Prometheus 监控服务 TKE 集群内安装组件说明

一、组件介绍

由于 TKE 集群有独立的网络环境，proxy-agent 部署在集群内为集群外的采集组件提供访问代理。外部采集组件一方面通过 proxy-agent 服务发现集群内的资源，另一方面通过 proxy-agent 抓取指标并写到 Prometheus 实例的时序存储中。

二、部署在集群内的资源对象

三、权限场景

四、外部 Kubernetes 集群额外权限场景

五、权限定义

apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata: name: prom-instancerules: – apiGroups: – monitoring.coreos.com resources: – scrapeconfigs – servicemonitors – podmonitors – probes – prometheuses – prometheusrules verbs: – get – list – watch # 外部 Kubernetes 集群使用 # – * – apiGroups: – "" resources: – namespaces – configmaps – secrets – nodes – services – endpoints – pods verbs: – get – list – watch – apiGroups: – networking.k8s.io resources: – ingresses verbs: – get – list – watch – apiGroups: [ "" ] resources: – nodes/metrics – nodes/proxy – pods/proxy verbs: – get – list – watch – nonResourceURLs: [ "/metrics", "/metrics/cadvisor" ] verbs: – get—# 外部 Kubernetes 集群使用apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: prom-instance
namespace: prom-instance
rules:
– apiGroups: [ "", "extensions", "apps" ]
resources: [ "*" ]
verbs: [ "*" ]

六、组件介绍

tke-kube-state-metrics 使用开源组件 kube-state-metrics，监听集群的 API server，生成集群内各种对象的状态指标。

七、部署在集群内的资源对象

八、权限场景

九、权限定义

apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata: name: tke-kube-state-metricsrules: – apiGroups: – "" resources: – configmaps – secrets – nodes – pods – services – serviceaccounts – resourcequotas – replicationcontrollers – limitranges – persistentvolumeclaims – persistentvolumes – namespaces – endpoints verbs: – list – watch – apiGroups: – apps resources: – statefulsets – daemonsets – deployments – replicasets verbs: – list – watch – apiGroups: – batch resources: – cronjobs – jobs verbs: – list – watch – apiGroups: – autoscaling resources: – horizontalpodautoscalers verbs: – list – watch – apiGroups: – authentication.k8s.io resources: – tokenreviews verbs: – create – apiGroups: – authorization.k8s.io resources: – subjectaccessreviews verbs: – create – apiGroups: – policy resources: – poddisruptionbudgets verbs: – list – watch – apiGroups: – certificates.k8s.io resources: – certificatesigningrequests verbs: – list – watch – apiGroups: – storage.k8s.io resources: – storageclasses – volumeattachments verbs: – list – watch – apiGroups: – admissionregistration.k8s.io resources: – mutatingwebhookconfigurations – validatingwebhookconfigurations verbs: – list – watch – apiGroups: – networking.k8s.io resources: – networkpolicies – ingresses verbs: – list – watch – apiGroups: – coordination.k8s.io resources: – leases verbs: – list – watch – apiGroups: – rbac.authorization.k8s.io resources: – clusterrolebindings – clusterroles – rolebindings – roles verbs: – list – watch—kind: Rolemetadata: name: tke-kube-state-metrics namespace: kube-systemrules: – apiGroups: – "" resources: – pods verbs: – get – apiGroups: – apps resourceNames: – tke-kube-state-metrics resources: – statefulsets verbs: – get

十、组件介绍

tke-node-exporter 使用开源项目 node_exporter，部署在集群内的每个 Node 上，用来采集硬件和类Unix操作系统指标。

十一、部署在集群内的资源

十二、组件权限说明

该组件不使用任何集群权限。