k8s登录_如何登录kubernetes仪表板？

Since version 1.7 Dashboard uses more secure setup. It means, that by

default it has minimal set of privileges and can only be accessed over

HTTPS. It is recommended to read 07000

guide before performing any further steps.

As of release 1.7 Dashboard supports user authentication based on:

07001 that can be used on Dashboard 07002.

07003 that can be used on Dashboard 07002.

— 07005

代币

这里Token可以是静态令牌,服务帐户令牌,Kubernetes Authenticating的OpenID Connect Token,但不是kubeadm Bootstrap Token.

使用kubectl,我们可以获得默认情况下在kubernetes中创建的服务帐户(例如部署控制器).

$kubectl -n kube-system get secret

# All secrets with type 'kubernetes.io/service-account-token' will allow to log in.

# Note that they have different privileges.

NAME TYPE DATA AGE

deployment-controller-token-frsqj kubernetes.io/service-account-token 3 22h

$kubectl -n kube-system describe secret deployment-controller-token-frsqj

Name: deployment-controller-token-frsqj

Namespace: kube-system

Labels:

Annotations: kubernetes.io/service-account.name=deployment-controller

kubernetes.io/service-account.uid=64735958-ae9f-11e7-90d5-02420ac00002

Type: kubernetes.io/service-account-token

Data

====

ca.crt: 1025 bytes

namespace: 11 bytes

token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkZXBsb3ltZW50LWNvbnRyb2xsZXItdG9rZW4tZnJzcWoiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVwbG95bWVudC1jb250cm9sbGVyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNjQ3MzU5NTgtYWU5Zi0xMWU3LTkwZDUtMDI0MjBhYzAwMDAyIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRlcGxveW1lbnQtY29udHJvbGxlciJ9.OqFc4CE1Kh6T3BTCR4XxDZR8gaF1MvH4M3ZHZeCGfO-sw-D0gp826vGPHr_0M66SkGaOmlsVHmP7zmTi-SJ3NCdVO5viHaVUwPJ62hx88_JPmSfD0KJJh6G5QokKfiO0WlGN7L1GgiZj18zgXVYaJShlBSz5qGRuGf0s1jy9KOBt9slAN5xQ9_b88amym2GIXoFyBsqymt5H-iMQaGP35tbRpewKKtly9LzIdrO23bDiZ1voc5QZeAZIWrizzjPY5HPM1qOqacaY9DcGc7akh98eBJG_4vZqH2gKy76fMf0yInFTeNKr45_6fWt8gRM77DQmPwb3hbrjWXe1VvXX_g

Kubeconfig

kubeconfig文件中的用户需要用户名和&密码或令牌,而admin.conf只有客户端证书.

$kubectl config set-credentials cluster-admin --token=bearer_token

替代方案(不建议用于生产)

以下是绕过身份验证的两种方法,但请谨慎使用.

使用HTTP部署仪表板

$kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/alternative/kubernetes-dashboard.yaml

授予Dashboard服务帐户管理员权限

$cat <

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: ClusterRoleBinding

metadata:

name: kubernetes-dashboard

labels:

k8s-app: kubernetes-dashboard

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

name: cluster-admin

subjects:

- kind: ServiceAccount

name: kubernetes-dashboard

namespace: kube-system

EOF

之后,您可以使用登录页面上的“跳过”选项来访问仪表板.