Enable external metrics for the cluster

README.md

@@ -49,6 +49,19 @@ The dashboard is always listening on port 32443 with SSL and a private certifica
 
 <https://myfamous-minicluster-hostname.cloud:32443>
 
+## Getting Prometheus metric for an external monitoring
+
+You must rollout the component `metrics-server` (enable this in `env.sh`).
+
+After this you get the config by executing `./get-metrics-reader-config.sh`.
+
+The config makes a:
+
+- ServiceAccount
+- ClusterRole
+- Rolebinding
+- Bearer Token to access the metrics via the API
+
 ## Getting login info for your cluster
 
 You can copy the admin.conf in your local kube environment. As normal user:

env.sh

@@ -10,5 +10,5 @@ WILDCARD_INGRESS=gubernat1.pflaeging.net
 MYIP=192.168.254.130
 
 # all components:
-#   cert-manager contour-ingress kubernetes-dashboard local-storage
-COMPONENTS="contour-ingress kubernetes-dashboard local-storage"
+#   cert-manager contour-ingress kubernetes-dashboard local-storage metrics-server
+COMPONENTS="contour-ingress kubernetes-dashboard local-storage metrics-server"

get-metrics-reader-config.sh

@@ -0,0 +1,11 @@
+#! /bin/sh 
+
+# get ip address 
+HOSTNAME=`hostname`
+# get token for pre-defined admin-user 
+TOKEN=$(kubectl get secret metrics-reader -n kube-system -o jsonpath='{.data.token}' | base64 -d)
+
+echo To access metrics:
+echo
+echo TOKEN=$TOKEN
+echo curl -vv -k https://$HOSTNAME:6443/metrics --header \"Authorization: Bearer \$TOKEN\"

metrics-server/clusterrole.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: metrics-reader
+rules:
+  - nonResourceURLs:
+    - "/metrics"
+    verbs:
+    - get

metrics-server/clusterrolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: metrics-reader-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: metrics-reader
+subjects:
+- kind: ServiceAccount
+  name: metrics-reader
+  namespace: kube-system

metrics-server/install.sh

@@ -0,0 +1,5 @@
+#! /bin/sh
+
+. ../env.sh
+
+kubectl apply -k .

metrics-server/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
+- sa.yaml
+- clusterrole.yaml
+- clusterrolebinding.yaml
+- secret.yaml
+
+patches:
+  - target:
+      kind: Deployment
+      name: metrics-server
+    patch: |-
+      - op: add
+        path: /spec/template/spec/containers/0/args/-
+        value: --kubelet-insecure-tls

metrics-server/sa.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: metrics-reader
+  namespace: kube-system

metrics-server/secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    kubernetes.io/service-account.name: metrics-reader
+  name: metrics-reader
+  namespace: kube-system
+type: kubernetes.io/service-account-token