一，简单搭建，未使用ssl证书，可载谷歌浏览器访问

1，拉取镜像

  1. docker pull gcrxio/kubernetes-dashboard-amd64:v1.10.1
  2. docker tag gcrxio/kubernetes-dashboard-amd64:v1.10.1    k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
  4. # 为主节点打标签，使容器起在主节点，修改部署文件见第2步
  5. kubectl label node k8s-master type=master

2，k8s dashboard 部署yaml

wget https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml 后有修改。

  1. cat kubernetes-dashboard.yaml
  2. # Copyright 2017 The Kubernetes Authors.
  3. #
  4. # Licensed under the Apache License, Version 2.0 (the "License");
  5. # you may not use this file except in compliance with the License.
  6. # You may obtain a copy of the License at
  7. #
  8. #     http://www.apache.org/licenses/LICENSE-2.0
  9. #
  10. # Unless required by applicable law or agreed to in writing, software
  11. # distributed under the License is distributed on an "AS IS" BASIS,
  12. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13. # See the License for the specific language governing permissions and
  14. # limitations under the License.
  16. # ------------------- Dashboard Secret ------------------- #
  18. apiVersion: v1
  19. kind: Secret
  20. metadata:
  21.   labels:
  22.     k8s-app: kubernetes-dashboard
  23.   name: kubernetes-dashboard-certs
  24.   namespace: kube-system
  25. type: Opaque
  27. ---
  28. # ------------------- Dashboard Service Account ------------------- #
  30. apiVersion: v1
  31. kind: ServiceAccount
  32. metadata:
  33.   labels:
  34.     k8s-app: kubernetes-dashboard
  35.   name: kubernetes-dashboard
  36.   namespace: kube-system
  38. ---
  39. # ------------------- Dashboard Role & Role Binding ------------------- #
  41. kind: Role
  42. apiVersion: rbac.authorization.k8s.io/v1
  43. metadata:
  44.   name: kubernetes-dashboard-minimal
  45.   namespace: kube-system
  46. rules:
  47.   # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
  48. - apiGroups: [""]
  49.   resources: ["secrets"]
  50.   verbs: ["create"]
  51.   # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
  52. - apiGroups: [""]
  53.   resources: ["configmaps"]
  54.   verbs: ["create"]
  55.   # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  56. - apiGroups: [""]
  57.   resources: ["secrets"]
  58.   resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
  59.   verbs: ["get", "update", "delete"]
  60.   # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  61. - apiGroups: [""]
  62.   resources: ["configmaps"]
  63.   resourceNames: ["kubernetes-dashboard-settings"]
  64.   verbs: ["get", "update"]
  65.   # Allow Dashboard to get metrics from heapster.
  66. - apiGroups: [""]
  67.   resources: ["services"]
  68.   resourceNames: ["heapster"]
  69.   verbs: ["proxy"]
  70. - apiGroups: [""]
  71.   resources: ["services/proxy"]
  72.   resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
  73.   verbs: ["get"]
  75. ---
  76. apiVersion: rbac.authorization.k8s.io/v1
  77. kind: RoleBinding
  78. metadata:
  79.   name: kubernetes-dashboard-minimal
  80.   namespace: kube-system
  81. roleRef:
  82.   apiGroup: rbac.authorization.k8s.io
  83.   kind: Role
  84.   name: kubernetes-dashboard-minimal
  85. subjects:
  86. - kind: ServiceAccount
  87.   name: kubernetes-dashboard
  88.   namespace: kube-system
  90. ---
  91. # ------------------- Dashboard Deployment ------------------- #
  93. kind: Deployment
  94. apiVersion: apps/v1
  95. metadata:
  96.   labels:
  97.     k8s-app: kubernetes-dashboard
  98.   name: kubernetes-dashboard
  99.   namespace: kube-system
  100. spec:
  101.   replicas: 1
  102.   revisionHistoryLimit: 10
  103.   selector:
  104.     matchLabels:
  105.       k8s-app: kubernetes-dashboard
  106.   template:
  107.     metadata:
  108.       labels:
  109.         k8s-app: kubernetes-dashboard
  110.     spec:
  111.       nodeSelector:
  112.         type: master
  113.       containers:
  114.       - name: kubernetes-dashboard
  115.         image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
  116.         imagePullPolicy: IfNotPresent
  117.         ports:
  118.         - containerPort: 8443
  119.           protocol: TCP
  120.         args:
  121.           - --auto-generate-certificates
  122.           # Uncomment the following line to manually specify Kubernetes API server Host
  123.           # If not specified, Dashboard will attempt to auto discover the API server and connect
  124.           # to it. Uncomment only if the default does not work.
  125.           # - --apiserver-host=http://my-address:port
  126.         volumeMounts:
  127.         - name: kubernetes-dashboard-certs
  128.           mountPath: /certs
  129.           # Create on-disk volume to store exec logs
  130.         - mountPath: /tmp
  131.           name: tmp-volume
  132.         livenessProbe:
  133.           httpGet:
  134.             scheme: HTTPS
  135.             path: /
  136.             port: 8443
  137.           initialDelaySeconds: 30
  138.           timeoutSeconds: 30
  139.       volumes:
  140.       - name: kubernetes-dashboard-certs
  141.         secret:
  142.           secretName: kubernetes-dashboard-certs
  143.       - name: tmp-volume
  144.         emptyDir: {}
  145.       serviceAccountName: kubernetes-dashboard
  146.       # Comment the following tolerations if Dashboard must not be deployed on master
  147.       tolerations:
  148.       - key: node-role.kubernetes.io/master
  149.         effect: NoSchedule
  151. ---
  152. # ------------------- Dashboard Service ------------------- #
  154. kind: Service
  155. apiVersion: v1
  156. metadata:
  157.   labels:
  158.     k8s-app: kubernetes-dashboard
  159.   name: kubernetes-dashboard
  160.   namespace: kube-system
  161. spec:
  162.   ports:
  163.     - port: 443
  164.       targetPort: 8443
  165.   selector:
  166.     k8s-app: kubernetes-dashboard

