• prometheus-operator项目给prometheus页面添加鉴权

    一、环境准备

    组件版本
    kube-prometheus-stackkube-prometheus-stack-39.6.0
    prometheus-operatorprometheus-operator:v0.58.0
    prometheusprometheus:v2.37.0
    alertmanageralertmanager:v0.24.0
    grafanagrafana:9.0.5
    node-explorternode-exporter:v1.3.1
    kube-state-metricskube-state-metrics:v2.5.0

    二、安装部署

    2.1 部署k8s集群

    略

    2.2 安装helm工具

    1. [root@master1 helm]# wget https://get.helm.sh/helm-v3.5.4-linux-amd64.tar.gz
    2. [root@master1 helm]# tar xvf helm-v3.5.4-linux-amd64.tar.gz
    3. [root@master1 helm]# cp linux-amd64/helm /usr/bin/

    检查是否安装成功

    1. [root@k8s-master]-[~]-#helm version
    2. version.BuildInfo{Version:"v3.5.4", GitCommit:"1b5edb69df3d3a08df77c9902dc17af864ff05d1", GitTreeState:"clean", GoVersion:"go1.15.11"}
    3. [root@k8s-master]-[~]-#

    2.3 部署kube-prometheus-stack

    2.3.1 添加helm repo

    helm repo add prometheus-community https://prometheus-community.github.io/helm-charts

    2.3.2 下载chart包

    helm pull prometheus-community/kube-prometheus-stack

    2.4.3 创建一个新的ns

    kubectl create ns monitoring

    2.4.4 安装chart

    helm install  kube-prometheus-stack -n monitoring ./kube-prometheus-stack

    2.4.5 检查所有对象资源运行正常

    1. [root@k8s-master]-[~]-#kubectl get all -n monitoring 
    2. NAME                                                            READY   STATUS    RESTARTS   AGE
    3. pod/alertmanager-kube-prometheus-stack-alertmanager-0           2/2     Running   0          137m
    4. pod/kube-prometheus-stack-grafana-6ddfb54796-h4tqg              3/3     Running   0          139m
    5. pod/kube-prometheus-stack-kube-state-metrics-677d866f69-t5frl   1/1     Running   0          139m
    6. pod/kube-prometheus-stack-operator-748857655d-5ckqx             1/1     Running   0          139m
    7. pod/kube-prometheus-stack-prometheus-node-exporter-9d7b6        1/1     Running   0          139m
    8. pod/kube-prometheus-stack-prometheus-node-exporter-dz2qs        1/1     Running   0          139m
    9. pod/kube-prometheus-stack-prometheus-node-exporter-k6nxw        1/1     Running   0          139m
    10. pod/prometheus-kube-prometheus-stack-prometheus-0               2/2     Running   0          37m
    11.  
    12. NAME                                                     TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
    13. service/alertmanager-operated                            ClusterIP   None                    9093/TCP,9094/TCP,9094/UDP   137m
    14. service/kube-prometheus-stack-alertmanager               NodePort    10.96.235.164           9093:30987/TCP               139m
    15. service/kube-prometheus-stack-grafana                    ClusterIP   10.96.233.113           80/TCP                       139m
    16. service/kube-prometheus-stack-kube-state-metrics         ClusterIP   10.96.76.27             8080/TCP                     139m
    17. service/kube-prometheus-stack-operator                   ClusterIP   10.96.254.251           443/TCP                      139m
    18. service/kube-prometheus-stack-prometheus                 NodePort    10.96.71.39             9090:30815/TCP               139m
    19. service/kube-prometheus-stack-prometheus-node-exporter   ClusterIP   10.96.81.210            9100/TCP                     139m
    20. service/prometheus-operated                              ClusterIP   None                    9090/TCP                     137m
    21.  
    22. NAME                                                            DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
    23. daemonset.apps/kube-prometheus-stack-prometheus-node-exporter   3         3         3       3            3                     139m
    24.  
    25. NAME                                                       READY   UP-TO-DATE   AVAILABLE   AGE
    26. deployment.apps/kube-prometheus-stack-grafana              1/1     1            1           139m
    27. deployment.apps/kube-prometheus-stack-kube-state-metrics   1/1     1            1           139m
    28. deployment.apps/kube-prometheus-stack-operator             1/1     1            1           139m
    29.  
    30. NAME                                                                  DESIRED   CURRENT   READY   AGE
    31. replicaset.apps/kube-prometheus-stack-grafana-6ddfb54796              1         1         1       139m
    32. replicaset.apps/kube-prometheus-stack-kube-state-metrics-677d866f69   1         1         1       139m
    33. replicaset.apps/kube-prometheus-stack-operator-748857655d             1         1         1       139m
    34.  
    35. NAME                                                               READY   AGE
    36. statefulset.apps/alertmanager-kube-prometheus-stack-alertmanager   1/1     137m
    37. statefulset.apps/prometheus-kube-prometheus-stack-prometheus       1/1     137m

    PS：有个别镜像pull不到，更换镜像地址即可

    三、创建secret

    3.1 使用bcrypt加密算法加密

    参考：HTTPS and authentication | Prometheus

    密码生成脚本如下：

    1. import bcrypt
    2.  
    3. passwd = b'admin1234'
    4.  
    5. # start 加密
    6. salt = bcrypt.gensalt()
    7. hashed = bcrypt.hashpw(passwd, salt)
    8.  
    9. print(salt)
    10. print(hashed)
    11. # end 加密
    12.  
    13.  
    14. # start 验证
    15. print(bcrypt.checkpw(passwd, hashed))
    16. # end 验证

    生成密码配置文件：

    1. [root@k8s-master]-[~]-#cat secret.txt 
    2. basic_auth_users:
    3.   admin: $2b$12$QkmXyjJlNsCI3HzMC.Srve6Dy0BClhWbeQirp7WGOrFXywd0Sr2Dm

    base64加密：

    1. cat secret.txt|base64 -w 0
    2. YmFzaWNfYXV0aF91c2VyczoKICBhZG1pbjogJDJiJDEyJFFrbVh5akpsTnNDSTNIek1DLlNydmU2RHkwQkNsaFdiZVFpcnA3V0dPckZYeXdkMFNyMkRtCg==

    3.2 创建secret对象

    1. apiVersion: v1
    2. data:
    3.   web.yaml: YmFzaWNfYXV0aF91c2VyczoKICBhZG1pbjogJDJiJDEyJFFrbVh5akpsTnNDSTNIek1DLlNydmU2RHkwQkNsaFdiZVFpcnA3V0dPckZYeXdkMFNyMkRtCg==
    4. kind: Secret
    5. metadata:
    6.   annotations:
    7.     meta.helm.sh/release-name: kube-prometheus-stack
    8.     meta.helm.sh/release-namespace: monitoring
    9.   labels:
    10.     app: kube-prometheus-stack-prometheus
    11.     app.kubernetes.io/component: prometheus
    12.     app.kubernetes.io/instance: kube-prometheus-stack
    13.     app.kubernetes.io/managed-by: Helm
    14.     app.kubernetes.io/part-of: kube-prometheus-stack
    15.     app.kubernetes.io/version: 39.6.0
    16.     chart: kube-prometheus-stack-39.6.0
    17.     heritage: Helm
    18.     release: kube-prometheus-stack
    19.   name: prometheus-basic-auth
    20.   namespace: monitoring
    21. type: Opaque

    四、编辑prometheus对象资源

    4.1 修改prometheus

    1. [root@k8s-master]-[~]-#
    2. [root@k8s-master]-[~]-#kubectl get prometheus -A
    3. NAMESPACE    NAME                               VERSION   REPLICAS   AGE
    4. monitoring   kube-prometheus-stack-prometheus   v2.37.0   1          17h
    1. [root@k8s-master]-[~]-#kubectl edit prometheus -nmonitoring   kube-prometheus-stack-prometheus
    2. apiVersion: monitoring.coreos.com/v1
    3. kind: Prometheus
    4. metadata:
    5.   annotations:
    6.     meta.helm.sh/release-name: kube-prometheus-stack
    7.     meta.helm.sh/release-namespace: monitoring
    8.   creationTimestamp: "2022-08-15T07:31:20Z"
    9.   generation: 13
    10.   labels:
    11.     app: kube-prometheus-stack-prometheus
    12.     app.kubernetes.io/instance: kube-prometheus-stack
    13.     app.kubernetes.io/managed-by: Helm
    14.     app.kubernetes.io/part-of: kube-prometheus-stack
    15.     app.kubernetes.io/version: 39.6.0
    16.     chart: kube-prometheus-stack-39.6.0
    17.     heritage: Helm
    18.     release: kube-prometheus-stack
    19.   name: kube-prometheus-stack-prometheus
    20.   namespace: monitoring
    21.   resourceVersion: "208703"
    22.   selfLink: /apis/monitoring.coreos.com/v1/namespaces/monitoring/prometheuses/kube-prometheus-stack-prometheus
    23.   uid: 45d42fa1-b2a7-44a1-809d-f1e3ada94250
    24. spec:
    25.   alerting:
    26.     alertmanagers:
    27.     - apiVersion: v2
    28.       name: kube-prometheus-stack-alertmanager
    29.       namespace: monitoring
    30.       pathPrefix: /
    31.       port: http-web
    32.   containers:
    33.   - args:
    34.     - --web.console.templates=/etc/prometheus/consoles
    35.     - --web.console.libraries=/etc/prometheus/console_libraries
    36.     - --storage.tsdb.retention.time=10d
    37.     - --config.file=/etc/prometheus/config_out/prometheus.env.yaml
    38.     - --storage.tsdb.path=/prometheus
    39.     - --web.enable-lifecycle
    40.     - --web.external-url=http://kube-prometheus-stack-prometheus.monitoring:9090
    41.     - --web.route-prefix=/
    42.     - --web.config.file=/etc/prometheus/secrets/prometheus-basic-auth/web.yaml  #修改Prometheus默认指定路径
    43.     livenessProbe:
    44.       failureThreshold: 6
    45.       httpGet:
    46.         httpHeaders:
    47.         - name: Authorization
    48.           value: Basic YWRtaW46YWRtaW4xMjM0   
    49.         path: /-/healthy
    50.         port: http-web
    51.         scheme: HTTP
    52.       periodSeconds: 5
    53.       successThreshold: 1
    54.       timeoutSeconds: 3
    55.     name: prometheus
    56.     readinessProbe:
    57.       httpGet:
    58.         httpHeaders:
    59.         - name: Authorization
    60.           value: Basic YWRtaW46YWRtaW4xMjM0
    61.         path: /-/ready
    62.         port: http-web
    63.         scheme: HTTP
    64.       periodSeconds: 5
    65.       successThreshold: 1
    66.       timeoutSeconds: 3
    67.   enableAdminAPI: false
    68.   evaluationInterval: 30s
    69.   externalUrl: http://kube-prometheus-stack-prometheus.monitoring:9090
    70.   image: quay.io/prometheus/prometheus:v2.37.0
    71.   listenLocal: false
    72.   logFormat: logfmt
    73.   logLevel: info
    74.   paused: false
    75.   podMonitorNamespaceSelector: {}
    76.   podMonitorSelector:
    77.     matchLabels:
    78.       release: kube-prometheus-stack
    79.   portName: http-web
    80.   probeNamespaceSelector: {}
    81.   probeSelector:
    82.     matchLabels:
    83.       release: kube-prometheus-stack
    84.   replicas: 1
    85.   retention: 10d
    86.   routePrefix: /
    87.   ruleNamespaceSelector: {}
    88.   ruleSelector:
    89.     matchLabels:
    90.       release: kube-prometheus-stack
    91.   scrapeInterval: 30s
    92.   secrets:
    93.   - prometheus-basic-auth               #将配置好的secret挂载到prometheus容器中
    94.   securityContext:
    95.     fsGroup: 2000
    96.     runAsGroup: 2000
    97.     runAsNonRoot: true
    98.     runAsUser: 1000
    99.   serviceAccountName: kube-prometheus-stack-prometheus
    100.   serviceMonitorNamespaceSelector: {}
    101.   serviceMonitorSelector:
    102.     matchLabels:
    103.       release: kube-prometheus-stack
    104.   shards: 1
    105.   version: v2.37.0
    106. status:
    107.   availableReplicas: 1
    108.   conditions:
    109.   - lastTransitionTime: "2022-08-15T09:13:15Z"
    110.     status: "True"
    111.     type: Available
    112.   - lastTransitionTime: "2022-08-15T07:33:22Z"
    113.     status: "True"
    114.     type: Reconciled
    115.   paused: false
    116.   replicas: 1
    117.   shardStatuses:
    118.   - availableReplicas: 1
    119.     replicas: 1
    120.     shardID: "0"
    121.     unavailableReplicas: 0
    122.     updatedReplicas: 1
    123.   unavailableReplicas: 0
    124.   updatedReplicas: 1

    就绪探针和存活探针一定要加认证，否则容器运行异常

  • 相关阅读:
    腾讯云轻量应用服务器ubuntu使用xshell安装宝塔面板
    C++模板（类模板）
    Redis常用数据结构操作与底层原理
    树查找（暑假每日一题 18）
    java开发手册-06工程结构
    数据库进阶教学——索引
    2024牛客暑期多校训练营7
    李沐论文精读系列五：DALL·E2（生成模型串讲，从GANs、VE/VAE/VQ-VAE/DALL·E到扩散模型DDPM/ADM）
    Tensorflow Lite从入门到精通
    Java中string、int、char之间互相转换
  • 原文地址：https://blog.csdn.net/zfw_666666/article/details/126351312