实战dashboard"/>
K8S实战dashboard
参考
.html
配置文件参考
.html
准备安装kubernetes dashboard的yaml文件
#在master上下载,安装dashboard只要在master节点操作 wget .0.0-beta4/aio/deploy/recommended.yaml
PS:如果发现该链接失效,请访问,然后查找最新的链接。
修改yaml文件,这里由于使用自签证书,要重建secret ,需要删除secret部分
---apiVersion: v1kind: Secretmetadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboard-certsnamespace: kubernetes-dashboardtype: Opaque---
这里顺便修改一下service资源对象,更改为nodeport类型,以供外网访问。
---kind: ServiceapiVersion: v1metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kubernetes-dashboardspec:# 添加Service的type为NodePort,注意大小写type: NodePortports:- port: 443targetPort: 8443# 添加映射到虚拟机的端口,k8s只支持30000以上的端口nodePort: 32201 selector:k8s-app: kubernetes-dashboard---
2. 为dashboard制作自签证书
创建SSL证书需要私钥和证书签名请求。这些可以通过一些简单的命令生成。当openssl req命令要求输入“密码”时,只需按回车键,密码为空。
#创建一个dashboard的私钥 openssl genrsa -out dashboard.key 2048 #生成一个证书签署请求 openssl req -new -key dashboard.key -out dashboard.csr #通过.key和.crt签署证书,dashboard.crt文件是适用于仪表板和dashboard.key私钥的证书。openssl x509 -req -sha256 -days 365 -in dashboard.csr -signkey dashboard.key -out dashboard.crt [root@master .kube]# ls cache config dashboard.crt dashboard.csr dashboard.key http-cache recommended.yaml
通过签署证书创建一个sercert
--from-file= 是证书的所在地
kubectl create secret generic kubernetes-dashboard-certs -n kubernetes-dashboard --from-file=dashboard.crt=./dashboard.crt --from-file=dashboard.key=./dashboard.key
3.创建dashboard的pod
[root@master .kube]# kubectl create -f recommended.yaml namespace/kubernetes-dashboard created serviceaccount/kubernetes-dashboard created service/kubernetes-dashboard created secret/kubernetes-dashboard-csrf created secret/kubernetes-dashboard-key-holder created configmap/kubernetes-dashboard-settings created role.rbac.authorization.k8s.io/kubernetes-dashboard created clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created deployment.apps/kubernetes-dashboard created service/dashboard-metrics-scraper created deployment.apps/dashboard-metrics-scraper created [root@master .kube]# kubectl get -n kubernetes-dashboard pod NAME READY STATUS RESTARTS AGE dashboard-metrics-scraper-566cddb686-ffdpp 1/1 Running 0 11m kubernetes-dashboard-7b5bf5d559-rb4j2 1/1 Running 0 67s [root@master .kube]# kubectl get -n kubernetes-dashboard svc NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE dashboard-metrics-scraper ClusterIP 10.104.247.1 <none> 8000/TCP 13m kubernetes-dashboard NodePort 10.110.34.66 <none> 443:32201/TCP 13m [root@master .kube]#
这时访问 https://ip:port ,已可以到达登录界面,需要输入(令牌)token登录
4.创建token
该ServiceAccount的secret作为登录dashboard的凭证。因为官方给的默认权限是最小的,所以我们要自建一个最大权限的SA。
4.1 创建ServiceAccount
[root@master .kube]# cat dashboard-sa.yaml apiVersion: v1kind: ServiceAccountmetadata:name: dashboard-adminnamespace: kubernetes-dashboard
4.2 创建clusterrolebinding为dashboard sa授权集群权限cluster-admin
[root@master .kube]# cat dashboard-clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:name: dashboard-adminroleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: cluster-adminsubjects:- kind: ServiceAccountname: dashboard-adminnamespace: kubernetes-dashboard
5. 启动服务
kubectl create -f dashboard-sa.yaml kubectl create -f dashboard-clusterrolebinding.yaml
6.获取验证token
[root@master .kube]# kubectl describe secret -n kubernetes-dashboard $(kubectl get secret -n kubernetes-dashboard | grep dashboard-admin | awk '{print $1}') Name: dashboard-admin-token-c5n4q Namespace: kubernetes-dashboard Labels: <none> Annotations: kubernetes.io/service-account.name: dashboard-adminkubernetes.io/service-account.uid: c5165903-7c0b-479d-8053-b5389436effdType: kubernetes.io/service-account-tokenData ==== ca.crt: 1025 bytes namespace: 20 bytes token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkJVUHMtak40ZGNVNlNCLTRjMlFHdHFTZ3NCQllUTkJ0MVEyX2VBLWRQZUUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tYzVuNHEiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiYzUxNjU5MDMtN2MwYi00NzlkLTgwNTMtYjUzODk0MzZlZmZkIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.QYlcgHqj-bVv0oZs_YSVBkiGmveBuFVB_rIKmrhJ617Vxe2HvY-yvqiHew3CZFFo7XlxlYp6A1ziaJdJbrlDar8hM53vXGLtMFv-oxP3zOxXmpmjxAqwOPeGR0I1UPRCeAVAJnLEe-bsIreJv9CVN0bI6PiF-4E4Ex8q6wztjFfiuXwZXkXoQrxuJP2t0WjT8HTqXwcL4t1f-AN3Z5D3Z9zHd_JyaR74jRbRiP9PCe3NfoU-JZ36hn-jjlmg32V-SIl1Wcl0G8oTW56oZ8TR_4yzSqeQLfk5y2L6hL152mBhAK1KWNgkNViPZ5Wn5TplIA1U_5T4x5WGp1fme8383g
6.登录dashboard
至此,dashboard已经搭建完成
删除kubernetes dashboard
// 查询pod
kubectl get pods --all-namespaces | grep "dashboard"
// 删除pod
kubectl delete deployment kubernetes-dashboard --namespace=kubernetes-dashboard kubectl delete deployment dashboard-metrics-scraper --namespace=kubernetes-dashboard
// 查询service
kubectl get service -A
// 删除service
kubectl delete service kubernetes-dashboard --namespace=kubernetes-dashboardkubectl delete service dashboard-metrics-scraper --namespace=kubernetes-dashboard
// 删除账户和密钥
kubectl delete sa kubernetes-dashboard --namespace=kubernetes-dashboard kubectl delete secret kubernetes-dashboard-certs --namespace=kubernetes-dashboard kubectl delete secret kubernetes-dashboard-key-holder --namespace=kubernetes-dashboard
更多推荐
K8S实战dashboard
发布评论