master节点
1. 查看k8s版本
[root@master ~]# kubectl version
2.查看k8s版本与dashboard版本兼容
https://github.com/kubernetes/dashboard/releases
3. 安装dashboard
下载yaml文件
[root@master ~]# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.6.1/aio/deploy/recommended.yaml
命名空间默认为 kubernetes-dashboard,修改为 kube-system
[root@master ~]# sed -i '/namespace/ s/kubernetes-dashboard/kube-system/g' recommended.yaml
NodePort 方式:为了便于本地访问,修改 yaml 文件,将 service 改为 NodePort 类型,同时端口设置为 31260
spec:
type: NodePort # 增加
ports:
- port: 443
targetPort: 8443
nodePort: 31260 # 增加
安装
[root@master ~]# kubectl apply -f recommended.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created
[root@master ~]# kubectl get pod,svc --all-namespaces -o wide
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
......
kube-system pod/dashboard-metrics-scraper-8c47d4b5d-8qskj 1/1 Running 0 98s 10.244.1.14 node1 <none> <none>
kube-system pod/kubernetes-dashboard-598f8d6864-jrqpf 1/1 Running 0 98s 10.244.2.13 node2 <none> <none>
NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
......
kube-system service/dashboard-metrics-scraper ClusterIP 10.100.136.48 <none> 8000/TCP 98s k8s-app=dashboard-metrics-scraper
kube-system service/kubernetes-dashboard NodePort 10.103.26.227 <none> 443:31260/TCP 98s k8s-app=kubernetes-dashboard
[root@master ~]# kubectl get deployment kubernetes-dashboard --namespace=kube-system
NAME READY UP-TO-DATE AVAILABLE AGE
kubernetes-dashboard 1/1 1 1 5m43s
4. 创建 kubernetes-dashboard 管理员
dashboard-svc-adminuser.yaml内容:
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kube-system
[root@master ~]# kubectl create -f dashboard-svc-adminuser.yaml
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user created
5. 获取Bearer Token
https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md
5.1 临时
[root@master ~]# kubectl -n kube-system create token admin-user
eyJhbGciOiJSUzI1NiIsImtpZCI6ImQ4UFVwX3RFRWdDd0premZjM3ZIclZRdllZVjc3WE9keFhqc3JJeDdabncifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxNjk3NTMwODE2LCJpYXQiOjE2OTc1MjcyMTYsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsInNlcnZpY2VhY2NvdW50Ijp7Im5hbWUiOiJhZG1pbi11c2VyIiwidWlkIjoiMjkzNmM1YTktOWQ0Yy00MzM1LWFjYTEtYTU4NDcwYjQ5NjVlIn19LCJuYmYiOjE2OTc1MjcyMTYsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTphZG1pbi11c2VyIn0.ZjSlzSOMBuk0QNBQds04LBcaxY86rzwJ3BJFL57vJcP8r3wpNPmhxALwqWO2pCZ_cMBTiJkugAh_YiShdRkcrOBrfHFlngD0IS7uz_LY4X8HiLoe6y1zqnwgBK3ffu5cQkLRNl7Ez-fZeAeeKEXIYZhmsMz9NzTSIW96-gdUadez8XtT1t8lx8w8z39sCik43hcorz-sSqnlkOI-1vhi6gjLHnLDTS1OjTAKi6fq5UTsyYfCsx6kcZUm_7PZOCqquapeG_ii_OU0jQ6RTufmWC_e9XZVgSK_5BjwlzUS8YQNqZEmb5TmtEMC4Or4lwiLQhyxhjoDBnWuJIrL8diS8A
5.2 长期
dashboard-svc-adminuser-longlived-token.yaml内容:
apiVersion: v1
kind: Secret
metadata:
name: admin-user
namespace: kube-system
annotations:
kubernetes.io/service-account.name: "admin-user"
type: kubernetes.io/service-account-token
[root@master ~]# kubectl apply -f dashboard-svc-adminuser-longlived-token.yaml
secret/admin-user created
[root@master ~]# kubectl get secret --all-namespaces
NAMESPACE NAME TYPE DATA AGE
kube-system admin-user kubernetes.io/service-account-token 3 6s
kube-system kubernetes-dashboard-certs Opaque 0 39m
kube-system kubernetes-dashboard-csrf Opaque 1 39m
kube-system kubernetes-dashboard-key-holder Opaque 2 39m
[root@master ~]# kubectl -n kube-system describe secret admin-user
Name: admin-user
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: admin-user
kubernetes.io/service-account.uid: 2936c5a9-9d4c-4335-aca1-a58470b4965e
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1099 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6ImQ4UFVwX3RFRWdDd0premZjM3ZIclZRdllZVjc3WE9keFhqc3JJeDdabncifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIyOTM2YzVhOS05ZDRjLTQzMzUtYWNhMS1hNTg0NzBiNDk2NWUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.bvZoPaRMtgoq3pH3xyAInWwiaAERTV1PNVm6Cu2bj7k603H3xBkAu-Edbq9nZVxIPviC04azrx8hJaDTfjKOsytVH-muMx8AMNzSizFS6TOM7EUxfwXaAEk0Da1-tyldABECLBDxLhUZtorvfPIP8VUG_UtvrXHmlUpBpHGLCzbQhHpFsOl3H7uH_bnDuWMP5wODM7lshf1rQrO8cugWVAdeJd15mcHeLz63edjvkES3JGIHQkQRGmX9kTfF_0H_Q6dfAIlAxXLRPZwKwXWF-Q7wvAE2szGQ5hiMBVFuA1ELDYVxD-PmDafyOUlJCi1dIowbwSFnn57YXd_eADi-Yw
6. 浏览器访问 https://[master-ip]:31260
输入上一步的token,即可登录