前言：
多节点基础上部署web管理页面
web页面管理pod资源
文章目录
一：部署前先检查状态
[root@master1 ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
192.168.247.143 NotReady <none> 7d22h v1.12.3
192.168.247.144 Ready <none> 7d21h v1.12.3
[root@master1 ~]# kubectl get pod
NAME READY STATUS RESTARTS AGE
nginx-dbddb74b8-sx4m6 1/1 Running 0 5d14h
二：部署UI界面到master节点
2.1 创建dashboard工作目录
[root@master1 ~]# mkdir /k8s/dashboard
2.2 推送官方的文件到本地
备注：
k8s创建pod资源有两种方式
-
命令工具kubectl创建
kubectl run --image=
-
使用yaml文件格式进行创建
kubectl create -f （yaml文件）
https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard
红线标注的是配置文件，md是官方文档
这五个文件很重要
dashboard-configmap.yaml 配置映射服务
dashboard-deployment.yaml 控制器
dashboard-rbac.yaml 角色控制，访问控制
dashboard-secret.yaml 安全
dashboard-service.yaml 服务
这些资源创建时，先创建①身份角色②安全③配置映射④控制器⑤服务
这里我使用dashboard的1.8.4版本
1.8.4版本中有一个配置文件叫controller.yaml,现在的是1.10版本，名称改为deployment.yaml，都是控制器
[root@master1 ~]# cd /k8s/dashboard/
[root@master1 dashboard]# ls
[root@master1 dashboard]# ls
dashboard-configmap.yaml dashboard-controller.yaml dashboard-rbac.yaml dashboard-secret.yaml dashboard-service.yaml k8s-admin.yaml
除了那五个文件，还有一个k8s-admin.yaml文件，后面会提到
2.3 查看这些文件的详细参数
- dashboard-rbac.yaml
[root@master1 dashboard]# cat dashboard-rbac.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
addonmanager.kubernetes.io/mode: Reconcile
name: kubernetes-dashboard-minimal
namespace: kube-system
rules:
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
verbs: ["get", "update", "delete"]
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["kubernetes-dashboard-settings"]
verbs: ["get", "update"]
# Allow Dashboard to get metrics from heapster.
- apiGroups: [""]
resources: ["services"]
resourceNames: ["heapster"]
verbs: ["proxy"]
- apiGroups: [""]
resources: ["services/proxy"]
resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: kubernetes-dashboard-minimal
namespace: kube-system
labels:
k8s-app: kubernetes-dashboard
addonmanager.kubernetes.io/mode: Reconcile
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: kubernetes-dashboard-minimal
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kube-system
[root@master1 dashboard]#
- dashboard-rbac.yaml
[root@master1 dashboard]# cat dashboard-rbac.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
addonmanager.kubernetes.io/mode: Reconcile
name: kubernetes-dashboard-minimal
namespace: kube-system
rules:
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
verbs: ["get", "update", "delete"]
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["kubernetes-dashboard-settings"]
verbs: ["get", "update"]
# Allow Dashboard to get metrics from heapster.
- apiGroups: [""]
resources: ["services"]
resourceNames: ["heapster"]
verbs: ["proxy"]
- apiGroups: [""]
resources: ["services/proxy"]
resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: kubernetes-dashboard-minimal
namespace: kube-system
labels:
k8s-app: kubernetes-dashboard
addonmanager.kubernetes.io/mode: Reconcile
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: kubernetes-dashboard-minimal
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kube-system
[root@master1 dashboard]# ls
dashboard-configmap.yaml dashboard-controller.yaml dashboard-rbac.yaml dashboard-secret.yaml dashboard-service.yaml k8s-admin.yaml
