部署dashboard

1.部署dashboard

mkdir -p /home/yaml/dashboard && cd /home/yaml/dashboard
wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.2.0/aio/deploy/recommended.yaml

#默认Dashboard只能集群内部访问，修改Service为NodePort类型，暴露到外部：
vi recommended.yaml
...
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 443
      targetPort: 8443
      nodePort: 30001
  type: NodePort
  selector:
    k8s-app: kubernetes-dashboard
 
 #启动
kubectl apply -f recommended.yaml

2.chrome 可以访问

vi recommended.yaml
...
#在 args 下面增加证书两行
args:
       # PLATFORM-SPECIFIC ARGS HERE
       - --auto-generate-certificates
       - --tls-key-file=server-key.pem
       - --tls-cert-file=server.pem
...

#删除默认的 secret
kubectl delete secret kubernetes-dashboard-certs -n kubernetes-dashboard
#查看secret
kubectl get secrets -n kubernetes-dashboard
NAME                               TYPE                                  DATA   AGE
default-token-krq7c                kubernetes.io/service-account-token   3      17m
kubernetes-dashboard-certs         Opaque                                0      16m #这里一定要是0或者没有这个，因为我们删除了证书
kubernetes-dashboard-csrf          Opaque                                1      17m
kubernetes-dashboard-key-holder    Opaque                                2      17m
kubernetes-dashboard-token-sbgrp   kubernetes.io/service-account-token   3      17m

# 用自签证书创建新的 secret
kubectl create secret generic kubernetes-dashboard-certs \
--from-file=/opt/kubernetes/ssl/server-key.pem --from-file=/opt/kubernetes/ssl/server.pem -n kubernetes-dashboard

#再次查看secret
kubectl get secrets -n kubernetes-dashboard
NAME                               TYPE                                  DATA   AGE
default-token-krq7c                kubernetes.io/service-account-token   3      17m
kubernetes-dashboard-certs         Opaque                                2      16m #这里2个就说明已经使用了我们的证书
kubernetes-dashboard-csrf          Opaque                                1      17m
kubernetes-dashboard-key-holder    Opaque                                2      17m
kubernetes-dashboard-token-sbgrp   kubernetes.io/service-account-token   3      17m

#重启 kubernetes-dashboard 应用加载
kubectl get pod -n kubernetes-dashboard
NAME                                         READY   STATUS    RESTARTS   AGE
dashboard-metrics-scraper-694557449d-9tcnh   1/1     Running   0          69s
kubernetes-dashboard-9774cc786-xj7wl         1/1     Running   0          29s #重启这个就好

#删除pod，它会自动重启
kubectl delete po kubernetes-dashboard-9774cc786-xj7wl  -n kubernetes-dashboard

3.创建管理角色

#创建service account并绑定默认cluster-admin管理员集群角色：
kubectl create serviceaccount dashboard-admin -n kube-system
kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
kubectl describe secrets -n kube-system $(kubectl -n kube-system get secret | awk '/dashboard-admin/{print $1}')

4.安装监控插件 metrics-server

#github地址:https://github.com/kubernetes-sigs/metrics-server
mkdir -p /home/yaml/metrics
cd /home/yaml/metrics
wget https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
#修改yaml文件
spec:
hostNetwork: true
containers:
- args:
  - --cert-dir=/tmp
  - --secure-port=4443
  #添加上这一行，不然启动不成功
  - --kubelet-insecure-tls
  - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
  - --kubelet-use-node-status-port
  #docker.hub 上查找，官方的下载不下来
  image: bitnami/metrics-server:0.4.4
  imagePullPolicy: IfNotPresent

#启动
kubectl apply -f components.yaml
kubectl  get pod -n kube-system | grep metrics-server
metrics-server-6d59d8cdd6-hmjw7   1/1     Running   0          21m

5.dashboard 500错误

如果dashboard 显示 500 的错误，
日志提示有 http: TLS handshake error from 10.244.159.128:35885: remote error: tls: unknown certificate
#解决方法
在master 节点上执行 
kubectl proxy 
Starting to serve on 127.0.0.1:8001

再次访问就没有问题了