![\"\"](\"https:\/\/blog.opshub.com.cn\/wp-content\/uploads\/2026\/01\/Image-50-1024x60.png\")
<\/figure>\n\n\n\n\u539f\u56e0\u662f\u6ca1\u6709\u5f00\u542fAPI\u805a\u5408\u3002<\/p>\n\n\n\n
\u5982\u679c\u4f60\u662f kubeadm \u6216\u8005\u5b98\u65b9\u7684 kube-up.sh \u811a\u672c\u90e8\u7f72 Kubernetes \u96c6\u7fa4\u7684\u8bdd\uff0c API\u805a\u5408\u6a21\u5f0f\u5c31\u662f\u9ed8\u8ba4\u5f00\u542f\u7684\uff1b\u5982\u679c\u662f\u624b\u52a8\u4e8c\u8fdb\u5236\u642d\u5efa\u7684\u8bdd\uff0c\u4f60\u5c31\u9700\u8981\u5f00\u542fAPI\u805a\u5408\u3002<\/p>\n\n\n\n
\u5f00\u542fAPI\u805a\u5408\uff1a<\/p>\n\n\n\n
\u521b\u5efaproxy-client-csr.json\u6587\u4ef6<\/p>\n\n\n\n
{\n \"CN\": \"kubernetes\",\n \"hosts\": [\n ],\n \"key\": {\n \"algo\": \"rsa\",\n \"size\": 2048\n },\n \"names\": [\n {\n \"C\": \"CN\",\n \"ST\": \"SuZhou\",\n \"L\": \"SuZhou\",\n \"O\": \"k8s\",\n \"OU\": \"System\"\n }\n ]\n}<\/code><\/pre>\n\n\n\n\u751f\u6210\u8bc1\u4e66\u548c\u5bc6\u94a5\uff1a<\/p>\n\n\n\n
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -profile=kubernetes proxy-client-csr.json |cfssljson -bare proxy-client\n\n\ncp proxy-client.pem proxy-client-key.pem \/etc\/kubernetes\/ssl\/<\/code><\/pre>\n\n\n\n\/etc\/kubernetes\/kube-apiserver.conf\u91cc\u52a0\u4e0a\u805a\u5408API\u7684\u914d\u7f6e\uff1a\uff08\u7ea2\u5b57\u90e8\u5206\uff09<\/p>\n\n\n\n
\u5982\u679c\u672a\u5728 master \u8282\u70b9\u4e0a\u8fd0\u884c kube-proxy\uff0c\u5219\u5fc5\u987b\u786e\u4fdd kube-apiserver \u542f\u52a8\u53c2\u6570\u4e2d\u5305\u542b–enable-aggregator-routing=true<\/mark><\/p>\n\n\n\nKUBE_APISERVER_OPTS=\"--enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \\\n --anonymous-auth=false \\\n --bind-address=0.0.0.0 \\\n --secure-port=6443 \\\n --insecure-port=0 \\\n --advertise-address=192.168.2.135 \\\n --authorization-mode=Node,RBAC \\\n --runtime-config=api\/all=true \\\n --enable-bootstrap-token-auth \\\n --service-cluster-ip-range=10.255.0.0\/16 \\\n --token-auth-file=\/etc\/kubernetes\/token.csv \\\n --service-node-port-range=30000-50000 \\\n --tls-cert-file=\/etc\/kubernetes\/ssl\/kube-apiserver.pem \\\n --tls-private-key-file=\/etc\/kubernetes\/ssl\/kube-apiserver-key.pem \\\n --client-ca-file=\/etc\/kubernetes\/ssl\/ca.pem \\\n --kubelet-client-certificate=\/etc\/kubernetes\/ssl\/kube-apiserver.pem \\\n --kubelet-client-key=\/etc\/kubernetes\/ssl\/kube-apiserver-key.pem \\\n --service-account-key-file=\/etc\/kubernetes\/ssl\/ca-key.pem \\\n --service-account-signing-key-file=\/etc\/kubernetes\/ssl\/ca-key.pem \\\n --service-account-issuer=https:\/\/kubernetes.default.svc.cluster.local \\\n --etcd-cafile=\/etc\/etcd\/ssl\/ca.pem \\\n --etcd-certfile=\/etc\/etcd\/ssl\/etcd.pem \\\n --etcd-keyfile=\/etc\/etcd\/ssl\/etcd-key.pem \\\n --etcd-servers=https:\/\/192.168.2.135:2379,https:\/\/192.168.2.136:2379,https:\/\/192.168.2.140:2379 \\\n --enable-swagger-ui=true \\\n --allow-privileged=true \\\n --apiserver-count=3 \\\n --audit-log-maxage=30 \\\n --audit-log-maxbackup=3 \\\n --audit-log-maxsize=100 \\\n --audit-log-path=\/var\/log\/kube-apiserver-audit.log \\\n --event-ttl=1h \\\n --alsologtostderr=true \\\n --logtostderr=false \\\n --log-dir=\/var\/log\/kubernetes \\\n --requestheader-allowed-names=aggregator \\\n --requestheader-group-headers=X-Remote-Group \\\n --requestheader-username-headers=X-Remote-User \\\n --requestheader-extra-headers-prefix=X-Remote-Extra- \\\n --requestheader-client-ca-file=\/etc\/kubernetes\/ssl\/ca.pem \\\n --proxy-client-cert-file=\/etc\/kubernetes\/ssl\/proxy-client.pem \\\n --proxy-client-key-file=\/etc\/kubernetes\/ssl\/proxy-client-key.pem \\<\/mark>\n --v=4\"<\/code><\/pre>\n\n\n\n\u91cd\u542fkube-apiserver\u670d\u52a1\uff1a<\/p>\n\n\n\n
systemctl restart kube-apiserver<\/code><\/pre>\n\n\n\nroot@k8s-master1:~# kubectl get apiservice v1beta1.metrics.k8s.io -o yaml\napiVersion: apiregistration.k8s.io\/v1\nkind: APIService\nmetadata:\n annotations:\n kubectl.kubernetes.io\/last-applied-configuration: |\n {\"apiVersion\":\"apiregistration.k8s.io\/v1\",\"kind\":\"APIService\",\"metadata\":{\"annotations\":{},\"labels\":{\"k8s-app\":\"metrics-server\"},\"name\":\"v1beta1.metrics.k8s.io\"},\"spec\":{\"group\":\"metrics.k8s.io\",\"groupPriorityMinimum\":100,\"insecureSkipTLSVerify\":true,\"service\":{\"name\":\"metrics-server\",\"namespace\":\"kube-system\"},\"version\":\"v1beta1\",\"versionPriority\":100}}\n creationTimestamp: \"2024-08-30T06:40:11Z\"\n labels:\n k8s-app: metrics-server\n name: v1beta1.metrics.k8s.io\n resourceVersion: \"341124\"\n uid: 168aea79-79fd-4345-ace1-8b27c195f68c\nspec:\n group: metrics.k8s.io\n groupPriorityMinimum: 100\n insecureSkipTLSVerify: true\n service:\n name: metrics-server\n namespace: kube-system\n port: 443\n version: v1beta1\n versionPriority: 100\nstatus:\n conditions:\n - lastTransitionTime: \"2024-08-30T09:28:21Z\"\n message: all checks passed\n reason: Passed\n status: \"True\"\n type: Available<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/blog.opshub.com.cn\/wp-content\/uploads\/2026\/01\/Image-51.png\")
<\/figure>\n\n\n\nphp-apache.yaml:<\/p>\n\n\n\n
apiVersion: apps\/v1\nkind: Deployment\nmetadata:\n name: php-apache\nspec:\n selector:\n matchLabels:\n run: php-apache\n template:\n metadata:\n labels:\n run: php-apache\n spec:\n containers:\n - name: php-apache\n image: registry.k8s.io\/hpa-example\n ports:\n - containerPort: 80\n resources:\n limits:\n cpu: 500m\n requests:\n cpu: 200m\n---\napiVersion: v1\nkind: Service\nmetadata:\n name: php-apache\n labels:\n run: php-apache\nspec:\n ports:\n - port: 8082\n protocol: TCP\n targetPort: 80\n selector:\n run: php-apache\n type: NodePort<\/code><\/pre>\n\n\n\nkubect apply -f php-apache.yaml\n\n\nroot@k8s-master1:~# kubectl get svc\nNAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE\nkubernetes ClusterIP 10.255.0.1 <none> 443\/TCP 23d\nphp-apache NodePort 10.255.180.35 <none> 8082:48581\/TCP 109m<\/code><\/pre>\n\n\n\n\u8bbe\u7f6e\u81ea\u52a8\u6269\u7f29\uff1a<\/p>\n\n\n\n