[root@master1 dashboard]# cat dashboard-secret.yaml
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
# Allows editing resource and makes sure it is created first.
addonmanager.kubernetes.io/mode: EnsureExists
name: kubernetes-dashboard-certs
namespace: kube-system
type: Opaque
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
# Allows editing resource and makes sure it is created first.
addonmanager.kubernetes.io/mode: EnsureExists
name: kubernetes-dashboard-key-holder
namespace: kube-system
type: Opaque
- dashboard-secret.yaml
[root@master1 dashboard]# cat dashboard-secret.yaml
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
# Allows editing resource and makes sure it is created first.
addonmanager.kubernetes.io/mode: EnsureExists
name: kubernetes-dashboard-certs
namespace: kube-system
type: Opaque
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
# Allows editing resource and makes sure it is created first.
addonmanager.kubernetes.io/mode: EnsureExists
name: kubernetes-dashboard-key-holder
namespace: kube-system
type: Opaque
[root@master1 dashboard]# cat dashboard-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
labels:
k8s-app: kubernetes-dashboard
# Allows editing resource and makes sure it is created first.
addonmanager.kubernetes.io/mode: EnsureExists
name: kubernetes-dashboard-settings
namespace: kube-system
- dashboard-controller.yaml
[root@master1 dashboard]# cat dashboard-controller.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
k8s-app: kubernetes-dashboard
addonmanager.kubernetes.io/mode: Reconcile
name: kubernetes-dashboard
namespace: kube-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: kubernetes-dashboard
namespace: kube-system
labels:
k8s-app: kubernetes-dashboard
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
spec:
selector:
matchLabels:
k8s-app: kubernetes-dashboard
template:
metadata:
labels:
k8s-app: kubernetes-dashboard
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ''
seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
spec:
priorityClassName: system-cluster-critical
containers:
- name: kubernetes-dashboard
image: siriuszg/kubernetes-dashboard-amd64:v1.8.3
resources:
limits:
cpu: 100m
memory: 300Mi
requests:
cpu: 50m
memory: 100Mi
ports:
- containerPort: 8443
protocol: TCP
args:
# PLATFORM-SPECIFIC ARGS HERE
- --auto-generate-certificates
volumeMounts:
- name: kubernetes-dashboard-certs
mountPath: /certs
- name: tmp-volume
mountPath: /tmp
livenessProbe:
httpGet:
scheme: HTTPS
path: /
port: 8443
initialDelaySeconds: 30
timeoutSeconds: 30
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
- name: tmp-volume
emptyDir: {}
serviceAccountName: kubernetes-dashboard
tolerations:
- key: "CriticalAddonsOnly"
operator: "Exists"
- dashboard-service.yaml
[root@master1 dashboard]# cat dashboard-service.yaml
apiVersion: v1
kind: Service
metadata:
name: kubernetes-dashboard
namespace: kube-system
labels:
k8s-app: kubernetes-dashboard
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
spec:
type: NodePort
selector:
k8s-app: kubernetes-dashboard
ports:
- port: 443
targetPort: 8443
nodePort: 30001
- k8s-admin.yaml
[root@master1 dashboard]# cat k8s-admin.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: dashboard-admin
namespace: kube-system
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: dashboard-admin
subjects:
- kind: ServiceAccount
name: dashboard-admin
namespace: kube-system
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
2.4 基于yaml文件创建pod资源
按顺序创建
①身份角色②安全③配置映射④控制器⑤服务
2.4.1 先rbac角色控制管理
2.4.1.1 查看当前各资源状态
当前命名空间状态
[root@master1 dashboard]# kubectl get ns
NAME STATUS AGE
default Active 7d23h
kube-public Active 7d23h
kube-system Active 7d23h
[root@master1 dashboard]# kubectl get pod
NAME READY STATUS RESTARTS AGE
nginx-dbddb74b8-sx4m6 1/1 Running 0 5d14h
[root@master1 dashboard]# kubectl get pod -n kube-system
No resources found.
