一、kubernetes Dashboard
在 Kubernetes 社区中,有一个很受欢迎的 Dashboard 项目,它可以给用户提供一个可视化的 Web 界面来查看当前集群的各种信息。用户可以用 Kubernetes Dashboard 部署容器化的应用、监控应用的状态、执行故障排查任务以及管理 Kubernetes 各种资源。
kubernetes Dashboard 是 Kubernetes 的官方 Web UI。使用 Kubernetes Dashboard,您可以:
- 向 Kubernetes 集群部署容器化应用
- 诊断容器化应用的问题
- 管理集群的资源
- 查看集群上所运行的应用程序
- 创建、修改Kubernetes 上的资源(例如 Deployment、Job、DaemonSet等)
- 展示集群上发生的错误
二、部署dashboard
1.下载镜像
首先通过github搜索dashboard
下载镜像:
docker pull kubernetesui/dashboard:v2.0.3
docker pull kubernetesui/metrics-scraper:v1.0.4
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.3/aio/deploy/recommended.yaml
更改yaml文件:因为在k8s中只能内部访问,需要添加选项,达到外网访问:
kubectl apply -f recommended.yaml
查看服务运行时间:
查看pod
创建用户和绑定账户:
kubectl create serviceaccount dashboard-admin -n kube-system
kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
访问网页:
查看tocken值
kubectl describe secrets -n kube-system dashboard-admin-token-5lnbr
登录验证结果:
三、harbor部署
1.下载harbor
https://github.com/goharbor/harbor/releases
tar zxf harbor-offline-installer-v1.10.3.tgz
cd harbor/
vim harbor.yml
./prepare
./install.sh
添加配置docker.json
为了方便不需要做https认证证书 于是把https注释掉,正常情况下需要开启https
2.安装docker-compose
chmod +x /usr/local/bin/docker-compose
ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
docker-compose up -d
3.创建项目
4.创建用户
5.添加成员
6.验证:
docker login 192.174.1.37:8888
username: test
password: Test123456
docker tag mysql:5.7 192.174.1.37:8888/mytest/mysql:5.7 (打标签时候需要把项目名称打上)
docker push 192.174.1.37:8888/mytest/mysql
注释:
四、部署harbor的https规则
1.删除缓存
将harbor部署机自身的/etc/docker/daemon.json文件里添加"insecure-registries"配置删除
[root@harbor-node ~]# vim /etc/docker/daemon.json
{
"registry-mirrors": ["https://v5d7kh0f.mirror.aliyuncs.com"]
}
rm -rf /root/.docker
重启docker服务
systemctl restart docker
2.重启docker和docker-cmpose
docker-compose down -t
docker-compose up -d
3.创建CA
[root@localhost harbor]# mkdir ssl
[root@localhost harbor]# cd ssl/
[root@localhost ssl]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 365 -out ca.crt
Generating a 4096 bit RSA private key
.........................................++
.................................................................++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:devOps
Organizational Unit Name (eg, section) []:Tec
Common Name (eg, your name or your server's hostname) []:192.174.1.37
Email Address []:wangjianye@163.com
4.创建证书请求文件csr
[root@localhost ssl]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout 192.174.1.37.key -out 192.174.1.37.csr
Generating a 4096 bit RSA private key
....................................................................................................................................................................................................................................++
.......................++
writing new private key to '192.174.1.37.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:DevOps
Organizational Unit Name (eg, section) []:Tec
Common Name (eg, your name or your server's hostname) []:192.174.1.37
Email Address []:wangjianye@163.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:DevOps
5.创建证书
[root@localhost ssl]# echo subjectAltName = IP:192.174.1.37 > extfile.cnf
[root@localhost ssl]# openssl x509 -req -days 365 -in 192.174.1.37.csr -CA ca.crt -CAkey ca.key -CAcreateserial -extfile extfile.cnf -out 192.174.1.37.crt
Signature ok
subject=/C=CN/ST=beijing/L=beijing/O=DevOps/OU=Tec/CN=192.174.1.37/emailAddress=wangjianye@163.com
Getting CA Private Key
6.设定证书&& 修改
查看证书所在路径, 后面将harbor.yaml文件中的路径也同样设定
7.修改harbor.yal文件
[root@localhost harbor]# vim harbor.yml
./prepare
8.重启docker-compose
docker-compose up -d
验证:
9.部署harbor本机login登录
直接登录会发生报错:
解决办法:
[root@localhost harbor]# chmod 644 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
[root@localhost harbor]# cat /root/harbor/ssl/192.174.1.37.crt >> /etc/pki/tls/certs/ca-bundle.crt
[root@localhost harbor]# chmod 444 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem4
由于证书是docker的daemon需要用到的,所以需要重启docker服务,进而也要重启docker-compose
[root@harbor-node harbor]# systemctl restart docker
[root@localhost harbor]# systemctl restart docker
[root@localhost harbor]# docker-compose down -v
[root@localhost harbor]# docker-compose up -d
然后再次尝试在harbor本机登陆, 发现就可以正常登陆了!!
登陆的权限信息保存到
/root/
.docker
/config
.json 文件里了,只要这个文件不删除,下次就可以不需要输入用户名和密码直接登陆了!
10.部署远程客户机上(这里客户机为192.174.1.3)测试harbor登陆
①、首先很重要的一步,这一步极其关键!一定不要忘记操作!!
就是需要将harbor服务端生成的CA证书拷贝到每个远程客户机的
"/etc/docker/certs.d/harbor服务器的域名或ip/"
目录下
[root@k8s-master ~]# mkdir -p /etc/docker/certs.d/192.174.1.37
[root@k8s-master ~]# cd /etc/docker/certs.d/192.174.1.37/
②、接着在harbor服务器将CA证书拷贝过来
[root@localhost ssl]# rsync -e "ssh -p22" -avpgolr ./* root@192.174.1.3:/etc/docker/certs.d/192.174.1.37
③、 进行同样的授权操作:
[root@k8s-master 192.174.1.37]# chmod 644 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
[root@k8s-master 192.174.1.37]# cat /etc/docker/certs.d/192.174.1.37/192.174.1.37.crt >> /etc/pki/tls/certs/ca-bundle.crt
[root@k8s-master 192.174.1.37]# chmod 444 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
重启docker服务
[root@k8s-master 192.174.1.37]# systemctl restart docker
④、登录
[root@k8s-master 192.174.1.37]# docker login -u test -p Test123456 192.174.1.37:443
上面是使用443端口登陆harbor仓库是正常的,如果此时使用80端口登陆,则出现如下报错: