# Metricbeat not reporting on port 10255 anymore using latest kubernetes, how to use the secured port 10250? **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [October 23, 2018, 1:14pm UTC](https://discuss.elastic.co/t/metricbeat-not-reporting-on-port-10255-anymore-using-latest-kubernetes-how-to-use-the-secured-port-10250/153605 "2018-10-23T13:14:01Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![pastorsx](https://avatars.discourse-cdn.com/v4/letter/p/58956e/32.png) [@pastorsx](https://discuss.elastic.co/u/pastorsx)\ **Post date:** [October 23, 2018, 1:14pm UTC](https://discuss.elastic.co/t/metricbeat-not-reporting-on-port-10255-anymore-using-latest-kubernetes-how-to-use-the-secured-port-10250/153605/1 "2018-10-23T13:14:01Z")
Hi all, I've been using metricbeat through its helm chart to install in a kubernetes cluster. It used to work by going though port 10255 which was a non-secured read only port.. but it seems latest releases of kubernetes (installed through kubeadm) deprecated it and we are now forced to use a secure port... I just cannot make it work... can anyone tell me what are the valid instructions for that: previous config: kubernetes: enabled: true config: - module: kubernetes metricsets: - node - system - pod - container - volume period: 10s hosts: ["[http://localhost:10255](http://localhost:10255)"] add\_metadata: true in\_cluster: true processors: - add\_cloud\_metadata: - add\_kubernetes\_metadata: in\_cluster: true new config that is not working: kubernetes: enabled: true config: - module: kubernetes metricsets: - node - system - pod - container - volume period: 10s hosts: ["https://${HOSTNAME}:10250"] bearer\_token\_file: /var/run/secrets/kubernetes.io/serviceaccount/token ssl.certificate\_authorities: - /var/run/secrets/kubernetes.io/serviceaccount/ca.crt add\_metadata: true in\_cluster: true processors: - add\_cloud\_metadata: - add\_kubernetes\_metadata: in\_cluster: true When using this config, I get errors that the "x509: certificate was signed by unknown authority" error When I use the curl comment on the host, I can have a good response: sudo curl [https://localhost:10250/stats/summary](https://localhost:10250/stats/summary) -k --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt --key /etc/kubernetes/pki/apiserver-kubelet-client.key Anyone was able to get around it... NOTE: helm chart uses a daemonset rather than a deployment.. I don't know if that may have an impact at all.. but I thought it was worth mentioning. thanks ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [October 23, 2018, 1:46pm UTC](https://discuss.elastic.co/t/metricbeat-not-reporting-on-port-10255-anymore-using-latest-kubernetes-how-to-use-the-secured-port-10250/153605/2 "2018-10-23T13:46:21Z")
Hi @pastorsx, You can use `bearer_token_file` like shown here: [https://github.com/elastic/beats/blob/master/metricbeat/modules.d/kubernetes.yml.disabled#L13-L16](https://github.com/elastic/beats/blob/master/metricbeat/modules.d/kubernetes.yml.disabled#L13-L16) i think it's time to switch to this approach by default, as most kubernetes versions out there will support it already. Would you mind creating a new issue for that? [https://github.com/elastic/beats/issues/new](https://github.com/elastic/beats/issues/new) Br, ---
**Author:** ![pastorsx](https://avatars.discourse-cdn.com/v4/letter/p/58956e/32.png) [@pastorsx](https://discuss.elastic.co/u/pastorsx)\ **Post date:** [October 23, 2018, 1:52pm UTC](https://discuss.elastic.co/t/metricbeat-not-reporting-on-port-10255-anymore-using-latest-kubernetes-how-to-use-the-secured-port-10250/153605/3 "2018-10-23T13:52:05Z")
Thanks, I will raise an issue.... but I tried this approach as it shows above... the file service-ca.crt does not exist... although ca.crt does, so I have been using it... but when I do, I get the "x509: certificate was signed by unknown authority" here as a result of the requests so I must be missing something else... any idea? thanks again for your reply... ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [October 23, 2018, 2:20pm UTC](https://discuss.elastic.co/t/metricbeat-not-reporting-on-port-10255-anymore-using-latest-kubernetes-how-to-use-the-secured-port-10250/153605/4 "2018-10-23T14:20:20Z")
Yes, probably you have to change `localhost` to the name of the node. In our default manifests we added the `NODE_NAME` env var for this. So if you [have it](https://github.com/elastic/beats/blob/master/deploy/kubernetes/metricbeat-kubernetes.yaml#L126-L129) reported, just switch to `${NODE_NAME}:10250`. ---
**Author:** ![pastorsx](https://avatars.discourse-cdn.com/v4/letter/p/58956e/32.png) [@pastorsx](https://discuss.elastic.co/u/pastorsx)\ **Post date:** [October 23, 2018, 4:06pm UTC](https://discuss.elastic.co/t/metricbeat-not-reporting-on-port-10255-anymore-using-latest-kubernetes-how-to-use-the-secured-port-10250/153605/5 "2018-10-23T16:06:01Z")
yeah.. thanks, I tried that too... that's what I have, but still no luck (get the same x509 error): kubernetes: enabled: true config: - module: kubernetes metricsets: - node - system - pod - container - volume period: 10s hosts: ["https://${HOSTNAME}:10250"] bearer\_token\_file: /var/run/secrets/kubernetes.io/serviceaccount/token ssl.certificate\_authorities: - /var/run/secrets/kubernetes.io/serviceaccount/ca.crt add\_metadata: true in\_cluster: true ---
**Author:** ![Artur\_Becker](https://avatars.discourse-cdn.com/v4/letter/a/977dab/32.png) [@Artur\_Becker](https://discuss.elastic.co/u/Artur_Becker)\ **Post date:** [October 30, 2018, 11:42am UTC](https://discuss.elastic.co/t/metricbeat-not-reporting-on-port-10255-anymore-using-latest-kubernetes-how-to-use-the-secured-port-10250/153605/6 "2018-10-30T11:42:19Z")
I have a similar problem. I am using Metricbeat version 6.4 and Kubernetes version v1.12.1. If I run the following Curl command, I get data. > curl [https://localhost:10250/stats/summary](https://localhost:10250/stats/summary) -k --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt --key /etc/kubernetes/pki/apiserver-kubelet-client.key I use the same configuration as "pastorsx simon", but Metricbeat will not start because /var/run/secrets/ does not exist on the system. Is this path created when installing Kubernetes? Greetings ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 27, 2018, 11:42am UTC](https://discuss.elastic.co/t/metricbeat-not-reporting-on-port-10255-anymore-using-latest-kubernetes-how-to-use-the-secured-port-10250/153605/7 "2018-11-27T11:42:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.