14.kubernetes部署Dashboard

Dashboard 是基于网页的 Kubernetes 用户界面。 你可以使用 Dashboard 将容器应用部署到 Kubernetes 集群中，也可以对容器应用排错，还能管理集群资源。 你可以使用 Dashboard 获取运行在集群中的应用的概览信息，也可以创建或者修改 Kubernetes 资源 （如 Deployment，Job，DaemonSet 等等）。 例如，你可以对 Deployment 实现弹性伸缩、发起滚动升级、重启 Pod 或者使用向导创建新的应用。

Dashboard 同时展示了 Kubernetes 集群中的资源状态信息和所有报错信息。

1、部署 Dashboard

ansible_k8s]# ansible-playbook -i example/hosts.multi-node  13.dashboard.yml 

PLAY [kube_client] ********************************************************************************************************

TASK [dashboard : Prepare k8s install dirs] *******************************************************************************
ok: [localhost]

TASK [Create dashboard.yaml] **********************************************************************************************
changed: [localhost]

TASK [Create dashboard-admin.yaml] ****************************************************************************************
changed: [localhost]

TASK [Create dashboard-ingress.yaml] **************************************************************************************
changed: [localhost]

TASK [deploy dashboard] ***************************************************************************************************
ok: [localhost] => {
    "msg": "  kubectl apply -f /root/ansible_k8s/example/yaml/dashboard.yaml  "
}

TASK [create dashboard admin serviceAccount] ******************************************************************************
ok: [localhost] => {
    "msg": "  kubectl apply -f /root/ansible_k8s/example/yaml/dashboard-admin.yaml  "
}

TASK [create dashboard-ingress] *******************************************************************************************
ok: [localhost] => {
    "msg": "  kubectl apply -f /root/ansible_k8s/example/yaml/dashboard-ingress.yaml  "
}

PLAY RECAP ****************************************************************************************************************
localhost                  : ok=7    changed=3    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   


[root@docker ansible_k8s]# kubectl apply -f /root/ansible_k8s/example/yaml/dashboard.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created

# 创建 admin ServiceAccount
[root@docker ansible_k8s]# cat /root/ansible_k8s/example/yaml/dashboard-admin.yaml
# https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: kubernetes-dashboard

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin
  namespace: kubernetes-dashboard

[root@docker ansible_k8s]# kubectl apply -f /root/ansible_k8s/example/yaml/dashboard-admin.yaml 
serviceaccount/admin created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created

2、通过ingress暴露 Dashboard UI

[root@docker ansible_k8s]# cat /root/ansible_k8s/example/yaml/dashboard-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  # https://kubernetes.github.io/ingress-nginx/user-guide/basic-usage/
  ingressClassName: nginx
  rules:
  - host: das.example.io
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: kubernetes-dashboard
            port: 
              number: 443

[root@docker ansible_k8s]# kubectl apply -f /root/ansible_k8s/example/yaml/dashboard-ingress.yaml
ingress.networking.k8s.io/kubernetes-dashboard created

3、通过ServiceAccount token访问Dashboard UI

[root@docker ansible_k8s]# kubectl -n kubernetes-dashboard create token admin --duration=360000s -oyaml
apiVersion: authentication.k8s.io/v1
kind: TokenRequest
metadata:
  creationTimestamp: "2024-01-11T07:39:18Z"
  name: admin
  namespace: kubernetes-dashboard
spec:
  audiences:
  - https://kubernetes.default.svc.cluster.local
  boundObjectRef: null
  expirationSeconds: 360000
status:
  expirationTimestamp: "2024-01-15T11:39:18Z"
  token:  eyJhbGciOiJFUzUxMiIsImtpZCI6ImRxY3QyT0JqZENfVUhPamk1SW50aVAzdGpWYzlGNE1MMWU1NUxtSEsxVGcifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxNzA1MzE4NzU4LCJpYXQiOjE3MDQ5NTg3NTgsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsInNlcnZpY2VhY2NvdW50Ijp7Im5hbWUiOiJhZG1pbiIsInVpZCI6IjllZDA4Y2VkLTA0NTYtNGE1ZS05OGY5LWFhMmZkMjQ5YmU5NiJ9fSwibmJmIjoxNzA0OTU4NzU4LCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4ifQ.AGQe-qDcaqoSYkCraZPRUChBGQ1EFsU4lzBUMiOiSEkW4X5bRyOB0p8hwLikxLjwPG8dj7OVtO6YeEXLvLqRn7KTALe3E6ycXMt2DGZli1cc0jTbBB8SjthgiVXNyO5c86ofMu3fb-ZhVGuCTwl_guRt26FLZCQAqgbi_1PiY6YKou8S

访问 https://das.example.io/ 页面，使用上面的 ServiceAccount Token 进行访问

注意要配置本地hosts文件