kubernetes-dashboard部署
参考资料:
官方部署方法如下:
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta4/aio/deploy/recommended.yaml
该方法是通过指定官方的yaml文件, 通过kubectl来进行部署,然而这个方法存在很多问题,首先是该yaml文件的地址有时候并不能访问,需要挂梯子;其次,该文件指定的dashboard的镜像也需要梯子才能访问;再者,部署的dashboard的证书过期时间有问题,导致chrome、safari等都不能访问,仅firefox可以访问。所以需要对部署流程做调整,先创建自签证书,再用证书来部署。
生成自签证书
1) 生成证书请求的key
openssl genrsa -out dashboard.key 2048
2) 生成证书请求
openssl req -new -out dashboard.csr -key dashboard.key -subj '/CN=<your_ip>'
<your_ip>换成自己的ip或域名??
3) 生成自签证书
openssl x509 -days 3650 -req -in dashboard.csr -signkey dashboard.key -out dashboard.crt
这里指定了过期时间3650天,默认365天
部署kubernetes-dashboard
1) 创建部署kubernetes-dashboard的yaml文件
kubernetes-dashboard.yaml
# Copyright 2017 The Kubernetes Authors.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: v1
kind: Namespace
metadata:
name: kubernetes-dashboard
---
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
---
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
type: NodePort #NodePort方式,改用其它方式把这行去掉
ports:
- port: 443
targetPort: 8443
nodePort: 32100 #NodePort方式端口,改用其它方式把这行去掉
selector:
k8s-app: kubernetes-dashboard
---
#不要用自带的证书,自带证书时间出错
#apiVersion: v1
#kind: Secret
#metadata:
# labels:
# k8s-app: kubernetes-dashboard
# name: kubernetes-dashboard-certs
# namespace: kubernetes-dashboard
#type: Opaque
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-csrf
namespace: kubernetes-dashboard
type: Opaque
data:
csrf: ""
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-key-holder
namespace: kubernetes-dashboard
type: Opaque
---
kind: ConfigMap
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-settings
namespace: kubernetes-dashboard
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
rules:
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
verbs: ["get", "update", "delete"]
\# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["kubernetes-dashboard-settings"]
verbs: ["get", "update"]
\# Allow Dashboard to get metrics.
- apiGroups: [""]
resources: ["services"]
resourceNames: ["heapster", "dashboard-metrics-scraper"]
verbs: ["proxy"]
- apiGroups: [""]
resources: ["services/proxy"]
resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
verbs: ["get"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
rules:
# Allow Metrics Scraper to get metrics from the Metrics server
- apiGroups: ["metrics.k8s.io"]
resources: ["pods", "nodes"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: kubernetes-dashboard
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kubernetes-dashboard
namespace: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: kubernetes-dashboard
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kubernetes-dashboard
---
kind: Deployment
apiVersion: apps/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: kubernetes-dashboard
template:
metadata:
labels:
k8s-app: kubernetes-dashboard
spec:
containers:
- name: kubernetes-dashboard
#image: registry.cn-hangzhou.aliyuncs.com/kubernetesui/dashboard:v2.0.0-beta5
image: kubernetesui/dashboard:v2.0.0-beta5
imagePullPolicy: IfNotPresent
ports:
- containerPort: 8443
protocol: TCP
args:
