下载安装dashboard

1. kubernetes-dashboard简介

2. kubernetes-dashboard安装

1、下载kubernetes-dashboard安装文件并应用YAML资源定义

[root@node-1 ~]# kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta8/aio/deploy/recommended.yaml

[root@dock01 ~]# kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta8/aio/deploy/recommended.yaml
namespace/kubernetes-dashboard unchanged
serviceaccount/kubernetes-dashboard unchanged
service/kubernetes-dashboard unchanged
secret/kubernetes-dashboard-certs unchanged
secret/kubernetes-dashboard-csrf configured
secret/kubernetes-dashboard-key-holder unchanged
configmap/kubernetes-dashboard-settings unchanged
role.rbac.authorization.k8s.io/kubernetes-dashboard unchanged
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard unchanged
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard unchanged
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard unchanged
deployment.apps/kubernetes-dashboard configured
service/dashboard-metrics-scraper unchanged
deployment.apps/dashboard-metrics-scraper configured

[root@dock01 ~]# kubectl  get deployments -n kubernetes-dashboard
NAME                        READY   UP-TO-DATE   AVAILABLE   AGE
dashboard-metrics-scraper   1/1     1            1           35m
kubernetes-dashboard        1/1     1            1           35m

[root@dock01 ~]# kubectl get services -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP        EXTERNAL-IP   PORT(S)    AGE
dashboard-metrics-scraper   ClusterIP   192.168.137.136   <none>        8000/TCP   35m
kubernetes-dashboard        ClusterIP   192.168.137.185   <none>        443/TCP    24m

[root@dock01 ~]# kubectl get pods  -n kubernetes-dashboard
NAME                                         READY   STATUS              RESTARTS   AGE
dashboard-metrics-scraper-7445d59dfd-p6qr4   1/1     Running             0          2m4s
kubernetes-dashboard-7448ffc97b-qvjqt        1/1     Running             0          11m
kubernetes-dashboard-7d8466d688-455dl        0/1     ContainerCreating   0          2m4s

[root@dock01 ~]# kubectl get secrets  -n kubernetes-dashboard
NAME                               TYPE                                  DATA   AGE
default-token-k8fd6                kubernetes.io/service-account-token   3      37m
kubernetes-dashboard-certs         Opaque                                0      37m
kubernetes-dashboard-csrf          Opaque                                1      37m
kubernetes-dashboard-key-holder    Opaque                                2      37m
kubernetes-dashboard-token-kwdrw   kubernetes.io/service-account-token   3      37m

kubernetes-dashbaord安装完毕后，kubernetes-dashboard默认service的类型为ClusterIP，为了从外部访问控制面板，开放为NodePort类型

[root@dock01 ~]# kubectl get services -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP        EXTERNAL-IP   PORT(S)    AGE
dashboard-metrics-scraper   ClusterIP   192.168.137.136   <none>        8000/TCP   38m
kubernetes-dashboard        ClusterIP   192.168.137.185   <none> 

kubectl edit  services -n kubernetes-dashboard

此时通过https协议访问30433端口即可打开dashboard的控制台，为了保护数据安全性，集群默认开启了RBAC认证授权，需要授予权限的用户才可以访问到kubernetes集群，因此需要授权用户访问集群，集群中已定有了cluster-admin的角色和相关的Role，ClusterRole和ClusterRoleBinding角色，定义ServiceAccount将其关联即可，如下:

[root@node-1 ~]# cat dashboard-rbac.yaml 
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: happycloudlab 
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: happycloudlab
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: happycloudlab
  namespace: kubernetes-dashboard
  
  5、应用RBAC规则，创建一个happycloudlab的用户，并和cluster-admin的角色关联

[root@node-1 ~]# kubectl apply -f dashboard-rbac.yaml

6、此时通过kubernetes-dashboard-csrf服务会自动创建一个和用户名关联的Secrets，通过token字段来登陆，token通过base64加密，解密后即可登录，如下演示登录的过程

 kubectl proxy --address='0.0.0.0' --accept-hosts='^\*$'

http://192.168.137.200:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/, 

kubectl port-forward --namespace kubernetes-dashboard service/kubernetes-dashboard 10443:443 --address 0.0.0.0

token:      eyJhbGciOiJSUzI1NiIsImtpZCI6Il9MRHhhcDFIYXFOa2lQT1BmMlpETllVa0J6QVg1QWI1dUhRQjRVYnNDeFUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC10b2tlbi1rd2RydyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjBmY2YxOTA1LTNjN2EtNGQzNi05YjQ1LWZiYjQ4OTkxMGZiNSIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDprdWJlcm5ldGVzLWRhc2hib2FyZCJ9.D8slUA3tqJ2pR5NBEuA-gm8YmGsL78mqhcIwLrVfpHPNchiBdJDI0wY1bf_avkKk4yzJY11xywujhtX5Wsbsu8Fx_vfFt6NtCUwhvevEJFNMaePj8T4ISZBKviszLcUg4cWBmtgAz40wpHqIngQvf_22dXvXvxZiyqHUPREZKdnqO7u6aQMGtl13sLa-JJqYkdCd-YOlmbFtFO8EtooMSPaRDZkO0dKDn6yEluBD8jgcRxP4bpUAODMggarfXxz5IFOgDBEEXC3Ls3dxECRAOP9rzaK5sqYivvoObn90FLnjQigZANwSl1bktKSoc7WU9-F29dTSzTpnbS3q6rD4Gw
[root@dock01 ~]# kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')

获取token：

[root@dock01 ~]# kubectl get secret -n kube-system |grep admin|awk '{print $1}'
dashboard-admin-token-x57sr
 
 
# 复制下面的 token,后面登陆的时候要用到
kubectl describe secret dashboard-admin-token-x57sr -n kube-system|grep '^token'|awk '{print $2}'

eyJhbGciOiJSUzI1NiIsImtpZCI6IkJOVUhyRElPQzJzU2t6VDNVdWpTdzhNZmZPZjV0U2s1UXBFTzctNE9uOFEifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tYndnanYiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiOTE5NGY5YWYtZDZlNC00ZDFmLTg4OWEtMDY4ODIyMDFlOGNmIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.kEK3XvUXJGzQlBI4LIOp-puYzBBhhXSkD20vFp9ET-rGErxmMHjUuCqWxg0iawbuOndMARrpeGJKNTlD2vL81bXMaPpKb4Y2qoB6bH5ETQPUU0HPpWYmfoHl4krEXy7S95h0mWehiHLcFkrUhyKGa39cEBq0B0HRo49tjM5QzkE6PNJ5nmEYHIJMb4U62E8wKeqY9vt60AlRa_Re7IDAO9qfb5_dGEmUaIdr3tu22sa3POBsm2bhr-R3aC8vQzNuafM35s3ed8KofOTQFk8fXu4p7lquJnji4yfC77yS3yo5Jo3VPyHi3p5np_9AuSNYfI8fo1EpSeMsXOBH45hu2w