k8s多节点仪表盘（web界面 ） dashboard 部署 与 谷歌浏览器访问仪表盘问题

前言

dashboard是商业智能仪表盘（business intelligence dashboard，BI dashboard）的简称，它是一般商业智
能都拥有的实现数据可视化的模块，是向企业展示度量信息和关键业务指标（KPI）现状的数据虚拟化工具 [1] 。
dashboard在一个简单屏幕上联合并整理数字、公制和绩效记分卡。它们调整适应特定角色并展示为单一视角或部门指定的度量。
dashboard关键的特征是从多种数据源获取实时数据，并且是定制化的交互式界面。
dashboard以丰富的，可交互的可视化界面为数据提供更好的使用体验.
数据可视化编辑
为了配合BI更好的展示企业的各项业务指标等数据，dashboard一般要拥有图表、仪表盘和
地图到积分卡、sparkline和状态指示器等数据可视化形式。
图形数据分析编辑
BI的基础就是OLAP了，dashboard也必须基于OLAP技术拥有图形上的数据分析功能。如图形上的一些交互操作，还有通用的平均值，
求和，趋势和预测等。
适用范围编辑
一是对前后数据的对比中。如今年的收入与去年同期收入的对比，今年实现的利润与去年的利润对比等等。如通过仪表盘可以清晰的反映出，今年的收入与去年相比，完成了多少。在期末的时候，还可以清晰的反映出，今年收入与上一年收入的对比情况等等。为此仪表盘的一个重要应用，就在于数据之间的对比。
二是在目标考核中，也有不小的用处。在实际工作中，为了对员工进行绩效考核，往往会为用户设置不同的目标。如会为销售员设置销售目标等等。在这种情况下，就可以仪表盘来直观的反映出销售人员的实际业绩与目标之间的关系。
价值体现编辑
易用性 [2]
分析功能
可伸缩性和可扩展性

具体部署

接上次K8S环境操作，具体环境参考此链接博客 K8S部署.

[root@master ~]# kubectl get node
NAME            STATUS   ROLES    AGE     VERSION
192.168.100.5   Ready    <none>   7d22h   v1.12.3
192.168.100.6   Ready    <none>   7d22h   v1.12.3
[root@master ~]# cd /root/k8s/
[root@master k8s]# mkdir dashboard
[root@master k8s]# cd dashboard/

拷贝官方的文件，下载dashboard

https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard
[root@master dashboard]# rz -E
rz waiting to receive.
[root@master dashboard]# ls
dashboard-configmap.yaml   dashboard-rbac.yaml    dashboard-service.yaml
dashboard-controller.yaml  dashboard-secret.yaml  k8s-admin.yaml
      443:30001/TCP   2m54s

根据 yaml 文件创建相关资源

[root@master dashboard]# kubectl create -f dashboard-rbac.yaml
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
[root@master dashboard]#  kubectl create -f dashboard-secret.yaml
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created
[root@master dashboard]#  kubectl create -f dashboard-configmap.yaml
configmap/kubernetes-dashboard-settings created
[root@master dashboard]# kubectl create -f dashboard-controller.yaml
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
[root@master dashboard]# kubectl create -f dashboard-service.yaml
service/kubernetes-dashboard created

完成后查看创建在指定的kube-system命名空间下

[root@master dashboard]# kubectl get pods -n kube-system
NAME                                    READY   STATUS    RESTARTS   AGE
kubernetes-dashboard-65f974f565-gfmvv   1/1     Running   0          60s
[root@master dashboard]# kubectl get pods -n kube-system  -w
NAME                                    READY   STATUS    RESTARTS   AGE
kubernetes-dashboard-65f974f565-gfmvv   1/1     Running   0          68s
//查看如何访问
[root@master dashboard]# kubectl get pods -n kube-system  -o wide
NAME                                    READY   STATUS    RESTARTS   AGE   IP            NODE            NOMINATED NODE
kubernetes-dashboard-65f974f565-gfmvv   1/1     Running   0          85s   172.17.22.2   192.168.100.5   <none>
[root@master dashboard]#

