Kubernetes的Dashboard目前版本已经升至2.0.0-rc3，这篇文章介绍一下如何在Kubernetes 1.17.2中安装此版本的Dashboard。
Dashboard-
Github地址 https://github.com/kubernetes/dashboard
-
目前版本：2.0.0-rc3 (2020/1/31)
Dashboard的配置文件可以在如下链接中获得：
- https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc3/aio/deploy/recommended.yaml
获取此文件内容，并将其保存为名为dashboard.yml
所需镜像使用此版本的Dashboard，会用到如下两个镜像：
[root@host131 dashboard]# grep image: dashboard.yml
image: kubernetesui/dashboard:v2.0.0-rc3
image: kubernetesui/metrics-scraper:v1.0.3
[root@host131 dashboard]#
- Dashboard镜像：kubernetesui/dashboard:v2.0.0-rc3
- kubernetesui/metrics-scraper:v1.0.3
本文使用Kubernetes 1.17.2，可参看下文进行快速环境搭建：
- 单机版本或者集群版本环境搭建
[root@host131 ansible]# kubectl get node -o wide NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME 192.168.163.131 Ready3m49s v1.17.2 192.168.163.131CentOS Linux 7 (Core) 3.10.0-957.el7.x86_64 docker://19.3.5 [root@host131 ansible]#
事先下载如下两个镜像，可以加快速度
[root@host131 dashboard]# docker images |grep dashboard kubernetesui/dashboard v2.0.0-rc3 4a0a1cf1b459 29 hours ago 126MB k8s.gcr.io/kubernetes-dashboard-amd64 v1.10.1 f9aed6605b81 13 months ago 122MB [root@host131 dashboard]#
修改配置文件：设定NodePort方式，端口设定为33307
32 kind: Service
33 apiVersion: v1
34 metadata: 35 labels: 36 k8s-app: kubernetes-dashboard
37 name: kubernetes-dashboard
38 namespace: kubernetes-dashboard
39 spec: 40 type: NodePort
41 ports: 42 - port: 443 43 targetPort: 8443 44 nodePort: 33307 45 selector: 46 k8s-app: kubernetes-dashboard
修改配置文件：修改imagePullPolicy为IfNotPresent
imagePullPolicy: IfNotPresent创建Dashboard服务
[root@host131 dashboard]# kubectl create -f . namespace/kubernetes-dashboard created serviceaccount/kubernetes-dashboard created service/kubernetes-dashboard created secret/kubernetes-dashboard-certs created secret/kubernetes-dashboard-csrf created secret/kubernetes-dashboard-key-holder created configmap/kubernetes-dashboard-settings created role.rbac.authorization.k8s.io/kubernetes-dashboard created clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created deployment.apps/kubernetes-dashboard created service/dashboard-metrics-scraper created deployment.apps/dashboard-metrics-scraper created [root@host131 dashboard]#结果确认
[root@host131 dashboard]# kubectl get service -A |grep dashboard kubernetes-dashboard dashboard-metrics-scraper ClusterIP 10.254.80.1058000/TCP 48s kubernetes-dashboard kubernetes-dashboard NodePort 10.254.254.214443:33307/TCP 48s [root@host131 dashboard]# [root@host131 dashboard]# kubectl get pod -A |grep dashboard kubernetes-dashboard dashboard-metrics-scraper-7b8b58dc8b-dmvqj 1/1 Running 0 59s kubernetes-dashboard kubernetes-dashboard-98d9ff664-s27v9 1/1 Running 0 59s [root@host131 dashboard]#浏览器确认 Chrome浏览器
由于Chrome浏览器在58+之后对于自签名的证书需要在subjectAltName中设定DNS.1，所以缺省下会有如下错误信息提示，注意此种状态下无法继续打开页面了
具体原因和对应方式可参看这篇SSL的基础内容：https://blog.csdn.net/liumiaocn/article/details/103562650
使用Firefox还可以继续确认
点击View Certificate可以确认到证书的内容
这里点击Accept Risk and Continue按钮即可看到Dashboard的登录界面
选择token的方式进行登录，具体获得token详细信息的方式可以使用如下两行命令来完成：
[root@host131 dashboard]# kubectl -n kubernetes-dashboard get secret NAME TYPE DATA AGE default-token-9g8fb kubernetes.io/service-account-token 3 23m kubernetes-dashboard-certs Opaque 0 23m kubernetes-dashboard-csrf Opaque 1 23m kubernetes-dashboard-key-holder Opaque 2 23m kubernetes-dashboard-token-cvjhq kubernetes.io/service-account-token 3 23m [root@host131 dashboard]#步骤2: 获取toekn信息
[root@host131 dashboard]# kubectl -n kubernetes-dashboard describe secrets kubernetes-dashboard-token-cvjhq
Name: kubernetes-dashboard-token-cvjhq
Namespace: kubernetes-dashboard
Labels:Annotations: kubernetes.io/service-account.name: kubernetes-dashboard
kubernetes.io/service-account.uid: 5d344a06-2efe-4c03-a5b4-cd0c90d4f463
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1359 bytes
namespace: 20 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6Ikt5aFRwRXR6M1hMLU5GTjg0M0R1LTNfNTZLOVNhVUxZd1BSZW9HNGJrMVEifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC10b2tlbi1jdmpocSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjVkMzQ0YTA2LTJlZmUtNGMwMy1hNWI0LWNkMGM5MGQ0ZjQ2MyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDprdWJlcm5ldGVzLWRhc2hib2FyZCJ9.gDRilxWVTYQmVh7MyvgLHpFOIYC8fU2qzscfJnqdPiioGjPeGZ3nE-V7BC7xQN5Ic6eiIe8aG7kFokerm6Y4JHJ9Mmd9E-0ny30Q32csqZePc4WX3_Odc9WqD4bAbaRIwJXeKxKS6MQfcDjaaA_7ziVVtmxgxkyK9i1htrfh62tKuLsPHmh7jrp5yUk3W7I50pUPKQejAXCvz5XQ2KlKwIIGDMonadcgsTaR6T5qcDqB3Q2WS2BA8ZPoEirCWh40WN_RbJxbJcIhb5Ct2UEMp3m2UXn2M9xOoloBemITIlnONH63PlrtHZ_X7R68HlkuQ1qyB6EXxDcr7iQZ9ZVXcg
[root@host131 dashboard]#
然后使用此token信息
可以看到已经登录进来了
但是实际上还是有问题的，在后续的文章中将会进一步展开说明
