解决Prometheus报错：unable to use specified CA cert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt

问题描述：
1.通过Prometheus监控k8snode节点状态，添加完配置文件，重启后发现在Prometheus界面中查看不到node节点信息。

2.查看systemctl status prometheus 发现报unable to use specified CA cert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
3.本文部署的k8s没有采用用户名密码认证，是通过token的方式认证，所以再Prometheus.yml配置文件中不能配置下面参数：

 tls_config:
        insecure_skip_verify: true
      basic_auth:
        username: admin
        password: admin

解决：将上面参数修改为下面的：

tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecure_skip_verify: true
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token

 # 使用方法为https、默认http
      scheme: https
      tls_config:
        # promethus访问Apiserver使用认证
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        # 跳过https认证
        insecure_skip_verify: true
      # promethus访问Apiserver使用认证
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token

注意事项：

1.如果Prometheus没有和k8s主机部署到同一台上面，需要将再k8s主机上面的ca.crt和token文件传输到Prometheus主机上。
2.先要确定自己有apiserver的认证文件，验证方式是：
如果是1即可

[k8s@k8smaster1-160 root]$ kubectl get serviceaccount
NAME      SECRETS   AGE
default   1         7d4h

3.不同的安装k8s方式，对应的ca.crt路径不同。如果是二进制方式部署k8s对应的ca.crt路径可以这样查：

[root@k8smaster1-160 serviceaccount]# find / -name ca.crt
/opt/k8s/work/kubernetes/pkg/controller/certificates/signer/testdata/ca.crt

之后将这个文件路径写到 ca_file: 之后即可

token如果是二进制方式部署，查看方式是：

[k8s@k8smaster1-160 serviceaccount]$ kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep dashboard-admin | awk '{print $1}') | grep -E '^token' 
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6Im5IS245a3pjUTZuclBOWlMzaVE3bm10LXVQTVNIcEhCMEcyazkxSkd0TEUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tOHNkcTkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZGZjZjE0YTgtNTk5YS00Y2ViLWI5YTItMTVjMDkwYTRiMzAwIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.MQk0aFlbRTlRITjgmL0_mNVyETqn-9ubR7qD78qF

之后将输出的token添加到对应配置参数的bearer_token_file:文件中即可：

vim  /var/run/secrets/kubernetes.io/serviceaccount/token
eyJhbGciOiJSUzI1NiIsImtpZCI6Im5IS245a3pjUTZuclBOWlMzaVE3bm10LXVQTVNIcEhCMEcyazkxSkd0TEUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tOHNkcTkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZGZjZjE0YTgtNTk5YS00Y2ViLWI5YTItMTVjMDkwYTRiMzAwIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.MQk0aFlbRTlRITjgmL0_mNVyETqn-9ubR7qD78qF

然后生效配置文件，重启服务即可：

systemctl daemon-reload
systemctl restart prometheus.service
systemctl status prometheus.service

浏览器即可观察到node状态：