kubectl autoscale deployment php-apache --cpu-percent=50 --min=1 --max=10<\/code><\/pre>\n\n\n\n\u538b\u6d4b\uff1a<\/p>\n\n\n\n
kubectl run -i --tty load-generator --rm --image=busybox:1.28 --restart=Never -- \/bin\/sh -c \"while sleep 0.01; do wget -q -O- http:\/\/10.255.180.35:8082; done\"<\/code><\/pre>\n\n\n\n\u89c2\u5bdf\uff1a<\/p>\n\n\n\n
root@k8s-master1:~# kubectl get hpa php-apache --watch\nNAME REFERENCE TARGETS MINPODS MAXPODS REPLICAS AGE\nphp-apache Deployment\/php-apache 186%\/50% 1 10 1 6m8s\nphp-apache Deployment\/php-apache 243%\/50% 1 10 4 6m11s\nphp-apache Deployment\/php-apache 243%\/50% 1 10 5 6m21s\nphp-apache Deployment\/php-apache 176%\/50% 1 10 5 6m31s\nphp-apache Deployment\/php-apache 164%\/50% 1 10 5 6m41s\nphp-apache Deployment\/php-apache 164%\/50% 1 10 7 6m51s\nphp-apache Deployment\/php-apache 140%\/50% 1 10 7 7m1s\nphp-apache Deployment\/php-apache 72%\/50% 1 10 7 7m11s\nphp-apache Deployment\/php-apache 62%\/50% 1 10 7 7m31s\nphp-apache Deployment\/php-apache 63%\/50% 1 10 7 7m41s\nphp-apache Deployment\/php-apache 63%\/50% 1 10 7 8m1s\nphp-apache Deployment\/php-apache 57%\/50% 1 10 7 8m11s\nphp-apache Deployment\/php-apache 68%\/50% 1 10 7 8m32s\nphp-apache Deployment\/php-apache 59%\/50% 1 10 7 8m42s\nphp-apache Deployment\/php-apache 62%\/50% 1 10 7 9m2s\nphp-apache Deployment\/php-apache 61%\/50% 1 10 7 9m12s\nphp-apache Deployment\/php-apache 59%\/50% 1 10 7 9m32s\nphp-apache Deployment\/php-apache 64%\/50% 1 10 7 9m42s\nphp-apache Deployment\/php-apache 56%\/50% 1 10 7 10m\nphp-apache Deployment\/php-apache 62%\/50% 1 10 7 10m\nphp-apache Deployment\/php-apache 60%\/50% 1 10 7 10m\nphp-apache Deployment\/php-apache 65%\/50% 1 10 7 10m\nphp-apache Deployment\/php-apache 59%\/50% 1 10 7 11m\nphp-apache Deployment\/php-apache 64%\/50% 1 10 7 11m\nphp-apache Deployment\/php-apache 61%\/50% 1 10 7 11m\nphp-apache Deployment\/php-apache 47%\/50% 1 10 7 11m\nphp-apache Deployment\/php-apache 3%\/50% 1 10 7 12m\nphp-apache Deployment\/php-apache 0%\/50% 1 10 7 12m\nphp-apache Deployment\/php-apache 1%\/50% 1 10 7 12m\nphp-apache Deployment\/php-apache 0%\/50% 1 10 7 13m\nphp-apache Deployment\/php-apache 0%\/50% 1 10 7 16m\nphp-apache Deployment\/php-apache 0%\/50% 1 10 4 17m\nphp-apache Deployment\/php-apache 0%\/50% 1 10 4 17m\nphp-apache Deployment\/php-apache 0%\/50% 1 10 3 17m\nphp-apache Deployment\/php-apache 0%\/50% 1 10 3 17m\nphp-apache Deployment\/php-apache 0%\/50% 1 10 1 18m<\/code><\/pre>\n\n\n\n\n- kubectl get apiservice v1beta1.metrics.k8s.io -o yaml \u62a5\u9519\uff1a<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/blog.opshub.com.cn\/wp-content\/uploads\/2026\/01\/image-52-1024x145.png\")
<\/figure>\n\n\n\nkubectl describe svc metrics-server -n kube-system\u67e5\u770b\u5230endpoints\u7f3a\u5931\uff1a<\/p>\n\n\n\n<\/figure>\n\n\n\nroot@m1:\/data\/work# kubectl describe pod metrics-server-85d6fcf458-rhn7p -n kube-system \u67e5\u770bpod\u4e8b\u4ef6\uff1a<\/p>\n\n\n\n<\/figure>\n\n\n\n\u89e3\u51b3\u65b9\u6cd5\uff0c\u662f\u5728components.yaml\u91cc\u52a0\u4e00\u884c\u914d\u7f6e\uff1a- –kubelet-insecure-tls<\/p>\n\n\n\n![\"\"](\"https:\/\/blog.opshub.com.cn\/wp-content\/uploads\/2026\/01\/image-53.png\")