kubectl get all #这个all 包含pod、deployment、service和副本replicaset四个资源
[root@master1 dashboard]# kubectl get all #这个all 包含pod、deployment、service和副本replicaset四个个资源
NAME READY STATUS RESTARTS AGE
pod/nginx-dbddb74b8-sx4m6 1/1 Running 0 5d14h
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.0.0.1 <none> 443/TCP 7d23h
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
deployment.apps/nginx 1 1 1 1 5d14h
NAME DESIRED CURRENT READY AGE
replicaset.apps/nginx-dbddb74b8 1 1 1 5d14h
查看当前k8s中的角色
[root@master1 dashboard]# kubectl get Role -n kube-system
NAME AGE
extension-apiserver-authentication-reader 7d23h
system::leader-locking-kube-controller-manager 7d23h
system::leader-locking-kube-scheduler 7d23h
system:controller:bootstrap-signer 7d23h
system:controller:cloud-provider 7d23h
system:controller:token-cleaner 7d23h
2.4.1.2 开始创建rbac资源
[root@master1 dashboard]# kubectl create -f dashboard-rbac.yaml
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
2.4.1.3 查看创建后的资源状态
[root@master1 dashboard]# kubectl get all
NAME READY STATUS RESTARTS AGE
pod/nginx-dbddb74b8-sx4m6 1/1 Running 0 5d14h
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.0.0.1 <none> 443/TCP 7d23h
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
deployment.apps/nginx 1 1 1 1 5d14h
NAME DESIRED CURRENT READY AGE
replicaset.apps/nginx-dbddb74b8 1 1 1 5d14h
查看角色，在配置文件中，角色的命名空间指定的是kube-system，所以查看的时候要-n指定
[root@master1 dashboard]# kubectl get role
No resources found.
[root@master1 dashboard]# kubectl get role -n kube-system
NAME AGE
extension-apiserver-authentication-reader 7d23h
kubernetes-dashboard-minimal 3m
system::leader-locking-kube-controller-manager 7d23h
system::leader-locking-kube-scheduler 7d23h
system:controller:bootstrap-signer 7d23h
system:controller:cloud-provider 7d23h
system:controller:token-cleaner 7d23h
2.4.2 创建安全secret资源
2.4.2.1 先查看状态
[root@master1 dashboard]# kubectl get secret #不指向命名空间代表默认空间
NAME TYPE DATA AGE
default-token-qm9rm kubernetes.io/service-account-token 3 7d23h
[root@master1 dashboard]# kubectl get secret -n kube-system
NAME TYPE DATA AGE
default-token-w9vck kubernetes.io/service-account-token 3 7d23h
2.4.2.2 创建secret资源
[root@master1 dashboard]# kubectl create -f dashboard-secret.yaml
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created
2.4.2.3 再次查看状态
[root@master1 dashboard]# kubectl get secret -n kube-system
NAME TYPE DATA AGE
default-token-w9vck kubernetes.io/service-account-token 3 7d23h
kubernetes-dashboard-certs Opaque 0 26s
kubernetes-dashboard-key-holder Opaque 0 26s
2.4.3 创建配置映射资源configmap
2.4.3.1 先查看状态
[root@master1 dashboard]# kubectl get ConfigMap
No resources found.
