オンプレマシンのkubernetesでkubectl topが使えない

CentOS Linux release 7.9.2009 (Core)
kubernetes 1.22.2

kubeadmを使用してkubernetesをインストールしましたがkubectl topコマンドが使えないです

[root@k8s-master ~]# kubeadm init --apiserver-advertise-address 192.168.1.10 --pod-network-cidr 10.240.0.0/16
[root@k8s-master ~]# kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
[root@k8s-master ~]# kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
[root@k8s-master ~]# kubectl get pod -n kube-system
metrics-server-6dfddc5fb8-gkfxm      0/1     CrashLoopBackOff   7 (78s ago)   10m

ログはこんな感じ。

[root@k8s-master ~]# kubectl logs metrics-server-6dfddc5fb8-gkfxm -n kube-system
panic: unable to load configmap based request-header-client-ca-file: Get "https://10.96.0.1:443/api/v1/namespaces/kube-system/configmaps/extension-apiserver-authentication": dial tcp 10.96.0.1:443: i/o timeout

yaml
1apiVersion: v1
2kind: ServiceAccount
3metadata:
4  labels:
5    k8s-app: metrics-server
6  name: metrics-server
7  namespace: kube-system
8---
9apiVersion: rbac.authorization.k8s.io/v1
10kind: ClusterRole
11metadata:
12  labels:
13    k8s-app: metrics-server
14    rbac.authorization.k8s.io/aggregate-to-admin: "true"
15    rbac.authorization.k8s.io/aggregate-to-edit: "true"
16    rbac.authorization.k8s.io/aggregate-to-view: "true"
17  name: system:aggregated-metrics-reader
18rules:
19- apiGroups:
20  - metrics.k8s.io
21  resources:
22  - pods
23  - nodes
24  verbs:
25  - get
26  - list
27  - watch
28---
29apiVersion: rbac.authorization.k8s.io/v1
30kind: ClusterRole
31metadata:
32  labels:
33    k8s-app: metrics-server
34  name: system:metrics-server
35rules:
36- apiGroups:
37  - ""
38  resources:
39  - pods
40  - nodes
41  - nodes/stats
42  - namespaces
43  - configmaps
44  verbs:
45  - get
46  - list
47  - watch
48---
49apiVersion: rbac.authorization.k8s.io/v1
50kind: RoleBinding
51metadata:
52  labels:
53    k8s-app: metrics-server
54  name: metrics-server-auth-reader
55  namespace: kube-system
56roleRef:
57  apiGroup: rbac.authorization.k8s.io
58  kind: Role
59  name: extension-apiserver-authentication-reader
60subjects:
61- kind: ServiceAccount
62  name: metrics-server
63  namespace: kube-system
64---
65apiVersion: rbac.authorization.k8s.io/v1
66kind: ClusterRoleBinding
67metadata:
68  labels:
69    k8s-app: metrics-server
70  name: metrics-server:system:auth-delegator
71roleRef:
72  apiGroup: rbac.authorization.k8s.io
73  kind: ClusterRole
74  name: system:auth-delegator
75subjects:
76- kind: ServiceAccount
77  name: metrics-server
78  namespace: kube-system
79---
80apiVersion: rbac.authorization.k8s.io/v1
81kind: ClusterRoleBinding
82metadata:
83  labels:
84    k8s-app: metrics-server
85  name: system:metrics-server
86roleRef:
87  apiGroup: rbac.authorization.k8s.io
88  kind: ClusterRole
89  name: system:metrics-server
90subjects:
91- kind: ServiceAccount
92  name: metrics-server
93  namespace: kube-system
94---
95apiVersion: v1
96kind: Service
97metadata:
98  labels:
99    k8s-app: metrics-server
100  name: metrics-server
101  namespace: kube-system
102spec:
103  ports:
104  - name: https
105    port: 443
106    protocol: TCP
107    targetPort: https
108  selector:
109    k8s-app: metrics-server
110---
111apiVersion: apps/v1
112kind: Deployment
113metadata:
114  labels:
115    k8s-app: metrics-server
116  name: metrics-server
117  namespace: kube-system
118spec:
119  selector:
120    matchLabels:
121      k8s-app: metrics-server
122  strategy:
123    rollingUpdate:
124      maxUnavailable: 0
125  template:
126    metadata:
127      labels:
128        k8s-app: metrics-server
129    spec:
130      containers:
131      - args:
132        - --cert-dir=/tmp
133        - --secure-port=443
134        - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
135        - --kubelet-use-node-status-port
136        - --metric-resolution=15s
137        image: k8s.gcr.io/metrics-server/metrics-server:v0.5.0
138        imagePullPolicy: IfNotPresent
139        livenessProbe:
140          failureThreshold: 3
141          httpGet:
142            path: /livez
143            port: https
144            scheme: HTTPS
145          periodSeconds: 10
146        name: metrics-server
147        ports:
148        - containerPort: 443
149          name: https
150          protocol: TCP
151        readinessProbe:
152          failureThreshold: 3
153          httpGet:
154            path: /readyz
155            port: https
156            scheme: HTTPS
157          initialDelaySeconds: 20
158          periodSeconds: 10
159        resources:
160          requests:
161            cpu: 100m
162            memory: 200Mi
163        securityContext:
164          readOnlyRootFilesystem: true
165          runAsNonRoot: true
166          runAsUser: 1000
167        volumeMounts:
168        - mountPath: /tmp
169          name: tmp-dir
170      nodeSelector:
171        kubernetes.io/os: linux
172      priorityClassName: system-cluster-critical
173      serviceAccountName: metrics-server
174      volumes:
175      - emptyDir: {}
176        name: tmp-dir
177---
178apiVersion: apiregistration.k8s.io/v1
179kind: APIService
180metadata:
181  labels:
182    k8s-app: metrics-server
183  name: v1beta1.metrics.k8s.io
184spec:
185  group: metrics.k8s.io
186  groupPriorityMinimum: 100
187  insecureSkipTLSVerify: true
188  service:
189    name: metrics-server
190    namespace: kube-system
191  version: v1beta1
192  versionPriority: 100
193

