k8s kubelet 10250监控端口访问配置

一、修改kubelet的config.yaml文件

修改成:

二、找到证书<本文使用的pem证书>

三、测试

curl -k --cert /etc/kubernetes/pki/ca.pem --key /etc/kubernetes/pki/ca-key.pem https://192.168.4.24:10250/pods

curl -k --cert /etc/kubernetes/pki/ca.pem --key /etc/kubernetes/pki/ca-key.pem https://192.168.4.24:10250/metrics

五、prometheus配置

5.1 metrics配置

5.2 pem文件转crt

pem转pem编码CRT,保留abse64格式

openssl x509 -in ca.pem -out ca.crt

pem转DER编码CRT(二进制格式),若目标系统要求crt文件为二进制DER格式:

openssl x509 -outform der -in ca.pem -out ca.crt

5.3 token生成

复制代码
创建ServiceAccount和RABC

# prometheus-rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: prometheus
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus
rules:
- apiGroups: [""]
  resources:
  - nodes
  - nodes/proxy
  - services
  - endpoints
  - pods
  verbs: ["get", "list", "watch"]
- apiGroups:
  - extensions
  resources:
  - ingresses
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prometheus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus
subjects:
- kind: ServiceAccount
  name: prometheus
  namespace: monitoring



为prometheus创建专用的kubelet访问token:
# prometheus-kubelet-token.yaml
apiVersion: v1
kind: Secret
metadata:
  name: prometheus-kubelet-token
  namespace: monitoring
  annotations:
    kubernetes.io/service-account.name: prometheus
type: kubernetes.io/service-account-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus-kubelet-access
rules:
- apiGroups: [""]
  resources: ["nodes", "nodes/proxy", "nodes/metrics"]
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics", "/metrics/cadvisor", "/metrics/probes"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prometheus-kubelet-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus-kubelet-access
subjects:
- kind: ServiceAccount
  name: prometheus
  namespace: monitoring


检查kuelet服务状态;
# systemctl status kubelet

检查防火墙规则:
# iptables -L |grep 10250    #iptables关闭则忽略

验证:
#  kubectl describe secrets -n monitoring prometheus-kubelet-token


检查RABC权限;
# kubectl auth can-i get nodes --as=system:serviceaccount:monitoring:prometheus

查看证书有效期:
openssl x509 -in /etc/kubernetes/pki/ca.crt -noout -dates


token转base64:
# kubectl get secret -n monitoring prometheus-kubelet-token -o jsonpath='{.data.token}' | base64 --decode
相关推荐
K_i1342 小时前
K8s优先级调度实战:创建高优先级类
云原生·容器·kubernetes
小白不想白a2 小时前
【K8s】K8s的声明式API核心
云原生·容器·kubernetes
Leon_az3 小时前
Docker 容器如何实现隔离
linux·docker·容器
艾莉丝努力练剑4 小时前
【C++STL :vector类 (二) 】攻克 C++ Vector 的迭代器失效陷阱:从源码层面详解原理与解决方案
linux·开发语言·c++·经验分享
知白守黑2674 小时前
访问控制、用户认证、https
linux·服务器·前端
紧迫感4 小时前
在Debian系统上修改开源软件源代码制作patch
linux
一张假钞4 小时前
Mac OS远程执行Shell命令技巧
linux·运维·服务器
牛奶咖啡135 小时前
解决keepalived的主备服务器都持有VIP——出现脑裂现象
linux·运维·服务器·vrrp·脑裂·keepalived主备·高可用主备都持有vip
幻灭行度5 小时前
CKAD-CN 考试知识点分享(3) 更新 Deployment 标签,并暴露 Service
kubernetes