k8s 部署dashboard
1. 当前环境
kubernetes v1.17
dashboard v2.0.0-rc5
2. 部署dashboard
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc5/aio/deploy/recommended.yaml
修改service的为NodePort:30443,以便外网可以访问,以https访问网站时出现证书无效的错误。
3. 自签证书
- 创建自签名CA
openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj "/C=CN/ST=CD/L=GX/O=WHYFATE/OU=WH/CN=CA"
- 签发dashboard证书
openssl genrsa -out dashboard.key 2048
openssl req -new -sha256 -key dashboard.key -out dashboard.csr -subj "/C=CN/ST=CD/L=GX/O=WHYFATE/OU=WH/CN=192.168.0.200"
// ---配置dashboard.cnf ---
// vim dashboard.cnf
extensions = san
[san]
keyUsage = digitalSignature
extendedKeyUsage = clientAuth,serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
subjectAltName = IP:192.168.0.200,IP:127.0.0.1,DNS:192.168.0.200,DNS:localhost
// --- 签发证书 ---
openssl x509 -req -sha256 -days 3650 -in dashboard.csr -out dashboard.crt -CA ca.crt -CAkey ca.key -CAcreateserial -extfile dashboard.cnf
4. 更新部署dashboard
- 删除 kubernetes-dashboard-certs
kubectl delete secret kubernetes-dashboard-certs -n kubernetes-dashboard
- 根据文件生成secret
kubectl create secret generic kubernetes-dashboard-certs --from-file="tls/dashboard.crt,tls/dashboard.key" -n kubernetes-dashboard
- 删除 dashboard pod 更新部署
kubectl delete -n kubernetes-dashboard pod $(kubectl get pod -A | awk '/kubernetes-dashboard-/ { print $2 }')
5. 导入CA
拷贝dashboard.crt文件到要访问的机器上,导入证书。
mac os 打开 钥匙串访问,把ca文件拖进去,信任 选择 始终信任,访问网站,出现192.168.0.200的登录证书,信任 选择 始终信任即可。
6. 创建ServiceAccount以便登录dashboard
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kubernetes-dashboard
- 得到token
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
拷贝token,登录选择token即可。