- --auto-generate-certificates
- --namespace=kubernetes-dashboard
# 把token过期时间设置为43200分钟,默认是15分钟
- --token-ttl=43200
# Uncomment the following line to manually specify Kubernetes API server Host
# If not specified, Dashboard will attempt to auto discover the API server and connect
# to it. Uncomment only if the default does not work.
# - --apiserver-host=http://my-address:port
volumeMounts:
- name: kubernetes-dashboard-certs
mountPath: /certs
# Create on-disk volume to store exec logs
- mountPath: /tmp
name: tmp-volume
livenessProbe:
httpGet:
scheme: HTTPS
path: /
port: 8443
initialDelaySeconds: 30
timeoutSeconds: 30
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
- name: tmp-volume
emptyDir: {}
serviceAccountName: kubernetes-dashboard
# Comment the following tolerations if Dashboard must not be deployed on master
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
---
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: dashboard-metrics-scraper
name: dashboard-metrics-scraper
namespace: kubernetes-dashboard
spec:
ports:
- port: 8000
targetPort: 8000
selector:
k8s-app: dashboard-metrics-scraper
---
kind: Deployment
apiVersion: apps/v1
metadata:
labels:
k8s-app: dashboard-metrics-scraper
name: dashboard-metrics-scraper
namespace: kubernetes-dashboard
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: dashboard-metrics-scraper
template:
metadata:
labels:
k8s-app: dashboard-metrics-scraper
spec:
containers:
- name: dashboard-metrics-scraper
image: kubernetesui/metrics-scraper:v1.0.1
ports:
- containerPort: 8000
protocol: TCP
livenessProbe:
httpGet:
scheme: HTTP
path: /
port: 8000
initialDelaySeconds: 30
timeoutSeconds: 30
volumeMounts:
- mountPath: /tmp
name: tmp-volume
serviceAccountName: kubernetes-dashboard
# Comment the following tolerations if Dashboard must not be deployed on master
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
volumes:
- name: tmp-volume
emptyDir: {}
这里根据官方文件做了微调: 1)把cert注释掉,使用待会自己创建的cert,因为默认的证书有问题;2)把token过期时间设置为43200分钟,默认为15分钟; 3)把dashboard访问方式改为NodePort,端口是32100,访问时用pod所在主机的ip加端口号即可访问; 4)imagePullPolicy改为IfNotPresent,当本地找不到镜像时才从网上拉取;
注意查看镜像路径是否有效,如果无效,自行百度查找镜像源,或者到别的地方把镜像下载到本地,然后把tag改成和yaml文件中的image一致
2) 部署kubernetes-dashboard
kubectl create -f <yaml_path>
<yaml_path>换成自己yaml的路径
3) 部署完成后还是不能访问,因为yaml文件中注释掉了kubernetes-dashboard-certs,相关的pod没跑起来,所以此时应创建certs
kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt -n kubernetes-dashboard
"dashboard.key"、"dashboard.crt"是之前生成的自签证书的相关文件的路径,这里用相对路径,所以直接给个名字; 创建的secret名为"kubernetes-dashboard-certs"; 用"-n kubernetes-dashboard"指明命名空间"kubernetes-dashboard",可自行更改,不过建议用这个,因为后面的操作是接着这里的
4) 一般经过以上步骤就可以访问dashboard,可以跳过这一步了,但如果此时仍不能访问,pod不是处于"running"状态,可以删除kubenetes-dashboard相关的pod,让kubelet自动生成一个新的可运行的pod
查看kubernetes-dashboard的pod名:
kubectl get pods -n kubernetes-dashboard
删除该pod:
kubectl delete pod -n kubernetes-dashboard <pod名>
5) 如果chrome仍然无法访问,需要到设置里把证书设置为"受信任证书"
创建访问用户
创建用于访问dashboard的Service Account
admin-user.yaml:
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kubernetes-dashboard
kubectl create -f admin-user.yaml
为用户绑定角色,创建ClusterRoleBinding
rolebinding.yaml:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kubernetes-dashboard
kubectl create -f rolebinding.yaml
也可以把两个yaml文件合成一个,中间用"---"隔开,用一个"kubectl create"语句即可,如下:
dashboard-adminuser.yaml
##创建名为admin-user的用户
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kubernetes-dashboard
---
##把集群角色cluster-admin绑定到admin-user
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kubernetes-dashboard
操作命令:
kubectl create -f dashboard-adminuser.yaml
不用配置文件,直接命令行也是可以的:
示例
在"kubernetes-dashboard"命名空间下创建一个名为"admin-user"的用户:
kubectl create serviceaccount admin-user -n kubernetes-dashboard
创建一个叫"admin-user"的“角色绑定”,给"admin-user"用户授予"cluster-admin"角色:
kubectl create clusterrolebinding admin-user -–clusterrole=cluster-admin –-serviceaccount=kubernetes-dashboard:admin-user
获取登录密钥
在上面创建用户的时候,kubectl会自动生成一个对应该用户的"secret",”secret“的名字是以用户名为前缀加上"-token-五位随机序列",例如创建的是"admin-user",在我电脑上的"secret"为"admin-user-token-5fkcr",
此时通过"kubectl describe"命令即可看到该用户的token,但由于kubernetes中的密钥太多,所以需要用以下命令筛选出需要的密钥:
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
得到类似如下的信息,把”token“后面那一串复制到dashboard登录,然后就可以愉快的玩耍啦
补充
在给dashboard分配角色时给了admin权限,可能对安全性有所影响。以上对官方的yaml做了修改,把dashboard部署方式改为NodePort,以使得可以通过节点ip+端口访问,当然这是不太安全的,最好是改为ingress或apiserver方式;如果使用官方默认部署方式,只能本机访问,而且需要先开启代理
kubectl proxy
kubernetes-dashboard部署的更多相关文章
- centos7下kubernetes(5。部署kubernetes dashboard)
基于WEB的dashboard,用户可以用kubernetes dashboard部署容器话的应用,监控应用的状态,执行故障排查任务以及管理kubernetes各种资源. 在kubernetes da ...
