k8s学习(二) k8s集群内安装dashboard

dashboard是k8s官方的UI界面，这个界面能显示所有的工作负载（workload)，包括运行的Nodes，Services，Pods，Jobs，Relica sets等k8s资源。

1、 下载 dashboard镜像，并将镜像打入本地镜像服务器

由于墙的原因，与上一篇安装k8s集群一样，先下载镜像，打入本地库

docker pull mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1

docker tag mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1 192.168.100.89:80/kubernetes-dashboard-amd64:v1.10.1

docker push 192.168.100.89:80/kubernetes-dashboard-amd64:v1.10.1

2、 下载kubernetes-dashboard.yaml

下载地址：https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml

3、 使用NodePort登陆UI

修改yaml文件中Service下 spec 的type为 NodePort 指定 nodePort为31620

4、启用dashboard

kubectl apply -f kubernetes-dashboard.yaml

5、证书过期处理：

mkdir key && cd key
#生成证书
openssl genrsa -out dashboard.key 2048 
#我这里写的自己的node1节点，因为我是通过nodeport访问的；如果通过apiserver访问，可以写成自己的master节点ip
openssl req -new -out dashboard.csr -key dashboard.key -subj '/CN=192.168.135.129'
openssl x509 -req -in dashboard.csr -signkey dashboard.key -out dashboard.crt 
#删除原有的证书secret
kubectl delete secret kubernetes-dashboard-certs -n kube-system
#创建新的证书secret
kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt -n kube-system
#查看pod
kubectl get pod -n kube-system
#重启pod
kubectl delete pod kubernetes-dashboard-7d75c474bb-bwps2  -n kube-system

6、创建一个cluster-admin角色的service account , 和一个clusterrolebinding, 以便访问所有的k8s资源

kubectl create serviceaccount cluster-admin-dashboard-sa
 
kubectl create clusterrolebinding cluster-admin-dashboard-sa \
  --clusterrole=cluster-admin \
  --serviceaccount=default:cluster-admin-dashboard-sa

7、获取token

[root@k8s-node1 tmp]# kubectl get secret | grep cluster-admin-dashboard-sa
cluster-admin-dashboard-sa-token-hld8l   kubernetes.io/service-account-token   3      45m

root@k8s-node1 tmp]# kubectl describe secrets/cluster-admin-dashboard-sa-token-hld8l
Name:         cluster-admin-dashboard-sa-token-hld8l
Namespace:    default
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: cluster-admin-dashboard-sa
              kubernetes.io/service-account.uid: 80ba693e-d03f-4087-a200-d3ab69f89f3f

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  7 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImNsdXN0ZXItYWRtaW4tZGFzaGJvYXJkLXNhLXRva2VuLWhsZDhsIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImNsdXN0ZXItYWRtaW4tZGFzaGJvYXJkLXNhIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiODBiYTY5M2UtZDAzZi00MDg3LWEyMDAtZDNhYjY5Zjg5ZjNmIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50OmRlZmF1bHQ6Y2x1c3Rlci1hZG1pbi1kYXNoYm9hcmQtc2EifQ.Ho8tO6L7KWSbxB632DasnoDbBDBLua9L9eJ48tfwmgJJQTLNaOrWP3hxsfGSVSsLuZVlNApYzxziRcdT7xVZ-IcRx2bWV4CF5aV8TcGXToXVQ4ibNlS8Lq6d9kERsx2wIiNj81K6lQk0TsyjbzOsGvAGwxizdWB_eAk1wwJWminuBQWostUBYjhnYE0hmqRijQ62u__MA95cMqS-rw6x2sAirOSwL-68LNLPPMnIcq4hXXrHxdbPLKo3E7KG_V0pH9rlEN6T865EGjQDpk4rcM8av6xw2ek2FcUWKxREGvficllhJWnhlCBdEgpA-YkP4yPziWTmwANlhfVWj_yV5g

复制token

8、进入UI

访问https://:31620
选择token登陆，输入上一步获取的token