Install the Metrics Server on UpCloud Managed Kubernetes

The Kubernetes Metrics Server collects CPU and memory usage from every node and pod in your cluster. It is what powers kubectl top, and the Horizontal Pod Autoscaler depends on it too.

UpCloud Managed Kubernetes does not ship the Metrics Server by default, so on a fresh cluster kubectl top fails:

kubectl top nodes

error: Metrics API not available

This is expected, not a fault. Installing it takes two commands: the official manifest, plus one extra step that Managed Kubernetes clusters need.

Install the official manifest

kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

This installs the latest Metrics Server release into the kube-system namespace. At the time of writing, latest resolves to v0.9.0.

If you check the pod at this point, you will find it running but never becoming Ready:

kubectl -n kube-system get pods -l k8s-app=metrics-server

NAME                              READY   STATUS    RESTARTS   AGE
metrics-server-794dd65494-hrkzn   0/1     Running   0          11s

Its logs show why:

x509: cannot validate certificate for 172.31.0.2 because it doesn't contain any IP SANs

The Metrics Server scrapes each node's kubelet over HTTPS at the node's internal IP address, and it verifies the kubelet's serving certificate when it connects. On Managed Kubernetes, kubelet serving certificates do not include IP addresses, so that verification fails and the Metrics Server refuses to scrape. This is the extra step: tell it to skip that particular check.

Allow the kubelet connection

kubectl -n kube-system patch deploy metrics-server --type=json \
  -p '[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'

The --kubelet-insecure-tls flag only skips certificate verification for the Metrics Server's connections to kubelets inside your cluster - traffic that never leaves your cluster's network. It does not affect TLS anywhere else.

If you manage your cluster through manifests or GitOps, add the flag to the args list in your copy of the Metrics Server manifest rather than relying on the patch alone - otherwise your tooling will revert it the next time it re-applies the manifest.

The patch rolls the deployment, and the new pod becomes Ready once its readiness probe passes.

Verify

Within about 30 seconds of the patch, metrics are available:

kubectl top nodes

NAME                         CPU(cores)   CPU(%)   MEMORY(bytes)   MEMORY(%)
docsmetrics-ng-vkwpg-dk8jj   279m         13%      705Mi           18%

kubectl top pods --all-namespaces works too, and the Metrics Server itself is a light addition to the cluster - around 22m CPU and 17Mi of memory on a small cluster.