[root@master1 dashboard]# kubectl get configmap -n kube-system
NAME DATA AGE
extension-apiserver-authentication 1 8d
2.4.3.2 开始创建
[root@master1 dashboard]# kubectl create -f dashboard-configmap.yaml
configmap/kubernetes-dashboard-settings created
2.4.3.3 再次查看状态
[root@master1 dashboard]# kubectl get configmap -n kube-system
NAME DATA AGE
extension-apiserver-authentication 1 8d
kubernetes-dashboard-settings 0 28s
2.4.4 创建控制器资源
[root@master1 dashboard]# kubectl create -f dashboard-controller.yaml
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
可以发现创建了两种资源
serviceaccount deployment.apps
服务访问和deployment控制器资源
[root@master1 dashboard]# kubectl get serviceaccount -n kube-system
NAME SECRETS AGE
default 1 7d23h
kubernetes-dashboard 1 2m16s
[root@master1 dashboard]# kubectl get deployment.apps -n kube-system
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
kubernetes-dashboard 1 1 1 1 2m34s
[root@master1 dashboard]# kubectl get deployment.apps
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
nginx 1 1 1 1 5d15h
2.4.5 创建service资源
备注：
创建的pod资源只是提供业务，还需要其他资源调配一起配合使用
kubectl get all种包含pod、deployment、service和副本replicaset四个资源
deployment和replica会随着pod自动创建
在pod运行的情况下，
一旦开启service资源，那么服务就会被启用，开启端口
[root@master1 dashboard]# cat dashboard-service.yaml
apiVersion: v1
kind: Service
metadata:
name: kubernetes-dashboard
namespace: kube-system
labels:
k8s-app: kubernetes-dashboard
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
spec:
type: NodePort
selector:
k8s-app: kubernetes-dashboard
ports:
- port: 443 #开启的是443端口
targetPort: 8443
nodePort: 30001 #节点端口
查看当前状态
[root@master1 dashboard]# kubectl get service
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.0.0.1 <none> 443/TCP 8d
开始创建
[root@master1 dashboard]# kubectl create -f dashboard-service.yaml
service/kubernetes-dashboard created
查看状态
[root@master1 dashboard]# kubectl get service -n kube-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes-dashboard NodePort 10.0.0.237 <none> 443:30001/TCP 20s
2.5 统一查看状态
查看kube-system命名空间的状态，可以发现pod已经创建出来，服务也已经开启
[root@master1 dashboard]# kubectl get all -n kube-system
NAME READY STATUS RESTARTS AGE
pod/kubernetes-dashboard-65f974f565-5hzk7 1/1 Running 0 12m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes-dashboard NodePort 10.0.0.237 <none> 443:30001/TCP 86s
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
deployment.apps/kubernetes-dashboard 1 1 1 1 12m
NAME DESIRED CURRENT READY AGE
replicaset.apps/kubernetes-dashboard-65f974f565 1 1 1 12m
-o 查看网络状态
[root@master1 dashboard]# kubectl get all -n kube-system -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod/kubernetes-dashboard-65f974f565-5hzk7 1/1 Running 0 19m 172.17.42.4 192.168.247.144 <none>
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service/kubernetes-dashboard NodePort 10.0.0.237 <none> 443:30001/TCP 8m9s k8s-app=kubernetes-dashboard
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR
deployment.apps/kubernetes-dashboard 1 1 1 1 19m kubernetes-dashboard siriuszg/kubernetes-dashboard-amd64:v1.8.3 k8s-app=kubernetes-dashboard
NAME DESIRED CURRENT READY AGE CONTAINERS IMAGES SELECTOR
replicaset.apps/kubernetes-dashboard-65f974f565 1 1 1 19m kubernetes-dashboard siriuszg/kubernetes-dashboard-amd64:v1.8.3 k8s-app=kubernetes-dashboard,pod-template-hash=65f974f565
由此可以发现，访问https://192.168.247.144:30001便可以访问dashboard
get查看时可以缩写，支持同时查看多个
查看日志
[root@master1 dashboard]# kubectl logs kubernetes-dashboard-65f974f565-5hzk7
Error from server (NotFound): pods "kubernetes-dashboard-65f974f565-5hzk7" not found
[root@master1 dashboard]# kubectl logs kubernetes-dashboard-65f974f565-5hzk7 -n kube-system
2020/05/08 02:38:54 Starting overwatch
2020/05/08 02:38:54 Using in-cluster config to connect to apiserver
2020/05/08 02:38:54 Using service account token for csrf signing
2020/05/08 02:38:54 No request provided. Skipping authorization
2020/05/08 02:38:54 Successful initial request to the apiserver, version: v1.12.3
2020/05/08 02:38:54 Generating JWE encryption key
2020/05/08 02:38:54 New synchronizer has been registered: kubernetes-dashboard-key-holder-kube-system. Starting
2020/05/08 02:38:54 Starting secret synchronizer for kubernetes-dashboard-key-holder in namespace kube-system
2020/05/08 02:38:55 Initializing JWE encryption key from synchronized object
2020/05/08 02:38:55 Creating in-cluster Heapster client
2020/05/08 02:38:56 Metric client health check failed: the server could not find the requested resource (get services heapster). Retrying in 30 seconds.
