dashboard

kubernetes版本1.19+

拓扑结构

metrics_server 通过连接到kubelet 10250端口收集node pod 的cpu / memory 使用情况
dashboard-metrics-scraper 
dashboard 通过dashboard-metrics-scraper的8000端口连接到metrics_server ，用于出图。

抓取

通过聚合到apiserver

dashboard

dashboard-metrics-scraper

metrics_server

kube-apiserver

安装部署

kube-apiserver需要开启聚合功能

  1. 安装metrics_server

    		apiVersion: v1
    		kind: ServiceAccount
    		metadata:
    		  labels:
    		    k8s-app: metrics-server
    		  name: metrics-server
    		  namespace: kube-system
    		apiVersion: rbac.authorization.k8s.io/v1
    		kind: ClusterRole
    		metadata:
    		  labels:
    		    k8s-app: metrics-server
    		    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    		    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    		    rbac.authorization.k8s.io/aggregate-to-view: "true"
    		  name: system:aggregated-metrics-reader
    		rules:
    		- apiGroups:
    		  - metrics.k8s.io
    		  resources:
    		  - pods
    		  - nodes
    		  verbs:
    		  - get
    		  - list
    		  - watch
    		apiVersion: rbac.authorization.k8s.io/v1
    		kind: ClusterRole
    		metadata:
    		  labels:
    		    k8s-app: metrics-server
    		  name: system:metrics-server
    		rules:
    		- apiGroups:
    		  - ""
    		  resources:
    		  - nodes/metrics
    		  verbs:
    		  - get
    		- apiGroups:
    		  - ""
    		  resources:
    		  - pods
    		  - nodes
    		  verbs:
    		  - get
    		  - list
    		  - watch
    		apiVersion: rbac.authorization.k8s.io/v1
    		kind: RoleBinding
    		metadata:
    		  labels:
    		    k8s-app: metrics-server
    		  name: metrics-server-auth-reader
    		  namespace: kube-system
    		roleRef:
    		  apiGroup: rbac.authorization.k8s.io
    		  kind: Role
    		  name: extension-apiserver-authentication-reader
    		subjects:
    		- kind: ServiceAccount
    		  name: metrics-server
    		  namespace: kube-system
    		apiVersion: rbac.authorization.k8s.io/v1
    		kind: ClusterRoleBinding
    		metadata:
    		  labels:
    		    k8s-app: metrics-server
    		  name: metrics-server:system:auth-delegator
    		roleRef:
    		  apiGroup: rbac.authorization.k8s.io
    		  kind: ClusterRole
    		  name: system:auth-delegator
    		subjects:
    		- kind: ServiceAccount
    		  name: metrics-server
    		  namespace: kube-system
    		apiVersion: rbac.authorization.k8s.io/v1
    		kind: ClusterRoleBinding
    		metadata:
    		  labels:
    		    k8s-app: metrics-server
    		  name: system:metrics-server
    		roleRef:
    		  apiGroup: rbac.authorization.k8s.io
    		  kind: ClusterRole
    		  name: system:metrics-server
    		subjects:
    		- kind: ServiceAccount
    		  name: metrics-server
    		  namespace: kube-system
    		apiVersion: apps/v1
    		kind: Deployment
    		metadata:
    		  labels:
    		    k8s-app: metrics-server
    		  name: metrics-server
    		  namespace: kube-system
    		spec:
    		  selector:
    		    matchLabels:
    		      k8s-app: metrics-server
    		  strategy:
    		    rollingUpdate:
    		      maxUnavailable: 0
    		  template:
    		    metadata:
    		      labels:
    		        k8s-app: metrics-server
    		    spec:
    		      containers:
    		      - args:
    		        - --cert-dir=/tmp
    		        - --secure-port=4443
    		        - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    		        - --kubelet-use-node-status-port
    		        - --metric-resolution=15s
    		        - --kubelet-insecure-tls=true
    		        image: registry.k8s.io/metrics-server/metrics-server:v0.6.3
    		        imagePullPolicy: IfNotPresent
    		        livenessProbe:
    		          failureThreshold: 3
    		          httpGet:
    		            path: /livez
    		            port: https
    		            scheme: HTTPS
    		          periodSeconds: 10
    		        name: metrics-server
    		        ports:
    		        - containerPort: 4443
    		          name: https
    		          protocol: TCP
    		        readinessProbe:
    		          failureThreshold: 3
    		          httpGet:
    		            path: /readyz
    		            port: https
    		            scheme: HTTPS
    		          initialDelaySeconds: 20
    		          periodSeconds: 10
    		        resources:
    		          requests:
    		            cpu: 100m
    		            memory: 200Mi
    		        securityContext:
    		          allowPrivilegeEscalation: false
    		          readOnlyRootFilesystem: true
    		          runAsNonRoot: true
    		          runAsUser: 1000
    		        volumeMounts:
    		        - mountPath: /tmp
    		          name: tmp-dir
    		      nodeSelector:
    		        kubernetes.io/os: linux
    		      priorityClassName: system-cluster-critical
    		      serviceAccountName: metrics-server
    		      volumes:
    		      - emptyDir: {}
    		        name: tmp-dir
    		---
    		apiVersion: v1
    		kind: Service
    		metadata:
    		  labels:
    		    k8s-app: metrics-server
    		  name: metrics-server
    		  namespace: kube-system
    		spec:
    		  ports:
    		  - name: https
    		    port: 443
    		    protocol: TCP
    		    targetPort: https
    		  selector:
    		    k8s-app: metrics-server
    		apiVersion: apiregistration.k8s.io/v1
    		kind: APIService
    		metadata:
    		  labels:
    		    k8s-app: metrics-server
    		  name: v1beta1.metrics.k8s.io
    		spec:
    		  group: metrics.k8s.io
    		  groupPriorityMinimum: 100
    		  insecureSkipTLSVerify: true
    		  service:
    		    name: metrics-server
    		    namespace: kube-system
    		  version: v1beta1
    		  versionPriority: 100

