dashboard部署
1.下载dashboard资源请单
wget https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
vim kubernetes-dashboard.yaml
spec:
ports:
- port: 443
targetPort: 8443
nodePort: 31000 固定端口映射
selector:
k8s-app: kubernetes-dashboard
type: NodePort 指定NodePort类的service，把服务放出去
...
spec:
containers:
- name: kubernetes-dashboard
image: mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1 修改镜像地址
volumeMounts:
- name: kubernetes-dashboard-certs
mountPath: /certs
# Create on-disk volume to store exec logs
- mountPath: /tmp
name: tmp-volume
livenessProbe:
httpGet:
scheme: HTTPS
path: /
port: 8443
initialDelaySeconds: 30
timeoutSeconds: 30
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
删除 下面这一段secret
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-certs
namespace: kube-system
type: Opaque
---
cd /etc/kubernetes/pki/
(umask 077;openssl genrsa -out dashboard.key 2048) 私钥
openssl req -new -key dashboard.key -out dashboard.csr -subj "/O=mageedu/CN=dashboard" 证书签名请求
openssl x509 -req -in dashboard.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out dashboard.crt -days 365 签署完成证书
kubectl create secret generic kubernetes-dashboard-certs -n kube-system --from-file=dashboard.crt=./dashboard.crt --from-file=dashboard.key=./dashboard.key 创建secret 类型是generic 即签名证书
kubectl get secrets -n kube-system 查询创建是否成功
2.创建dashboard
kubectl apply –f kubernetes-dashboard.yaml
查看dashboard的POD是否正常启动，如果正常说明安装成功
kubectl get pods --namespace=kube-system
解决签名证书过期的问题参考: https://www.jianshu.com/p/c6d560d12d50
登录dashboard的方式
1.通过token登录
创建sa
kubectl create serviceaccount dashboard-admin -n kube-system
kubectl get sa -n kube-system 查询sa
kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin 给sa账号dashboard-admin添加集群角色 绑定名要与sa账号一致
结果: dashboard-admin-token-j6g69
kubectl describe secrets -n kube-system dashboard-admin-token-j6g69
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tajZnNjkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMGY5ZjE0MzEtZThhNC00MWE3LTg4MmUtNzExNDNiMzEwODJmIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.c2yulGwZU9AECgGBXmYACpB1Sg7IaZIjMFrOC2MYAPeAdDWPGRjhtTFL5vwheu1EUsuPTA__uxLwvQ4VDxWA64MjsZy_PT-86Oe4LuhGltZpHiqfuonqpRGqQLdlXut0AU1NULi4pZ7QJxVoS9hrN88Cwc40AxyyKjoqdudmRuQC1C6zp_fP-VPHKtVJg6JMgTaFBNoFDL40j9nNm9GDCDDVqdWapQxuaaPdz9Mm-Nm3cL8hz3oGV0FBrgoi5zvumMKZLsU70B5_zDW8ZeMRjf7Js5G4LSQ8C5bQ-bEs3ioCbV-2YtPMuFALJJHmmY_yzommDqJ3Jf3TUu3_n9R_ig
复制token，并粘帖到认证栏里即可
2.通过自建kubeconf文件登录
kubectl create serviceaccount def-ns-admin -n default 创建sa账号def-ns-admin
kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin 给sa账号绑定角色
kubectl describe secrets def-ns-admin-token-8flrw 获取token也能登录系统
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi04ZmxydyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI0MzdlNzcwOS1hYzdlLTRhMGEtYTU1OC0xZGNmOWVlOTg2ZjkiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.TdEtTTFydD5smIksOQ7Vqk9yUV9Gg7t6dTN8Ei1qDi4jYT2LcUBxK1u7KeDJKTHaMxg_Jce3zK9heQT9CaIvnKW-c9B99nd31MAcfeGdQ0zB4Mi5dVMMoVHF1N1S9jqurkjpg4rMnIMA3l-GitXvatouWH1J2mMUX5xOXbQHs-zUOhN_RqvLl1KNSWzQoK8EEWqw82Xuz33JwcbCJfwB5xXWXzz_2rHpkYqVCKAkoskEA8V3BX0DrdKa7XslgeXs6W55tEbTykmsRTCrq6o750dbyolYY5NHhV-QFIr0uNdXQHygG-Mh4MHV-wCXbI--ueSnmP7y9fgeouD_2xEa3g
Mh4MHV-wCXbI--ueSnmP7y9fgeouD_2xEa3g
DEF_NS_ADMIN_TOKEN=$(kubectl get secret def-ns-admin-token-8flrw -o jsonpath={.data.token} | base64 -d)
kubectl config set-cluster kubernetes --certificate-authority=/etc/kubernetes/pki/ca.crt --server="https://192.168.85.110:6443" --embed-certs=true --kubeconfig=/root/def-ns-admin.conf 创建集群，设置集群
kubectl config view --kubeconfig=/root/def-ns-admin.conf 查看创建的conf生效了没有
kubectl config set-credentials def-ns-admin --token=$DEF_NS_ADMIN_TOKEN --kubeconfig=/root/def-ns-admin.conf 设置登录集群账号，账号名要与sa账号一致
kubectl config set-context def-ns-admin@kubernetes --cluster=kubernetes --user=def-ns-admin --kubeconfig=/root/def-ns-admin.conf 设置context 账号的切换就是context的切换
kubectl config use-context def-ns-admin@kubernetes --kubeconfig=/root/def-ns-admin.conf 切换context
kubectl config view --kubeconfig=/root/def-ns-admin.conf 这个def-ns-admin.conf可以拿去当用户认证信息使用了
注释:认证时的账号必须为serviceaccount:被dashborad pod拿来由kubernetes进行认证
Token:1.创建serviceaccount，根据其管理目标，使用rolebinding或clusterrolebinding绑定至合理的role或clusterrole
2.获取用户的认证信息，既获取 serviceaccount账号的secret的详细的信息，其中就有token
Kubeconfig:1.把serviceaccount的token封装为kubeconfig
2. DEF_NS_ADMIN_TOKEN=$(kubectl get secret def-ns-admin-token-8flrw -o jsonpath={.data.token} | base64 -d)
3.生成kubeconfig文件
Kubectl config set-cluster
Kubectl config set-credentials
Kubectl config set-context
Kubectl config use-context
Kubernetes集群的管理方式: 1.命令式 kubectl get create run expose delete edit
2.命令式配置文件 kubectl create/delete –f filename
3.声明式配置文件 kubectl apply –f filename