ネットワーク的な問題のような気がしますが全然解決でいなくてもう何時間か消費してます…
何処を直したらいいでしょうか？

行動規範の内容に同意します

回答1件

https://github.com/kubernetes-sigs/metrics-server/blob/master/README.md#requirements

Metrics Serverのrequirementにもありますが、オンプレの場合metrics serverのDeploymentsに--kubelet-insecure-tlsのフラグを渡す必要があると思います。

投稿2021/09/25 17:51

inductor

総合スコア428

maki19

2021/09/30 14:35 編集

大変遅くなってしまいましたが、言われたとおりにしたところエラーの内容が変わりました！少し前進した気がします！ Successfully assigned kube-system/metrics-server-5cd859f5c-t89rd to k8s-node1 Pulling image "k8s.gcr.io/metrics-server/metrics-server:v0.5.0" Successfully pulled image "k8s.gcr.io/metrics-server/metrics-server:v0.5.0" in 2.696813755s Liveness probe failed: Get "https://10.240.1.5:443/livez": context deadline exceeded Readiness probe failed: Get "https://10.240.1.5:443/readyz": context deadline exceeded Container metrics-server failed liveness probe, will be restarted Created container metrics-server Container image "k8s.gcr.io/metrics-server/metrics-server:v0.5.0" already present on machine Started container metrics-server Liveness probe failed: Get "https://10.240.1.5:443/livez": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) Readiness probe failed: Get "https://10.240.1.5:443/readyz": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) Back-off restarting failed container となりました…力を貸していただければ幸いでございます。。。どうか知識を貸していただければ幸いです。。。

maki19

2021/09/30 14:43

kubectl logs metrics-server-5cd859f5c-t89rd -n kube-system とした所 panic: unable to load configmap based request-header-client-ca-file: Get "https://10.96.0.1:443/api/v1/namespaces/kube-system/configmaps/extension-apiserver-authentication": dial tcp 10.96.0.1:443: i/o timeout となっております

行動規範の内容に同意します