vim metrics-server-csr.json{"CN": "aggregator","hosts": [],"key": {"algo": "rsa","size": 2048},"names": [{"C": "CN","ST": "BeiJing","L": "BeiJing","O": "k8s","OU": "System"}]
}

cfssl gencert -ca=/etc/kubernetes/ssl/ca.pem \-ca-key=/etc/kubernetes/ssl/ca-key.pem \ -config=/opt/ssl/config.json \-profile=kubernetes metrics-server-csr.json | cfssljson -bare metrics-server

  --requestheader-client-ca-file=/etc/kubernetes/ssl/ca.pem \--requestheader-extra-headers-prefix=X-Remote-Extra- \--requestheader-group-headers=X-Remote-Group \--requestheader-username-headers=X-Remote-User \--proxy-client-cert-file=/etc/kubernetes/ssl/metrics-server.pem \--proxy-client-key-file=/etc/kubernetes/ssl/metrics-server-key.pem \--runtime-config=api/all=true \

--horizontal-pod-autoscaler-use-rest-clients=true

apiVersion: v1
kind: ServiceAccount
metadata: name: metrics-servernamespace: kube-system
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:name: metrics-servernamespace: kube-systemlabels:k8s-app: metrics-server
spec:selector:matchLabels:k8s-app: metrics-servertemplate:metadata:name: metrics-serverlabels:k8s-app: metrics-serverspec:serviceAccountName: metrics-servervolumes:# mount in tmp so we can safely use from-scratch images and/or read-only containers- name: tmp-diremptyDir: {}containers:- name: metrics-serverimage: mirrorgooglecontainers/metrics-server-amd64:v0.3.1imagePullPolicy: Always  command:- /metrics-server- --kubelet-insecure-tls- --kubelet-preferred-address-types=InternalIPvolumeMounts:- name: tmp-dirmountPath: /tmp

NAME    CPU(cores)   CPU%   MEMORY(bytes)   MEMORY%
es-60   377m         18%    5915Mi          76%
es-61   267m         13%    5479Mi          70%