访问 https://192.168.100.5:30001，发现访问不了，需自创建证书

容器如何和master 通信？

设置谷歌浏览器自建证书

创建脚本文件

[root@master dashboard]# vim dashboard-cert.sh

写入内容

---

cat > dashboard-csr.json <<EOF
{
   "CN": "Dashboard",
   "hosts": [],
   "key": {
       "algo": "rsa",
       "size": 2048
   },
   "names": [
       {
           "C": "CN",
           "L": "BeiJing",
           "ST": "BeiJing"
       }
   ]
}
EOF

K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | cfssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system

修改yaml, 增加证书两行

[root@master dashboard]# vim dashboard-controller.yaml

 args:
      # PLATFORM-SPECIFIC ARGS HERE
      - --auto-generate-certificates
      //加入下面两行，新增证书指向
       - --tls-key-file=dashboard-key.pem
        - --tls-cert-file=dashboard.pem

[root@master dashboard]# ls
dashboard-cert.sh          dashboard-rbac.yaml     k8s-admin.yaml
dashboard-configmap.yaml   dashboard-secret.yaml
dashboard-controller.yaml  dashboard-service.yaml

重新生成证书文件

[root@master dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/
2020/10/10 10:55:23 [INFO] generate received request
2020/10/10 10:55:23 [INFO] received CSR
2020/10/10 10:55:23 [INFO] generating key: rsa-2048
2020/10/10 10:55:23 [INFO] encoded CSR
2020/10/10 10:55:23 [INFO] signed certificate with serial number 454538801428910231776246817982778213713183391467
2020/10/10 10:55:23 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
secret "kubernetes-dashboard-certs" deleted
secret/kubernetes-dashboard-certs created

重新部署

[root@master dashboard]# kubectl apply -f dashboard-controller.yaml
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply

重新访问

我们选择令牌登录，下面生成令牌文件

生成令牌

[root@master dashboard]# kubectl create -f k8s-admin.yaml
serviceaccount/dashboard-admin created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created

保存

[root@master dashboard]# kubectl get secret -n kube-system
NAME                               TYPE                                  DATA   AGE
dashboard-admin-token-8zz7g        kubernetes.io/service-account-token   3      23s
default-token-mqkkv                kubernetes.io/service-account-token   3      61m
kubernetes-dashboard-certs         Opaque                                11     7m15s
kubernetes-dashboard-key-holder    Opaque                                2      20m
kubernetes-dashboard-token-h7xnk   kubernetes.io/service-account-token   3      20m

查看令牌

[root@master dashboard]# kubectl describe secret dashboard-admin-token-8zz7g -n kube-systemName:         dashboard-admin-token-8zz7g
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 000c4caf-0aa5-11eb-9770-000c2994a1fc

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1359 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tOHp6N2ciLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMDAwYzRjYWYtMGFhNS0xMWViLTk3NzAtMDAwYzI5OTRhMWZjIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.cy0ns5VER6Kc5vMgvmpyDpsh1ijtT9kRX4s5Jp-TO6QNRcMU8_DbuA3C6n0NCOEr-qR71a5d4OC9WKmkxnoaV2IrddQbYkrhdSAWXNVcyTtQZ5IKuGIB4EZXPICWGkf3-ozOdhWoyp6L0XnTNWxJZ0B_3PZiZ5UJcWao3iTtDThSp0BRbHrtNP5FbTxbiaTcVg-9-6mhHCz1egcJ80P52vgPLwclg3IqVtrfqOIHURH-nK4KWdEBeYBXgHUARgKYEiPAQQhIGYLGFlD41VLejxXRPRZjIJP78llaijc3-3DvWg8JsL15QKs7BzoCDHdKfXg4BH0-AW63LAFqdFnwFw
[root@master dashboard]#

将令牌文件复制到网页，进行登录操作，图形化管理