Metrics Server deployment — installing the resource metrics

The Metrics Server deployment is the cluster’s resource metrics. The Helm chart is the canonical deployment. The kubelet TLS is the common failure mode. This lesson walks the deployment, the TLS, the RBAC, and the verification.

The Helm chart

The Helm chart is the canonical deployment:

helm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/
helm install metrics-server metrics-server/metrics-server \
  --namespace kube-system \
  --set args="{--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname,--kubelet-use-node-status-port,--metric-resolution=15s}"

The Helm chart installs:

• The Deployment.
• The ServiceAccount.
• The ClusterRole and ClusterRoleBinding.
• The Service.
• The API Service.

The chart is the production deployment.

The kubelet TLS

The kubelet TLS is the common failure mode:

metrics-server: x509: certificate is valid for 10.0.1.10, not for 127.0.0.1

The Metrics Server scrapes the kubelet via the kubelet’s TLS cert. The cert’s SAN must include the kubelet’s IP address.

The Helm chart arguments:

args:
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port

The flags tell the Metrics Server to use the kubelet’s status port and the preferred address types.

The kubelet cert

The kubelet cert is auto-generated by the kubelet:

# The kubelet's serving cert
ls -la /var/lib/kubelet/pki/kubelet-server-*.crt

The cert is for the kubelet’s serving. The Metrics Server uses the cert to verify the TLS connection.

The RBAC

The RBAC is the cluster’s access control:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: system:metrics-server
rules:
- apiGroups: [""]
  resources:
  - pods
  - nodes
  - nodes/stats
  - namespaces
  verbs: ["get", "list", "watch"]

The RBAC grants the Metrics Server read-only access to the pods, nodes, and namespaces.

The Service

The Service exposes the Metrics Server:

apiVersion: v1
kind: Service
metadata:
  name: metrics-server
  namespace: kube-system
spec:
  selector:
    k8s-app: metrics-server
  ports:
  - port: 443
    targetPort: 4443
    protocol: TLS

The Service is the endpoint for the API Service.

The API Service

The API Service registers the Metrics Server:

apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1beta1.metrics.k8s.io
spec:
  service:
    name: metrics-server
    namespace: kube-system
  group: metrics.k8s.io
  version: v1beta1
  groupPriorityMinimum: 100
  versionPriority: 100

The API Service registers the metrics.k8s.io API.

The HA pattern

The HA pattern is a single replica:

flowchart LR
    A[Kubelet] --> B[Metrics Server]
    B --> C[metrics.k8s.io API]
    C --> D[HPA]

The Metrics Server is a passive listener; the single replica is sufficient. Some teams run two replicas for HA.

spec:
  replicas: 2

The HA is via the replicas.

The verification

The verification:

# Verify the deployment
kubectl get pods -n kube-system -l k8s-app=metrics-server

# Verify the API
kubectl get --raw=/apis/metrics.k8s.io/v1beta1/

# Verify the metrics
kubectl top nodes
kubectl top pods -A

The verification confirms the deployment.

The troubleshooting

The common troubleshooting:

# Check the pod status
kubectl describe pod -n kube-system -l k8s-app=metrics-server

# Check the logs
kubectl logs -n kube-system -l k8s-app=metrics-server

# Check the API Service
kubectl get apiservice v1beta1.metrics.k8s.io

The troubleshooting is direct.

The kubelet certificate authority

The kubelet certificate authority:

# The kubelet's CA
ls -la /etc/kubernetes/pki/ca.crt

The Metrics Server uses the kubelet’s CA to verify the kubelet’s cert.

Cross-course references

• The Helm course covers the chart installation.
• The HPA course (Part LXXXII) covers the integration.
• The Prometheus course (Part LXXXVIII) covers the metrics.

Quiz

Production discipline

• Deploy the Metrics Server via Helm. The canonical way.
• Configure the kubelet TLS. Use —kubelet-preferred-address-types.
• Use the API Service. The metrics.k8s.io API.
• Verify the deployment. The pod status, the kubectl top.
• Document the deployment. The Helm values, the configuration.
• Monitor the metrics-server metrics. Prometheus exposes them.

The Metrics Server deployment is the cluster’s resource metrics. Operating it well is via the Helm chart, with the kubelet TLS configured, and the kubectl top verifying the metrics.