从零到一k8s(三)安装Addons

Metricbeat（集群日志收集）

 https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-kubernetes.html

metric-server(top 指令数据源)

kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

 ingress(nginx)

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml

  externalTrafficPolicy: Local
  默认情况下ingress 开启了这个选项 为了保证nginx 能接收到client真实ip 这一项默认打开。但是会造成pod 如果为分布在此节点那直接访问主机ip 进行的转发链条为空造成 SYNSEND 状态持续

ip-masq-agent(管理nat 出网规则) 

kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/ip-masq-agent/master/ip-masq-agent.yaml
如果你的网络模式已经确认 pod 地址段通过bgp模式 或者 switch路由方式已经发布到集群外主机，可以将主机网络的nat masquery 屏蔽 通过以下方式
cat ip-masq-agent-config
nonMasqueradeCIDRs:
  - 10.160.105.0/24
resyncInterval: 60s
root@us-test00:~# kubectl create configmap ip-masq-agent --from-file=ip-masq-agent-config --namespace=kube-system

iptables -t nat -nvL |grep -i agent

 2157  136K IP-MASQ-AGENT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* ip-masq-agent: ensure nat POSTROUTING directs all non-LOCAL destination traffic to our custom IP-MASQ-AGENT chain */ ADDRTYPE match dst-type !LOCAL

Chain IP-MASQ-AGENT (1 references)

    0     0 RETURN     all  --  *      *       0.0.0.0/0            169.254.0.0/16       /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL

    3   230 RETURN     all  --  *      *       0.0.0.0/0            10.160.105.0/24      /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL

    2   120 MASQUERADE  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* ip-masq-agent: outbound traffic should be subject to MASQUERADE (this match must come after cluster-local CIDR matches) */ ADDRTYPE match dst-type !LOCAL