kubeadm部署dashboard-2.0.0版本

kubeadm部署dashboard-2.0.0版本
#创建dashboard的secret的私钥
[root@yunwei CA]# openssl genrsa -out od.com.key 2048

#创建dashboard的secret请求文件，这个secret配置CN=泛域名，
[root@yunwei CA]# openssl req -new -x509 -days 3650 -key od.com.key -out od.com.csr -subj /C=CN/ST=Beijing/O=DevOps/CN=*.od.com

#创建dashboard的secret的证书，
[root@yunwei CA]# openssl x509 -req -in od.com.csr -signkey od.com.key -out od.com.crt

#先安装dashboard，
[root@master01 deploy]# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.3/aio/deploy/recommended.yaml

#修改image为harbor下载的地址，私有仓库事先创建harbor的imagepullsecret的，这里就省略。
[root@master01 deploy]# kubectl apply -f recommended.yaml

#如果要dashbord被外部访问，需要添加证书
#修改recommended.yaml文件
[root@master01 deploy]# vi recommended.yaml
。。。。。。。。。。。。。。。。。。。。。。。。。。
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  type: NodePort     #指定nodeport类型。
  ports:
    - port: 443
      targetPort: 8443
      nodePort: 30008  #指定nodeport为3008端口。
  selector:
    k8s-app: kubernetes-dashboard
。。。。。。。。。。。。。。。。。。。。。。。。。。。。
spec:
      containers:
        - name: kubernetes-dashboard
          image: harbor.od.com/kubeadm/dashboard:v2.0.0
          imagePullPolicy: Always
          ports:
            - containerPort: 8443
              protocol: TCP
          command:                                # 新增
            - /dashboard                          # 新增
          args:
            - --auto-generate-certificates
            - --namespace=kubernetes-dashboard
            - --token-ttl=3600                    # 新增，token的登录
            - --bind-address=0.0.0.0              # 新增
            - --tls-cert-file=od.com.crt          # 新增，这里证书名字一定要跟创建的secret指定时同名，
            - --tls-key-file=od.com.key           # 新增，这里证书私钥名字一定要跟创建的secret指定时同名，
            # Uncomment the following line to manually specify Kubernetes API server Host
            # If not specified, Dashboard will attempt to auto discover the API server and connect
            # to it. Uncomment only if the default does not work.
            # - --apiserver-host=http://my-address:port
          volumeMounts:
            - name: kubernetes-dashboard-certs
              mountPath: /certs
              # Create on-disk volume to store exec logs
            - mountPath: /tmp
              name: tmp-volume
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /
              port: 8443
            initialDelaySeconds: 30
            timeoutSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      volumes:
        - name: kubernetes-dashboard-certs  #默认pod的secret挂载到volumeMounts指定的mountPath: /certs，但是上面配置command跟args，所以pod里的默认就不执行了，不使用默认的secret
          secret:
            secretName: kubernetes-dashboard-certs
        - name: tmp-volume
          emptyDir: {}
      serviceAccountName: kubernetes-dashboard
。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。

在kubernetes-dashboard名称空间创建secret，作为配置dashboard的ingress
[root@master01 tls]# kubectl create secret generic dashboard-ingress-secret --from-file=od.com.crt --from-file=od.com.key -n  kubernetes-dashboard

#对修改配置，重新加载
[root@master01 deploy]# kubectl apply -f recommended.yaml

#查看dashboard创建的svc，类型为nodeport，端口30008
[root@master01 tls]# kubectl get svc -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.97.189.115   <none>        8000/TCP        49m
kubernetes-dashboard        NodePort    10.101.20.126   <none>        443:30008/TCP   49m

#由于配置了nodeport。所以可以在集群外部通过nodeip+nodeport访问：10.4.7.51:3008

#由于人习惯浏览器访问，所以需要配置域名。
#配置dashboard的ingress
[root@master01 deploy]# cat dashboard-ingress.yaml 
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-dashboard
  namespace: kubernetes-dashboard
  annotations:
    kubernetes.io/ingress.class: "nginx"
    # 开启use-regex，启用path的正则匹配
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  tls:
  - hosts:
    - dashboard.od.com
    secretName: dashboard-ingress-secret   #创建的dashboard的secret的名字
  rules:
  - host: dashboard.od.com
    http:
      paths:
      - path: /
        backend:
          serviceName: kubernetes-dashboard   #dashboard创建的svc
          servicePort: 443
          
#默认是dashboard的文件定义serviceaccount只有list，get，watch权限，创建dashboard管理账号
[root@master01 deploy]# cat dashboard-admin-user.yaml 
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dashboard-admin
  namespace: kubernetes-dashboard  #一定要指定dashboard部署的同一名称空间，sa账号是对namespace

