【kubernetes】从kubernetes Dashboard的yaml文件看应用的部署

于 2023-09-25 19:42:17 发布
阅读量991 收藏 1
点赞数
分类专栏： kubernetes 文章标签： kubernetes 容器
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/luofengmacheng/article/details/133279309
版权

从kubernetes Dashboard的yaml文件看应用的部署

1 Dashboard的yaml文件

Dashboard

# 创建名称空间
apiVersion: v1
kind: Namespace
metadata:
  name: kubernetes-dashboard

---

# 创建dashboard的SA
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard

---

# 创建dashboard的服务
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  # 服务的端口时443(https)，容器端口时8443
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-certs
  namespace: kubernetes-dashboard
type: Opaque

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-csrf
  namespace: kubernetes-dashboard
type: Opaque
data:
  csrf: ""

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-key-holder
  namespace: kubernetes-dashboard
type: Opaque

---

kind: ConfigMap
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-settings
  namespace: kubernetes-dashboard

---

# 创建dashboard的角色
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
rules:
    # 只允许对下面这3个secret进行操作
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
    verbs: ["get", "update", "delete"]
    # 允许对下面configmap进行get和update，这里面存储的应该是dashboard的配置
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["kubernetes-dashboard-settings"]
    verbs: ["get", "update"]
    # 允许dashboard获取指标
  - apiGroups: [""]
    resources: ["services"]
    resourceNames: ["heapster", "dashboard-metrics-scraper"]
    verbs: ["proxy"]
  - apiGroups: [""]
    resources: ["services/proxy"]
    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
    verbs: ["get"]

---

# 创建集群角色，允许dashboard获取集群的一些数据
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
rules:
  # 允许读取node和pod的指标数据
  - apiGroups: ["metrics.k8s.io"]
    resources: ["pods", "nodes"]
    verbs: ["get", "list", "watch"]

---

# 将角色与SA绑定
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubernetes-dashboard
subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: kubernetes-dashboard

---

# 将集群角色与SA绑定
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubernetes-dashboard
subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: kubernetes-dashboard

---

# 部署dashboard
kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  # 1个副本
  replicas: 1
  # 保留历史版本的数量，用于回滚
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
    spec:
      containers:
        - name: kubernetes-dashboard
          image: kubernetesui/dashboard:v2.2.0
          imagePullPolicy: Always
          # 容器端口是8443
          ports:
            - containerPort: 8443
              protocol: TCP
          # 容器参数
          args:
            - --auto-generate-certificates
            - --namespace=kubernetes-dashboard
            # 下面的参数指定apiserver的地址，默认情况下，dashboard会自动发现，如果无法发现可以手动配置
            # - --apiserver-host=http://my-address:port
          volumeMounts:
            # 从secret获取证书
            - name: kubernetes-dashboard-certs
              mountPath: /certs
              # Create on-disk volume to store exec logs
            - mountPath: /tmp
              name: tmp-volume
          # 存活探针
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /
              port: 8443
            initialDelaySeconds: 30
            timeoutSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      volumes:
        - name: kubernetes-dashboard-certs
          secret:
            secretName: kubernetes-dashboard-certs
        - name: tmp-volume
          emptyDir: {}
      # Pod访问apiserver的SA
      serviceAccountName: kubernetes-dashboard
      # 只能部署在linux
      nodeSelector:
        "kubernetes.io/os": linux
      # 容忍污点，如果不允许dashboard部署在master，可以删掉
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule

---

# dashboard的指标拉取服务
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: dashboard-metrics-scraper
  name: dashboard-metrics-scraper
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 8000
      targetPort: 8000
  selector:
    k8s-app: dashboard-metrics-scraper

---

# 部署dashboard的指标拉取应用
# 用户可以在dashboard查看node和pod的指标
kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: dashboard-metrics-scraper
  name: dashboard-metrics-scraper
  namespace: kubernetes-dashboard
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: dashboard-metrics-scraper
  template:
    metadata:
      labels:
        k8s-app: dashboard-metrics-scraper
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
    spec:
      containers:
        - name: dashboard-metrics-scraper
          image: kubernetesui/metrics-scraper:v1.0.6
          ports:
            - containerPort: 8000
              protocol: TCP
          livenessProbe:
            httpGet:
              scheme: HTTP
              path: /
              port: 8000
            initialDelaySeconds: 30
            timeoutSeconds: 30
          volumeMounts:
          - mountPath: /tmp
            name: tmp-volume
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      serviceAccountName: kubernetes-dashboard
      nodeSelector:
        "kubernetes.io/os": linux
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
      volumes:
        - name: tmp-volume
          emptyDir: {}