- K8S从入门到放弃系列-(14)Kubernetes集群Dashboard部署
Dashboard是k8s的web界面,用户可以用 Kubernetes Dashboard 部署容器化的应用.监控应用.并对集群本身进行管理,在 Kubernetes Dashboard 中可以查看 ...
- Kubernetes Dashboard - 每天5分钟玩转 Docker 容器技术(173)
前面章节 Kubernetes 所有的操作我们都是通过命令行工具 kubectl 完成的.为了提供更丰富的用户体验,Kubernetes 还开发了一个基于 Web 的 Dashboard,用户可以用 ...
- Kubernetes Dashboard 【转】
前面章节 Kubernetes 所有的操作我们都是通过命令行工具 kubectl 完成的.为了提供更丰富的用户体验,Kubernetes 还开发了一个基于 Web 的 Dashboard,用户可以用 ...
- 019.Kubernetes二进制部署插件dashboard
一 修改配置文件 1.1 下载解压 [root@k8smaster01 ~]# cd /opt/k8s/work/kubernetes/ [root@k8smaster01 kubernetes]# ...
- [原]部署kubernetes dashboard(二)
####################### 以下为声明 ##################### 此文档是之前做笔记在两台机上进行的实践,kubernetes处于不断开发阶段 不能保证每 ...
- 微服务探索之路02篇liunx ubuntu服务器部署k8s(kubernetes)-kubernetes/dashboard
本章介绍所需环境:ubuntu18.04,建立在上一篇微服务探索之路01篇已经安装了docker的基础上. 1 替换k8s镜像源为国内镜像 进入目录 cd /etc/apt/sources.list. ...
- kubernetes之部署dashboard 和heapster
部署dashboard之前,先确保traefik https方式部署成功,这样就可以通过 https 域名的方式访问dashboard,无需kube-proxy转发了.假设traefik-ingres ...
- [原]CentOS7安装Rancher2.1并部署kubernetes (二)---部署kubernetes
################## Rancher v2.1.7 + Kubernetes 1.13.4 ################ ##################### ...
- [原]CentOS7安装Rancher2.1并部署kubernetes (一)---部署Rancher
################## Rancher v2.1.7 + Kubernetes 1.13.4 ################ ##################### ...
随机推荐
- ORACLE 创建pfile和spfile
使用服务器参数文件spfile创建文本参数文件pfile:1,SQL> create pfile from spfile="/u01/app/oracle/product/9. ...
- oracle用Where子句替换HAVING子句
避免使用HAVING子句, HAVING 只会在检索出所有记录之后才对结果集进行过滤. 这个处理需要排序,总计等操作. 如果能通过WHERE子句限制记录的数目,那就能减少这方面的开销. 例如: 低效: ...
- 首次揭秘:阿里巴巴中间件在 Serverless 技术领域的探索
Serverless 话题涉及范围极广,几乎包含了代码管理.测试.发布.运维和扩容等与应用生命周期关联的所有环节.AWS Lambda 是 Serverless 领域的标志性产品,但如果将其应用于核心 ...
- 2018-8-10-git-使用-VisualStudio-比较分支更改
title author date CreateTime categories git 使用 VisualStudio 比较分支更改 lindexi 2018-08-10 19:16:52 +0800 ...
- Laravel实现找回密码及密码重置的例子
https://mp.weixin.qq.com/s/PO5f5OJPt5FzUZr-7Xz8-g Laravel实现找回密码及密码重置功能在php实现与在这里实现会有什么区别呢,下面我们来看看Lar ...
- poj 1279 Art Gallery (Half Plane Intersection)
1279 -- Art Gallery 还是半平面交的问题,要求求出多边形中可以观察到多边形所有边的位置区域的面积.其实就是把每一条边看作有向直线然后套用半平面交.这题在输入的时候应该用多边形的有向面 ...
- cf1234-div3
A 水题 B 直接看2,发现`unordered_map被卡了...` 乖乖离散化 C 有六种水管,可以任意的旋转,使得有一条从(1, 0)到(2, n)的通路. 找规律,当时写D没来得及看 #inc ...
- hdu 4394 Digital Square(bfs)
Digital Square Time Limit: 2000/1000 MS (Java/Others) Memory Limit: 32768/32768 K (Java/Others)To ...
- hadoop 端口总结
localhost:50030/jobtracker.jsp localhost:50060/tasktracker.jsp localhost:50070/dfshealth.jsp 1. Name ...
- js基础——正则表达式
1.创建方式: var box = new RegExp('box');//第一个参数字符串 var box = new RegExp('box','ig');//第二个参数可选模式修饰符 等同于 v ...