k8s kubelet 10250监控端口访问配置

一、修改kubelet的config.yaml文件

修改成:

二、找到证书<本文使用的pem证书>

三、测试

curl -k --cert /etc/kubernetes/pki/ca.pem --key /etc/kubernetes/pki/ca-key.pem https://192.168.4.24:10250/pods

curl -k --cert /etc/kubernetes/pki/ca.pem --key /etc/kubernetes/pki/ca-key.pem https://192.168.4.24:10250/metrics

五、prometheus配置

5.1 metrics配置

5.2 pem文件转crt

pem转pem编码CRT,保留abse64格式

openssl x509 -in ca.pem -out ca.crt

pem转DER编码CRT(二进制格式),若目标系统要求crt文件为二进制DER格式:

openssl x509 -outform der -in ca.pem -out ca.crt

5.3 token生成

复制代码
创建ServiceAccount和RABC

# prometheus-rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: prometheus
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus
rules:
- apiGroups: [""]
  resources:
  - nodes
  - nodes/proxy
  - services
  - endpoints
  - pods
  verbs: ["get", "list", "watch"]
- apiGroups:
  - extensions
  resources:
  - ingresses
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prometheus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus
subjects:
- kind: ServiceAccount
  name: prometheus
  namespace: monitoring



为prometheus创建专用的kubelet访问token:
# prometheus-kubelet-token.yaml
apiVersion: v1
kind: Secret
metadata:
  name: prometheus-kubelet-token
  namespace: monitoring
  annotations:
    kubernetes.io/service-account.name: prometheus
type: kubernetes.io/service-account-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus-kubelet-access
rules:
- apiGroups: [""]
  resources: ["nodes", "nodes/proxy", "nodes/metrics"]
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics", "/metrics/cadvisor", "/metrics/probes"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prometheus-kubelet-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus-kubelet-access
subjects:
- kind: ServiceAccount
  name: prometheus
  namespace: monitoring


检查kuelet服务状态;
# systemctl status kubelet

检查防火墙规则:
# iptables -L |grep 10250    #iptables关闭则忽略

验证:
#  kubectl describe secrets -n monitoring prometheus-kubelet-token


检查RABC权限;
# kubectl auth can-i get nodes --as=system:serviceaccount:monitoring:prometheus

查看证书有效期:
openssl x509 -in /etc/kubernetes/pki/ca.crt -noout -dates


token转base64:
# kubectl get secret -n monitoring prometheus-kubelet-token -o jsonpath='{.data.token}' | base64 --decode
相关推荐
Wang's Blog1 天前
Linux小课堂: 深入理解前后台进程控制机制——基于 &、nohup、Ctrl+Z、bg 与 fg 的完整实践体系
linux·运维·服务器
-SGlow-1 天前
Linux相关概念和易错知识点(48)(epoll的底层原理、epoll的工作模式、反应堆模式)
linux·服务器·c语言·网络·c++
秉承初心1 天前
Linux中Expect脚本和Shell的脚本核心特点解析、以及比对分析和应用场景
linux·运维·服务器·sh·exp
脏脏a1 天前
【Linux】Linux:sudo 白名单配置与 GCC/G++ 编译器使用指南
linux·运维·服务器
---学无止境---1 天前
Linux中初始化字符设备子系统chrdev_init的实现
linux
Ahern_1 天前
崖山数据库安装部署
linux·数据库
BS_Li1 天前
【Linux系统编程】权限的概念
linux·权限
cellurw1 天前
Day67 Linux I²C 总线与设备驱动架构、开发流程与调试
linux·c语言·架构
荣光波比1 天前
K8S(十)—— Kubernetes核心组件详解:Pod控制器与配置资源管理
java·容器·kubernetes
天朝八阿哥1 天前
Bye~~ win10!
linux·windows