八、K8S metrics-server

下载yaml文件

wget https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/high-availability.yaml

改名：mv high-availability.yaml metrics-server.yaml

查看镜像地址

查看镜像地址
grep -rn image high-availability.yaml 
150:        image: k8s.gcr.io/metrics-server/metrics-server:v0.6.1
151:        imagePullPolicy: IfNotPresent

设置镜像地址为阿里云
sed -i "s#k8s.gcr.io/metrics-server#registry.cn-hangzhou.aliyuncs.com/chenby#g" high-availability.yaml

查看镜像地址已更新
grep -rn image high-availability.yaml 
150:        image: registry.cn-hangzhou.aliyuncs.com/chenby/metrics-server:v0.6.1
151:        imagePullPolicy: IfNotPresent
vim high-availability.yaml
添加"- --kubelet-insecure-tls"
执行配置
kubectl apply -f high-availability.yaml

[root@k8s-master-1 cfg]# kubectl get pod -n kube-system
NAME                                    READY   STATUS    RESTARTS   AGE

metrics-server-6f6c655778-ds596         1/1     Running   0          28m
metrics-server-6f6c655778-m6r7g         1/1     Running   0          28m
#启动正常，查看top 报错如下图

?查看API-server日志报错如下

是因为缺少认证的证书文件，创建文件

[root@k8s-master-1 ssl]# 
[root@k8s-master-1 ssl]#  cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -profile=kubernetes -config=ca-config.json proxy-client-csr.json | cfssljson -bare proxy-client
2023/05/04 14:53:56 [INFO] generate received request
2023/05/04 14:53:56 [INFO] received CSR
2023/05/04 14:53:56 [INFO] generating key: rsa-2048
2023/05/04 14:53:56 [INFO] encoded CSR
2023/05/04 14:53:56 [INFO] signed certificate with serial number 469318432138754596153118826805525884889293204022
2023/05/04 14:53:56 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
[root@k8s-master-1 ssl]# 
[root@k8s-master-1 ssl]# 
[root@k8s-master-1 ssl]# ls
ca-config.json  ca-csr.json  ca.pem          kube-proxy-csr.json  kube-proxy.pem  kubernetes-csr.json  kubernetes.pem    proxy-client-csr.json  proxy-client.pem
ca.csr          ca-key.pem   kube-proxy.csr  kube-proxy-key.pem   kubernetes.csr  kubernetes-key.pem   proxy-client.csr  proxy-client-key.pem
[root@k8s-master-1 ssl]# 
[root@k8s-master-1 ssl]# 

?修改kube-apiserver.conf，添加如下内容

--runtime-config=api/all=true \
--requestheader-allowed-names=aggregator \
--requestheader-group-headers=X-Remote-Group \
--requestheader-username-headers=X-Remote-User \
--requestheader-extra-headers-prefix=X-Remote-Extra- \
--requestheader-client-ca-file=/k8s/kubernetes/ssl/ca.pem \
--proxy-client-cert-file=/k8s/kubernetes/ssl/proxy-client.pem \
--proxy-client-key-file=/k8s/kubernetes/ssl/proxy-client-key.pem \

参数说明：
–requestheader-client-ca-file： 客户端 CA 证书。
–requestheader-allowed-names： 允许访问的客户端 common names 列表，通过header中–requestheader-username-headers 参数指定的字段获取。
客户端 common names 的名称需要在 client-ca-file 中进行设置，将其设置为空值时，表示任意客户端都可访问。
–requestheader-username-headers： 参数指定的字段获取。
–requestheader-extra-headers-prefix： 请求头中需要检查的前缀名。
–requestheader-group-headers 请求头中需要检查的组名。
–requestheader-username-headers 请求头中需要检查的用户名。
–proxy-client-cert-file： 在请求期间验证 Aggregator 的客户端 CA 证书。
–proxy-client-key-file： 在请求期间验证 Aggregator 的客户端私钥。

#重启kube-apiserver
[root@k8s-master-1 cfg]# systemctl daemon-reload && systemctl restart kube-apiserver

#验证
[root@k8s-master-1 cfg]# kubectl top node
NAME         CPU(cores)   CPU%   MEMORY(bytes)   MEMORY%   
k8s-node-1   80m          4%     812Mi           22%       
k8s-node-2   81m          4%     775Mi           21%       
[root@k8s-master-1 cfg]# 

[root@k8s-master-1 cfg]# kubectl top pod
NAME                  CPU(cores)   MEMORY(bytes)   
busybox               0m           0Mi             
web-96d5df5c8-sw784   0m           1Mi