K8S实战dashboard

参考

https://cloud.tencent.com/developer/article/1616434
https://www.cnblogs.com/yy690486439/p/13596947.html

https://www.jianshu.com/p/be2a12a8bc0b
配置文件参考
https://www.yisu.com/zixun/4503.html

准备安装kubernetes dashboard的yaml文件

#在master上下载，安装dashboard只要在master节点操作
wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta4/aio/deploy/recommended.yaml

PS：如果发现该链接失效，请访问https://github.com/kubernetes/dashboard，然后查找最新的链接。

修改yaml文件，这里由于使用自签证书，要重建secret ，需要删除secret部分

---

apiVersion: v1

kind: Secret

metadata:

  labels:

    k8s-app: kubernetes-dashboard

  name: kubernetes-dashboard-certs

  namespace: kubernetes-dashboard

type: Opaque

---

这里顺便修改一下service资源对象，更改为nodeport类型，以供外网访问。

---

kind: Service

apiVersion: v1

metadata:

  labels:

    k8s-app: kubernetes-dashboard

  name: kubernetes-dashboard

  namespace: kubernetes-dashboard

spec:
  # 添加Service的type为NodePort,注意大小写
  type: NodePort

  ports:

    - port: 443

      targetPort: 8443

      # 添加映射到虚拟机的端口,k8s只支持30000以上的端口
      nodePort: 32201 

  selector:

    k8s-app: kubernetes-dashboard

---

2. 为dashboard制作自签证书

创建SSL证书需要私钥和证书签名请求。这些可以通过一些简单的命令生成。当openssl req命令要求输入“密码”时，只需按回车键，密码为空。

#创建一个dashboard的私钥
openssl genrsa -out dashboard.key 2048
#生成一个证书签署请求
openssl req -new -key dashboard.key -out dashboard.csr
#通过.key和.crt签署证书，dashboard.crt文件是适用于仪表板和dashboard.key私钥的证书。
 openssl x509 -req -sha256 -days 365 -in dashboard.csr -signkey dashboard.key -out dashboard.crt 

[root@master .kube]# ls
cache  config  dashboard.crt  dashboard.csr  dashboard.key  http-cache  recommended.yaml 

通过签署证书创建一个sercert

--from-file= 是证书的所在地

kubectl create secret generic kubernetes-dashboard-certs -n kubernetes-dashboard --from-file=dashboard.crt=./dashboard.crt --from-file=dashboard.key=./dashboard.key

3.创建dashboard的pod

[root@master .kube]# kubectl create -f recommended.yaml 
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created
[root@master .kube]# kubectl get -n kubernetes-dashboard  pod 
NAME                                         READY   STATUS    RESTARTS   AGE
dashboard-metrics-scraper-566cddb686-ffdpp   1/1     Running   0          11m
kubernetes-dashboard-7b5bf5d559-rb4j2        1/1     Running   0          67s
[root@master .kube]# kubectl get -n kubernetes-dashboard  svc
NAME                        TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.104.247.1   <none>        8000/TCP        13m
kubernetes-dashboard        NodePort    10.110.34.66   <none>        443:32201/TCP   13m
[root@master .kube]# 

这时访问 https://ip:port ，已可以到达登录界面，需要输入(令牌)token登录

4.创建token

该ServiceAccount的secret作为登录dashboard的凭证。因为官方给的默认权限是最小的，所以我们要自建一个最大权限的SA。

4.1 创建ServiceAccount

[root@master .kube]# cat dashboard-sa.yaml 
apiVersion: v1

kind: ServiceAccount

metadata:

  name: dashboard-admin

  namespace: kubernetes-dashboard 

4.2 创建clusterrolebinding为dashboard sa授权集群权限cluster-admin

[root@master .kube]# cat dashboard-clusterrolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

  name: dashboard-admin

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: cluster-admin

subjects:

- kind: ServiceAccount

  name: dashboard-admin

  namespace: kubernetes-dashboard

5. 启动服务

kubectl create -f dashboard-sa.yaml
kubectl create -f dashboard-clusterrolebinding.yaml

6.获取验证token

[root@master .kube]# kubectl describe secret -n kubernetes-dashboard $(kubectl get secret -n kubernetes-dashboard | grep dashboard-admin | awk '{print $1}')
Name:         dashboard-admin-token-c5n4q
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: c5165903-7c0b-479d-8053-b5389436effd

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IkJVUHMtak40ZGNVNlNCLTRjMlFHdHFTZ3NCQllUTkJ0MVEyX2VBLWRQZUUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tYzVuNHEiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiYzUxNjU5MDMtN2MwYi00NzlkLTgwNTMtYjUzODk0MzZlZmZkIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.QYlcgHqj-bVv0oZs_YSVBkiGmveBuFVB_rIKmrhJ617Vxe2HvY-yvqiHew3CZFFo7XlxlYp6A1ziaJdJbrlDar8hM53vXGLtMFv-oxP3zOxXmpmjxAqwOPeGR0I1UPRCeAVAJnLEe-bsIreJv9CVN0bI6PiF-4E4Ex8q6wztjFfiuXwZXkXoQrxuJP2t0WjT8HTqXwcL4t1f-AN3Z5D3Z9zHd_JyaR74jRbRiP9PCe3NfoU-JZ36hn-jjlmg32V-SIl1Wcl0G8oTW56oZ8TR_4yzSqeQLfk5y2L6hL152mBhAK1KWNgkNViPZ5Wn5TplIA1U_5T4x5WGp1fme8383g

6.登录dashboard

至此，dashboard已经搭建完成

 

删除kubernetes dashboard

// 查询pod 

kubectl get pods --all-namespaces | grep "dashboard"

// 删除pod

kubectl delete deployment kubernetes-dashboard  --namespace=kubernetes-dashboard
kubectl delete deployment dashboard-metrics-scraper --namespace=kubernetes-dashboard

// 查询service

kubectl get service -A

// 删除service

 kubectl delete service kubernetes-dashboard  --namespace=kubernetes-dashboard
 kubectl delete service dashboard-metrics-scraper  --namespace=kubernetes-dashboard

 // 删除账户和密钥

kubectl delete sa kubernetes-dashboard --namespace=kubernetes-dashboard
kubectl delete secret kubernetes-dashboard-certs --namespace=kubernetes-dashboard
kubectl delete secret kubernetes-dashboard-key-holder --namespace=kubernetes-dashboard