2 部署应用的yaml

通过对dashboard各个部分的说明，在部署一个应用时，yaml通常需要包含以下几个部分：

  • 创建命名空间
  • 创建SA
  • 创建Role和ClusterRole
  • 将Role和ClusterRole与SA绑定，然后SA就拥有了对应的权限
  • 创建ConfigMap存放应用配置
  • 创建Deployment和Service，其中Deployment中的Pod使用前面创建的SA
luofengmacheng
关注
专栏目录
kubernetes-dashboard.yaml
08-11
# Copyright 2017 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # ------------------- Dashboard Secret ------------------- # apiVersion: v1 kind: Secret metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-certs namespace: kube-system type: Opaque --- # ------------------- Dashboard Service Account ------------------- # apiVersion: v1 kind: ServiceAccount metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system --- # ------------------- Dashboard Role & Role Binding ------------------- # kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: kubernetes-dashboard-minimal namespace: kube-system rules: # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret. - apiGroups: [""] resources: ["secrets"] verbs: ["create"] # Allow Dashboard to create 'kubernetes-dashboard-settings' config map. - apiGroups: [""] resources: ["configmaps"] verbs: ["create"] # Allow Dashboard to get, update and delete Dashboard exclusive secrets. - apiGroups: [""] resources: ["secrets"] resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"] verbs: ["get", "update", "delete"] # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. - apiGroups: [""] resources: ["configmaps"] resourceNames: ["kubernetes-dashboard-settings"] verbs: ["get", "update"] # Allow Dashboard to get metrics from heapster. - apiGroups: [""] resources: ["services"] resourceNames: ["heapster"] verbs: ["proxy"] - apiGroups: [""] resources: ["services/proxy"] resourceNames: ["heapster", "http:heapster:", "https:heapster:"] verbs: ["get"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: kubernetes-dashboard-minimal namespace: kube-system roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: kubernetes-dashboard-minimal subjects: - kind: ServiceAccount name: kubernetes-dashboard namespace: kube-system --- # ------------------- Dashboard Deployment ------------------- # kind: Deployment apiVersion: apps/v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: k8s-app: kubernetes-dashboard template: metadata: labels: k8s-app: kubernetes-dashboard spec: containers: - name: kubernetes-dashboard image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1 imagePullPolicy: IfNotPresent ports: - containerPort: 8443 protocol: TCP args: - --auto-generate-certificates # Uncomment the following line to manually specify Kubernetes API server Host # If not specified, Dashboard will attempt to auto discover the API server and connect # to it. Uncomment only if the default does not work. #- --apiserver-host=http://192.168.140.129:8080 volumeMounts: - name: kubernetes-dashboard-certs mountPath: /certs # Create on-disk volume to store exec logs - mountPath: /tmp name: tmp-volume livenessProbe: httpGet: scheme: HTTPS path: / port: 8443 initialDelaySeconds: 30 timeoutSeconds: 30 volumes: - name: kubernetes-dashboard-certs secret: secretName: kubernetes-dashboard-certs - name: tmp-volume emptyDir: {} serviceAccountName: kubernetes-dashboard # Comment the following tolerations if Dashboard must not be deployed on master tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule --- # ------------------- Dashboard Service ------------------- # kind: Service apiVersion: v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system spec: type: NodePort ports: - port: 443 targetPort: 8443 selector: k8s-app: kubernetes-dashboard
Kubernetes Dashboard部署教程
最新发布
m0_69740353的博客
10-28 464
Kubernetes Dashboard部署教程
dashboard.yaml
04-23
k8s dashborad的yaml安装文件，有需要的可以下载哦，v2.0.0版本。给那些不能科学上网的小伙伴使用，不知道如何使用的也可以关注我的博客k8s相关的部分，里面有完整的k8s使用教程，希望对你有所帮助。
kubernetes-dashboard-v1.8.3 yaml文件
10-08
kubernetes-dashboard-v1.8.3 yaml文件，使用方法： kubectl -n kube-system create -f .
K8s安装之Dashboard.yaml(直接复制使用)
CoreCmd的博客
10-23 1982
