kubernets网站页面dashboard

最新推荐文章于 2022-10-02 11:47:54 发布

慧日破重昏，芳心困落日

最新推荐文章于 2022-10-02 11:47:54 发布

阅读量2.1k

点赞数

分类专栏： Kubernetes

本文链接：https://blog.csdn.net/weixin_46355881/article/details/109015921

版权

Kubernetes 专栏收录该内容

5 篇文章 0 订阅

订阅专栏

dashboard 仪表盘
K8S Dashboard是官方的一个基于WEB的用户界面，专门用来管理K8S集群，并可展示集群的状态。K8S集群安装好后默认没有包含Dashboard，所以需要额外创建。

RBAC
K8S 1.6引进，是让用户能够访问 k8S API 资源的授权方式【不授权就没有资格访问K8S的资源】
用户
K8S有两种用户：User和Service Account。其中，User给人用，Service Account给进程用，让进程有相关权限。如Dashboard就是一个进程，我们就可以创建一个Service Account给它
角色
Role是一系列权限的集合，例如一个Role可包含读取和列出 Pod的权限【 ClusterRole 和 Role 类似，其权限范围是整个集群】
角色绑定
RoleBinding把角色映射到用户，从而让这些用户拥有该角色的权限【ClusterRoleBinding 和RoleBinding 类似，可让用户拥有 ClusterRole 的权限】
Secret
Secret是一个包含少量敏感信息如密码，令牌，或秘钥的对象。把这些信息保存在 Secret对象中，可以在这些信息被使用时加以控制，并可以降低信息泄露的风险

//网站页面
需要
dashboard-configmap.yaml 配置文件
dashboard-doployment.yaml 部署资源 dashboard安装依赖于doployment
dashboard-service.yaml 服务
dashboard-rbac.yaml 安全授权管理
dashboard-secret.yaml 安全证书验证
k8s-admin.yaml 管理证书

资源创建 create apply
资源重新部署，更新 apply
kubectl create -f //创建资源
-f：引用

在apply始终检测不到文件时，把文件delete掉，重新apply
//在master01上操作
//创建dashborad工作目录

[root@master ~]# cd k8s/
[root@master k8s]# mkdir dashboard
[root@master k8s]# cd dashboard/
[root@master dashboard]#

//拷贝官方的文件
https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard

[root@master dashboard]# ls
dashboard-configmap.yaml   dashboard-rbac.yaml    dashboard-service.yaml
dashboard-controller.yaml  dashboard-secret.yaml  k8s-admin.yaml

//创建资源

[root@master dashboard]# kubectl create -f dashboard-rbac.yaml 
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created

[root@master dashboard]# kubectl create -f dashboard-secret.yaml 
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created

[root@master dashboard]# kubectl create -f dashboard-configmap.yaml 
configmap/kubernetes-dashboard-settings created

[root@master dashboard]# kubectl create -f dashboard-controller.yaml 
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created

[root@master dashboard]# kubectl create -f dashboard-service.yaml 
service/kubernetes-dashboard created

//完成后查看创建在指定的kube-system命名空间下

[root@master dashboard]# kubectl get pods -n kube-system
NAME                                    READY   STATUS    RESTARTS   AGE
kubernetes-dashboard-65f974f565-7bjjq   1/1     Running   0          24s

//查看如何访问

[root@master dashboard]# kubectl get pods,svc -n kube-system
NAME                                        READY   STATUS    RESTARTS   AGE
pod/kubernetes-dashboard-65f974f565-7bjjq   1/1     Running   0          50s

NAME                           TYPE       CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE
service/kubernetes-dashboard   NodePort   10.0.0.224   <none>        443:30001/TCP   41s

[root@master dashboard]# kubectl get pods,svc -n kube-system -o wide
NAME                                        READY   STATUS    RESTARTS   AGE   IP            NODE            NOMINATED NODE
pod/kubernetes-dashboard-65f974f565-7bjjq   1/1     Running   0          82s   172.17.59.2   192.168.20.30   <none>

NAME                           TYPE       CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE   SELECTOR
service/kubernetes-dashboard   NodePort   10.0.0.224   <none>        443:30001/TCP   73s   k8s-app=kubernetes-dashboard

[root@node2 cfg]# docker ps -a
CONTAINER ID        IMAGE                                                                 COMMAND                  CREATED              STATUS                           PORTS               NAMES
6294ae449a5b        siriuszg/kubernetes-dashboard-amd64                                   "/dashboard --insecu…"   About a minute ago   Up About a minute                                    k8s_kubernetes-dashboard_kubernetes-dashboard-65f974f565-7bjjq_kube-system_8a4fb83f-0975-11eb-aede-000c29959657_0
170d1c0fb152        registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0   "/pause"                 2 minutes ago        Up 2 minutes                                         k8s_POD_kubernetes-dashboard-65f974f565-7bjjq_kube-system_8a4fb83f-0975-11eb-aede-000c29959657_0
36f7e070b4fd        centos:7                                                              "/bin/bash"              2 hours ago          Exited (130) About an hour ago                       frosty_bartik

//访问nodeIP就可以访问

https://192.168.20.30:30001/

这里使用谷歌浏览器，会出现如下情况，需要自行制作证书
在这里插入图片描述

[root@master dashboard]# vim dashboard-cert.sh
cat > dashboard-csr.json <<EOF
{
   "CN": "Dashboard",
   "hosts": [],
   "key": {
       "algo": "rsa",
       "size": 2048
   },
   "names": [
       {
           "C": "CN",
           "L": "BeiJing",
           "ST": "BeiJing"
       }
   ]
}
EOF

K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | c
fssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system

增加证书两行，然后apply

[root@localhost dashboard]# vim dashboard-controller.yaml
        args:
          # PLATFORM-SPECIFIC ARGS HERE
          - --auto-generate-certificates
          - --tls-key-file=dashboard-key.pem
          - --tls-cert-file=dashboard.pem

[root@master dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/
2020/10/08 22:57:18 [INFO] generate received request
2020/10/08 22:57:18 [INFO] received CSR
2020/10/08 22:57:18 [INFO] generating key: rsa-2048
2020/10/08 22:57:18 [INFO] encoded CSR
2020/10/08 22:57:18 [INFO] signed certificate with serial number 447633174051868055331633690754042067283491175690
2020/10/08 22:57:18 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
secret "kubernetes-dashboard-certs" deleted
secret/kubernetes-dashboard-certs created

//重新部署

[root@localhost dashboard]# kubectl apply -f dashboard-controller.yaml 
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
serviceaccount/kubernetes-dashboard configured
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
deployment.apps/kubernetes-dashboard configured

//生成令牌

[root@master dashboard]# kubectl create -f k8s-admin.yaml
serviceaccount/dashboard-admin created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
//保存
[root@master dashboard]# kubectl get secret -n kube-system 
NAME                               TYPE                                  DATA   AGE
dashboard-admin-token-fmksp        kubernetes.io/service-account-token   3      28s
default-token-8mhqw                kubernetes.io/service-account-token   3      89m
kubernetes-dashboard-certs         Opaque                                11     2m40s
kubernetes-dashboard-key-holder    Opaque                                2      10m
kubernetes-dashboard-token-clssw   kubernetes.io/service-account-token   3      9m58s

//查看令牌

[root@master dashboard]# kubectl describe secret dashboard-admin-token-fmksp -n kube-system
Name:         dashboard-admin-token-fmksp
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: de923e3d-0976-11eb-aede-000c29959657

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1359 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tZm1rc3AiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZGU5MjNlM2QtMDk3Ni0xMWViLWFlZGUtMDAwYzI5OTU5NjU3Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.Wi8CNzkhjUVjOxxnJhM-VwRaw9TycHQUYe4lxTqIw9aVWHjZOoQrtj2ERBTw_SFFVk94_Lsi3T8How3Yzh5xhvXdIQBNYdZnZMHNCEoR313T1fMVyQXVYzj0TJ_kw1pgepuTnYQnt2dVHfqaNJb7KRubTYmZ0UJFUYKANHrjwAGCI1qKQvtExCUfhv2InyGzvNxIvs120pzOAL2erwkb_DVsxJvw6a3exL5GTLyJtilapS0FnClbsgDyBmPZAnvIDpzbtE1cTSePjimUcQih4g3vgNv4oUhehBNW6IoNvjdnpL6Diq_2amnotM0nUrdRj6MEn6d5rA0-q4Cze_sokg

复制下令牌eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJu

刷新网页
在这里插入图片描述选择令牌，然后把令牌复制进去选择登录
使用火狐浏览器

慧日破重昏，芳心困落日

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
3
评论
kubernets网站页面dashboard

dashboard 仪表盘K8S Dashboard是官方的一个基于WEB的用户界面，专门用来管理K8S集群，并可展示集群的状态。K8S集群安装好后默认没有包含Dashboard，所以需要额外创建。RBACK8S 1.6引进，是让用户能够访问 k8S API 资源的授权方式【不授权就没有资格访问K8S的资源】用户K8S有两种用户：User和Service Account。其中，User给人用，Service Account给进程用，让进程有相关权限。如Dashboard就是一个进程，我们就可以创建
复制链接

扫一扫