基于Kubernetes二进制部署(多节点)后部署网页界面
https://blog.csdn.net/chengu04/article/details/108904028
#在master01上操作
#创建dashborad工作目录
[root@localhost k8s]# mkdir dashboard
#拷贝官方的文件
https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard
[root@master01 dashboard]# ls
dashboard-configmap.yaml dashboard-rbac.yaml dashboard-service.yaml
dashboard-controller.yaml dashboard-secret.yaml k8s-admin.yaml
默认的三个命名空间:
[root@master01 dashboard]# kubectl get ns
NAME STATUS AGE
default Active 9d
kube-public Active 9d
kube-system Active 9d
#按以下次序以yaml文件进行创建
资源创建:create和apply
资源重新部署,更新:apply
[root@localhost dashboard]# kubectl create -f dashboard-rbac.yaml
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
[root@localhost dashboard]# kubectl create -f dashboard-secret.yaml
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created
[root@localhost dashboard]# kubectl create -f dashboard-configmap.yaml
configmap/kubernetes-dashboard-settings created
[root@localhost dashboard]# kubectl create -f dashboard-controller.yaml
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
[root@master01 dashboard]# vim dashboard-service.yaml
[root@localhost dashboard]# kubectl create -f dashboard-service.yaml
service/kubernetes-dashboard created
#完成后查看pod创建在指定的kube-system命名空间下
[root@master01 dashboard]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
kubernetes-dashboard-65f974f565-bpr5g 1/1 Running 0 115m
[root@master01 dashboard]# kubectl get pods,svc -n kube-system
NAME READY STATUS RESTARTS AGE
pod/kubernetes-dashboard-65f974f565-bpr5g 1/1 Running 0 115m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes-dashboard NodePort 10.0.0.29 <none> 443:30005/TCP 115m
在谷歌浏览器通过https://https://14.0.0.60:30005/访问
这时客户想要用谷歌浏览器访问,出现如上没有证书的问题;
解决方法:做证书自签
[root@master01 dashboard]# vim dashboard-cert.sh
cat > dashboard-csr.json <<EOF
{
"CN": "Dashboard",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "BeiJing",
"ST": "BeiJing"
}
]
}
EOF
K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | cfssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system
[root@master01 dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/
2020/10/08 16:32:07 [INFO] generate received request
2020/10/08 16:32:07 [INFO] received CSR
2020/10/08 16:32:07 [INFO] generating key: rsa-2048
2020/10/08 16:32:07 [INFO] encoded CSR
2020/10/08 16:32:07 [INFO] signed certificate with serial number 440915070513025525150133193939425537885647398645
2020/10/08 16:32:07 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
secret "kubernetes-dashboard-certs" deleted
secret/kubernetes-dashboard-certs created
[root@master01 dashboard]# vim dashboard-controller.yaml
args:
# PLATFORM-SPECIFIC ARGS HERE
- --auto-generate-certificates
- --tls-key-file=dashboard-key.pem #指定根证书的密钥
- --tls-cert-file=dashboard.pem #指定根证书
[root@master01 dashboard]# kubectl apply -f dashboard-controller.yaml
Warning: kubectl apply should be used on resource created by either kubectl create --s ave-config or kubectl apply
serviceaccount/kubernetes-dashboard configured
Warning: kubectl apply should be used on resource created by either kubectl create --s ave-config or kubectl apply
deployment.apps/kubernetes-dashboard configured
#注意:此处如果修改完apply提示unchanged,这时可以先delete, 再create,让修改的配置生效
#生成令牌
[root@master01 dashboard]# kubectl create -f k8s-admin.yaml
serviceaccount/dashboard-admin created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
#查看生成的secret资源名
[root@master01 dashboard]# kubectl get secret -n kube-system
NAME TYPE DATA AGE
dashboard-admin-token-xqg89 kubernetes.io/service-account-token 3 94m
default-token-7r875 kubernetes.io/service-account-token 3 9d
kubernetes-dashboard-certs Opaque 11 22m
kubernetes-dashboard-key-holder Opaque 2 162m
kubernetes-dashboard-token-v6brb kubernetes.io/service-account-token 3 162m
#查看令牌
[root@master01 dashboard]# kubectl describe secret dashboard-admin-token-xqg89 -n kube-system
Name: dashboard-admin-token-xqg89
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: bcbed3b9-0936-11eb-9d5c-000c2942d3a9
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1359 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4teHFnODkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiYmNiZWQzYjktMDkzNi0xMWViLTlkNWMtMDAwYzI5NDJkM2E5Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.Unb-uo74ErBPZyFej9HByytJNcYmD2UdtbGVfsPHhwT9pBUQiH1GW55G5fqxyBjXw8LR91rG17hm7GtKWukbVGwG0IQqe14_rMHJ86J92045Xmng_u1KWiNvGFELyDW4SBWoiK0nu_TqnLQ9_8nRVMjPJuCg5tU1rkrbvTiv8EOUlWF7BmAlwlRdyeU-Jnv5ZsgvzAY2wapVNAfoqe-5ypu60_LH168OZv0xX1cV4LHPLqLqbt4yQ77psN6tkFivWsQADAW-sX7vBXiHDH1NONYCjfwynKgLFijmLgOlm6bAStw-GN7Zgx29xZ1BGRxSd81bbooaUyox-_6pHBvM4Q