k8s kubelet 10250监控端口访问配置

一、修改kubelet的config.yaml文件

修改成：

二、找到证书<本文使用的pem证书>

三、测试

curl -k --cert /etc/kubernetes/pki/ca.pem --key /etc/kubernetes/pki/ca-key.pem https://192.168.4.24:10250/pods

curl -k --cert /etc/kubernetes/pki/ca.pem --key /etc/kubernetes/pki/ca-key.pem https://192.168.4.24:10250/metrics

五、prometheus配置

5.1 metrics配置

5.2 pem文件转crt

pem转pem编码CRT，保留abse64格式

openssl x509 -in ca.pem -out ca.crt

pem转DER编码CRT（二进制格式），若目标系统要求crt文件为二进制DER格式：

openssl x509 -outform der -in ca.pem -out ca.crt

5.3 token生成

创建ServiceAccount和RABC

# prometheus-rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: prometheus
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus
rules:
- apiGroups: [""]
  resources:
  - nodes
  - nodes/proxy
  - services
  - endpoints
  - pods
  verbs: ["get", "list", "watch"]
- apiGroups:
  - extensions
  resources:
  - ingresses
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prometheus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus
subjects:
- kind: ServiceAccount
  name: prometheus
  namespace: monitoring



为prometheus创建专用的kubelet访问token：
# prometheus-kubelet-token.yaml
apiVersion: v1
kind: Secret
metadata:
  name: prometheus-kubelet-token
  namespace: monitoring
  annotations:
    kubernetes.io/service-account.name: prometheus
type: kubernetes.io/service-account-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus-kubelet-access
rules:
- apiGroups: [""]
  resources: ["nodes", "nodes/proxy", "nodes/metrics"]
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics", "/metrics/cadvisor", "/metrics/probes"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prometheus-kubelet-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus-kubelet-access
subjects:
- kind: ServiceAccount
  name: prometheus
  namespace: monitoring


检查kuelet服务状态;
# systemctl status kubelet

检查防火墙规则：
# iptables -L |grep 10250    #iptables关闭则忽略

验证：
#  kubectl describe secrets -n monitoring prometheus-kubelet-token


检查RABC权限;
# kubectl auth can-i get nodes --as=system:serviceaccount:monitoring:prometheus

查看证书有效期：
openssl x509 -in /etc/kubernetes/pki/ca.crt -noout -dates


token转base64：
# kubectl get secret -n monitoring prometheus-kubelet-token -o jsonpath='{.data.token}' | base64 --decode