<\/figure>\n\n\n\n\u7136\u540e\uff1akubectl delete -f components.yaml;kubectl apply -f components.yaml<\/p>\n\n\n\n
kubectl describe pod metrics-server-f95dcdc9c-55b58 -n kube-system \u8b66\u544a\u4e0d\u89c1\u4e86<\/p>\n\n\n\n
kubectl get apiservice v1beta1.metrics.k8s.io -o yaml\uff0c\u4e00\u5207\u6b63\u5e38\uff1a<\/p>\n\n\n\n<\/figure>\n","protected":false},"excerpt":{"rendered":"\u5728master\u4e0a\u5b89\u88c5kubelet\u548ckube-proxy\u5c06master\u4f5c\u4e3anode\u52a0\u5165\u96c6\u7fa4\uff0c\u7136\u540e\u6253\u4e0a\u6c61\u70b9\uff0c\u907f\u514dpod\u8c03\u5ea6\u5230\u4e0a\u9762 \u5b89\u88c5\u00a0metrics-server \u4e14\u67e5\u770b\u5bb9\u5668\u65e5\u5fd7\u6709\uff1a \u539f\u56e0\u662f\u6ca1\u6709\u5f00\u542fAPI\u805a\u5408\u3002 \u5982\u679c\u4f60\u662f kubeadm \u6216\u8005\u5b98\u65b9\u7684 kube-up.sh \u811a\u672c\u90e8\u7f72 Kubernetes \u96c6\u7fa4\u7684\u8bdd\uff0c API\u805a\u5408\u6a21\u5f0f\u5c31\u662f\u9ed8\u8ba4\u5f00\u542f\u7684\uff1b\u5982\u679c\u662f\u624b\u52a8\u4e8c\u8fdb\u5236\u642d\u5efa\u7684\u8bdd\uff0c\u4f60\u5c31\u9700\u8981\u5f00\u542fAPI\u805a\u5408\u3002 \u5f00\u542fAPI\u805a\u5408\uff1a \u521b\u5efaproxy-client-csr.json\u6587\u4ef6 \u751f\u6210\u8bc1\u4e66\u548c\u5bc6\u94a5\uff1a \/etc\/kubernetes\/kube-apiserver.conf\u91cc\u52a0\u4e0a\u805a\u5408API\u7684\u914d\u7f6e\uff1a\uff08\u7ea2\u5b57\u90e8\u5206\uff09 \u5982\u679c\u672a\u5728 master \u8282\u70b9\u4e0a\u8fd0\u884c kube-proxy\uff0c\u5219\u5fc5\u987b\u786e\u4fdd kube-apiserver \u542f\u52a8\u53c2\u6570\u4e2d\u5305\u542b–enable-aggregator-routing=true \u91cd\u542fkube-apiserver\u670d\u52a1\uff1a php-apache.yaml: \u8bbe\u7f6e\u81ea\u52a8\u6269\u7f29\uff1a \u538b\u6d4b\uff1a \u89c2\u5bdf\uff1a kubectl describe svc metrics-server -n kube-system\u67e5\u770b\u5230endpoints\u7f3a\u5931\uff1a root@m1:\/data\/work# kubectl describe pod metrics-server-85d6fcf458-rhn7p -n kube-system \u67e5\u770bpod\u4e8b\u4ef6\uff1a \u89e3\u51b3\u65b9\u6cd5\uff0c\u662f\u5728components.yaml\u91cc\u52a0\u4e00\u884c\u914d\u7f6e\uff1a- –kubelet-insecure-tls \u7136\u540e\uff1akubectl delete -f components.yaml;kubectl apply -f components.yaml kubectl describe pod metrics-server-f95dcdc9c-55b58 -n kube-system \u8b66\u544a\u4e0d\u89c1\u4e86 kubectl […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-355","post","type-post","status-publish","format-standard","hentry","category-dockerkubernetes"],"_links":{"self":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=355"}],"version-history":[{"count":3,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/355\/revisions"}],"predecessor-version":[{"id":625,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/355\/revisions\/625"}],"wp:attachment":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/blog.opshub.com.cn\/wp-content\/uploads\/2026\/01\/Image-49.png\")
<\/figure>\n\n\n\n