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin       #绑定k8s系统的默认cluster-admin的角色
subjects:
- kind: ServiceAccount      #用户类型是serviceaccount，因为是用pod在集群认证的，
  name: dashboard-admin
  namespace: kubernetes-dashboard
  
[root@master01 deploy]# kubectl apply -f dashboard-admin-user.yaml 
serviceaccount/dashboard-admin created  
  
#生成一个serviceaccount的名字开头的token
[root@master01 tls]# kubectl get secret -n kubernetes-dashboard|grep dashboard-admin
dashboard-admin-token-zfmh9        kubernetes.io/service-account-token   3      3m36s

[root@master01 tls]# kubectl describe secret dashboard-admin-token-zfmh9 -n kubernetes-dashboard
Name:         dashboard-admin-token-zfmh9
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: f89cf609-c18a-4309-8ce5-04d5968600a9

Type:  kubernetes.io/service-account-token

Data
====
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IlVZQzIwM1NmeVlCS3JGRDFHR1oycnJwRU9seTRZMGpJNkI1SVlRbUZHc28ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4temZtaDkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZjg5Y2Y2MDktYzE4YS00MzA5LThjZTUtMDRkNTk2ODYwMGE5Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.wJ5fq6VPt7jBIrXC9iDkQAt_chCWrYks0-jr3FLRemGNGpYuwuGxiZd-moJhHPxhtMXyLrEdAW9VsxiXwGad5qreE3iKLy_YWcPby5oW8_01b3j3Frie4A9UnvMsES4m9I9DnWM-xY1yPvzSPXzBxwSP2S-uiXSC6hdsgXuMNEZCKIE0WNW_J4VK5uXf0fp3BRDNFokFblUfV44gpA5E39QDl-1F2jAXrfFpxAPDd4lTuG0un-07qFU1a0XlhY27vq8VgCzQckJZbV_WsE2bs7THaPK2tEkU3kH6u8lIbtknEJ0hE9a1To2qa4pgbbBxF4Ngejp_4-QCaE5Pf1VkDw
ca.crt:     1029 bytes
 

#解释dashboard域名.解析到节点ip
[root@master01 deploy]# vi /var/named/od.com.zone 
dashboard          A   10.4.7.51

[root@master01 deploy]# systemctl restart named

#浏览器访问:https://dashboard.od.com  ，通过token登录

2.通过生成的kubeconfig认证方式登录k8s集群，在dashboard管理页面。
#创建一个新的serviceaccount，只能管理default名称空间
[root@master01 tls]# kubectl create serviceaccount def-ns-admin -n default

#通过rolebinding把serviceaccount绑定到admin的集群角色，因为rolebinding只授权在指定的namespace名称空间里。
[root@master01 tls]# kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin -n default
rolebinding.rbac.authorization.k8s.io/def-ns-admin created

[root@master01 tls]# kubectl get rolebinding -n default
NAME            ROLE                AGE
def-ns-admin    ClusterRole/admin   15s

#由于创建一个serviceaccount账号，会自动生成一个对应的secret，是以serviceaccount账号名字开头token
[root@master01 tls]# kubectl get secret -n default
NAME                       TYPE                                  DATA   AGE
def-ns-admin-token-prjpc   kubernetes.io/service-account-token   3      7m23s

#这个token账号，只能访问k8s的defaut名称空间，因为robebinding只定义在default名称空间。
[root@master01 tls]# kubectl describe secret def-ns-admin-token-prjpc -n default
Name:         def-ns-admin-token-prjpc
Namespace:    default
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: def-ns-admin
              kubernetes.io/service-account.uid: 01fe5a9f-cc3b-4192-bd69-d61bdfd1a703

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1029 bytes
namespace:  7 bytes   #下面创建kubeconfig文件访问k8s集群，通过dashboard。使用的token值。
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IlVZQzIwM1NmeVlCS3JGRDFHR1oycnJwRU9seTRZMGpJNkI1SVlRbUZHc28ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi1wcmpwYyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIwMWZlNWE5Zi1jYzNiLTQxOTItYmQ2OS1kNjFiZGZkMWE3MDMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.k4n3n8rGpaMdHEq3cNgsoFeA-xc3JuqPZOdBDMIw39RBdZvLeaWsYzRBh1ooBE5nZ1wMiTCVLd7z6OBRB7SHEKEuDXNI8Sm2eH1kMwRlYe5IIYCPc7kpHWSdq-CTAYoImJ4MVc1kflxWaWUAopnHOGAJllaqXZ4O3Dq11MT_yhFNEzV6_g3lP9ShrBcHgXbmWxDVRkunM9QJcc3VMThKcyc4zl8rQibyI2NDWwpSCmvrBDlyvFpPA9zYjqdlNCNYBMIvSOdHNGHEDTt84WKrZh-GHJmR0tVvo3rkvaHAAlfmxwCm9TdbusjqDpTtrvruJSwEpitLozbL1bg1UTJtMg

#通过生成kubeconfig，管理default名称空间
#创建一个集群名称，指定要管理的集群，生成一个kubeconfig文件。
[root@master01 tls]# kubectl config set-cluster kubernetes --server="https://10.4.7.48:6443" --certificate-authority=/etc/kubernetes/pki/ca.crt --embed-certs=true --kubeconfig=/root/def-ns-admin.conf
Cluster "kubernetes" set.

#查看kubeconfig文件
[root@master01 tls]# kubectl config view --kubeconfig=/root/def-ns-admin.conf 
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.4.7.48:6443
  name: kubernetes
contexts: null
current-context: ""
kind: Config
preferences: {}
users: null

#set-credentials创建的用户所使用的token，这里是使用上面创建的serviceaccount账号def-ns-admin的token
[root@master01 tls]# kubectl config set-credentials def-ns-admin --token="eyJhbGciOiJSUzI1NiIsImtpZCI6IlVZQzIwM1NmeVlCS3JGRDFHR1oycnJwRU9seTRZMGpJNkI1SVlRbUZHc28ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi1wcmpwYyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIwMWZlNWE5Zi1jYzNiLTQxOTItYmQ2OS1kNjFiZGZkMWE3MDMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.k4n3n8rGpaMdHEq3cNgsoFeA-xc3JuqPZOdBDMIw39RBdZvLeaWsYzRBh1ooBE5nZ1wMiTCVLd7z6OBRB7SHEKEuDXNI8Sm2eH1kMwRlYe5IIYCPc7kpHWSdq-CTAYoImJ4MVc1kflxWaWUAopnHOGAJllaqXZ4O3Dq11MT_yhFNEzV6_g3lP9ShrBcHgXbmWxDVRkunM9QJcc3VMThKcyc4zl8rQibyI2NDWwpSCmvrBDlyvFpPA9zYjqdlNCNYBMIvSOdHNGHEDTt84WKrZh-GHJmR0tVvo3rkvaHAAlfmxwCm9TdbusjqDpTtrvruJSwEpitLozbL1bg1UTJtMg" --kubeconfig=/root/def-ns-admin.conf 

#设置context上下文。就是定义用户绑定集群的信息
[root@master01 tls]# kubectl config set-context def-ns-admin@kubernetes --cluster=kubernetes --user=def-ns-admin --namespace=default --kubeconfig=/root/def-ns-admin.conf 
Context "def-ns-admin@kubernetes" created.

#使context上下文。指定用户绑定集群context上下文切换到当前。
#未设置之前，定义的上下文用户绑定集群不生效，
[root@master01 tls]# kubectl config view --kubeconfig=/root/def-ns-admin.conf 
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.4.7.48:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: default
    user: def-ns-admin
  name: def-ns-admin@kubernetes
current-context: ""   #未设置之前，当前上下文为空，也就没有开启。
kind: Config
preferences: {}
users:
- name: def-ns-admin
  user:
    token: eyJhbGciOiJSUzI1NiIsImtpZCI6IlVZQzIwM1NmeVlCS3JGRDFHR1oycnJwRU9seTRZMGpJNkI1SVlRbUZHc28ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi1wcmpwYyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIwMWZlNWE5Zi1jYzNiLTQxOTItYmQ2OS1kNjFiZGZkMWE3MDMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.k4n3n8rGpaMdHEq3cNgsoFeA-xc3JuqPZOdBDMIw39RBdZvLeaWsYzRBh1ooBE5nZ1wMiTCVLd7z6OBRB7SHEKEuDXNI8Sm2eH1kMwRlYe5IIYCPc7kpHWSdq-CTAYoImJ4MVc1kflxWaWUAopnHOGAJllaqXZ4O3Dq11MT_yhFNEzV6_g3lP9ShrBcHgXbmWxDVRkunM9QJcc3VMThKcyc4zl8rQibyI2NDWwpSCmvrBDlyvFpPA9zYjqdlNCNYBMIvSOdHNGHEDTt84WKrZh-GHJmR0tVvo3rkvaHAAlfmxwCm9TdbusjqDpTtrvruJSwEpitLozbL1bg1UTJtMg

#切换上下文
[root@master01 tls]# kubectl config use-context def-ns-admin@kubernetes --kubeconfig=/root/def-ns-admin.conf 
Switched to context "def-ns-admin@kubernetes".

#使用kubeconfig文件来访问k8s集群，把这个/root/def-ns-admin.conf 导出去电脑，
#浏览器上面，https://dashboard.od.com ,登录页面选择"kubeconfig"方式进行验证