-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Open
Labels
kind/bugCategorizes issue or PR as related to a bug.Categorizes issue or PR as related to a bug.needs-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.Indicates an issue or PR lacks a `triage/foo` label and requires one.
Description
I deployed kube-state-metrics in the kubernetes cluster. Here is my deployment code
mkdir -p /root/kube-state-metrics && cd /root/kube-state-metrics
kubectl delete -f kube-state-metrics-deploy.yaml &> /dev/null
cat > kube-state-metrics-deploy.yaml <<"EOF"
apiVersion: apps/v1
kind: Deployment
metadata:
name: kube-state-metrics
namespace: kube-system
spec:
replicas: 1 # 副本数:指定该 Deployment 启动一个副本
selector:
matchLabels:
app: kube-state-metrics
template:
metadata:
labels:
app: kube-state-metrics
spec:
serviceAccountName: kube-state-metrics # 使用的服务账户,确保 Pod 具有正确的 RBAC 权限
containers:
- name: kube-state-metrics
image: registry.k8s.io/kube-state-metrics//kube-state-metrics:v2.17.0
ports:
- containerPort: 8080 # 容器监听端口:8080
EOF
kubectl apply -f kube-state-metrics-deploy.yaml
kubectl get pod -n kube-system -o wide | grep kube-state-metrics
This is an svc file
mkdir -p /root/kube-state-metrics && cd /root/kube-state-metrics
kubectl delete -f kube-state-metrics-svc.yaml &> /dev/null
cat > kube-state-metrics-svc.yaml <<"EOF"
apiVersion: v1
kind: Service
metadata:
annotations:
prometheus.io/scrape: 'true'
name: kube-state-metrics
namespace: kube-system
labels:
app: kube-state-metrics
spec:
ports:
- name: kube-state-metrics
port: 8080
protocol: TCP
selector:
app: kube-state-metrics
EOF
kubectl apply -f kube-state-metrics-svc.yaml
kubectl get svc -n kube-system | grep kube-state-metrics
This is the rbac authorization file
mkdir -p /root/kube-state-metrics && cd /root/kube-state-metrics
kubectl delete -f kube-state-metrics-rbac.yaml &> /dev/null
cat > kube-state-metrics-rbac.yaml <<"EOF"
---
# 创建 ServiceAccount:为 kube-state-metrics 创建一个服务账户
apiVersion: v1
kind: ServiceAccount
metadata:
name: kube-state-metrics # 服务账户的名称
namespace: kube-system # 将该服务账户放入 kube-system 命名空间
---
# 创建 ClusterRole:为 kube-state-metrics 赋予权限,能够访问 Kubernetes 资源
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: kube-state-metrics # ClusterRole 名称
rules:
# 资源访问权限规则:以下为访问资源的权限定义
- apiGroups: [""]
resources: ["nodes", "pods", "services", "resourcequotas", "replicationcontrollers", "limitranges", "persistentvolumeclaims", "persistentvolumes", "namespaces", "endpoints", "secrets", "configmaps"] # 需要访问的资源
verbs: ["list", "watch"] # 授予 list 和 watch 权限(列出和监视)
- apiGroups: ["apps"] # 应用 API 组(包含新版 Deployment、ReplicaSet、DaemonSet、StatefulSet)
resources: ["daemonsets", "deployments", "replicasets", "statefulsets"] # 需要访问的资源
verbs: ["list", "watch"]
- apiGroups: ["batch"] # 批处理 API 组
resources: ["cronjobs", "jobs"] # 需要访问的资源
verbs: ["list", "watch"]
- apiGroups: ["autoscaling"] # 自动扩缩容 API 组
resources: ["horizontalpodautoscalers"] # 需要访问的资源
verbs: ["list", "watch"]
# 【新增资源权限】增加对 storageclasses 资源的访问权限
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"] # 需要访问的资源
verbs: ["list", "watch"]
- apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"] # 需要访问的资源
verbs: ["list", "watch"]
- apiGroups: ["policy"]
resources: ["poddisruptionbudgets"] # 需要访问的资源
verbs: ["list", "watch"]
- apiGroups: ["networking.k8s.io"]
resources: ["networkpolicies"] # 需要访问的资源
verbs: ["list", "watch"]
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] # 需要访问的资源
verbs: ["list", "watch"]
- apiGroups: ["certificates.k8s.io"]
resources: ["certificatesigningrequests"] # 需要访问的资源
verbs: ["list", "watch"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"] # 需要访问的资源
verbs: ["list", "watch"]
- apiGroups: ["networking.k8s.io"]
resources: ["ingresses"] # 需要访问的资源
verbs: ["list", "watch"]
---
# 创建 ClusterRoleBinding:将 ServiceAccount 和 ClusterRole 绑定在一起,赋予其相应的权限
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kube-state-metrics # ClusterRoleBinding 名称
roleRef:
apiGroup: rbac.authorization.k8s.io # 指定角色的 API 组
kind: ClusterRole # 指定角色类型为 ClusterRole
name: kube-state-metrics # 绑定的 ClusterRole 名称
subjects:
- kind: ServiceAccount
name: kube-state-metrics # 绑定的 ServiceAccount 名称
namespace: kube-system # 指定 ServiceAccount 所在的命名空间
EOF
kubectl apply -f kube-state-metrics-rbac.yaml
kubectl get sa -n kube-system | grep kube-state-metrics
bug
root@master1:~/kube-state-metrics# kubectl get svc -A | grep metrics
kube-system kube-state-metrics ClusterIP 10.109.108.62 <none> 8080/TCP 89m
root@master1:~/kube-state-metrics# curl http://10.109.108.62:8080/metrics | grep kube_job_status
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 186k 0 186k 0 0 29.3M 0 --:--:-- --:--:-- --:--:-- 30.3M
root@master1:~/kube-state-metrics# curl http://10.109.108.62:8080/metrics | grep kube_job
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 186k 0 186k 0 0 28.6M 0 --:--:-- --:--:-- --:--:-- 30.3M
root@master1:~/kube-state-metrics# curl http://10.109.108.62:8080/metrics | grep job
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 186k 0 186k 0 0 32.5M 0 --:--:-- --:--:-- --:--:-- 36.4M
root@master1:~/kube-state-metrics#
There is no kube_job_status at all. What's the problem? Besides, I checked the release update log of this repository. Version 2.15.0 clearly stated that kube_job_status was updated, but why wasn't it updated in version 2.17.0
Moreover, I tried the v2.15.0 and v2.16.0 versions of the image, but it still didn't work
Metadata
Metadata
Assignees
Labels
kind/bugCategorizes issue or PR as related to a bug.Categorizes issue or PR as related to a bug.needs-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.Indicates an issue or PR lacks a `triage/foo` label and requires one.
Type
Projects
Status
Needs Triage