2020/05/08 02:38:56 Auto-generating certificates
2020/05/08 02:38:56 Successfully created certificates
2020/05/08 02:38:56 Serving securely on HTTPS port: 8443
2020/05/08 02:39:26 Metric client health check failed: the server could not find the requested resource (get services heapster). Retrying in 30 seconds.
2020/05/08 02:39:56 Metric client health check failed: the server could not find the requested resource (get services heapster). Retrying in 30 seconds.
三：访问web
此时就可以去访问nodeIPhttps://192.168.247.144:30001验证，使用谷歌浏览器发现无法访问
3.1 查看开发人员工具
在安全中发现是不信任的证书
右边显示证书是不被信任的
3.2 解决当前浏览器无法访问的问题
3.2.1 颁发证书
编辑生成证书的脚本
[root@master1 dashboard]# vim dashboard-cert.sh
cat > dashboard-csr.json << EOF
{
"CN":"Dashboard",
"hosts":[],
"key":{
"algo":"rsa",
"size":2048
},
"names":[
{
"C":"CN",
"L":"BeiJing",
"ST":"BeiJing"
}
]
}
EOF
K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | cfssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system
查看材料文件路径
[root@master1 dashboard]# ls /k8s/ssl/
ca-key.pem ca.pem server-key.pem server.pem
[root@master1 dashboard]# ls /root/k8s/k8s-cert/
admin.csr admin.pem ca-csr.json k8s-cert.sh kube-proxy-key.pem server-csr.json
admin-csr.json ca-config.json ca-key.pem kube-proxy.csr kube-proxy.pem server-key.pem
admin-key.pem ca.csr ca.pem kube-proxy-csr.json server.csr server.pem
生成证书
[root@master1 dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/
dashboard-cert.sh: line 20: cfssjson: command not found
2020/05/08 11:19:20 [INFO] generate received request
2020/05/08 11:19:20 [INFO] received CSR
2020/05/08 11:19:20 [INFO] generating key: rsa-2048
2020/05/08 11:19:20 [INFO] encoded CSR
2020/05/08 11:19:20 [INFO] signed certificate with serial number 292722549079728181346404671844966168885415575748
2020/05/08 11:19:20 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
secret "kubernetes-dashboard-certs" deleted
secret/kubernetes-dashboard-certs created
[root@master1 dashboard]# ls #只看新增的文件
dashboard-cert.sh dashboard.pem
dashboard-csr.json dashboard-key.pem
编辑secret资源的yaml文件
[root@master1 dashboard]# vim dashboard-controller.yaml
45 args:
46 # PLATFORM-SPECIFIC ARGS HERE
47 - --auto-generate-certificates
48 - --tls-key-file=dashboard-key.pem #新增
49 - --tls-cert-file=dashboard.pem #新增
重新部署
[root@master1 dashboard]# kubectl apply -f dashboard-controller.yaml
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
serviceaccount/kubernetes-dashboard configured
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
deployment.apps/kubernetes-dashboard configured
查看此时状态
MatchInterPodAffinity：根据pod之间的亲和性做判断
pod依旧在192.168.247.144上
[root@master1 dashboard]# kubectl get all -n kube-system -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod/kubernetes-dashboard-7dffbccd68-l4tcd 1/1 Running 0 2m32s 172.17.42.5 192.168.247.144 <none>
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service/kubernetes-dashboard NodePort 10.0.0.237 <none> 443:30001/TCP 51m k8s-app=kubernetes-dashboard
