一起来学k8s 24.二进制k8s集群安装dashboard

二进制k8s集群安装dashboard

环境准备

##/etc/hosts
192.168.48.101 master01
192.168.48.102 master02
192.168.48.103 master03
192.168.48.201 node01
192.168.48.202 node02

## keepalived的vip
192.168.48.66

IP	Hostname	CPU	Memory
192.168.48.101	master01	2	4G
192.168.48.102	master02	2	4G
192.168.48.103	master03	2	4G
192.168.48.201	node01	2	4G
192.168.48.202	node02	2	4G

软件	版本
kubernetes	1.15.2
docker-ce	19.03
calico	3.8
etcd	3.3.13
CNI	0.8.1
coredns	1.4.0
metrics-server	0.3.3
ingress-controller	0.25.0
dashboard	1.10.1

安装

官方地址

https://github.com/kubernetes/dashboard

yaml文件下载

wget https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml

镜像下载

需要的镜像

k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1

链接：https://pan.baidu.com/s/1A4NI1guHwOFQv-n7F6ajYA 提取码：fvne

节点导入镜像

docker load -i dashboard.tar.gz

生成dashboard的证书

默认的证书不支持chrome，生成新证书通过openssl生成自签名证书即可,这样就有了证书文件dashboard.crt 和 私钥 dashboad.key

[root@master01 ~]# cd /etc/kubernetes/pki/
[root@master01 pki]# openssl genrsa -out dashboard.key 2048
[root@master01 pki]# openssl req -new -out dashboard.csr -key dashboard.key -subj "/C=/ST=/L=/O=/OU=/CN=kubernetes-dashboard"
[root@master01 pki]# openssl x509 -req -in dashboard.csr -out dashboard.crt -signkey dashboard.key  -CA ca.crt -CAkey ca.key -CAcreateserial -days 1000

生成secret

[root@master01 ~]# kubectl  create secret generic kubernetes-dashboard-certs --from-file=/etc/kubernetes/pki/dashboard.key --from-file=/etc/kubernetes/pki/dashboard.crt -n kube-system 
secret/kubernetes-dashboard-certs created

生成ingress的tls文件

[root@master01 ~]# cd /etc/kubernetes/pki/
[root@master01 pki]# openssl req -x509 -nodes -days 10000 -newkey rsa:2048 -keyout k8s-dashboard-tls.key -out k8s-dashboard-tls.crt -subj "/CN=dashboard.tk8s.com/O=dashboard.tk8s.com"

[root@master01 ~]# kubectl -n kube-system create secret tls k8s-dashboard-tls --key=/etc/kubernetes/pki/k8s-dashboard-tls.key  --cert=/etc/kubernetes/pki/k8s-dashboard-tls.crt 
secret/k8s-dashboard-tls created

修改kubernetes-dashboard.yaml文件

[root@master01 ~]# vim kubernetes-dashboard.yaml

删除原先的Dashboard Secret

添加ingress

##ingress
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: k8s-dashboard-ingress
  namespace: kube-system
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  tls:
  - hosts:
    - dashboard.tk8s.com
    secretName: k8s-dashboard-tls
  rules:
  - host: dashboard.tk8s.com
    http:
      paths:
      - backend:
          serviceName: kubernetes-dashboard
          servicePort: 443

加载yaml文件

[root@master01 ~]# kubectl apply -f kubernetes-dashboard.yaml 
serviceaccount/kubernetes-dashboard created
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
deployment.apps/kubernetes-dashboard created
service/kubernetes-dashboard created
ingress.extensions/k8s-dashboard-ingress created

[root@master01 ~]# kubectl get pods -n kube-system  |grep dashboard
kubernetes-dashboard-7d75c474bb-wblhg      1/1     Running   0          2m7s
[root@master01 ~]# kubectl get ingresses -n kube-system 
NAME                    HOSTS                ADDRESS   PORTS     AGE
k8s-dashboard-ingress   dashboard.tk8s.com             80, 443   4m53s

访问

登录

利用token登录

创建serviceaccount

kubectl create serviceaccount  dashboard-admin -n kube-system 

clusterrolebinding绑定

 kubectl create clusterrolebinding  dashboard-cluster-admin --clusterrole=cluster-admin   --serviceaccount=kube-system:dashboard-admin

获取token

[root@master01 ~]# kubectl describe secrets  -n kube-system  dashboard-admin-token-zszk4 
Name:         dashboard-admin-token-zszk4
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 45407a6c-2bde-435a-8fd2-e224cdcf580e

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1046 bytes
namespace:  11 bytes
token:      eyJhbGciOiJFUzUxMiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tenN6azQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNDU0MDdhNmMtMmJkZS00MzVhLThmZDItZTIyNGNkY2Y1ODBlIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.AR-MHKM_Ea9U2qWbmp2Sg1gxUhyaWPie_6eXjo5Ysw11GOphHjid1_xhm4zcs0wd50gTPK7YKOgD68BpjsLraywvAHr5QXli52rlkcvf5Ysp_s3dbddy8MGWWThQF5jY7xsKk8iUBqSIHV_Vl69cg__54noh4rJBApPQ2JLVY9p_HxjK

配置文件登录

将token加入到配置文件中

[root@master01 ~]# cp .kube/config  /root/admin

[root@master01 ~]# vim /root/admin
...
    token: eyJhbGciOiJFUzUxMiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tenN6azQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNDU0MDdhNmMtMmJkZS00MzVhLThmZDItZTIyNGNkY2Y1ODBlIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.AR-MHKM_Ea9U2qWbmp2Sg1gxUhyaWPie_6eXjo5Ysw11GOphHjid1_xhm4zcs0wd50gTPK7YKOgD68BpjsLraywvAHr5QXli52rlkcvf5Ysp_s3dbddy8MGWWThQF5jY7xsKk8iUBqSIHV_Vl69cg__54noh4rJBApPQ2JLVY9p_HxjK