Kubernetes --Dashboard网页界面

基于Kubernetes二进制部署（多节点）后部署网页界面
https://blog.csdn.net/chengu04/article/details/108904028
#在master01上操作
#创建dashborad工作目录

[root@localhost k8s]# mkdir dashboard

#拷贝官方的文件

https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard

[root@master01 dashboard]# ls
dashboard-configmap.yaml   dashboard-rbac.yaml    dashboard-service.yaml
dashboard-controller.yaml  dashboard-secret.yaml  k8s-admin.yaml

默认的三个命名空间：

[root@master01 dashboard]# kubectl get ns
NAME          STATUS   AGE
default          Active       9d
kube-public   Active      9d
kube-system   Active    9d

#按以下次序以yaml文件进行创建
资源创建：create和apply
资源重新部署，更新：apply

[root@localhost dashboard]# kubectl create -f dashboard-rbac.yaml
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
[root@localhost dashboard]# kubectl create -f dashboard-secret.yaml
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created
[root@localhost dashboard]# kubectl create -f dashboard-configmap.yaml
configmap/kubernetes-dashboard-settings created
[root@localhost dashboard]# kubectl create -f dashboard-controller.yaml
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
[root@master01 dashboard]# vim dashboard-service.yaml

[root@localhost dashboard]# kubectl create -f dashboard-service.yaml
service/kubernetes-dashboard created

#完成后查看pod创建在指定的kube-system命名空间下

[root@master01 dashboard]# kubectl get pods -n kube-system
NAME                                    READY   STATUS    RESTARTS   AGE
kubernetes-dashboard-65f974f565-bpr5g   1/1     Running   0          115m
[root@master01 dashboard]# kubectl get pods,svc -n kube-system
NAME                                        READY   STATUS    RESTARTS   AGE
pod/kubernetes-dashboard-65f974f565-bpr5g   1/1     Running   0          115m

NAME                           TYPE       CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE
service/kubernetes-dashboard   NodePort   10.0.0.29    <none>        443:30005/TCP   115m

在谷歌浏览器通过https://https://14.0.0.60:30005/访问

这时客户想要用谷歌浏览器访问，出现如上没有证书的问题；
解决方法：做证书自签

[root@master01 dashboard]# vim dashboard-cert.sh
cat > dashboard-csr.json <<EOF
{
   "CN": "Dashboard",
   "hosts": [],
   "key": {
       "algo": "rsa",
       "size": 2048
   },
   "names": [
       {
           "C": "CN",
           "L": "BeiJing",
           "ST": "BeiJing"
       }
   ]
}
EOF
 
K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | cfssljson -bare dashboard

kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system

[root@master01 dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/
2020/10/08 16:32:07 [INFO] generate received request
2020/10/08 16:32:07 [INFO] received CSR
2020/10/08 16:32:07 [INFO] generating key: rsa-2048
2020/10/08 16:32:07 [INFO] encoded CSR
2020/10/08 16:32:07 [INFO] signed certificate with serial number 440915070513025525150133193939425537885647398645
2020/10/08 16:32:07 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
secret "kubernetes-dashboard-certs" deleted
secret/kubernetes-dashboard-certs created

[root@master01 dashboard]# vim dashboard-controller.yaml
        args:
          # PLATFORM-SPECIFIC ARGS HERE
          - --auto-generate-certificates
          - --tls-key-file=dashboard-key.pem      #指定根证书的密钥
          - --tls-cert-file=dashboard.pem             #指定根证书

[root@master01 dashboard]# kubectl apply -f dashboard-controller.yaml
Warning: kubectl apply should be used on resource created by either kubectl create --s                        ave-config or kubectl apply
serviceaccount/kubernetes-dashboard configured
Warning: kubectl apply should be used on resource created by either kubectl create --s                        ave-config or kubectl apply
deployment.apps/kubernetes-dashboard configured

#注意：此处如果修改完apply提示unchanged，这时可以先delete， 再create，让修改的配置生效

#生成令牌
[root@master01 dashboard]# kubectl create -f k8s-admin.yaml
serviceaccount/dashboard-admin created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
#查看生成的secret资源名
[root@master01 dashboard]# kubectl get secret -n kube-system
NAME                               TYPE                                  DATA   AGE
dashboard-admin-token-xqg89        kubernetes.io/service-account-token   3      94m
default-token-7r875                kubernetes.io/service-account-token   3      9d
kubernetes-dashboard-certs         Opaque                                11     22m
kubernetes-dashboard-key-holder    Opaque                                2      162m
kubernetes-dashboard-token-v6brb   kubernetes.io/service-account-token   3      162m
#查看令牌
[root@master01 dashboard]# kubectl describe secret dashboard-admin-token-xqg89 -n kube-system
Name:         dashboard-admin-token-xqg89
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: bcbed3b9-0936-11eb-9d5c-000c2942d3a9

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1359 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4teHFnODkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiYmNiZWQzYjktMDkzNi0xMWViLTlkNWMtMDAwYzI5NDJkM2E5Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.Unb-uo74ErBPZyFej9HByytJNcYmD2UdtbGVfsPHhwT9pBUQiH1GW55G5fqxyBjXw8LR91rG17hm7GtKWukbVGwG0IQqe14_rMHJ86J92045Xmng_u1KWiNvGFELyDW4SBWoiK0nu_TqnLQ9_8nRVMjPJuCg5tU1rkrbvTiv8EOUlWF7BmAlwlRdyeU-Jnv5ZsgvzAY2wapVNAfoqe-5ypu60_LH168OZv0xX1cV4LHPLqLqbt4yQ77psN6tkFivWsQADAW-sX7vBXiHDH1NONYCjfwynKgLFijmLgOlm6bAStw-GN7Zgx29xZ1BGRxSd81bbooaUyox-_6pHBvM4Q