kubernetes（k8s）部署|kubernetes（k8s）部署 Metrics Server 资源 kubernetes（k8s）部署MetricsServe

资源使用指标，例如容器 CPU 和内存使用率，可通过 Metrics API 在 Kubernetes 中获得。这些指标可以直接被用户访问，比如使用 kubectl top 命令行，或者被集群中的控制器（例如 Horizontal Pod Autoscalers) 使用来做决策。

文章图片

配置api聚合层

添加配置api启动service文件--enable-aggregator-routing=true ps -ef |grep apiserver|grep enable-aggregator-routing root11471 10 10:23 ?00:30:13 /usr/local/bin/kube-apiserver --v=2 --logtostderr=true --allow-privileged=true --bind-address=0.0.0.0 --secure-port=6443 --insecure-port=0 --advertise-address=192.168.1.30 --service-cluster-ip-range=10.96.0.0/12 --service-node-port-range=30000-32767 --etcd-servers=https://192.168.1.30:2379,https://192.168.1.31:2379,https://192.168.1.32:2379 --etcd-cafile=/etc/etcd/ssl/etcd-ca.pem --etcd-certfile=/etc/etcd/ssl/etcd.pem --etcd-keyfile=/etc/etcd/ssl/etcd-key.pem --client-ca-file=/etc/kubernetes/pki/ca.pem --tls-cert-file=/etc/kubernetes/pki/apiserver.pem --tls-private-key-file=/etc/kubernetes/pki/apiserver-key.pem --kubelet-client-certificate=/etc/kubernetes/pki/apiserver.pem --kubelet-client-key=/etc/kubernetes/pki/apiserver-key.pem --service-account-key-file=/etc/kubernetes/pki/sa.pub --service-account-signing-key-file=/etc/kubernetes/pki/sa.key --service-account-issuer=https://kubernetes.default.svc.cluster.local --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,ResourceQuota --authorization-mode=Node,RBAC --enable-bootstrap-token-auth=true --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.pem --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.pem --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client-key.pem --requestheader-allowed-names=aggregator --requestheader-group-headers=X-Remote-Group --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-username-headers=X-Remote-User --enable-aggregator-routing=true

创建应用权限 RBAC 资源文件

root@hello:~/cby# cat metrics-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: system:aggregated-metrics-reader labels: rbac.authorization.k8s.io/aggregate-to-view: "true" rbac.authorization.k8s.io/aggregate-to-edit: "true" rbac.authorization.k8s.io/aggregate-to-admin: "true" rules: - apiGroups: ["metrics.k8s.io"] resources: ["pods", "nodes"] verbs: ["get", "list", "watch"]--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: metrics-server:system:auth-delegator roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: system:auth-delegator subjects: - kind: ServiceAccount name: metrics-server namespace: kube-system--- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: metrics-server-auth-reader namespace: kube-system roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: extension-apiserver-authentication-reader subjects: - kind: ServiceAccount name: metrics-server namespace: kube-system--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: system:metrics-server rules: - apiGroups: - "" resources: - pods - nodes - nodes/stats - namespaces verbs: - get - list - watch--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: system:metrics-server roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: system:metrics-server subjects: - kind: ServiceAccount name: metrics-server namespace: kube-system--- apiVersion: v1 kind: ServiceAccount metadata: name: metrics-server namespace: kube-system root@hello:~/cby#

创建 APIService 资源文件
设置扩展 API Service 工作于聚合层，允许使用其 API 扩展 Kubernetes apiserver，而这些 API 并不是核心 Kubernetes API 的一部分。这里部署 APIservice 资源，来提供 Kubernetes Metrics 指标 API 数据。

root@hello:~/cby# cat metrics-api-service.yaml ## APIService apiVersion: apiregistration.k8s.io/v1 kind: APIService metadata: name: v1beta1.metrics.k8s.io spec: service: name: metrics-server namespace: kube-system port: 443 group: metrics.k8s.io version: v1beta1 insecureSkipTLSVerify: true groupPriorityMinimum: 100 versionPriority: 100 root@hello:~/cby#

创建 Metrics Server 应用资源文件

root@hello:~/cby# cat metrics-server-deploy.yaml apiVersion: apps/v1 kind: Deployment metadata: name: metrics-server namespace: kube-system labels: k8s-app: metrics-server spec: selector: matchLabels: k8s-app: metrics-server template: metadata: name: metrics-server labels: k8s-app: metrics-server spec: serviceAccountName: metrics-server volumes: # mount in tmp so we can safely use from-scratch images and/or read-only containers - name: tmp-dir emptyDir: {} hostNetwork: true containers: - name: metrics-server image: bitnami/metrics-server # command: # - /metrics-server # - --kubelet-insecure-tls # - --kubelet-preferred-address-types=InternalIP args: - --cert-dir=/tmp - --secure-port=4443 - --kubelet-insecure-tls=true - --kubelet-preferred-address-types=InternalIP,Hostname,InternalDNS,externalDNS ports: - name: main-port containerPort: 4443 protocol: TCP securityContext: readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 1000 imagePullPolicy: Always volumeMounts: - name: tmp-dir mountPath: /tmp nodeSelector: beta.kubernetes.io/os: linux--- apiVersion: v1 kind: Service metadata: name: metrics-server namespace: kube-system labels: kubernetes.io/name: "Metrics-server" kubernetes.io/cluster-service: "true" spec: selector: k8s-app: metrics-server ports: - port: 443 protocol: TCP targetPort: 4443 root@hello:~/cby#

