Kubernetes1.14.2实践 - Dashboard配置

上篇文章介绍了k8s1.14.2的安装,本文介绍k8s Dashboard的配置。由于heapster镜像pull的限制,Dashboard的配置也需要复杂的操作。

一、安装heapster

  1. 配置k8s yaml文件

     创建目录~/heapster,复制以下四个文件的内容到heapster目录下
         https://github.com/kubernetes-retired/heapster/tree/master/deploy/kube-config/influxdb/grafana.yaml
         https://github.com/kubernetes-retired/heapster/tree/master/deploy/kube-config/influxdb/heapster.yaml
         https://github.com/kubernetes-retired/heapster/tree/master/deploy/kube-config/influxdb/influxdb.yaml
         https://github.com/kubernetes-retired/heapster/tree/master/deploy/kube-config/rbac/heapster-rbac.yaml
    
  2. 替换文件中的镜像地址

     sed -i 's/k8s.gcr.io/ist0ne/g' grafana.yaml 
     sed -i 's/k8s.gcr.io/ist0ne/g'  heapster.yaml
     sed -i 's/k8s.gcr.io/ist0ne/g'  influxdb.yaml
     如果镜像pull失败服务状态为ImagePullBackOff, 可以尝试其他镜像(docker search heapster)
  3. 安装heapster

     kubectl create -f heapster/

二、安装dashboard

      wget https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
      sed -i 's/k8s.gcr.io/loveone/g' kubernetes-dashboard.yaml
      sed -i '/targetPort:/a\ \ \ \ \ \ nodePort: 30001\n\ \ type: NodePort' kubernetes-dashboard.yaml
      kubectl create -f kubernetes-dashboard.yaml

三、检查安装

    kubectl get deployment kubernetes-dashboard -n kube-system
    kubectl get pods -n kube-system -o wide
    kubectl get services -n kube-system

四、浏览器访问Dashboard

    https://192.168.33.10:30001
    默认配置中,服务端挂载的是一个空证书,浏览器无法正常访问

Kubernetes1.14.2实践 - Dashboard配置_第1张图片

五、 为Dashboard提供完成的TLS证书

    mkdir  -p ~/kubernetes/yml/tls
    cd ~/kubernetes/yml/tls
  1. 创建自签名CA

      openssl genrsa -out ca.key 2048
      openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj "/C=CN/ST=HB/L=WH/O=DM/OU=YPT/CN=CA"
      openssl x509 -in ca.crt -noout -text
  2. 签发Dashboard证书

     openssl genrsa -out dashboard.key 2048
     openssl req -new -sha256 -key dashboard.key -out dashboard.csr -subj "/C=CN/ST=HB/L=WH/O=DM/OU=YPT/CN=192.168.33.10"
     cat dashboard.cnf 
     openssl x509 -req -sha256 -days 3650 -in dashboard.csr -out dashboard.crt -CA ca.crt -CAkey ca.key -CAcreateserial -extfile dashboard.cnf
     openssl x509 -in dashboard.crt -noout -text
  3. 挂载证书到Dashboard

     kubectl delete -f kubernetes-dashboard.yml 
     kubectl create secret generic kubernetes-dashboard-certs --from-file="tls/dashboard.crt,tls/dashboard.key" -n kube-system 
     kubectl get secret kubernetes-dashboard-certs -n kube-system -o yaml
     kubectl apply -f kubernetes-dashboard.yml 
    
    

六、创建令牌使用令牌访问

    kubectl create serviceaccount  dashboard-admin -n kube-system
    kubectl create clusterrolebinding  dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
    kubectl describe secrets -n kube-system $(kubectl -n kube-system get secret | awk '/dashboard-admin/{print $1}')

Kubernetes1.14.2实践 - Dashboard配置_第2张图片

输入令牌进行访问:

Kubernetes1.14.2实践 - Dashboard配置_第3张图片

查看工作负载:

Kubernetes1.14.2实践 - Dashboard配置_第4张图片

Created by 苏亚强([email protected]) on 2019/8/12.

你可能感兴趣的:(kubernetes)