  2. 安装dashboard-metrics-scraper

    		apiVersion: v1
    		kind: Namespace
    		metadata:
    		  name: kubernetes-dashboard
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    addonmanager.kubernetes.io/mode: Reconcile
    		apiVersion: v1
    		kind: ServiceAccount
    		metadata:
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    addonmanager.kubernetes.io/mode: Reconcile
    		  name: kubernetes-dashboard
    		  namespace: kubernetes-dashboard
    		apiVersion: v1
    		kind: Secret
    		metadata:
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    addonmanager.kubernetes.io/mode: EnsureExists
    		  name: kubernetes-dashboard-certs
    		  namespace: kubernetes-dashboard
    		type: Opaque
    		---
    		apiVersion: v1
    		kind: Secret
    		metadata:
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    addonmanager.kubernetes.io/mode: EnsureExists
    		  name: kubernetes-dashboard-csrf
    		  namespace: kubernetes-dashboard
    		type: Opaque
    		data:
    		  csrf: ""
    		---
    		apiVersion: v1
    		kind: Secret
    		metadata:
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    addonmanager.kubernetes.io/mode: EnsureExists
    		  name: kubernetes-dashboard-key-holder
    		  namespace: kubernetes-dashboard
    		type: Opaque
    		 
    		---
    		kind: ConfigMap
    		apiVersion: v1
    		metadata:
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    addonmanager.kubernetes.io/mode: EnsureExists
    		  name: kubernetes-dashboard-settings
    		  namespace: kubernetes-dashboard
    		---
    		kind: Role
    		apiVersion: rbac.authorization.k8s.io/v1
    		metadata:
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    addonmanager.kubernetes.io/mode: Reconcile
    		  name: kubernetes-dashboard
    		  namespace: kubernetes-dashboard
    		rules:
    		  - apiGroups: [""]
    		    resources: ["secrets"]
    		    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
    		    verbs: ["get", "update", "delete"]
    		  - apiGroups: [""]
    		    resources: ["configmaps"]
    		    resourceNames: ["kubernetes-dashboard-settings"]
    		    verbs: ["get", "update"]
    		  - apiGroups: [""]
    		    resources: ["services"]
    		    resourceNames: ["heapster", "dashboard-metrics-scraper"]
    		    verbs: ["proxy"]
    		  - apiGroups: [""]
    		    resources: ["services/proxy"]
    		    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
    		    verbs: ["get"]
    		---
    		kind: ClusterRole
    		apiVersion: rbac.authorization.k8s.io/v1
    		metadata:
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    addonmanager.kubernetes.io/mode: Reconcile
    		  name: kubernetes-dashboard
    		rules:
    		  - apiGroups: ["metrics.k8s.io"]
    		    resources: ["pods", "nodes"]
    		    verbs: ["get", "list", "watch"]
    		 
