k8s部署dashboard

master节点

1. 查看k8s版本

[root@master ~]# kubectl version

2.查看k8s版本与dashboard版本兼容

https://github.com/kubernetes/dashboard/releases

3. 安装dashboard

下载yaml文件

[root@master ~]# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.6.1/aio/deploy/recommended.yaml

命名空间默认为 kubernetes-dashboard，修改为 kube-system

[root@master ~]# sed -i '/namespace/ s/kubernetes-dashboard/kube-system/g' recommended.yaml

NodePort 方式：为了便于本地访问，修改 yaml 文件，将 service 改为 NodePort 类型，同时端口设置为 31260

 spec:
   type: NodePort     # 增加
   ports:
     - port: 443
       targetPort: 8443
       nodePort: 31260   # 增加

安装

[root@master ~]# kubectl apply -f recommended.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created

[root@master ~]# kubectl get pod,svc --all-namespaces -o wide 
NAMESPACE     NAME                                            READY   STATUS    RESTARTS         AGE     IP               NODE     NOMINATED NODE   READINESS GATES
......
kube-system   pod/dashboard-metrics-scraper-8c47d4b5d-8qskj   1/1     Running   0                98s     10.244.1.14      node1    <none>           <none>
kube-system   pod/kubernetes-dashboard-598f8d6864-jrqpf       1/1     Running   0                98s     10.244.2.13      node2    <none>           <none>

NAMESPACE     NAME                                TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                  AGE     SELECTOR
......
kube-system   service/dashboard-metrics-scraper   ClusterIP   10.100.136.48   <none>        8000/TCP                 98s     k8s-app=dashboard-metrics-scraper
kube-system   service/kubernetes-dashboard        NodePort    10.103.26.227   <none>        443:31260/TCP            98s     k8s-app=kubernetes-dashboard

[root@master ~]# kubectl get deployment kubernetes-dashboard --namespace=kube-system
NAME                   READY   UP-TO-DATE   AVAILABLE   AGE
kubernetes-dashboard   1/1     1            1           5m43s

4. 创建 kubernetes-dashboard 管理员

dashboard-svc-adminuser.yaml内容：

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system

 [root@master ~]# kubectl create -f dashboard-svc-adminuser.yaml 
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user created

5. 获取Bearer Token

https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md

5.1 临时

[root@master ~]# kubectl -n kube-system create token admin-user
eyJhbGciOiJSUzI1NiIsImtpZCI6ImQ4UFVwX3RFRWdDd0premZjM3ZIclZRdllZVjc3WE9keFhqc3JJeDdabncifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxNjk3NTMwODE2LCJpYXQiOjE2OTc1MjcyMTYsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsInNlcnZpY2VhY2NvdW50Ijp7Im5hbWUiOiJhZG1pbi11c2VyIiwidWlkIjoiMjkzNmM1YTktOWQ0Yy00MzM1LWFjYTEtYTU4NDcwYjQ5NjVlIn19LCJuYmYiOjE2OTc1MjcyMTYsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTphZG1pbi11c2VyIn0.ZjSlzSOMBuk0QNBQds04LBcaxY86rzwJ3BJFL57vJcP8r3wpNPmhxALwqWO2pCZ_cMBTiJkugAh_YiShdRkcrOBrfHFlngD0IS7uz_LY4X8HiLoe6y1zqnwgBK3ffu5cQkLRNl7Ez-fZeAeeKEXIYZhmsMz9NzTSIW96-gdUadez8XtT1t8lx8w8z39sCik43hcorz-sSqnlkOI-1vhi6gjLHnLDTS1OjTAKi6fq5UTsyYfCsx6kcZUm_7PZOCqquapeG_ii_OU0jQ6RTufmWC_e9XZVgSK_5BjwlzUS8YQNqZEmb5TmtEMC4Or4lwiLQhyxhjoDBnWuJIrL8diS8A

5.2 长期

dashboard-svc-adminuser-longlived-token.yaml内容：

apiVersion: v1
kind: Secret
metadata:
  name: admin-user
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: "admin-user"   
type: kubernetes.io/service-account-token

[root@master ~]# kubectl apply -f dashboard-svc-adminuser-longlived-token.yaml 
secret/admin-user created

[root@master ~]# kubectl get secret --all-namespaces
NAMESPACE     NAME                              TYPE                                  DATA   AGE
kube-system   admin-user                        kubernetes.io/service-account-token   3      6s
kube-system   kubernetes-dashboard-certs        Opaque                                0      39m
kube-system   kubernetes-dashboard-csrf         Opaque                                1      39m
kube-system   kubernetes-dashboard-key-holder   Opaque                                2      39m

[root@master ~]# kubectl -n kube-system describe secret admin-user
Name:         admin-user
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: admin-user
              kubernetes.io/service-account.uid: 2936c5a9-9d4c-4335-aca1-a58470b4965e

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1099 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6ImQ4UFVwX3RFRWdDd0premZjM3ZIclZRdllZVjc3WE9keFhqc3JJeDdabncifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIyOTM2YzVhOS05ZDRjLTQzMzUtYWNhMS1hNTg0NzBiNDk2NWUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.bvZoPaRMtgoq3pH3xyAInWwiaAERTV1PNVm6Cu2bj7k603H3xBkAu-Edbq9nZVxIPviC04azrx8hJaDTfjKOsytVH-muMx8AMNzSizFS6TOM7EUxfwXaAEk0Da1-tyldABECLBDxLhUZtorvfPIP8VUG_UtvrXHmlUpBpHGLCzbQhHpFsOl3H7uH_bnDuWMP5wODM7lshf1rQrO8cugWVAdeJd15mcHeLz63edjvkES3JGIHQkQRGmX9kTfF_0H_Q6dfAIlAxXLRPZwKwXWF-Q7wvAE2szGQ5hiMBVFuA1ELDYVxD-PmDafyOUlJCi1dIowbwSFnn57YXd_eADi-Yw

6. 浏览器访问 https://[master-ip]:31260

输入上一步的token，即可登录