内容转载自:https://github.com/opsnull/follow-me-install-kubernetes-cluster/blob/master/07-2.kubelet.md
上一篇:K8s-docker.07-01
tags: worker, kubelet
07-2.部署 kubelet 组件
kublet 运行在每个 worker 节点上,接收 kube-apiserver 发送的请求,管理 Pod 容器,执行交互式命令,如 exec、run、logs 等。
kublet 启动时自动向 kube-apiserver 注册节点信息,内置的 cadvisor 统计和监控节点的资源使用情况。
为确保安全,本文档只开启接收 https 请求的安全端口,对请求进行认证和授权,拒绝未授权的访问(如 apiserver、heapster)。
下载和分发 kubelet 二进制文件
安装依赖包
创建 kubelet bootstrap kubeconfig 文件
source /opt/k8s/bin/environment.sh for master_name in ${MASTER_NAMES[@]} do echo ">>> ${master_name}" # 创建 token export BOOTSTRAP_TOKEN=$(kubeadm token create \ --description kubelet-bootstrap-token \ --groups system:bootstrappers:${master_name} \ --kubeconfig ~/.kube/config) # 设置集群参数 kubectl config set-cluster kubernetes \ --certificate-authority=/etc/kubernetes/cert/ca.pem \ --embed-certs=true \ --server=${KUBE_APISERVER} \ --kubeconfig=kubelet-bootstrap-${master_name}.kubeconfig # 设置客户端认证参数 kubectl config set-credentials kubelet-bootstrap \ --token=${BOOTSTRAP_TOKEN} \ --kubeconfig=kubelet-bootstrap-${master_name}.kubeconfig # 设置上下文参数 kubectl config set-context default \ --cluster=kubernetes \ --user=kubelet-bootstrap \ --kubeconfig=kubelet-bootstrap-${master_name}.kubeconfig # 设置默认上下文 kubectl config use-context default --kubeconfig=kubelet-bootstrap-${master_name}.kubeconfig done
- 证书中写入 Token 而非证书,证书后续由 controller-manager 创建。
查看 kubeadm 为各节点创建的 token:
[root@k8s-master-0001 ~]# kubeadm token list --kubeconfig ~/.kube/config TOKEN TTL EXPIRES USAGES DESCRIPTION EXTRA GROUPS bvlzfi.c0kirfoq732rrm0g 23h 2019-01-04T16:07:43+08:00 authentication,signing kubelet-bootstrap-token system:bootstrappers:k8s-master-0001 jp3xkl.pd1wbsyor1q0583j 23h 2019-01-04T16:07:44+08:00 authentication,signing kubelet-bootstrap-token system:bootstrappers:k8s-master-0003 vgin9z.b78tf029lm9c29mb 23h 2019-01-04T16:07:43+08:00 authentication,signing kubelet-bootstrap-token system:bootstrappers:k8s-master-0002
- 创建的 token 有效期为 1 天,超期后将不能再被使用,且会被 kube-controller-manager 的 tokencleaner 清理(如果启用该 controller 的话);
- kube-apiserver 接收 kubelet 的 bootstrap token 后,将请求的 user 设置为 system:bootstrap:,group 设置为 system:bootstrappers;
各 token 关联的 Secret:
$ kubectl get secrets -n kube-system NAME TYPE DATA AGE bootstrap-token-k0s2bj bootstrap.kubernetes.io/token 7 1m bootstrap-token-mkus5s bootstrap.kubernetes.io/token 7 1m bootstrap-token-zkiem5 bootstrap.kubernetes.io/token 7 1m default-token-99st7 kubernetes.io/service-account-token 3 2d
分发 bootstrap kubeconfig 文件到所有 worker 节点
source /opt/k8s/bin/environment.sh for i in {0..2} do echo ">>> ${NODE_IP[i]}" scp kubelet-bootstrap-${MASTER_NAMES[i]}.kubeconfig k8s@${NODE_IP[i]}:/etc/kubernetes/kubelet-bootstrap.kubeconfig done
创建和分发 kubelet 参数配置文件
从 v1.10 开始,kubelet 部分参数需在配置文件中配置,kubelet --help
会提示:
DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag
创建 kubelet 参数配置模板文件:
source /opt/k8s/bin/environment.sh cat > kubelet.config.json.template <<EOF { "kind": "KubeletConfiguration", "apiVersion": "kubelet.config.k8s.io/v1beta1", "authentication": { "x509": { "clientCAFile": "/etc/kubernetes/cert/ca.pem" }, "webhook": { "enabled": true, "cacheTTL": "2m0s" }, "anonymous": { "enabled": false } }, "authorization": { "mode": "Webhook", "webhook": { "cacheAuthorizedTTL": "5m0s", "cacheUnauthorizedTTL": "30s" } }, "address": "##NODE_IP##", "port": 10250, "readOnlyPort": 0, "cgroupDriver": "cgroupfs", "hairpinMode": "promiscuous-bridge", "serializeImagePulls": false, "featureGates": { "RotateKubeletClientCertificate": true, "RotateKubeletServerCertificate": true }, "clusterDomain": "${CLUSTER_DNS_DOMAIN}", "clusterDNS": ["${CLUSTER_DNS_SVC_IP}"] } EOF
