二进制k8s集群安装dashboard
环境准备
##/etc/hosts
192.168.48.101 master01
192.168.48.102 master02
192.168.48.103 master03
192.168.48.201 node01
192.168.48.202 node02
## keepalived的vip
192.168.48.66
IP | Hostname | CPU | Memory |
---|---|---|---|
192.168.48.101 | master01 | 2 | 4G |
192.168.48.102 | master02 | 2 | 4G |
192.168.48.103 | master03 | 2 | 4G |
192.168.48.201 | node01 | 2 | 4G |
192.168.48.202 | node02 | 2 | 4G |
软件 | 版本 |
---|---|
kubernetes | 1.15.2 |
docker-ce | 19.03 |
calico | 3.8 |
etcd | 3.3.13 |
CNI | 0.8.1 |
coredns | 1.4.0 |
metrics-server | 0.3.3 |
ingress-controller | 0.25.0 |
dashboard | 1.10.1 |
安装
官方地址
https://github.com/kubernetes/dashboard
yaml文件下载
wget https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
镜像下载
需要的镜像
k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
链接:https://pan.baidu.com/s/1A4NI1guHwOFQv-n7F6ajYA 提取码:fvne
节点导入镜像
docker load -i dashboard.tar.gz
生成dashboard的证书
默认的证书不支持chrome,生成新证书通过openssl生成自签名证书即可,这样就有了证书文件dashboard.crt 和 私钥 dashboad.key
[root@master01 ~]# cd /etc/kubernetes/pki/
[root@master01 pki]# openssl genrsa -out dashboard.key 2048
[root@master01 pki]# openssl req -new -out dashboard.csr -key dashboard.key -subj "/C=/ST=/L=/O=/OU=/CN=kubernetes-dashboard"
[root@master01 pki]# openssl x509 -req -in dashboard.csr -out dashboard.crt -signkey dashboard.key -CA ca.crt -CAkey ca.key -CAcreateserial -days 1000
生成secret
[root@master01 ~]# kubectl create secret generic kubernetes-dashboard-certs --from-file=/etc/kubernetes/pki/dashboard.key --from-file=/etc/kubernetes/pki/dashboard.crt -n kube-system
secret/kubernetes-dashboard-certs created
生成ingress的tls文件
[root@master01 ~]# cd /etc/kubernetes/pki/
[root@master01 pki]# openssl req -x509 -nodes -days 10000 -newkey rsa:2048 -keyout k8s-dashboard-tls.key -out k8s-dashboard-tls.crt -subj "/CN=dashboard.tk8s.com/O=dashboard.tk8s.com"
[root@master01 ~]# kubectl -n kube-system create secret tls k8s-dashboard-tls --key=/etc/kubernetes/pki/k8s-dashboard-tls.key --cert=/etc/kubernetes/pki/k8s-dashboard-tls.crt
secret/k8s-dashboard-tls created
修改kubernetes-dashboard.yaml文件
[root@master01 ~]# vim kubernetes-dashboard.yaml
删除原先的Dashboard Secret
添加ingress
##ingress
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: k8s-dashboard-ingress
namespace: kube-system
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
tls:
- hosts:
- dashboard.tk8s.com
secretName: k8s-dashboard-tls
rules:
- host: dashboard.tk8s.com
http:
paths:
- backend:
serviceName: kubernetes-dashboard
servicePort: 443
加载yaml文件
[root@master01 ~]# kubectl apply -f kubernetes-dashboard.yaml
serviceaccount/kubernetes-dashboard created
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
deployment.apps/kubernetes-dashboard created
service/kubernetes-dashboard created
ingress.extensions/k8s-dashboard-ingress created
[root@master01 ~]# kubectl get pods -n kube-system |grep dashboard
kubernetes-dashboard-7d75c474bb-wblhg 1/1 Running 0 2m7s
[root@master01 ~]# kubectl get ingresses -n kube-system
NAME HOSTS ADDRESS PORTS AGE
k8s-dashboard-ingress dashboard.tk8s.com 80, 443 4m53s
访问
登录
利用token登录
创建serviceaccount
kubectl create serviceaccount dashboard-admin -n kube-system
clusterrolebinding绑定
kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
获取token
[root@master01 ~]# kubectl describe secrets -n kube-system dashboard-admin-token-zszk4
Name: dashboard-admin-token-zszk4
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: 45407a6c-2bde-435a-8fd2-e224cdcf580e
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1046 bytes
namespace: 11 bytes
token: eyJhbGciOiJFUzUxMiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tenN6azQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNDU0MDdhNmMtMmJkZS00MzVhLThmZDItZTIyNGNkY2Y1ODBlIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.AR-MHKM_Ea9U2qWbmp2Sg1gxUhyaWPie_6eXjo5Ysw11GOphHjid1_xhm4zcs0wd50gTPK7YKOgD68BpjsLraywvAHr5QXli52rlkcvf5Ysp_s3dbddy8MGWWThQF5jY7xsKk8iUBqSIHV_Vl69cg__54noh4rJBApPQ2JLVY9p_HxjK
配置文件登录
将token加入到配置文件中
[root@master01 ~]# cp .kube/config /root/admin
[root@master01 ~]# vim /root/admin
...
token: eyJhbGciOiJFUzUxMiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tenN6azQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNDU0MDdhNmMtMmJkZS00MzVhLThmZDItZTIyNGNkY2Y1ODBlIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.AR-MHKM_Ea9U2qWbmp2Sg1gxUhyaWPie_6eXjo5Ysw11GOphHjid1_xhm4zcs0wd50gTPK7YKOgD68BpjsLraywvAHr5QXli52rlkcvf5Ysp_s3dbddy8MGWWThQF5jY7xsKk8iUBqSIHV_Vl69cg__54noh4rJBApPQ2JLVY9p_HxjK