【k8s】集群15-Dashboard

最新推荐文章于 2023-12-25 21:53:17 发布

机智的埃努

最新推荐文章于 2023-12-25 21:53:17 发布

阅读量256

点赞数

分类专栏： k8s 容器虚拟化文章标签： k8s

本文链接：https://blog.csdn.net/yq90125/article/details/119933630

版权

k8s 同时被 3 个专栏收录

17 篇文章 1 订阅

订阅专栏

虚拟化

15 篇文章 0 订阅

订阅专栏

容器

14 篇文章 0 订阅

订阅专栏

1 准备工作

1.1 拉取镜像

准备4个镜像
参考https://www.cnblogs.com/ling-yu-amen/p/10955094.html

docker pull kubernetesui/dashboard:v2.0.0-beta7

对象:h136

docker tag kubernetesui/dashboard:v2.0.0-beta7 harbor.od.com/public/k8s-dashboard:v2.0.0-beta7
docker push harbor.od.com/public/k8s-dashboard:v2.0.0-beta7

1.2 添加A记录

对象:h132
vim /var/named/od.com.zone添加如下一条，并重启named服务

dashboard IN       A    192.168.146.130

2 资源配置清单

基础的清单模板在github的kubernetes/kubernetes下cluster->addons->dashboard下
对象：h136的 /data/k8s-yaml/dashboard下创建

2.1 rbac.yaml

---

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kubernetes-dashboard
#N1
    addonmanager.kubernetes.io/mode: Reconcile
  name: kubernetes-dashboard
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: cluster-admin
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
- nonResourceURLs:
  - '*'
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
#N4
#  namespace: kube-system
  labels:
          k8s-app: kubernetes-dashboard
          addonmanager.kubernetes.io/mode: Reconcile
  name: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
###    name: kubernetes-dashboard
    name: kubernetes-dashboard
    namespace: kube-system

2.2 dp.yaml

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
#N2
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
  name: kubernetes-dashboard
  namespace: kube-system
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
#N2
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
#N1
      priorityClassName: system-cluster-critical
      containers:
        - name: kubernetes-dashboard
          image: harbor.od.com/public/k8s-dashboard:v2.0.0-beta7
          imagePullPolicy: Always
          ports:
            - containerPort: 8443
              protocol: TCP
          args:
            - --auto-generate-certificates
#modify
#            - --namespace=kubernetes-dashboard
            - --namespace=kube-system
            # Uncomment the following line to manually specify Kubernetes API server Host
            # If not specified, Dashboard will attempt to auto discover the API server and connect
            # to it. Uncomment only if the default does not work.
            # - --apiserver-host=http://my-address:port
          volumeMounts:
            - name: kubernetes-dashboard-certs
              mountPath: /certs
              # Create on-disk volume to store exec logs
            - mountPath: /tmp
              name: tmp-volume
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /
              port: 8443
            initialDelaySeconds: 30
            timeoutSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      volumes:
        - name: kubernetes-dashboard-certs
          secret:
            secretName: kubernetes-dashboard-certs
        - name: tmp-volume
          emptyDir: {}
      serviceAccountName: kubernetes-dashboard
      nodeSelector:
        "beta.kubernetes.io/os": linux
      # Comment the following tolerations if Dashboard must not be deployed on master
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
      imagePullSecrets:
      - name: regcred-kube-system

2.3 svc.yaml

---
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
#N2
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
  name: kubernetes-dashboard
  namespace: kube-system
spec:
  type: NodePort
  ports:
    - port: 443
      targetPort: 8443
      nodePort: 18443
  selector:
    k8s-app: kubernetes-dashboard

2.4 configmap.yaml

---

kind: ConfigMap
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
#N1
    addonmanager.kubernetes.io/mode: EnsureExists
  name: kubernetes-dashboard-settings
  namespace: kube-system

2.5 secret.yaml

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
#N1
    addonmanager.kubernetes.io/mode: EnsureExists
  name: kubernetes-dashboard-certs
  namespace: kube-system
type: Opaque

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
#N1
    addonmanager.kubernetes.io/mode: EnsureExists
  name: kubernetes-dashboard-csrf
  namespace: kube-system
type: Opaque
data:
  csrf: ""
---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
#N1
    addonmanager.kubernetes.io/mode: EnsureExists
  name: kubernetes-dashboard-key-holder
  namespace: kube-system
type: Opaque

2.8 scraper.yaml

---

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: dashboard-metrics-scraper
  name: dashboard-metrics-scraper
  namespace: kube-system
spec:
  ports:
    - port: 8000
      targetPort: 8000
  selector:
    k8s-app: dashboard-metrics-scraper