    		apiVersion: rbac.authorization.k8s.io/v1
    		kind: RoleBinding
    		metadata:
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    addonmanager.kubernetes.io/mode: Reconcile
    		  name: kubernetes-dashboard
    		  namespace: kubernetes-dashboard
    		roleRef:
    		  apiGroup: rbac.authorization.k8s.io
    		  kind: Role
    		  name: kubernetes-dashboard
    		subjects:
    		  - kind: ServiceAccount
    		    name: kubernetes-dashboard
    		    namespace: kubernetes-dashboard
    		apiVersion: rbac.authorization.k8s.io/v1
    		kind: ClusterRoleBinding
    		metadata:
    		  name: kubernetes-dashboard
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    addonmanager.kubernetes.io/mode: Reconcile
    		roleRef:
    		  apiGroup: rbac.authorization.k8s.io
    		  kind: ClusterRole
    		  name: kubernetes-dashboard
    		subjects:
    		  - kind: ServiceAccount
    		    name: kubernetes-dashboard
    		    namespace: kubernetes-dashboard
    		 
    		kind: Service
    		apiVersion: v1
    		metadata:
    		  labels:
    		    k8s-app: dashboard-metrics-scraper
    		  name: dashboard-metrics-scraper
    		  namespace: kubernetes-dashboard
    		spec:
    		  ports:
    		    - port: 8000
    		      targetPort: 8000
    		  selector:
    		    k8s-app: dashboard-metrics-scraper
    		---
    		kind: Deployment
    		apiVersion: apps/v1
    		metadata:
    		  labels:
    		    k8s-app: dashboard-metrics-scraper
    		  name: dashboard-metrics-scraper
    		  namespace: kubernetes-dashboard
    		spec:
    		  replicas: 1
    		  revisionHistoryLimit: 10
    		  selector:
    		    matchLabels:
    		      k8s-app: dashboard-metrics-scraper
    		  template:
    		    metadata:
    		      labels:
    		        k8s-app: dashboard-metrics-scraper
    		      annotations:
    		        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
    		    spec:
    		      containers:
    		        - name: dashboard-metrics-scraper
    		          image: kubernetesui/metrics-scraper:v1.0.4
    		          args:
    		          - --kubelet-insecure-tls
    		          ports:
    		            - containerPort: 8000
    		              protocol: TCP
    		          livenessProbe:
    		            httpGet:
    		              scheme: HTTP
    		              path: /
    		              port: 8000
    		            initialDelaySeconds: 30
    		            timeoutSeconds: 30
    		          volumeMounts:
    		          - mountPath: /tmp
    		            name: tmp-volume
    		          securityContext:
    		            allowPrivilegeEscalation: false
    		            readOnlyRootFilesystem: true
    		            runAsUser: 1001
    		            runAsGroup: 2001
    		      serviceAccountName: kubernetes-dashboard
    		      nodeSelector:
    		        "kubernetes.io/os": linux
    		      tolerations:
    		        - key: node-role.kubernetes.io/master
    		          effect: NoSchedule
    		      volumes:
    		        - name: tmp-volume
    		          emptyDir: {}

