17. dashboard
17. dashboard
dashboard的安装步骤：
-
wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta1/aio/deploy/recommended.yaml
-
修改成可以外网访问：
[root@k8s-master ~]# kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kubernetes-dashboard
或者直接修改yaml资源文件，找到Service配置部分,修改service的type
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
type: NodePort #在这个位子添加这一行
ports:
- port: 443
targetPort: 8443
selector:
k8s-app: kubernetes-dashboard
-
kubectl apply -f recommended.yaml
-
创建登录dashboard的serviceaccount
[root@k8s-master manifests]# cat dashboard-sa.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kubernetes-dashboard
[root@k8s-master manifests]# cat dashboard-clusterbinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kubernetes-dashboard
kubectl apply -f dashboard-sa.yaml
kubectl apply -f dashboard-clusterbinding.yaml
- 查看分配的dashboard service对外访问的端口号
[root@k8s-master manifests]# kubectl get svc -n kubernetes-dashboard
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
dashboard-metrics-scraper ClusterIP 10.107.174.193 <none> 8000/TCP 146m
kubernetes-dashboard NodePort 10.108.37.234 <none> 443:31077/TCP 146m
可以看到分配的端口是31077
-
通过火狐浏览器访问https://nodeip:31077
https://10.250.0.89:31077注意： 这里我测试是必须要用火狐浏览器，当我使用360以及谷歌浏览器的时候就会在后面的使用token登录时候点击Sign in一直没反应的情况，目前还没查出来原因。
-
使用token登录
找到secret中对应的admin-user，然后通过describe查看到对应的token值
[root@k8s-master manifests]# kubectl get secret -n kubernetes-dashboard
NAME TYPE DATA AGE
admin-user-token-pnszj kubernetes.io/service-account-token 3 136m
default-token-ddt24 kubernetes.io/service-account-token 3 154m
kubernetes-dashboard-certs Opaque 0 154m
kubernetes-dashboard-csrf Opaque 1 154m
kubernetes-dashboard-key-holder Opaque 2 154m
kubernetes-dashboard-token-lnm2h kubernetes.io/service-account-token 3 154m
[root@k8s-master manifests]# kubectl describe secret admin-user-token-pnszj -n kubernetes-dashboard
Name: admin-user-token-pnszj
Namespace: kubernetes-dashboard
Labels: <none>
Annotations: kubernetes.io/service-account.name: admin-user
kubernetes.io/service-account.uid: 7ea6f585-9a1b-11e9-bb28-000c299c8399
Type: kubernetes.io/service-account-token
Data
====
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLXBuc3pqIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI3ZWE2ZjU4NS05YTFiLTExZTktYmIyOC0wMDBjMjk5YzgzOTkiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.QynjhkMhknnqfblzgE71on6ojdZg7a66nCpoOPhHKVBQ6ySjt4BO_Iw_EbM4qPdygLsMsnpUwA3RjoK0a0qtSX-jZDPPQXv6A5rKl5NrawDjlcO2dIUxtSuy79pWqH16li0oHcgHm5ye0qNq6XbOYYx2C84N6Eq6uv-1MTgKgfMb1HJYE5xHURpbSg7luxRcl2VIGaPZCTpLVCTbQN6xVZRwPbCNEFT2ft-ESSJr8u4kOJTPzqIDseNThKYIitHhOKxTIhf1kuCp3kdOmOSg42dA-DjRWywTCqbSZdzCCS673pIPymiWKFL0AkMCNOnjd0ocZRMz52p_oUxF_N0JAg
ca.crt: 1025 bytes
namespace: 20 bytes
- 使用复制下来的token值登录dashboard
下面是通过proxy的方式配置外网访问dashboard,自己测试还有点问题，后续补充了
这里使用proxy方法：
[root@k8s-master ~]# kubectl proxy --address='0.0.0.0' --accept-hosts='^*$'
--address='0.0.0.0' 指定监听的地址
--accept-hosts='^*$' 设置可以访问的ip的权限 如果没有这个授权会报错forbiden
然后通过下面的url访问：
http://10.250.0.89:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/.
[root@k8s-master ~]# kubectl create serviceaccount dashboard-admin -n kubernetes-dashboard
[root@k8s-master ~]# kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tcGRwbWIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMDAyNDg2YzAtOTlkOS0xMWU5LWJiMjgtMDAwYzI5OWM4Mzk5Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.au7S7c3mvf4LCeyauCCYV3pXY2WUCjx719bJ7X9SvMzHZeuz1rALm-sZ-Ate5tXZ1hLOwgTCBj4fNlKCgWR7M9io7M1PCQCHzWfXKYmZ9KI4N0EzSffXonoV9VDvpn2I42YtwypepDVvitxP5q-hHWkj43kvt_ObWTDmJETl3gcBSV1kYNhpHkC4N2uLPD2UXzukPMOH-Z_fIvdUT7BuaxwqTEa_l5NJPlhNsnCpBqvijXUyzNFPx_jH7WOMTS6ohSu85lGi5OLQcXDfxZlr4_p_xCt7DaQ9Uh6zWDOZQMCujhpP7SPRE90IilJUGLrkuSWu0VJCQTWk-8Yiz77bvQ
kubectl -n kubenetes-dashboard describe secret $(kubectl -n kubenetes-dashboard get secret | grep admin-user | awk '{print $1}')
