K
Q

How to disable heapster's security?

4/10/2016

After install heapster in my k8s cluster, I got the following errors:

2016-04-09T16:08:27.437604037Z I0409 16:08:27.433278       1 heapster.go:60] /heapster --source=kubernetes:https://kubernetes.default --sink=influxdb:http://monitoring-influxdb:8086
2016-04-09T16:08:27.437781968Z I0409 16:08:27.433390       1 heapster.go:61] Heapster version 1.1.0-beta1
2016-04-09T16:08:27.437799021Z F0409 16:08:27.433556       1 heapster.go:73] Failed to create source provide: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory

The security is low priority to my demo; so I'd like to disable it firstly. My apiserver also did not enable security. Any suggestion?

-- Klaus Ma
heapster
kubernetes

Similar Questions

Graceful shutdown of explicitly selected pod
Remote Access to Kubernetes API Without the Proxy
nginx reverse proxying wss - client sent invalid method while reading client request line
Error attaching azureFile to kubernetes pod

3 Answers

4/21/2016

If you didn't enable https for API server, you might see this error. Check Matthias's answer for official guide. Below is the YAML file for Heapster replication controller I used. Replace the api server ip and port with yours.

apiVersion: v1
kind: ReplicationController
metadata:
  labels:
    k8s-app: heapster
    name: heapster
    version: v6
  name: heapster
  namespace: kube-system
spec:
  replicas: 1
  selector:
    k8s-app: heapster
    version: v6
  template:
    metadata:
      labels:
        k8s-app: heapster
        version: v6
    spec:
      containers:
      - name: heapster
        image: kubernetes/heapster:canary
        imagePullPolicy: Always
        command:
        - /heapster
        - --source=kubernetes:http://<api server ip>:<port>?inClusterConfig=false
        - --sink=influxdb:http://monitoring-influxdb:8086
-- aaskey
Source: StackOverflow
4/10/2016
  1. Start apiserver with "--admission_control=ServiceAccount", so it'll create secret for default service account (tested with kubernetes 1.2)
  2. Use "http" instead of "https" to avoid security

NOTE: it's only used to demo the feature; can not be used in production.

-- Klaus Ma
Source: StackOverflow
4/14/2016

check out the heapster docs there is described how to configure the source without security:

https://github.com/kubernetes/heapster/blob/master/docs/source-configuration.md

--source=kubernetes:http://<YOUR_API_SERVER>?inClusterConfig=false

Not sure if that will work in your setup but it works here (on premise kubernetes install; no gcp involved :) ).

Best wishes, Matthias

-- Matthias
Source: StackOverflow