  3. 安装dashboard

    		kind: Deployment
    		apiVersion: apps/v1
    		metadata:
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		  name: kubernetes-dashboard
    		  namespace: kubernetes-dashboard
    		spec:
    		  replicas: 1
    		  revisionHistoryLimit: 10
    		  selector:
    		    matchLabels:
    		      k8s-app: kubernetes-dashboard
    		  template:
    		    metadata:
    		      labels:
    		        k8s-app: kubernetes-dashboard
    		    spec:
    		      containers:
    		        - name: kubernetes-dashboard
    		          image: kubernetesui/dashboard:v2.0.1
    		          imagePullPolicy: Always
    		          ports:
    		            - containerPort: 8443
    		              protocol: TCP
    		          args:
    		            - --auto-generate-certificates
    		            - --namespace=kubernetes-dashboard
    		          volumeMounts:
    		            - name: kubernetes-dashboard-certs
    		              mountPath: /certs
    		            - mountPath: /tmp
    		              name: tmp-volume
    		          livenessProbe:
    		            httpGet:
    		              scheme: HTTPS
    		              path: /
    		              port: 8443
    		            initialDelaySeconds: 30
    		            timeoutSeconds: 30
    		          securityContext:
    		            allowPrivilegeEscalation: false
    		            readOnlyRootFilesystem: true
    		            runAsUser: 1001
    		            runAsGroup: 2001
    		      volumes:
    		        - name: kubernetes-dashboard-certs
    		          secret:
    		            secretName: kubernetes-dashboard-certs
    		        - name: tmp-volume
    		          emptyDir: {}
    		      serviceAccountName: kubernetes-dashboard
    		      nodeSelector:
    		        "kubernetes.io/os": linux
    		      tolerations:
    		        - key: "CriticalAddonsOnly"
    		          operator: "Exists"
    		        - key: node-role.kubernetes.io/master
    		          effect: NoSchedule
    		---
    		kind: Service
    		apiVersion: v1
    		metadata:
    		  labels:
    		    k8s-app: kubernetes-dashboard
    		    kubernetes.io/cluster-service: "true"
    		    addonmanager.kubernetes.io/mode: Reconcile
    		  name: kubernetes-dashboard
    		  namespace: kubernetes-dashboard
    		spec:
    		  ports:
    		    - port: 443
    		      targetPort: 8443
    		  selector:
    		    k8s-app: kubernetes-dashboard

认证授权

kubectl create sa dashboard-admin
kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=default:dashboard-admin 
kubectl config set-cluster test1 \
--certificate-authority=/etc/kubernetes/ssl/ca.pem \
--server=https://55.3.139.10:8443 \
--embed-certs=true \
--kubeconfig=dashboard-admin
 
kubectl config set-credentials test-dashboard \
--token=$token
 
kubectl config set-context test-dashboard@test1 \
--cluster=test1 \
--user=test-dashboard \
--kubeconfig=dashboard-admin
 
kubectl config use-context test-dashboard@test1 \
--kubeconfig=dashboard-admin

问题排查

  1. 执行kubectl top nodes 报错
[root@master2 ~]<20230418 16:42:51># kubectl top nodes 
Error from server (ServiceUnavailable): the server is currently unable to handle the request (get nodes.metrics.k8s.io)

检查 apiservice 资源提示失败

[root@master2 ~]<20230418 16:42:53># kubectl get apiservice v1beta1.metrics.k8s.io  
NAME                     SERVICE                      AVAILABLE                      AGE
v1beta1.metrics.k8s.io   kube-system/metrics-server   False (FailedDiscoveryCheck)   23h 
[root@master2 ~]<20230418 16:42:53># kubectl describe  apiservice v1beta1.metrics.k8s.io
Status:
  Conditions:
    Last Transition Time:  2023-04-18T08:39:21Z
    Message:               failing or missing response from https://172.24.22.161:4443/apis/metrics.k8s.io/v1beta1: Get "https://172.24.22.161:4443/apis/metrics.k8s.io/v1beta1": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
    Reason:                FailedDiscoveryCheck
    Status:                False
    Type:                  Available
Events:                    <none>

以上修改 hostNetwork=true 解决

  1. dashboard 无法出图日志报错

    		2023/04/18 10:32:25 Metric client health check failed: an error on the server ("unknown") has prevented the request from succeeding (get services dashboard-metrics-scraper). Retrying in 30 seconds.

    解决办法

    检查发下我的coredns 无法正常解析域名，我这里做了妥协让步。修改dashboard的启动参数后修复

    		args:
    		  - --auto-generate-certificates
    		  - --namespace=kubernetes-dashboard
    		  - --token-ttl=3600
    		  - --sidecar-host=http:// 10.244.0.209:8000

    参考

posted @   mingtian是吧  阅读(97)  评论(0)  编辑  收藏  举报
编辑推荐：
· Linux系列：如何用heaptrack跟踪.NET程序的非托管内存泄露
· 开发者必知的日志记录最佳实践
· SQL Server 2025 AI相关能力初探
· Linux系列：如何用 C#调用 C方法造成内存泄露
· AI与.NET技术实操系列（二）：开始使用ML.NET
阅读排行：
· 无需6万激活码！GitHub神秘组织3小时极速复刻Manus，手把手教你使用OpenManus搭建本
· C#/.NET/.NET Core优秀项目和框架2025年2月简报
· 葡萄城 AI 搜索升级：DeepSeek 加持，客户体验更智能
· 什么是nginx的强缓存和协商缓存
· 一文读懂知识蒸馏
点击右上角即可分享
微信分享提示