelet-preferred-address-types=InternalIP,Hostname,InternalDNS,ExternalDNS,ExternalIP
# cat resource-reader.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: system:metrics-server
rules:
- apiGroups:
- ""
resources:
- pods
- nodes
- nodes/stats
- namespaces
verbs:
- get
- list
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: system:metrics-server
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: metrics-server
namespace: kube-system
kubectl apply -f .
参考链接：
https://blog.51cto.com/blief/2416018
https://www.orchome.com/1203
https://www.jianshu.com/p/a89e1ee3d45e
https://blog.51cto.com/ylw6006/2114338
https://www.jianshu.com/p/d017fc44959e