kubernetes部署metrics-server遇到的问题

kubernetes部署metrics-server后执行kubectl top pod或kubectl top node报错
Error from server (ServiceUnavailable): the server is currently unable to handle the request (get pods.metrics.k8s.io)

一、问题检查步骤：

1.1、查看metrics-server服务日志

检查发现metrics-server服务并没有什么异常

1.2、检查kube-apiserver日志

检查发现是由于调用metrics-server无权限，返回了http 403错误

1.3、检查是否配置了以下参数
1.4、问题总结：
metrics-server服务配置是没有问题的，但服务依然报错 Error from server (ServiceUnavailable): the server is currently unable to handle the request (get pods.metrics.k8s.io)，有两种方法可以解决问题
1、授权集群角色给用户system:anonymous
kubectl create clusterrolebinding system:anonymous ? --clusterrole=cluster-admin ? --user=system:anonymous
2、创建system:metrics-server角色并授权

二、问题解决(创建system:metrics-server角色并授权)：

2.1、配置metrics-server证书

# vim metrics-server-csr.json
{
  "CN": "system:metrics-server",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "system"
    }
  ]
}
# cfssl gencert -ca=/etc/kubernetes/ssl/ca.pem -ca-key=/etc/kubernetes/ssl/ca-key.pem -config=ca-config.json -profile=kubernetes metrics-server-csr.json | cfssljson -bare metrics-server

2.2、配置metrics-server  RBAC授权

cat > auth-metrics-server.yaml << EOF
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: system:auth-metrics-server-reader
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods", "nodes"]
  verbs: ["get", "list", "watch"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: metrics-server:system:auth-metrics-server
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-metrics-server-reader
subjects:
- kind: User
  name: system:metrics-server
  namespace: kube-system
EOF

2.3、kube-apiserver添加metrics-server需要的配置

--requestheader-client-ca-file=/etc/kubernetes/ssl/ca.pem --requestheader-allowed-names=aggregator,metrics-server --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --proxy-client-cert-file=/etc/kubernetes/ssl/metrics-server.pem --proxy-client-key-file=/etc/kubernetes/ssl/metrics-server-key.pem 

2.4、检查是否能够正常获取到监控信息