Prometheus #

prometheus/prometheus Github stars Language Last Tag Last commit

quick-start #

$ docker run --name prometheus -d -p 8015:9090 quay.io/prometheus/prometheus

$ cat /etc/prometheus/prometheus.yml

# my global config
global:
  scrape_interval: 15s # Set the scrape interval to every 15 seconds. Default is every 1 minute.
  evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.
  # scrape_timeout is set to the global default (10s).

# Alertmanager configuration
alerting:
  alertmanagers:
    - static_configs:
        - targets:
          # - alertmanager:9093

# Load rules once and periodically evaluate them according to the global 'evaluation_interval'.
rule_files:
  # - "first_rules.yml"
  # - "second_rules.yml"

# A scrape configuration containing exactly one endpoint to scrape:
# Here it's Prometheus itself.
scrape_configs:
  # The job name is added as a label `job=<job_name>` to any timeseries scraped from this config.
  - job_name: "prometheus"

    # metrics_path defaults to '/metrics'
    # scheme defaults to 'http'.

    static_configs:
      - targets: ["localhost:9090"]

Prometheus 证书 #

$ tree /etc/kubernetes/pki

/etc/kubernetes/pki
├── apiserver.crt
├── apiserver-etcd-client.crt
├── apiserver-etcd-client.key
├── apiserver.key
├── apiserver-kubelet-client.crt
├── apiserver-kubelet-client.key
├── ca.crt
├── ca.key
├── etcd
│  ├── ca.crt
│  ├── ca.key
│  ├── healthcheck-client.crt
│  ├── healthcheck-client.key
│  ├── peer.crt
│  ├── peer.key
│  ├── server.crt
│  └── server.key
├── front-proxy-ca.crt
├── front-proxy-ca.key
├── front-proxy-client.crt
├── front-proxy-client.key
├── sa.key
└── sa.pub

1 directory, 22 files

service account #

token 和 ca.crt 挂载到 /var/run/secrets/kubernetes.io/serviceaccount/

- name: kube-api-access-<random-suffix>
  projected:
    defaultMode: 420 # 0644
    sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
            - key: ca.crt
              path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace

这里的 ca.crt 就是 /etc/kubernetes/pki/ca.crt

bash-5.0# cd /var/run/secrets/kubernetes.io/serviceaccount/
bash-5.0# ls -l
total 0
lrwxrwxrwx    1 root     root            13 Oct  8 10:41 ca.crt -> ..data/ca.crt
lrwxrwxrwx    1 root     root            16 Oct  8 10:41 namespace -> ..data/namespace
lrwxrwxrwx    1 root     root            12 Oct  8 10:41 token -> ..data/token
bash-5.0#

参考：

教程 #

yunlzheng/prometheus-book #

Prometheus 操作指南 https://yunlzheng.gitbook.io/prometheus-book/