metrics-server TLS | 易学教程

准备证书

cat << EOF | tee /opt/kubernetes/ca_json/metrics-server.json
{
  "CN": "metrics-server",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Shanghai",
      "L": "Shanghai",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

生成证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes metrics-server.json | cfssljson -bare ./metrics-server

kube-apiserver需添加的参数

--proxy-client-cert-file=/opt/kubernetes/ssl/metrics-server.pem
--proxy-client-key-file=/opt/kubernetes/ssl/metrics-server-key.pem
--requestheader-allowed-names=aggregator
--requestheader-client-ca-file=/opt/kubernetes/ssl/ca.pem
--requestheader-extra-headers-prefix=X-Remote-Extra-
--requestheader-group-headers=X-Remote-Group
--requestheader-username-headers=X-Remote-User
--enable-aggregator-routing=true

创建secret

kubectl create secret generic metrics-server-certs --from-file=metrics-server-key.pem --from-file=metrics-server.pem -n kube-system

修改metrics-server-deployment.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-server
  namespace: kube-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: metrics-server
  namespace: kube-system
  labels:
    k8s-app: metrics-server
spec:
  selector:
    matchLabels:
      k8s-app: metrics-server
  template:
    metadata:
      name: metrics-server
      labels:
        k8s-app: metrics-server
    spec:
      serviceAccountName: metrics-server
      volumes:
      # mount in tmp so we can safely use from-scratch images and/or read-only containers
      - name: tmp-dir
        emptyDir: {}
      - name: metrics-server-certs  #添加
        secret:  #添加
          secretName: metrics-server-certs  #添加
      containers:
      - name: metrics-server
        image: registry.cn-hangzhou.aliyuncs.com/google_containers/metrics-server-amd64:v0.3.6
        imagePullPolicy: IfNotPresent
        args:
          - --cert-dir=/tmp
          - --tls-cert-file=/certs/metrics-server.pem  #添加
          - --tls-private-key-file=/certs/metrics-server-key.pem  #添加
          - --kubelet-preferred-address-types=InternalIP,Hostname,InternalDNS,ExternalDNS,ExternalIP  #添加
          - --secure-port=4443
        ports:
        - name: main-port
          containerPort: 4443
          protocol: TCP
        securityContext:
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
        volumeMounts:
        - name: tmp-dir
          mountPath: /tmp
        - name: metrics-server-certs  #添加
          mountPath: /certs  #添加
      nodeSelector:
        kubernetes.io/os: linux
        kubernetes.io/arch: "amd64"

kubectl create -f metrics-server/deploy/kubernetes/

注：master上需配置kubelet并启动

来源：oschina

链接：https://my.oschina.net/u/4059319/blog/3219513

标签

metrics

Kubernetes

tls