- address:API 监听地址,不能为 127.0.0.1,否则 kube-apiserver、heapster 等不能调用 kubelet 的 API;
- readOnlyPort=0:关闭只读端口(默认 10255),等效为未指定;
- authentication.anonymous.enabled:设置为 false,不允许匿名�访问 10250 端口;
- authentication.x509.clientCAFile:指定签名客户端证书的 CA 证书,开启 HTTP 证书认证;
- authentication.webhook.enabled=true:开启 HTTPs bearer token 认证;
- 对于未通过 x509 证书和 webhook 认证的请求(kube-apiserver 或其他客户端),将被拒绝,提示 Unauthorized;
- authroization.mode=Webhook:kubelet 使用 SubjectAccessReview API 查询 kube-apiserver 某 user、group 是否具有操作资源的权限(RBAC);
- featureGates.RotateKubeletClientCertificate、featureGates.RotateKubeletServerCertificate:自动 rotate 证书,证书的有效期取决于 kube-controller-manager 的 --experimental-cluster-signing-duration 参数;
- 需要 root 账户运行;
为各节点创建和分发 kubelet 配置文件:
source /opt/k8s/bin/environment.sh for node_ip in ${NODE_IP[@]} do echo ">>> ${node_ip}" sed -e "s/##NODE_IP##/${node_ip}/" kubelet.config.json.template > kubelet.config-${node_ip}.json scp kubelet.config-${node_ip}.json root@${node_ip}:/etc/kubernetes/kubelet.config.json done
创建和分发 kubelet systemd unit 文件
创建 kubelet systemd unit 文件模板:
cat > kubelet.service.template <<EOF [Unit] Description=Kubernetes Kubelet Documentation=https://github.com/GoogleCloudPlatform/kubernetes After=docker.service Requires=docker.service [Service] WorkingDirectory=/var/lib/kubelet ExecStart=/opt/k8s/bin/kubelet \\ --bootstrap-kubeconfig=/etc/kubernetes/kubelet-bootstrap.kubeconfig \\ --cert-dir=/etc/kubernetes/cert \\ --kubeconfig=/etc/kubernetes/kubelet.kubeconfig \\ --config=/etc/kubernetes/kubelet.config.json \\ --hostname-override=##NODE_NAME## \\ --pod-infra-container-image=registry.access.redhat.com/rhel7/pod-infrastructure:latest \\ --allow-privileged=true \\ --alsologtostderr=true \\ --logtostderr=false \\ --log-dir=/var/log/kubernetes \\ --v=2 Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target EOF
- 如果设置了
--hostname-override
选项,则kube-proxy
也需要设置该选项,否则会出现找不到 Node 的情况; --bootstrap-kubeconfig
:指向 bootstrap kubeconfig 文件,kubelet 使用该文件中的用户名和 token 向 kube-apiserver 发送 TLS Bootstrapping 请求;- K8S approve kubelet 的 csr 请求后,在
--cert-dir
目录创建证书和私钥文件,然后写入--kubeconfig
文件;
为各节点创建和分发 kubelet systemd unit 文件:
source /opt/k8s/bin/environment.sh for node_name in ${NODE_NAMES[@]} do echo ">>> ${node_name}" sed -e "s/##NODE_NAME##/${node_name}/" kubelet.service.template > kubelet-${node_name}.service scp kubelet-${node_name}.service root@${node_name}:/etc/systemd/system/kubelet.service done
Bootstrap Token Auth 和授予权限
kublet 启动时查找配置的 --kubeletconfig 文件是否存在,如果不存在则使用 --bootstrap-kubeconfig 向 kube-apiserver 发送证书签名请求 (CSR)。
kube-apiserver 收到 CSR 请求后,对其中的 Token 进行认证(事先使用 kubeadm 创建的 token),认证通过后将请求的 user 设置为 system:bootstrap:,group 设置为 system:bootstrappers,这一过程称为 Bootstrap Token Auth。
默认情况下,这个 user 和 group 没有创建 CSR 的权限,kubelet 启动失败,错误日志如下:
$ sudo journalctl -u kubelet -a |grep -A 2 'certificatesigningrequests' May 06 06:42:36 kube-node1 kubelet[26986]: F0506 06:42:36.314378 26986 server.go:233] failed to run Kubelet: cannot create certificate signing request: certificatesigningrequests.certificates.k8s.io is forbidden: User "system:bootstrap:lemy40" cannot create certificatesigningrequests.certificates.k8s.io at the cluster scope May 06 06:42:36 kube-node1 systemd[1]: kubelet.service: Main process exited, code=exited, status=255/n/a May 06 06:42:36 kube-node1 systemd[1]: kubelet.service: Failed with result 'exit-code'.