# Copyright 2017 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses
云计算+kubernetes+网络插件yaml文件+dashboard-yaml文件
10-17
在压缩包中的"dashboard-yaml文件"很可能是Kubernetes Dashboard的部署文件，例如`kubectl apply -f dashboard.yaml`即可在集群中安装Dashboard。这个yaml文件通常包含Dashboard的Deployment、Service和RoleBinding...
k8s kubernetes dashboard dns 配置文件 yaml
06-26
为了设置Dashboard，你需要一个名为`dashboard.yaml`的YAML文件，其中包含了定义Dashboard服务和部署的配置信息。这个文件会指定Dashboard的副本数量、端口、服务类型、环境变量和依赖的其他服务等。 DNS（Domain ...
kubernetes-dashboardv1.0 yaml
03-19
1、yaml配置文件 2、kubernetes dashboard 1.10 镜像资源 3、dashboard admin 配置文件 kubectl describe secret/$(kubectl get secret -nkube-system |grep admin|awk '{print $1}') -n kube-system
dashboard-adminuser.yaml
08-11
--- apiVersion: v1 kind: ServiceAccount metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-admin namespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRoleBinding metadata: name: kubernetes-dashboard-admin labels: k8s-app: kubernetes-dashboard roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: kubernetes-dashboard-admin namespace: kube-system
k8s-dashboard镜像和yaml文件.rar
11-08
本资源“k8s-dashboard镜像和yaml文件.rar”包含部署Kubernetes Dashboard所需的镜像和YAML配置文件，这将帮助用户通过图形界面方式来监控和管理集群。 Kubernetes Dashboard是一个Web UI，它提供了可视化的界面来...
kubernetes-dashboard.yaml 源码文件
踏浪归来
07-07 147
【代码】kubernetes-dashboard.yaml 源码文件。
dashboard的yaml配置文件
weixin_45574151的博客
11-06 378
链接：https://pan.baidu.com/s/1QYJEEwdIxuQyDfTEjcE3RQ 提取码：ZgLt
kubernetes-dashboard.yaml--安装kubernetes可视化界面
qq_46126559的博客
08-23 3398
部署 kubectl apply -f kubernetes-dashboard.yaml # Copyright 2017 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the Li
Kubernetes 的kubernetes-dashboard.yaml源码
qq_37390414的博客
11-23 453
--- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: flannel rules: - apiGroups: - "" resources: - pods verbs: - get - apiGroups: - "" resources: - nodes verbs: - list
Kubernetes 搭建部署dash board
Q274948451的博客
09-29 497
k8s集群部署完成之后 1.在master节点上安装dash board [root@k8s-master ~]# vim dash_board.yaml apiVersion: v1 kind: Namespace metadata: name: kubernetes-dashboard --- apiVersion: v1 kind: ServiceAccount metadata: labels: k8s-app: kubernetes-dashboard name: ku
Kubernetes Dashboard yaml文件参数解析
05-26
Kubernetes Dashboard 是一个基于 Web 的 UI 工具，用于管理 Kubernetes 集群。它包含了一些常用的管理功能，如查看 Pod、Deployment、Service 等资源的状态信息，以及进行一些基本的操作。 Kubernetes Dashboard 的部署需要使用 yaml 文件，下面是一个简单的 yaml 文件示例： ``` apiVersion: v1 kind: ServiceAccount metadata: name: kubernetes-dashboard namespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRoleBinding metadata: name: kubernetes-dashboard roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: kubernetes-dashboard namespace: kube-system --- apiVersion: extensions/v1beta1 kind: Deployment metadata: name: kubernetes-dashboard namespace: kube-system labels: k8s-app: kubernetes-dashboard spec: replicas: 1 selector: matchLabels: k8s-app: kubernetes-dashboard template: metadata: labels: k8s-app: kubernetes-dashboard spec: serviceAccountName: kubernetes-dashboard containers: - name: kubernetes-dashboard image: kubernetesui/dashboard:v2.0.3 ports: - containerPort: 9090 protocol: TCP args: - --namespace=kube-system livenessProbe: httpGet: path: / port: 9090 initialDelaySeconds: 30 timeoutSeconds: 30 ``` 上面的 yaml 文件包含了三个部分： 1. ServiceAccount：定义了一个名为 kubernetes-dashboard 的 ServiceAccount，用于授权 Dashboard 访问 Kubernetes API。 2. ClusterRoleBinding：定义了一个名为 kubernetes-dashboard 的 ClusterRoleBinding，将 ClusterRole cluster-admin 授权给 kubernetes-dashboard ServiceAccount。这样 Dashboard 就能够访问所有 Kubernetes API 资源。 3. Deployment：定义了一个名为 kubernetes-dashboard 的 Deployment，用于部署 Kubernetes Dashboard。 在 Deployment 中，包含了一些参数，下面是一些主要参数的解释： - replicas：指定了需要创建的 Pod 数量。 - selector：用于选择要管理的 Pod。 - template：定义了 Pod 的模板，包括了容器、镜像、端口、环境变量等信息。 - serviceAccountName：指定了使用的 ServiceAccount。 - containers：定义了 Pod 中的容器，包括了镜像、端口、命令、参数等信息。 - livenessProbe：定义了 Pod 的健康检查方式，包括了访问路径、端口、检查频率等信息。 通过这些参数的设置，可以灵活地部署和管理 Kubernetes Dashboard。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值