# Copyright 2017 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. apiVersion: v1 kind: Namespace metadata: name: kubernetes-dashboard --- apiVersion: v1 kind: ServiceAccount metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kubernetes-dashboard --- kind: Service apiVersion: v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kubernetes-dashboard spec: ports: - port: 443 targetPort: 8443 selector: k8s-app: kubernetes-dashboard --- apiVersion: v1 kind: Secret metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-certs namespace: kubernetes-dashboard type: Opaque --- apiVersion: v1 kind: Secret metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-csrf namespace: kubernetes-dashboard type: Opaque data: csrf: "" --- apiVersion: v1 kind: Secret metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-key-holder namespace: kubernetes-dashboard type: Opaque --- kind: ConfigMap apiVersion: v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-settings namespace: kubernetes-dashboard --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kubernetes-dashboard rules: # Allow Dashboard to get, update and delete Dashboard exclusive secrets. - apiGroups: [""] resources: ["secrets"] resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"] verbs: ["get", "update", "delete"] # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. - apiGroups: [""] resources: ["configmaps"] resourceNames: ["kubernetes-dashboard-settings"] verbs: ["get", "update"] # Allow Dashboard to get metrics. - apiGroups: [""] resources: ["services"] resourceNames: ["heapster", "dashboard-metrics-scraper"] verbs: ["proxy"] - apiGroups: [""] resources: ["services/proxy"] resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"] verbs: ["get"] --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard rules: # Allow Metrics Scraper to get metrics from the Metrics server - apiGroups: ["metrics.k8s.io"] resources: ["pods", "nodes"] verbs: ["get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kubernetes-dashboard roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: kubernetes-dashboard subjects: - kind: ServiceAccount name: kubernetes-dashboard namespace: kubernetes-dashboard --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: kubernetes-dashboard roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: kubernetes-dashboard subjects: - kind: ServiceAccount name: kubernetes-dashboard namespace: kubernetes-dashboard --- kind: Deployment apiVersion: apps/v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kubernetes-dashboard spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: k8s-app: kubernetes-dashboard template: metadata: labels: k8s-app: kubernetes-dashboard spec: containers: - name: kubernetes-dashboard image: kubernetesui/dashboard:v2.0.0-rc3 imagePullPolicy: Always ports: - containerPort: 8443 protocol: TCP args: - --auto-generate-certificates - --namespace=kubernetes-dashboard # Uncomment the following line to manually specify Kubernetes API server Host # If not specified, Dashboard will attempt to auto discover the API server and connect # to it. Uncomment only if the default does not work. # - --apiserver-host=http://my-address:port volumeMounts: - name: kubernetes-dashboard-certs mountPath: /certs # Create on-disk volume to store exec logs - mountPath: /tmp name: tmp-volume livenessProbe: httpGet: scheme: HTTPS path: / port: 8443 initialDelaySeconds: 30 timeoutSeconds: 30 securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsUser: 1001 runAsGroup: 2001 volumes: - name: kubernetes-dashboard-certs secret: secretName: kubernetes-dashboard-certs - name: tmp-volume emptyDir: {} serviceAccountName: kubernetes-dashboard nodeSelector: "beta.kubernetes.io/os": linux # Comment the following tolerations if Dashboard must not be deployed on master tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule --- kind: Service apiVersion: v1 metadata: labels: k8s-app: dashboard-metrics-scraper name: dashboard-metrics-scraper namespace: kubernetes-dashboard spec: ports: - port: 8000 targetPort: 8000 selector: k8s-app: dashboard-metrics-scraper --- kind: Deployment apiVersion: apps/v1 metadata: labels: k8s-app: dashboard-metrics-scraper name: dashboard-metrics-scraper namespace: kubernetes-dashboard spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: k8s-app: dashboard-metrics-scraper template: metadata: labels: k8s-app: dashboard-metrics-scraper annotations: seccomp.security.alpha.kubernetes.io/pod: 'runtime/default' spec: containers: - name: dashboard-metrics-scraper image: kubernetesui/metrics-scraper:v1.0.3 ports: - containerPort: 8000 protocol: TCP livenessProbe: httpGet: scheme: HTTP path: / port: 8000 initialDelaySeconds: 30 timeoutSeconds: 30 volumeMounts: - mountPath: /tmp name: tmp-volume securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsUser: 1001 runAsGroup: 2001 serviceAccountName: kubernetes-dashboard nodeSelector: "beta.kubernetes.io/os": linux # Comment the following tolerations if Dashboard must not be deployed on master tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule volumes: - name: tmp-volume emptyDir: {}
参考内容
https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/README.md https://github.com/kubernetes/dashboard