解决办法是:创建一个 clusterrolebinding,将 group system:bootstrappers 和 clusterrole system:node-bootstrapper 绑定:
$ kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --group=system:bootstrappers
启动 kubelet 服务
source /opt/k8s/bin/environment.sh for node_ip in ${NODE_IP[@]} do echo ">>> ${node_ip}" ssh root@${node_ip} "mkdir -p /var/lib/kubelet" ssh root@${node_ip} "/usr/sbin/swapoff -a" ssh root@${node_ip} "mkdir -p /var/log/kubernetes && chown -R k8s /var/log/kubernetes" ssh root@${node_ip} "systemctl daemon-reload && systemctl enable kubelet && systemctl restart kubelet" done
- 关闭 swap 分区,否则 kubelet 会启动失败;
- 必须先创建工作和日志目录;
$ journalctl -u kubelet |tail Jun 13 16:05:40 kube-node2 kubelet[22343]: I0613 16:05:40.388242 22343 feature_gate.go:226] feature gates: &{{} map[RotateKubeletServerCertificate:true RotateKubeletClientCertificate:true]} Jun 13 16:05:40 kube-node2 kubelet[22343]: I0613 16:05:40.394342 22343 mount_linux.go:211] Detected OS with systemd Jun 13 16:05:40 kube-node2 kubelet[22343]: W0613 16:05:40.394494 22343 cni.go:171] Unable to update cni config: No networks found in /etc/cni/net.d Jun 13 16:05:40 kube-node2 kubelet[22343]: I0613 16:05:40.399508 22343 server.go:376] Version: v1.10.4 Jun 13 16:05:40 kube-node2 kubelet[22343]: I0613 16:05:40.399583 22343 feature_gate.go:226] feature gates: &{{} map[RotateKubeletServerCertificate:true RotateKubeletClientCertificate:true]} Jun 13 16:05:40 kube-node2 kubelet[22343]: I0613 16:05:40.399736 22343 plugins.go:89] No cloud provider specified. Jun 13 16:05:40 kube-node2 kubelet[22343]: I0613 16:05:40.399752 22343 server.go:492] No cloud provider specified: "" from the config file: "" Jun 13 16:05:40 kube-node2 kubelet[22343]: I0613 16:05:40.399777 22343 bootstrap.go:58] Using bootstrap kubeconfig to generate TLS client cert, key and kubeconfig file Jun 13 16:05:40 kube-node2 kubelet[22343]: I0613 16:05:40.446068 22343 csr.go:105] csr for this node already exists, reusing Jun 13 16:05:40 kube-node2 kubelet[22343]: I0613 16:05:40.453761 22343 csr.go:113] csr for this node is still valid
kubelet 启动后使用 --bootstrap-kubeconfig 向 kube-apiserver 发送 CSR 请求,当这个 CSR 被 approve 后,kube-controller-manager 为 kubelet 创建 TLS 客户端证书、私钥和 --kubeletconfig 文件。
注意:kube-controller-manager 需要配置 --cluster-signing-cert-file
和 --cluster-signing-key-file
参数,才会为 TLS Bootstrap 创建证书和私钥。
$ kubectl get csr NAME AGE REQUESTOR CONDITION node-csr-QzuuQiuUfcSdp3j5W4B2UOuvQ_n9aTNHAlrLzVFiqrk 43s system:bootstrap:zkiem5 Pending node-csr-oVbPmU-ikVknpynwu0Ckz_MvkAO_F1j0hmbcDa__sGA 27s system:bootstrap:mkus5s Pending node-csr-u0E1-ugxgotO_9FiGXo8DkD6a7-ew8sX2qPE6KPS2IY 13m system:bootstrap:k0s2bj Pending $ kubectl get nodes No resources found.
- 三个 work 节点的 csr 均处于 pending 状态;
approve kubelet CSR 请求
可以手动或自动 approve CSR 请求。推荐使用自动的方式,因为从 v1.8 版本开始,可以自动轮转approve csr 后生成的证书。
手动 approve CSR 请求
查看 CSR 列表:
[root@k8s-master-0001 ~]# kubectl get csr NAME AGE REQUESTOR CONDITION node-csr-Msi0bzWiYipr_3-0tILs4b3tySYv480Vp6eYhDE8x14 30s system:bootstrap:157efz Pending node-csr-fBp7h46XDRURNm5UeC2WBqrZv9Hxp5naEIV1ijNtUnQ 29s system:bootstrap:zzgtvm Pending node-csr-ue0fQQCRdphQLgK8yA2TgdJ3wMdFuCa1u6JMNty1GME 23s system:bootstrap:q5x3cm Pending
approve CSR:
[root@k8s-master-0001 ~]# kubectl certificate approve node-csr-Msi0bzWiYipr_3-0tILs4b3tySYv480Vp6eYhDE8x14 certificatesigningrequest.certificates.k8s.io "node-csr-Msi0bzWiYipr_3-0tILs4b3tySYv480Vp6eYhDE8x14" approved
查看 Approve 结果:
[root@k8s-master-0001 ~]# kubectl describe csr node-csr-Msi0bzWiYipr_3-0tILs4b3tySYv480Vp6eYhDE8x14 Name: node-csr-Msi0bzWiYipr_3-0tILs4b3tySYv480Vp6eYhDE8x14 Labels: <none> Annotations: <none> CreationTimestamp: Thu, 03 Jan 2019 16:57:17 +0800 Requesting User: system:bootstrap:157efz Status: Approved,Issued Subject: Common Name: system:node:k8s-node-0001 Serial Number: Organization: system:nodes Events: <none>
Requesting User
:请求 CSR 的用户,kube-apiserver 对它进行认证和授权;Subject
:请求签名的证书信息;- 证书的 CN 是 system:node:kube-node2, Organization 是 system:nodes,kube-apiserver 的 Node 授权模式会授予该证书的相关权限;
自动 approve CSR 请求
创建三个 ClusterRoleBinding,分别用于自动 approve client、renew client、renew server 证书:
cat > csr-crb.yaml <<EOF # Approve all CSRs for the group "system:bootstrappers" kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: auto-approve-csrs-for-group subjects: - kind: Group name: system:bootstrappers apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: system:certificates.k8s.io:certificatesigningrequests:nodeclient apiGroup: rbac.authorization.k8s.io --- # To let a node of the group "system:nodes" renew its own credentials kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: node-client-cert-renewal subjects: - kind: Group name: system:nodes apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient apiGroup: rbac.authorization.k8s.io --- # A ClusterRole which instructs the CSR approver to approve a node requesting a # serving cert matching its client cert. kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: approve-node-server-renewal-csr rules: - apiGroups: ["certificates.k8s.io"] resources: ["certificatesigningrequests/selfnodeserver"] verbs: ["create"] --- # To let a node of the group "system:nodes" renew its own server credentials kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: node-server-cert-renewal subjects: - kind: Group name: system:nodes apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: approve-node-server-renewal-csr apiGroup: rbac.authorization.k8s.io EOF
- auto-approve-csrs-for-group:自动 approve node 的第一次 CSR; 注意第一次 CSR 时,请求的 Group 为 system:bootstrappers;
- node-client-cert-renewal:自动 approve node 后续过期的 client 证书,自动生成的证书 Group 为 system:nodes;
- node-server-cert-renewal:自动 approve node 后续过期的 server 证书,自动生成的证书 Group 为 system:nodes;
生效配置:
$ kubectl apply -f csr-crb.yaml
查看 kublet 的情况
等待一段时间(1-10 分钟),三个节点的 CSR 都被自动 approve:
[root@k8s-master-0001 ~]# kubectl get csr NAME AGE REQUESTOR CONDITION csr-8mtc7 11s system:node:k8s-node-0002 Approved,Issued csr-ljmtm 2m system:node:k8s-node-0001 Approved,Issued csr-m29k4 5s system:node:k8s-node-0003 Approved,Issued node-csr-Msi0bzWiYipr_3-0tILs4b3tySYv480Vp6eYhDE8x14 3m system:bootstrap:157efz Approved,Issued node-csr-fBp7h46XDRURNm5UeC2WBqrZv9Hxp5naEIV1ijNtUnQ 3m system:bootstrap:zzgtvm Approved,Issued node-csr-ue0fQQCRdphQLgK8yA2TgdJ3wMdFuCa1u6JMNty1GME 3m system:bootstrap:q5x3cm Approved,Issued
所有节点均 ready:
[root@k8s-master-0001 ~]# kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-node-0001 Ready <none> 2m v1.10.4 k8s-node-0002 Ready <none> 25s v1.10.4 k8s-node-0003 Ready <none> 20s v1.10.4
kube-controller-manager 为各 node 生成了 kubeconfig 文件和公私钥:
[root@k8s-node-0001 ~]# ls -l /etc/kubernetes/kubelet.kubeconfig -rw------- 1 root root 2295 Jan 3 16:58 /etc/kubernetes/kubelet.kubeconfig [root@k8s-node-0001 ~]# ls -l /etc/kubernetes/cert/|grep kubelet -rw-r--r-- 1 root root 1050 Jan 3 16:58 kubelet-client.crt -rw------- 1 root root 227 Jan 3 16:57 kubelet-client.key -rw------- 1 root root 1346 Jan 3 17:00 kubelet-server-2019-01-03-17-00-15.pem lrwxrwxrwx 1 root root 59 Jan 3 17:00 kubelet-server-current.pem -> /etc/kubernetes/cert/kubelet-server-2019-01-03-17-00-15.pem
- kubelet-server 证书会周期轮转;
kubelet 提供的 API 接口
kublet 启动后监听多个端口,用于接收 kube-apiserver 或其它组件发送的请求:
$ sudo netstat -lnpt|grep kubelet tcp 0 0 172.27.129.111:4194 0.0.0.0:* LISTEN 2490/kubelet tcp 0 0 127.0.0.1:10248 0.0.0.0:* LISTEN 2490/kubelet tcp 0 0 172.27.129.111:10250 0.0.0.0:* LISTEN 2490/kubelet
- 4194: cadvisor http 服务;
- 10248: healthz http 服务;
- 10250: https API 服务;注意:未开启只读端口 10255;
例如执行 kubectl ec -it nginx-ds-5rmws -- sh
命令时,kube-apiserver 会向 kubelet 发送如下请求:
POST /exec/default/nginx-ds-5rmws/my-nginx?command=sh&input=1&output=1&tty=1
kubelet 接收 10250 端口的 https 请求:
- /pods、/runningpods
- /metrics、/metrics/cadvisor、/metrics/probes
- /spec
- /stats、/stats/container
- /logs
- /run/、"/exec/", "/attach/", "/portForward/", "/containerLogs/" 等管理;
详情参考:https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/server/server.go#L434:3
由于关闭了匿名认证,同时开启了 webhook 授权,所有访问 10250 端口 https API 的请求都需要被认证和授权。
预定义的 ClusterRole system:kubelet-api-admin 授予访问 kubelet 所有 API 的权限:
[root@k8s-master-0001 ~]# kubectl describe clusterrole system:kubelet-api-admin Name: system:kubelet-api-admin Labels: kubernetes.io/bootstrapping=rbac-defaults Annotations: rbac.authorization.kubernetes.io/autoupdate=true PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- nodes [] [] [get list watch proxy] nodes/log [] [] [*] nodes/metrics [] [] [*] nodes/proxy [] [] [*] nodes/spec [] [] [*] nodes/stats [] [] [*]
kublet api 认证和授权
kublet 配置了如下认证参数:
- authentication.anonymous.enabled:设置为 false,不允许匿名�访问 10250 端口;
- authentication.x509.clientCAFile:指定签名客户端证书的 CA 证书,开启 HTTPs 证书认证;
- authentication.webhook.enabled=true:开启 HTTPs bearer token 认证;
同时配置了如下授权参数:
- authroization.mode=Webhook:开启 RBAC 授权;
kubelet 收到请求后,使用 clientCAFile 对证书签名进行认证,或者查询 bearer token 是否有效。如果两者都没通过,则拒绝请求,提示 Unauthorized:
$ curl -s --cacert /etc/kubernetes/cert/ca.pem https://172.27.129.107:10250/metrics Unauthorized $ curl -s --cacert /etc/kubernetes/cert/ca.pem -H "Authorization: Bearer 123456" https://172.27.129.107:10250/metrics Unauthorized
通过认证后,kubelet 使用 SubjectAccessReview API 向 kube-apiserver 发送请求,查询证书或 token 对应的 user、group 是否有操作资源的权限(RBAC);
证书认证和授权:
$ # 权限不足的证书; $ curl -s --cacert /etc/kubernetes/cert/ca.pem --cert /etc/kubernetes/cert/kube-controller-manager.pem --key /etc/kubernetes/cert/kube-controller-manager-key.pem https://172.27.129.107:10250/metrics Forbidden (user=system:kube-controller-manager, verb=get, resource=nodes, subresource=metrics) $ # 使用部署 kubectl 命令行工具时创建的、具有最高权限的 admin 证书; $ curl -s --cacert /etc/kubernetes/cert/ca.pem --cert ./admin.pem --key ./admin-key.pem https://172.27.129.107:10250/metrics|head # HELP apiserver_client_certificate_expiration_seconds Distribution of the remaining lifetime on the certificate used to authenticate a request. # TYPE apiserver_client_certificate_expiration_seconds histogram apiserver_client_certificate_expiration_seconds_bucket{le="0"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="21600"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="43200"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="86400"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="172800"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="345600"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="604800"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="2.592e+06"} 0
--cacert
、--cert
、--key
的参数值必须是文件路径,如上面的./admin.pem
不能省略./
,否则返回401 Unauthorized
;
bear token 认证和授权:
创建一个 ServiceAccount,将它和 ClusterRole system:kubelet-api-admin 绑定,从而具有调用 kubelet API 的权限:
kubectl create sa kubelet-api-test kubectl create clusterrolebinding kubelet-api-test --clusterrole=system:kubelet-api-admin --serviceaccount=default:kubelet-api-test SECRET=$(kubectl get secrets | grep kubelet-api-test | awk '{print $1}') TOKEN=$(kubectl describe secret ${SECRET} | grep -E '^token' | awk '{print $2}') echo ${TOKEN} $ curl -s --cacert /etc/kubernetes/cert/ca.pem -H "Authorization: Bearer ${TOKEN}" https://172.27.129.111:10250/metrics|head # HELP apiserver_client_certificate_expiration_seconds Distribution of the remaining lifetime on the certificate used to authenticate a request. # TYPE apiserver_client_certificate_expiration_seconds histogram apiserver_client_certificate_expiration_seconds_bucket{le="0"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="21600"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="43200"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="86400"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="172800"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="345600"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="604800"} 0 apiserver_client_certificate_expiration_seconds_bucket{le="2.592e+06"} 0
cadvisor 和 metrics
cadvisor 统计�所在节点各容器的资源(CPU、内存、磁盘、网卡)使用情况,分别在自己的 http web 页面(4194 端口)和 10250 以 promehteus metrics 的形式输出。
浏览器访问 http://172.27.129.107:4194/containers/ 可以查看到 cadvisor 的监控页面: (114.116.157.221是公有云的公网IP)
注意:
- kublet.config.json 设置 authentication.anonymous.enabled 为 false,不允许匿名证书访问 10250 的 https 服务;
- 参考A.浏览器访问kube-apiserver安全端口.md,创建和导入相关证书,然后访问上面的 10250 端口;
获取 kublet 的配置
从 kube-apiserver 获取各 node 的配置:
$ source /opt/k8s/bin/environment.sh
$ # 使用部署 kubectl 命令行工具时创建的、具有最高权限的 admin 证书;
$ curl -sSL --cacert /etc/kubernetes/cert/ca.pem --cert ./admin.pem --key ./admin-key.pem {KUBE_APISERVER}/api/v1/nodes/kube-node1/proxy/configz | jq
或者参考代码中的注释:https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go
参考
- kubelet 认证和授权:https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/
下一篇:K8s-部署 kube-proxy 组件.07-03