通过 Kubectl 命令部署

root@hello:~/cby# kubectl apply -f metrics-rbac.yaml -n kube-system clusterrole.rbac.authorization.k8s.io/system:aggregated-metrics-reader created clusterrolebinding.rbac.authorization.k8s.io/metrics-server:system:auth-delegator created rolebinding.rbac.authorization.k8s.io/metrics-server-auth-reader created clusterrole.rbac.authorization.k8s.io/system:metrics-server created clusterrolebinding.rbac.authorization.k8s.io/system:metrics-server created serviceaccount/metrics-server createdroot@hello:~/cby# kubectl apply -f metrics-api-service.yaml -n kube-system apiservice.apiregistration.k8s.io/v1beta1.metrics.k8s.io createdroot@hello:~/cby# kubectl apply -f metrics-server-deploy.yaml -n kube-system Warning: spec.template.spec.nodeSelector[beta.kubernetes.io/os]: deprecated since v1.14; use "kubernetes.io/os" instead deployment.apps/metrics-server created service/metrics-server created root@hello:~/cby# 验证root@hello:~/cby# kubectlget pod -A | grep metrics-server kube-systemmetrics-server-5c69d5d5b7-b62461/1Running02m25s root@hello:~/cby# 查看日志root@hello:~/cby# kubectllogs -n kube-systemmetrics-server-5c69d5d5b7-b6246 I0328 07:11:37.6764901 serving.go:341] Generated self-signed cert (/tmp/apiserver.crt, /tmp/apiserver.key) I0328 07:11:38.1484571 requestheader_controller.go:169] Starting RequestHeaderAuthRequestController I0328 07:11:38.1484721 configmap_cafile_content.go:202] Starting client-ca::kube-system::extension-apiserver-authentication::client-ca-file I0328 07:11:38.1485071 shared_informer.go:240] Waiting for caches to sync for client-ca::kube-system::extension-apiserver-authentication::client-ca-file I0328 07:11:38.1484751 configmap_cafile_content.go:202] Starting client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file I0328 07:11:38.1485501 shared_informer.go:240] Waiting for caches to sync for client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file I0328 07:11:38.1484901 shared_informer.go:240] Waiting for caches to sync for RequestHeaderAuthRequestController I0328 07:11:38.1490731 dynamic_serving_content.go:130] Starting serving-cert::/tmp/apiserver.crt::/tmp/apiserver.key I0328 07:11:38.1494281 secure_serving.go:202] Serving securely on [::]:4443 I0328 07:11:38.1495351 tlsconfig.go:240] Starting DynamicServingCertificateController I0328 07:11:38.2487131 shared_informer.go:247] Caches are synced for RequestHeaderAuthRequestController I0328 07:11:38.2487321 shared_informer.go:247] Caches are synced for client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file I0328 07:11:38.2487541 shared_informer.go:247] Caches are synced for client-ca::kube-system::extension-apiserver-authentication::client-ca-file root@hello:~/cby#查看node资源信息root@hello:~/cby# kubectltop node NAMECPU(cores)CPU%MEMORY(bytes)MEMORY% 192.168.1.50184m2%4354Mi56% 192.168.1.51207m2%3892Mi50% 192.168.1.52197m2%3881Mi50% 192.168.1.53185m2%3528Mi46% 192.168.1.54109m1%3427Mi44% root@hello:~/cby# 查看pod资源信息root@hello:~/cby# kubectltop pod -n kube-system NAMECPU(cores)MEMORY(bytes) calico-kube-controllers-754966f84c-jm7f75m25Mi calico-node-9tvck43m69Mi calico-node-kt2pk41m68Mi calico-node-skm8245m70Mi calico-node-t4lhb44m65Mi calico-node-tz5k945m66Mi coredns-596755dbff-7ggzl3m15Mi dashboard-metrics-scraper-799d786dbf-s6r5f1m7Mi kubernetes-dashboard-9f8c8b989-57fhz1m13Mi metrics-server-5c69d5d5b7-b62464m16Mi node-local-dns-4hzvh5m17Mi node-local-dns-6zpdh3m17Mi node-local-dns-9jmzz5m16Mi node-local-dns-q8pcw5m17Mi node-local-dns-tpm6b5m29Mi root@hello:~/cby# 查看单个pod资源信息root@hello:~/cby# kubectltop pod-n kube-system metrics-server-5c69d5d5b7-b6246 NAMECPU(cores)MEMORY(bytes) metrics-server-5c69d5d5b7-b62464m13Mi root@hello:~/cby#

https://www.oiox.cn/
https://www.chenby.cn/
https://cby-chen.github.io/
https://weibo.com/u/5982474121
https://blog.csdn.net/qq_3392...
https://my.oschina.net/u/3981543
https://www.zhihu.com/people/...
https://segmentfault.com/u/hp...
【kubernetes（k8s）部署|kubernetes（k8s）部署 Metrics Server 资源】https://juejin.cn/user/331578...
https://space.bilibili.com/35...
https://cloud.tencent.com/dev...
https://www.jianshu.com/u/0f8...
https://www.toutiao.com/c/use...
CSDN、GitHub、知乎、开源中国、思否、掘金、简书、腾讯云、哔哩哔哩、今日头条、新浪微博、个人博客、全网可搜《小陈运维》