此处为修改位置,添加了 :

imagePullPolicy: IfNotPresent #使用本地的镜像

nodeSelector: #容器起在主节点上

type: master

  1. # ------------------- Dashboard Deployment ------------------- #
  3. kind: Deployment
  4. apiVersion: apps/v1
  5. metadata:
  6.   labels:
  7.     k8s-app: kubernetes-dashboard
  8.   name: kubernetes-dashboard
  9.   namespace: kube-system
  10. spec:
  11.   replicas: 1
  12.   revisionHistoryLimit: 10
  13.   selector:
  14.     matchLabels:
  15.       k8s-app: kubernetes-dashboard
  16.   template:
  17.     metadata:
  18.       labels:
  19.         k8s-app: kubernetes-dashboard
  20.     spec:
  21.       nodeSelector:
  22.         type: master
  23.       containers:
  24.       - name: kubernetes-dashboard
  25.         image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
  26.         imagePullPolicy: IfNotPresent
  27.         ports:
  28.         - containerPort: 8443
  29.           protocol: TCP

部署：

kubectl apply -f kubernetes-dashboard.yaml

查看：

kubectl get pods --all-namespaces

使用API Server 访问

  1. https://<master-ip>:<apiserver-port>/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/

访问结果为：

  1. {
  2.   "kind": "Status",
  3.   "apiVersion": "v1",
  4.   "metadata": {
  6.   },
  7.   "status": "Failure",
  8.   "message": "services \"https:kubernetes-dashboard:\" is forbidden: User \"system:anonymous\" cannot get services/proxy in the namespace \"kube-system\"",
  9.   "reason": "Forbidden",
  10.   "details": {
  11.     "name": "https:kubernetes-dashboard:",
  12.     "kind": "services"
  13.   },
  14.   "code": 403
  15. }

这是因为没有进行认证，需要去创建一个证书

创建证书

  1. #将kubectl的配置文件复制到$HOME/.kube/config中,$HOME/.kube/config 可能存在，可以先备份
  2.   mkdir -p $HOME/.kube
  3.   sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  4.   sudo chown $(id -u):$(id -g) $HOME/.kube/config

生成p12文件

  1. # 生成client-certificate-data
  2. grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt
  4. # 生成client-key-data
  5. grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key
  7. # 生成p12，这里会要求输入密码，记住这个密码
  8. openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name "kubernetes-client"

导入p12文件；可以在谷歌浏览器内导入私有证书

装过程中需要输入的密码则为生成p12文件过程中输入的密码

安装完成后，关闭所有的浏览器，再重新打开，就会显示让选择证书的界面，选择证书，就会出现登录界面。

创建用户

  1. vi admin-user.yaml
  3. apiVersion: v1
  4. kind: ServiceAccount
  5. metadata:
  6.   name: admin-user
  7.   namespace: kube-system
  9. kubectl create -f admin-user.yaml

