metrics-server:v0.4.2无法在AWS kubernetes集群环境中抓取指标(无法验证证书，不包含任何IP SAN)

Question

场景:指标服务器部署镜像是: AWS我已经使用kops工具将kubernetes集群部署到一个k8s.gcr.io/metrics-server/metrics-server:v0.4.2帐户中。

由kubectl -n kube-system logs metrics-server-bcc948649-dsnd6获取的错误及其失败原因

 unable to fully scrape metrics: [unable to fully scrape metrics from node ip-10-33-47-106.eu-central-1.compute.internal: unable to fetch metrics from node ip-10-33-47-106.eu-central-1.compute.internal: Get "https://10.33.47.106:10250/stats/summary?only_cpu_and_memory=true": x509: cannot validate certificate for 10.33.47.106 because it doesn't contain any IP SANs, unable to fully scrape metrics from node ip-10-33-50-109.eu-central-1.compute.internal: unable to fetch metrics from node ip-10-33-50-109.eu-central-1.compute.internal: Get "https://10.33.50.109:10250/stats/summary?only_cpu_and_memory=true": x509: cannot validate certificate for 10.33.50.109 because it doesn't contain any IP SANs]

我可以通过修改度量服务器部署模板并将参数- --kubelet-insecure-tls添加到容器args来轻松解决此问题，但似乎不是生产解决方案。

我想在这里问和学习的是，我如何在不损失安全性的情况下以适当的方式解决这个问题？

Answer 1

kOps创建的Kubelet证书在其SAN中仅包含节点主机名，而使用默认清单部署的metrics服务器正在尝试使用节点专用IP进行抓取。更改kubelet-preferred-address-types参数可解决此问题：

- --kubelet-preferred-address-types=Hostname