kubernets網站頁面dashboard
2020-10-12 11:00:04
dashboard 儀表盤
K8S Dashboard是官方的一個基於WEB的使用者介面，專門用來管理K8S叢集，並可展示叢集的狀態。K8S叢集安裝好後預設沒有包含Dashboard，所以需要額外建立。
RBAC
K8S 1.6引進，是讓使用者能夠存取 k8S API 資源的授權方式【不授權就沒有資格存取K8S的資源】
使用者
K8S有兩種使用者：User和Service Account。其中，User給人用，Service Account給程序用，讓程序有相關許可權。如Dashboard就是一個程序，我們就可以建立一個Service Account給它
角色
Role是一系列許可權的集合，例如一個Role可包含讀取和列出 Pod的許可權【 ClusterRole 和 Role 類似，其許可權範圍是整個叢集】
角色系結
RoleBinding把角色對映到使用者，從而讓這些使用者擁有該角色的許可權【ClusterRoleBinding 和RoleBinding 類似，可讓使用者擁有 ClusterRole 的許可權】
Secret
Secret是一個包含少量敏感資訊如密碼，令牌，或祕鑰的物件。把這些資訊儲存在 Secret物件中，可以在這些資訊被使用時加以控制，並可以降低資訊洩露的風險
//網站頁面
需要
dashboard-configmap.yaml 組態檔
dashboard-doployment.yaml 部署資源 dashboard安裝依賴於doployment
dashboard-service.yaml 服務
dashboard-rbac.yaml 安全 授權管理
dashboard-secret.yaml 安全 證書驗證
k8s-admin.yaml 管理證書
資源建立 create apply
資源重新部署，更新 apply
kubectl create -f //建立資源
-f：參照
在apply始終檢測不到檔案時，把檔案delete掉，重新apply
//在master01上操作
//建立dashborad工作目錄
[root@master ~]# cd k8s/
[root@master k8s]# mkdir dashboard
[root@master k8s]# cd dashboard/
[root@master dashboard]#
//拷貝官方的檔案
https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard
[root@master dashboard]# ls
dashboard-configmap.yaml dashboard-rbac.yaml dashboard-service.yaml
dashboard-controller.yaml dashboard-secret.yaml k8s-admin.yaml
//建立資源
[root@master dashboard]# kubectl create -f dashboard-rbac.yaml
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
[root@master dashboard]# kubectl create -f dashboard-secret.yaml
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created
[root@master dashboard]# kubectl create -f dashboard-configmap.yaml
configmap/kubernetes-dashboard-settings created
[root@master dashboard]# kubectl create -f dashboard-controller.yaml
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
[root@master dashboard]# kubectl create -f dashboard-service.yaml
service/kubernetes-dashboard created
//完成後檢視建立在指定的kube-system名稱空間下
[root@master dashboard]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
kubernetes-dashboard-65f974f565-7bjjq 1/1 Running 0 24s
//檢視如何存取
[root@master dashboard]# kubectl get pods,svc -n kube-system
NAME READY STATUS RESTARTS AGE
pod/kubernetes-dashboard-65f974f565-7bjjq 1/1 Running 0 50s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes-dashboard NodePort 10.0.0.224 <none> 443:30001/TCP 41s
[root@master dashboard]# kubectl get pods,svc -n kube-system -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod/kubernetes-dashboard-65f974f565-7bjjq 1/1 Running 0 82s 172.17.59.2 192.168.20.30 <none>
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service/kubernetes-dashboard NodePort 10.0.0.224 <none> 443:30001/TCP 73s k8s-app=kubernetes-dashboard
[root@node2 cfg]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
6294ae449a5b siriuszg/kubernetes-dashboard-amd64 "/dashboard --insecu…" About a minute ago Up About a minute k8s_kubernetes-dashboard_kubernetes-dashboard-65f974f565-7bjjq_kube-system_8a4fb83f-0975-11eb-aede-000c29959657_0
170d1c0fb152 registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0 "/pause" 2 minutes ago Up 2 minutes k8s_POD_kubernetes-dashboard-65f974f565-7bjjq_kube-system_8a4fb83f-0975-11eb-aede-000c29959657_0
36f7e070b4fd centos:7 "/bin/bash" 2 hours ago Exited (130) About an hour ago frosty_bartik
//存取nodeIP就可以存取
https://192.168.20.30:30001/
這裡使用谷歌瀏覽器，會出現如下情況，需要自行製作證書
[root@master dashboard]# vim dashboard-cert.sh
cat > dashboard-csr.json <<EOF
{
"CN": "Dashboard",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "BeiJing",
"ST": "BeiJing"
}
]
}
EOF
K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | c
fssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system
增加證書兩行，然後apply
[root@localhost dashboard]# vim dashboard-controller.yaml
args:
# PLATFORM-SPECIFIC ARGS HERE
- --auto-generate-certificates
- --tls-key-file=dashboard-key.pem
- --tls-cert-file=dashboard.pem
[root@master dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/
2020/10/08 22:57:18 [INFO] generate received request
2020/10/08 22:57:18 [INFO] received CSR
2020/10/08 22:57:18 [INFO] generating key: rsa-2048
2020/10/08 22:57:18 [INFO] encoded CSR
2020/10/08 22:57:18 [INFO] signed certificate with serial number 447633174051868055331633690754042067283491175690
2020/10/08 22:57:18 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
secret "kubernetes-dashboard-certs" deleted
secret/kubernetes-dashboard-certs created
//重新部署
[root@localhost dashboard]# kubectl apply -f dashboard-controller.yaml
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
serviceaccount/kubernetes-dashboard configured
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
deployment.apps/kubernetes-dashboard configured
//生成令牌
[root@master dashboard]# kubectl create -f k8s-admin.yaml
serviceaccount/dashboard-admin created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
//儲存
[root@master dashboard]# kubectl get secret -n kube-system
NAME TYPE DATA AGE
dashboard-admin-token-fmksp kubernetes.io/service-account-token 3 28s
default-token-8mhqw kubernetes.io/service-account-token 3 89m
kubernetes-dashboard-certs Opaque 11 2m40s
kubernetes-dashboard-key-holder Opaque 2 10m
kubernetes-dashboard-token-clssw kubernetes.io/service-account-token 3 9m58s
//檢視令牌
[root@master dashboard]# kubectl describe secret dashboard-admin-token-fmksp -n kube-system
Name: dashboard-admin-token-fmksp
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: de923e3d-0976-11eb-aede-000c29959657
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1359 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tZm1rc3AiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZGU5MjNlM2QtMDk3Ni0xMWViLWFlZGUtMDAwYzI5OTU5NjU3Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.Wi8CNzkhjUVjOxxnJhM-VwRaw9TycHQUYe4lxTqIw9aVWHjZOoQrtj2ERBTw_SFFVk94_Lsi3T8How3Yzh5xhvXdIQBNYdZnZMHNCEoR313T1fMVyQXVYzj0TJ_kw1pgepuTnYQnt2dVHfqaNJb7KRubTYmZ0UJFUYKANHrjwAGCI1qKQvtExCUfhv2InyGzvNxIvs120pzOAL2erwkb_DVsxJvw6a3exL5GTLyJtilapS0FnClbsgDyBmPZAnvIDpzbtE1cTSePjimUcQih4g3vgNv4oUhehBNW6IoNvjdnpL6Diq_2amnotM0nUrdRj6MEn6d5rA0-q4Cze_sokg
複製下令牌eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJu
重新整理網頁
選擇令牌，然後把令牌複製進去選擇登入
使用火狐瀏覽器