用户绑定角色

  1. vi admin-user-role-binding.yaml
  3. apiVersion: rbac.authorization.k8s.io/v1beta1
  4. kind: ClusterRoleBinding
  5. metadata:
  6.   name: admin-user
  7. roleRef:
  8.   apiGroup: rbac.authorization.k8s.io
  9.   kind: ClusterRole
  10.   name: cluster-admin
  11. subjects:
  12. - kind: ServiceAccount
  13.   name: admin-user
  14.   namespace: kube-system
  16. kubectl create -f admin-user-role-binding.yaml

获取token ,这个token 是系统默认的token

  1. kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')

访问

https://172.20.7.132:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy

输入获取的token

参考感谢：

https://www.jianshu.com/p/073577bdec98

https://www.cnblogs.com/RainingNight/p/deploying-k8s-dashboard-ui.html

问题：

1，搭建使用了系统默认的证书，并未自己新建证书进行加载

2，对角色，用户绑定等知识点不熟

3，集成Heapster插件安装失败

4，细节不懂，只是照抄而已

操作的步骤

  1.    31  docker pull gcrxio/kubernetes-dashboard-amd64:v1.10.1
  2.    32  docker tag gcrxio/kubernetes-dashboard-amd64:v1.10.1 k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
  3.    33  ll
  4.    34  cd /k8s/
  5.    35  ll
  6.    36  curl -O https://raw.githubusercontent.com/kubernetes/dashboard/master/aio/deploy/recommended/kubernetes-dashboard.yaml
  7.    37  ll
  8.    38  kubectl label node k8s-master type=master
  9.    39  vim kubernetes-dashboard.yaml
  10.    40  cat  kubernetes-dashboard.yaml
  11.    41  rm  kubernetes-dashboard.yaml
  12.    42  ll
  13.    43  wget https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/recommended/kubernetes-dashboard.yaml
  14.    44  ll
  15.    45  wget https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
  16.    46  ll
  17.    47  vim  kubernetes-dashboard.yaml
  18.    48  kubectl apply -f  kubernetes-dashboard.yaml
  19.    49  kubectl get pods --all-namespaces
  20.    50  vim  admin-user.yaml
  21.    51  kubectl create -f admin-user.yaml
  22.    52  vim admin-user-role-binding.yaml
  23.    53  kubectl create -f  admin-user-role-binding.yaml
  24.    54  kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
  25.    55  kubectl cluster-info
  26.    56  ll
  27.    57  grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt
  28.    58  ll
  29.    59  grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key
  30.    60  openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name "kubernetes-client"
  31.    61  ll
  32.    62  ss  -tanl
  33.    63  kubectl -n kube-system edit service kubernetes-dashboard
  34.    64  kubectl -n kube-system get service kubernetes-dashboard
  35.    65  kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
  36.    66  ll
  37.    67  kubectl create -f http://mirror.faasx.com/kubernetes/heapster/deploy/kube-config/influxdb/influxdb.yaml
  38.    68  ll
  39.    69  wget  http://mirror.faasx.com/kubernetes/heapster/deploy/kube-config/influxdb/influxdb.yaml
  40.    70  kubectl create -f http://mirror.faasx.com/kubernetes/heapster/deploy/kube-config/influxdb/grafana.yaml
  41.    71  wget   http://mirror.faasx.com/kubernetes/heapster/deploy/kube-config/influxdb/grafana.yaml
  42.    72  kubectl create -f http://mirror.faasx.com/kubernetes/heapster/deploy/kube-config/influxdb/heapster.yaml
  43.    73  wget  http://mirror.faasx.com/kubernetes/heapster/deploy/kube-config/influxdb/heapster.yaml
  44.    74  kubectl create -f http://mirror.faasx.com/kubernetes/heapster/deploy/kube-config/rbac/heapster-rbac.yaml
  45.    75  wget   http://mirror.faasx.com/kubernetes/heapster/deploy/kube-config/rbac/heapster-rbac.yaml
  46.    76  kubectl  get  pods   --namespace=kube-system

k8s-dashboard搭建的更多相关文章

  1. Ubuntu下搭建Kubernetes集群(4)--部署K8S Dashboard

    K8S Dashboard是官方的一个基于WEB的用户界面,专门用来管理K8S集群,并可展示集群的状态.K8S集群安装好后默认没有包含Dashboard,我们需要额外创建它. 首先我们执行命令: wg ...

  2. kubernetes实践之二：Kubernetes可视WEB UI Dashboard搭建

    Kubernetes可视WEBUI Dashboard搭建 支持浏览器:火狐 一．Dashboard下载地址 git clone https://github.com/kubernetes/kuber ...