---

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: dashboard-metrics-scraper
  name: dashboard-metrics-scraper
  namespace: kube-system
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: dashboard-metrics-scraper
  template:
    metadata:
      labels:
        k8s-app: dashboard-metrics-scraper
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
    spec:
      containers:
        - name: dashboard-metrics-scraper
          image: harbor.od.com/public/scraper:v1.0.1 
          ports:
            - containerPort: 8000
              protocol: TCP
          livenessProbe:
            httpGet:
              scheme: HTTP
              path: /
              port: 8000
            initialDelaySeconds: 30
            timeoutSeconds: 30
          volumeMounts:
          - mountPath: /tmp
            name: tmp-volume
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      serviceAccountName: kubernetes-dashboard
      nodeSelector:
        "beta.kubernetes.io/os": linux
      # Comment the following tolerations if Dashboard must not be deployed on master
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
      volumes:
        - name: tmp-volume
          emptyDir: {}
      imagePullSecrets:
        - name: regcred-kube-system

2.7 ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
   name: kubernetes-dashboard
   namespace: kube-system
   annotations:
     kubernetes.io/ingress.class: traefik
spec:
   rules:
   - host: dashboard.od.com
     http:
       paths:
       - backend:
            serviceName: kubernetes-dashboard
            servicePort: 443

2.5 应用配置清单

对象:h134或h135
对上面的每个yaml文件进行kubectl apply，过程省略

3 验证

在客户机（自己的电脑）win10系统的hosts里添加
192.168.146.130 dashboard.od.com
用token登录无法进入页面，这里由于svc里用的是NodePort方式暴露，我用实际ip+端口访问
先用kubectl describe secret -n kube-system 查看dashboard的token，再用token登入https://192.168.146.135:18443

在这里插入图片描述

4创建证书

由于无法在http的方式下用token登录dashboard，为了用https登录dashboard也为了让traefik的域名方式登录生效，这里生成证书。
以下展示2中方式生成证书
对象:h136 /opt/certs/

4.1 openssl

4.1.1 生成私钥

[root@h136 certs]# (umask 077;openssl genrsa -out dashboard.od.com.key 2048)
Generating RSA private key, 2048 bit long modulus
..................+++
................+++
e is 65537 (0x10001)

会生成私钥文件dashboard.od.com.key

4.1.2 创建证书签发的请求文件

[root@h136 certs]#  openssl req -new -key dashboard.od.com.key -out dashboard.od.com.csr -subj "/CN=dashboard.od.com/C=CN/ST=BJ/L=Beijing/O=od/OU=ops"

会生成证书请求文件dashboard.od.com.csr

4.1.3 用opessl的x509签发证书

[root@h136 certs]# openssl x509 -req -in dashboard.od.com.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out dashboard.od.com.crt -days 3650
Signature ok
subject=/CN=dashboard.od.com/C=CN/ST=BJ/L=Beijing/O=od/OU=ops
Getting CA Private Key

会生成dashboard.od.com.crt文件

4.2 cfssl

4.2.1 创建请求文件dashboard.json

{
    "CN": "dashboard.od.com",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "beijing",
            "L": "beijing",
            "O": "od",
            "OU": "ops"
        }
    ]
}

4.2.2 生成秘钥及证书

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server dashboard.json | cfssl-json -bare dashboard

生成dashboard.pem和dashboard-key.pem

5 证书应用到nginx

对象:h132,h133的nginx
以openssl生成的证书为例

mkdir /etc/nginx/certs
cd /etc/nginx/certs
scp root@h136:/opt/certs/dashboard.od.com.{crt,key} .

创建配置文件vim /etc/nginx/conf.d/dashboard.conf

server {
        listen 80;
        server_name dashboard.od.com;
        rewrite ^(.*)$ https://${server_name}$1 permanent;
}
server {
        listen 443 ssl;
        server_name dashboard.od.com;
        ssl_certificate "certs/dashboard.od.com.crt";
        ssl_certificate_key "certs/dashboard.od.com.key";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout 10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        location / {
                proxy_pass http://default_backend_traefik;
                proxy_set_header Host $http_host;
                proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
        }
}

5 坑

登录后有显示未授权之类的提示，请检查rbac部分的授权，ClusterRoleBinding用cluster-admin这个默认自带的ClusterRole可以授权所有资源，如果误删了cluster-admin，可以重建一下。

机智的埃努

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
【k8s】集群15-Dashboard

1 准备工作1.1 拉取镜像对象:h136docker pull k8scn/kubernetes-dashboard-amd64:v1.8.3docker tag k8scn/kubernetes-dashboard-amd64:v1.8.3 harbor.od.com/public/dashboard:v1.8.3docker push harbor.od.com/public/dashboard:v1.8.32 资源配置清单基础的清单模板在github的kubernetes/kuber
复制链接

扫一扫