kubernetes的可视化工具dashboard与harbor

一、kubernetes Dashboard

      在 Kubernetes 社区中，有一个很受欢迎的 Dashboard 项目，它可以给用户提供一个可视化的 Web 界面来查看当前集群的各种信息。用户可以用 Kubernetes Dashboard 部署容器化的应用、监控应用的状态、执行故障排查任务以及管理 Kubernetes 各种资源。

     kubernetes Dashboard 是 Kubernetes 的官方 Web UI。使用 Kubernetes Dashboard，您可以：

• 向 Kubernetes 集群部署容器化应用
• 诊断容器化应用的问题
• 管理集群的资源
• 查看集群上所运行的应用程序
• 创建、修改Kubernetes 上的资源（例如 Deployment、Job、DaemonSet等）
• 展示集群上发生的错误

二、部署dashboard

   1.下载镜像

          首先通过github搜索dashboard

     

 

   下载镜像：

docker pull kubernetesui/dashboard:v2.0.3
docker pull kubernetesui/metrics-scraper:v1.0.4
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.3/aio/deploy/recommended.yaml

   更改yaml文件：因为在k8s中只能内部访问，需要添加选项，达到外网访问：

    

kubectl apply -f recommended.yaml

 查看服务运行时间：

 查看pod

 

创建用户和绑定账户：

 kubectl create serviceaccount  dashboard-admin -n kube-system
kubectl create clusterrolebinding  dashboard-admin --clusterrole=cluster-admin  --serviceaccount=kube-system:dashboard-admin

 访问网页：

            https://192.174.1.3:30001/

  查看tocken值

kubectl describe secrets -n kube-system  dashboard-admin-token-5lnbr

登录验证结果：

 

三、harbor部署

      1.下载harbor

      https://github.com/goharbor/harbor/releases

tar zxf harbor-offline-installer-v1.10.3.tgz
cd harbor/
vim harbor.yml
./prepare
./install.sh

     

      添加配置docker.json

          

   为了方便不需要做https认证证书 于是把https注释掉，正常情况下需要开启https

     2.安装docker-compose

chmod +x /usr/local/bin/docker-compose
ln -s /usr/local/bin/docker-compose  /usr/bin/docker-compose

docker-compose up -d

 

        

   3.创建项目

     

 4.创建用户

       

5.添加成员

          

6.验证：

docker login 192.174.1.37:8888
username： test
password： Test123456

docker tag mysql:5.7 192.174.1.37:8888/mytest/mysql:5.7  （打标签时候需要把项目名称打上）
docker push 192.174.1.37:8888/mytest/mysql

    注释：

             

 

四、部署harbor的https规则

      1.删除缓存

  将harbor部署机自身的/etc/docker/daemon.json文件里添加"insecure-registries"配置删除
[root@harbor-node ~]# vim /etc/docker/daemon.json
{
  "registry-mirrors": ["https://v5d7kh0f.mirror.aliyuncs.com"]
}

rm -rf /root/.docker

重启docker服务
systemctl restart docker

       2.重启docker和docker-cmpose

docker-compose down -t
docker-compose up -d

      3.创建CA

[root@localhost harbor]# mkdir ssl
[root@localhost harbor]# cd ssl/
[root@localhost ssl]# openssl req  -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 365 -out ca.crt
Generating a 4096 bit RSA private key
.........................................++
.................................................................++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:devOps    
Organizational Unit Name (eg, section) []:Tec
Common Name (eg, your name or your server's hostname) []:192.174.1.37
Email Address []:wangjianye@163.com

      4.创建证书请求文件csr

[root@localhost ssl]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout 192.174.1.37.key -out 192.174.1.37.csr
Generating a 4096 bit RSA private key
....................................................................................................................................................................................................................................++
.......................++
writing new private key to '192.174.1.37.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:DevOps
Organizational Unit Name (eg, section) []:Tec  
Common Name (eg, your name or your server's hostname) []:192.174.1.37
Email Address []:wangjianye@163.com            

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:DevOps

        5.创建证书

[root@localhost ssl]# echo subjectAltName = IP:192.174.1.37 > extfile.cnf

[root@localhost ssl]# openssl x509 -req -days 365 -in 192.174.1.37.csr  -CA ca.crt  -CAkey ca.key  -CAcreateserial -extfile extfile.cnf -out 192.174.1.37.crt
Signature ok
subject=/C=CN/ST=beijing/L=beijing/O=DevOps/OU=Tec/CN=192.174.1.37/emailAddress=wangjianye@163.com
Getting CA Private Key

       6.设定证书&& 修改

           查看证书所在路径, 后面将harbor.yaml文件中的路径也同样设定

           

      7.修改harbor.yal文件

[root@localhost harbor]# vim harbor.yml

           

./prepare

         

     8.重启docker-compose

docker-compose up -d

     

    验证：

     9.部署harbor本机login登录

            直接登录会发生报错：

    解决办法：

[root@localhost harbor]# chmod 644 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
[root@localhost harbor]# cat /root/harbor/ssl/192.174.1.37.crt >> /etc/pki/tls/certs/ca-bundle.crt
[root@localhost harbor]# chmod 444 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem4

由于证书是docker的daemon需要用到的，所以需要重启docker服务，进而也要重启docker-compose
[root@harbor-node harbor]# systemctl restart docker
[root@localhost harbor]# systemctl restart docker
[root@localhost harbor]# docker-compose down -v
[root@localhost harbor]# docker-compose up -d

然后再次尝试在harbor本机登陆, 发现就可以正常登陆了！！

    登陆的权限信息保存到/root/.docker/config.json 文件里了，只要这个文件不删除，下次就可以不需要输入用户名和密码直接登陆了！

    

   10.部署远程客户机上(这里客户机为192.174.1.3)测试harbor登陆

          ①、首先很重要的一步,这一步极其关键！一定不要忘记操作！！

    就是需要将harbor服务端生成的CA证书拷贝到每个远程客户机的"/etc/docker/certs.d/harbor服务器的域名或ip/" 目录下

[root@k8s-master ~]# mkdir -p  /etc/docker/certs.d/192.174.1.37
[root@k8s-master ~]# cd /etc/docker/certs.d/192.174.1.37/

      ②、接着在harbor服务器将CA证书拷贝过来

[root@localhost ssl]#  rsync -e "ssh -p22" -avpgolr ./* root@192.174.1.3:/etc/docker/certs.d/192.174.1.37

         

     ③、 进行同样的授权操作：

[root@k8s-master 192.174.1.37]# chmod 644 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
[root@k8s-master 192.174.1.37]# cat /etc/docker/certs.d/192.174.1.37/192.174.1.37.crt >> /etc/pki/tls/certs/ca-bundle.crt
[root@k8s-master 192.174.1.37]# chmod 444 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem 

重启docker服务
[root@k8s-master 192.174.1.37]# systemctl restart docker

     ④、登录

[root@k8s-master 192.174.1.37]# docker login -u test -p Test123456 192.174.1.37:443

   

      

   上面是使用443端口登陆harbor仓库是正常的，如果此时使用80端口登陆，则出现如下报错：