  3. Docker & k8s 系列二：本机k8s环境搭建

    本篇将会讲解k8s是什么?本机k8s环境搭建,部署一个pod并演示几个kubectl命令,k8s dashboard安装. k8s是什么 k8s是kubernetes的简写,它是一个全新的基于容器技术 ...

  4. 【k8s】在AWS EKS部署并通过ALB访问k8s Dashboard保姆级教程

    本教程适用范围 在AWS上使用EKS服务部署k8s Dashboard,并通过ALB访问 EKS集群计算节点采用托管EC2,并使用启动模板. 使用AWS海外账号,us-west-2区域 使用账号默认v ...

  5. 在k8s中搭建可解析hostname的DNS服务

    2016-01-25更新 上篇文章总结k8s中搭建hbase时,遇到Pod中hostname的DNS解析问题,本篇将通过修改kube2sky源码来解决这个问题. 1 前言 kube2sky在Githu ...

  6. Hystrix + Hystrix Dashboard搭建（Spring Cloud 2.X）

    本机IP为  192.168.1.102 一.搭建Hystrix Dashboard 1.   新建 Maven 项目  hystrix-dashboard 2. pom.xml <projec ...

  7. Alibaba Nacos 学习（五）：K8S Nacos搭建,使用nfs

    Alibaba Nacos 学习(一):Nacos介绍与安装 Alibaba Nacos 学习(二):Spring Cloud Nacos Config Alibaba Nacos 学习(三):Spr ...

  8. kubernetes学习14—Dashboard搭建和认证

    本文收录在容器技术学习系列文章总目录 一.介绍 Kubernetes Dashboard是Kubernetes集群的基于Web的通用UI.它允许用户管理在群集中运行的应用程序并对其进行故障排除,以及管 ...

  9. k8s dashboard 安装和证书更新

    1.k8s 搭建   参见https://blog.51cto.com/lizhenliang/2325770 [root@VM_0_48_centos ~]# kubectl get cs NAME ...

  10. k8s初始化搭建方法

    http://www.cnblogs.com/cocowool/p/kubeadm_install_kubernetes.html https://www.kubernetes.org.cn/doc- ...

随机推荐

  1. c语言l博客作业07

    一.本周教学内容&目标 第3章 分支结构 3.3 使学生熟悉多分支结构switch语句的使用. 二.本周作业头 这个作业属于那个课程 C语言程序设计II 这个作业要求在哪里 https://e ...

  2. Spring Boot常用功能

    1.Spring Boot打war包配置 利用IDEA将SpringBoot的项目打包成war文件

  3. 【Linux 网络编程】常用套接字类型

    常用套接字类型<1>流式套接字(SOCK_STREAM)---TCP      提供面向连接的.可靠的传输服务,数据无差错,无重复的发送,      且按发送顺序接收.<2>数 ...

  4. GPIB、USB、PCI、PCI Express和以太网/LAN/LXI

    GPIB 我们研究的第一个总线是IEEE 488总线,较为熟悉的称谓是GPIB(通用接口总线).GPIB是一种在业界已经得到证明的专为仪器控制应用设计的总线.GPIB在过去30年来一直是鲁棒的.可靠的 ...

  5. ZOJ 2836 Number Puzzle 题解

    题面 lcm(x,y)=xy/gcd(x,y) lcm(x1,x2,···,xn)=lcm(lcm(x1,x2,···,xn-1),xn) #include <bits/stdc++.h> ...

  6. Luogu P1080 [NOIP2012]国王游戏

    题目 按\(a_i*b_i\)升序排序即可. 证明考虑交换法. 对于排序后相邻的两个人\(i,j(a_ib_i\le a_jb_j)\),设前面的总的积为\(s\),则当前答案为\(\max(\fra ...

  7. C++ 大数运算（加减乘除取模）

    加法:(字符串模拟小学加法) string add(string s1, string s2) { int len1 = s1.length(), len2 = s2.length(); ; '); ...

  8. ORA-00979: 不是 GROUP BY 表达式

    在oracle数据库中,sql语句中group by子句报错,原因是select 存在列字段,而group by中不存在.

  9. vue在组件中使用v-model

    <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8&quo ...

  10. 异步分布式队列Celery

    异步分布式队列Celery 转载地址 Celery 是什么? 官网 Celery 是一个由 Python 编写的简单.灵活.可靠的用来处理大量信息的分布式系统,它同时提供操作和维护分布式系统所需的工具 ...