问题描述:
1.通过Prometheus监控k8snode节点状态,添加完配置文件,重启后发现在Prometheus界面中查看不到node节点信息。
2.查看systemctl status prometheus
发现报unable to use specified CA cert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
3.本文部署的k8s没有采用用户名密码认证,是通过token的方式认证,所以再Prometheus.yml配置文件中不能配置下面参数:
tls_config:
insecure_skip_verify: true
basic_auth:
username: admin
password: admin
解决:将上面参数修改为下面的:
tls_config:
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
insecure_skip_verify: true
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
# 使用方法为https、默认http
scheme: https
tls_config:
# promethus访问Apiserver使用认证
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
# 跳过https认证
insecure_skip_verify: true
# promethus访问Apiserver使用认证
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
注意事项:
1.如果Prometheus没有和k8s主机部署到同一台上面,需要将再k8s主机上面的ca.crt和token文件传输到Prometheus主机上。
2.先要确定自己有apiserver的认证文件,验证方式是:
如果是1即可
[k8s@k8smaster1-160 root]$ kubectl get serviceaccount
NAME SECRETS AGE
default 1 7d4h
3.不同的安装k8s方式,对应的ca.crt路径不同。如果是二进制方式部署k8s对应的ca.crt路径可以这样查:
[root@k8smaster1-160 serviceaccount]# find / -name ca.crt
/opt/k8s/work/kubernetes/pkg/controller/certificates/signer/testdata/ca.crt
之后将这个文件路径写到 ca_file: 之后即可
token如果是二进制方式部署,查看方式是:
[k8s@k8smaster1-160 serviceaccount]$ kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep dashboard-admin | awk '{print $1}') | grep -E '^token'
token: eyJhbGciOiJSUzI1NiIsImtpZCI6Im5IS245a3pjUTZuclBOWlMzaVE3bm10LXVQTVNIcEhCMEcyazkxSkd0TEUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tOHNkcTkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZGZjZjE0YTgtNTk5YS00Y2ViLWI5YTItMTVjMDkwYTRiMzAwIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.MQk0aFlbRTlRITjgmL0_mNVyETqn-9ubR7qD78qF
之后将输出的token添加到对应配置参数的bearer_token_file:文件中即可:
vim /var/run/secrets/kubernetes.io/serviceaccount/token
eyJhbGciOiJSUzI1NiIsImtpZCI6Im5IS245a3pjUTZuclBOWlMzaVE3bm10LXVQTVNIcEhCMEcyazkxSkd0TEUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tOHNkcTkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZGZjZjE0YTgtNTk5YS00Y2ViLWI5YTItMTVjMDkwYTRiMzAwIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.MQk0aFlbRTlRITjgmL0_mNVyETqn-9ubR7qD78qF
然后生效配置文件,重启服务即可:
systemctl daemon-reload
systemctl restart prometheus.service
systemctl status prometheus.service
浏览器即可观察到node状态: