Prerrequisites
- Conectividad a la API de Kubernetes
El plugin debe poder llegar a API de forma remota para poder extraer la información.
- Permisos
Para hacer las solicitudes a través de la api, la cuenta utilizada para autenticar en la ejecución requiere de unos determinados permisos.
Asignación de permisos
A continuación se describen los pasos a seguir para crear un usuario con los permisos suficientes para obtener los datos de la monitorización.
- Creación de un “Cluster role” de
lectura llamado “api-read-only”:lectura. Secrearádebe crear unrolfichero.yamlqueconcedaconloselpermisossiguiente“get”,contenido“list” y “watch” de todos los recursos de Kubernetes.:
catapiVersion: <<EOFrbac.authorization.k8s.io/v1
|kind: kubectlClusterRole
applymetadata:
name: node-reader
rules:
-f apiGroups: [""]
resources: ["nodes"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
labels:
name: api-read-onlypod-reader
rules:
- apiGroups: - '*'[""]
resources: - '*'["pods"]
verbs: ["get", "list"]
---
getapiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: deployment-reader
rules:
- listapiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: metrics-reader
rules:
- watchapiGroups: ["metrics.k8s.io"]
resources: ["*"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: namespace-reader
rules:
- apiGroups: [""]
resources: ["namespaces"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: component-status-reader
rules:
- apiGroups: [""]
resources: ["componentstatuses"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: node-reader-binding
subjects:
- kind: ServiceAccount
name: default
namespace: default
roleRef:
kind: ClusterRole
name: node-reader
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: pod-reader-binding
subjects:
- kind: ServiceAccount
name: default
namespace: default
roleRef:
kind: ClusterRole
name: pod-reader
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: deployment-reader-binding
subjects:
- kind: ServiceAccount
name: default
namespace: default
roleRef:
kind: ClusterRole
name: deployment-reader
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: metrics-reader-binding
subjects:
- kind: ServiceAccount
name: default
namespace: default
roleRef:
kind: ClusterRole
name: metrics-reader
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: namespace-reader-binding
subjects:
- kind: ServiceAccount
name: default
namespace: default
roleRef:
kind: ClusterRole
name: namespace-reader
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: component-status-reader-binding
subjects:
- kind: ServiceAccount
name: default
namespace: default
roleRef:
kind: ClusterRole
name: component-status-reader
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: node-reader
rules:
- apiGroups: [""]
resources: ["nodes"]
verbs: ["get", "list"]
- nonResourceURLs: -["/healthz", '*'"/healthz/ping", "/healthz/log", "/healthz/etcd", "/healthz/poststarthook/crd-informer-synced", "/healthz/poststarthook/generic-apiserver-start-informers", "/healthz/poststarthook/start-apiextensions-controllers", "/healthz/poststarthook/start-apiextensions-informers"]
verbs: ["get"]
---
getapiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: service-reader
rules:
- listapiGroups: [""]
resources: ["services"]
verbs: ["get", "list", "watch"]
- watchnonResourceURLs: EOF["/api/v1/services"]
verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: service-reader-binding
subjects:
- kind: ServiceAccount
name: default
namespace: default
roleRef:
kind: ClusterRole
name: service-reader
apiGroup: rbac.authorization.k8s.io
2. CreaciónDespués dese undebe “Clusteraplicar el cluster role binding” llamado “bind-api-read-only”: Se vinculará el rolcreado anteriormente a una “service account” ya existente.
kubectl create clusterrolebinding bind-api-read-only \apply --clusterrole=api-read-onlyf \
--serviceaccount=namespace:userfichero.yaml
- Instalar metrics server
Para instalar el addon de “metrics-server”, será necesario descargarlo en el entorno de Kubernetes. Se puede obtener de su proyecto de github:
https://github.com/kubernetes-incubator/metrics-server
Una vez descargado solo se tiene que desplegar mediante el comando “kubectl”:
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
Se puede verificar que el despliegue se haya realizado con éxito si al lanzar el siguiente comando el estado de su API figura como “true”:
kubectl get apiservices | grep metrics-server
v1beta1.metrics.k8s.io kube-system/metrics-server True 1m
Si el despliegue tiene éxito, el API de “metrics-server” debería quedar accesible:
kubectl get --raw "/apis/metrics.k8s.io/v1beta1/"
{"kind":"APIResourceList","apiVersion":"v1","groupVersion":"metrics.k8s.io/v1beta1","res
ources":[{"name":"nodes","singularName":"","namespaced":false,"kind":"NodeMetrics
","verbs":["get","list"]},{"name":"pods","singularName":"","namespaced":true,"kind":"P
odMetrics","verbs":["get","list"]}]}
Además, pasados algunos segundos, se deberían poder obtener datos de uso de CPU y memoria de contenedores y nodos:
$ kubectl top node
NAMECPU(cores) CPU%MEMORY(bytes)MEMORY%
kube93m968Mi56%4%
$ kubectl top pod
NAMECPU(cores)MEMORY(bytes)
pod10m3Mi
pod20m3Mi
pod30m2Mi
pod40m3Mi
pod50m1Mi