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR
deployment.apps/kubernetes-dashboard 1 1 1 1 62m kubernetes-dashboard siriuszg/kubernetes-dashboard-amd64:v1.8.3 k8s-app=kubernetes-dashboard
NAME DESIRED CURRENT READY AGE CONTAINERS IMAGES SELECTOR
replicaset.apps/kubernetes-dashboard-65f974f565 0 0 0 62m kubernetes-dashboard siriuszg/kubernetes-dashboard-amd64:v1.8.3 k8s-app=kubernetes-dashboard,pod-template-hash=65f974f565
replicaset.apps/kubernetes-dashboard-7dffbccd68 1 1 1 14m kubernetes-dashboard siriuszg/kubernetes-dashboard-amd64:v1.8.3 k8s-app=kubernetes-dashboard,pod-template-hash=7dffbccd68
清空历史记录访问此时节点
继续前往
四：使用令牌访问
4.1 生成令牌
k8s-admin.yaml的作用就出现了
[root@master1 dashboard]# kubectl create -f k8s-admin.yaml
serviceaccount/dashboard-admin created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
4.2 查看状态
[root@master1 dashboard]# kubectl get secret -n kube-system
NAME TYPE DATA AGE
dashboard-admin-token-dmlzw kubernetes.io/service-account-token 3 65s
default-token-w9vck kubernetes.io/service-account-token 3 8d
kubernetes-dashboard-certs Opaque 11 12m
kubernetes-dashboard-key-holder Opaque 2 72m
kubernetes-dashboard-token-7dhnw kubernetes.io/service-account-token 3 66m
[root@master1 dashboard]# kubectl get serviceaccount -n kube-system
NAME SECRETS AGE
dashboard-admin 1 96s
default 1 8d
kubernetes-dashboard 1 67m
[root@master1 dashboard]# kubectl get clusterrolebinding.rbac.authorization.k8s.io -n kube-system
NAME AGE
cluster-admin 8d
cluster-system-anonymous 5d15h
dashboard-admin 2m1s
·······
4.3 查看令牌详细信息
[root@master1 dashboard]# kubectl describe serviceaccount dashboard-admin -n kube-system
Name: dashboard-admin
Namespace: kube-system
Labels: <none>
Annotations: <none>
Image pull secrets: <none>
Mountable secrets: dashboard-admin-token-dmlzw
Tokens: dashboard-admin-token-dmlzw
Events: <none>
[root@master1 dashboard]# kubectl describe tokens dashboard-admin-token-dmlzw -n kube-system
error: the server doesn't have a resource type "tokens"
[root@master1 dashboard]# kubectl describe secret dashboard-admin-token-dmlzw -n kube-system
Name: dashboard-admin-token-dmlzw
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: 34604321-90de-11ea-a668-000c29db840b
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1359 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tZG1senciLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMzQ2MDQzMjEtOTBkZS0xMWVhLWE2NjgtMDAwYzI5ZGI4NDBiIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.iK6wXehw9ZlK4Qjln4uiPR5Ww1K14t23rvJ-pmn56ynHw1KXow1Pg1Qi2hUY01ncCBjbyjaJBtcVNez-XFr7VQXO7lCPbnxlXat0euD2Qg8DPy-PQBnyAd2Jgh_y1e_OIgcrMowhyKUhkqaNPxDG4HWUqIFzcnHdaxOtCPZQ3GTV8XfoAe4aLemCdIHsZHoCeWKbwFJgnczvbBnzyZ0w91JdoAYK6xVc-fpVz4Pin5IodQ81TOFS2uwLyTQ8aGyrK-HuOs-mTPqDMBS8fWvsJttRtgI2UUwdsSodxEgRREXWUNg15swcVVF9_fiO7wsoXk7IhXAaAnNCd7gIF419Lw
token：后面便是令牌，复制保存
4.4 复制登录
102
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
