#什么是metrics-server？

kubernetes 集群资源监控之前可以通过 heapster 来获取数据，在 1.11 开始开始逐渐废弃 heapster 了，采用 metrics-server 来代替，metrics-server 是集群的核心监控数据的聚合器，它从 kubelet 公开的 Summary API 中采集指标信息，metrics-server 是扩展的 APIServer，依赖于kube-aggregator，因为我们需要在 APIServer 中开启相关参数。

查看 APIServer 参数配置，确保你的 APIServer 启动参数中包含下的一些参数配置。

...

- --requestheader-client-ca-file=/etc/kubernetes/certs/proxy-ca.crt

- --proxy-client-cert-file=/etc/kubernetes/certs/proxy.crt

- --proxy-client-key-file=/etc/kubernetes/certs/proxy.key

- --requestheader-allowed-names=aggregator

- --requestheader-extra-headers-prefix=X-Remote-Extra-

- --requestheader-group-headers=X-Remote-Group

- --requestheader-username-headers=X-Remote-User

- --enable-aggregator-routing=true

...

如果您未在 master 节点上运行 kube-proxy，则必须确保 kube-apiserver 启动参数中包含--enable-aggregator-routing=true

#安装

从Metrics Server版本下载最新版本，并按如下所示进行部署：

kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/download/v0.3.7/components.yaml

目前我采用最新版本部署，v0.3.7

#完整的资源清单文件

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

name: system:aggregated-metrics-reader

labels:

rbac.authorization.k8s.io/aggregate-to-view: "true"

rbac.authorization.k8s.io/aggregate-to-edit: "true"

rbac.authorization.k8s.io/aggregate-to-admin: "true"

rules:

- apiGroups: ["metrics.k8s.io"]

resources: ["pods", "nodes"]

verbs: ["get", "list", "watch"]

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

name: metrics-server:system:auth-delegator

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

name: system:auth-delegator

subjects:

- kind: ServiceAccount

name: metrics-server

namespace: kube-system

---

apiVersion: rbac.authorization.k8s.io/v1

kind: RoleBinding

metadata:

name: metrics-server-auth-reader

namespace: kube-system

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: Role

name: extension-apiserver-authentication-reader

subjects:

- kind: ServiceAccount

name: metrics-server

namespace: kube-system

---

apiVersion: apiregistration.k8s.io/v1beta1

kind: APIService

metadata:

name: v1beta1.metrics.k8s.io

spec:

service:

name: metrics-server

namespace: kube-system

group: metrics.k8s.io

version: v1beta1

insecureSkipTLSVerify: true

groupPriorityMinimum: 100

versionPriority: 100

---

apiVersion: v1

kind: ServiceAccount

metadata:

name: metrics-server

namespace: kube-system

---

apiVersion: apps/v1

kind: Deployment

metadata:

name: metrics-server

namespace: kube-system

labels:

k8s-app: metrics-server

spec:

selector:

matchLabels:

k8s-app: metrics-server

template:

metadata:

name: metrics-server

labels:

k8s-app: metrics-server

spec:

serviceAccountName: metrics-server

volumes:

# mount in tmp so we can safely use from-scratch images and/or read-only containers

- name: tmp-dir

emptyDir: {}

containers:

- name: metrics-server

image: coll/metrics-server:v0.3.7 # image默认是谷歌，修改为可用的

imagePullPolicy: IfNotPresent

args:

- --cert-dir=/tmp

- --secure-port=4443

command: #新增command配置

- /metrics-server

- --kubelet-insecure-tls

- --kubelet-preferred-address-types=InternalIP

ports:

- name: main-port

containerPort: 4443

protocol: TCP

securityContext:

readOnlyRootFilesystem: true

runAsNonRoot: true

runAsUser: 1000

volumeMounts:

- name: tmp-dir

mountPath: /tmp

nodeSelector:

kubernetes.io/os: linux

---

apiVersion: v1

kind: Service

metadata:

name: metrics-server

namespace: kube-system

labels:

kubernetes.io/name: "Metrics-server"

kubernetes.io/cluster-service: "true"

spec:

selector:

k8s-app: metrics-server

ports:

- port: 443

protocol: TCP

targetPort: main-port

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

name: system:metrics-server

rules:

- apiGroups:

- ""

resources:

- pods

- nodes

- nodes/stats

- namespaces

- configmaps

verbs:

- get

- list

- watch

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

name: system:metrics-server

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

name: system:metrics-server

subjects:

- kind: ServiceAccount

name: metrics-server

namespace: kube-system

#遇到的问题

E0908 03:43:06.048002 1 reststorage.go:135] unable to fetch node metrics for node "build-02": no metrics known for node

E0908 03:43:06.048022 1 reststorage.go:135] unable to fetch node metrics for node "build-01": no metrics known for node

E0908 03:43:06.048030 1 reststorage.go:135] unable to fetch node metrics for node "build-03": no metrics known for node

E0908 03:43:48.828393 1 manager.go:111] unable to fully collect metrics: [unable to fully scrape metrics from source kubelet_summary:build-03: unable to fetch metrics from Kubelet build-03 (build-03): Get https://build-03:10250/stats/summary?only_cpu_and_memory=true: dial tcp: lookup build-03 on 10.96.0.10:53: server misbehaving, unable to fully scrape metrics from source kubelet_summary:build-01: unable to fetch metrics from Kubelet build-01 (build-01): Get https://build-01:10250/stats/summary?only_cpu_and_memory=true: dial tcp: lookup build-01 on 10.96.0.10:53: server misbehaving, unable to fully scrape metrics from source kubelet_summary:build-02: unable to fetch metrics from Kubelet build-02 (build-02): Get https://build-02:10250/stats/summary?only_cpu_and_memory=true: dial tcp: lookup build-02 on 10.96.0.10:53: server misbehaving]

因为部署集群的时候，CA 证书并没有把各个节点的 IP 签上去，所以这里 metrics-server 通过 IP 去请求时，提示签的证书没有对应的 IP(错误：x509: cannot validate certificate for 192.168.33.11 because it doesn’t contain any IP SANs)，我们可以添加一个--kubelet-insecure-tls参数跳过证书校验：

command: #新增command配置

- /metrics-server

- --kubelet-insecure-tls

- --kubelet-preferred-address-types=InternalIP

添加上面以上参数，然后再重新安装。

kubectl apply -f components.yaml

过一会可以看到，使用Metrics-Server收集到节点信息，说明Metrics-Server安装成功。

[root@build-01 manifests]# kubectl top node

NAME CPU(cores) CPU% MEMORY(bytes) MEMORY%

build-01 142m 3% 3818Mi 50%

build-02 83m 2% 3674Mi 48%

build-03 2782m 69% 4262Mi 55%

相关文档：