kubernetes addons dashboard

一、准备

• 官方文档

• kubernetes 1.8.3

• dashboard 1.8.0

二、安装

下载官方yaml文件

wget https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/recommended/kubernetes-dashboard.yaml

在service添加

kubernetes.io/cluster-service: "true"

# ------------------- Dashboard Service ------------------- #

apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: kubernetes-dashboard
    kubernetes.io/cluster-service: "true"
  name: kubernetes-dashboard
  namespace: kube-system
spec:
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard

安装

kubectl apply -f /etc/kubernetes/addons/dashboard/kubernetes-dashboard.yaml

三、验证

安装成功后的状态

[root@node1 ~]# kubectl cluster-info 
Kubernetes master is running at https://192.168.1.121:6443
dnsmasq is running at https://192.168.1.121:6443/api/v1/namespaces/kube-system/services/dnsmasq/proxy
KubeDNS is running at https://192.168.1.121:6443/api/v1/namespaces/kube-system/services/kube-dns/proxy
kubernetes-dashboard is running at https://192.168.1.121:6443/api/v1/namespaces/kube-system/services/kubernetes-dashboard/proxy

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

[root@node1 ~]# kubectl get po -o wide -n kube-system
NAME                                    READY     STATUS    RESTARTS   AGE       IP              NODE
calico-node-7mvzn                       1/1       Running   1          23h       192.168.1.123   node3
calico-node-hgqm2                       1/1       Running   1          23h       192.168.1.124   node4
calico-node-jpd8g                       1/1       Running   1          23h       192.168.1.121   node1
calico-node-x7krm                       1/1       Running   1          23h       192.168.1.122   node2
dnsmasq-775767cfd7-mqcpf                1/1       Running   1          23h       10.233.74.68    node4
dnsmasq-775767cfd7-qwgd6                1/1       Running   1          23h       10.233.71.50    node3
dnsmasq-autoscaler-856b5c899b-cr8xg     1/1       Running   1          23h       10.233.71.48    node3
kube-apiserver-node1                    1/1       Running   2          23h       192.168.1.121   node1
kube-controller-manager-node1           1/1       Running   2          23h       192.168.1.121   node1
kube-dns-cf9d8c47-krxnb                 3/3       Running   3          23h       10.233.75.2     node2
kube-dns-cf9d8c47-ww4lk                 3/3       Running   3          23h       10.233.74.67    node4
kube-proxy-node1                        1/1       Running   1          23h       192.168.1.121   node1
kube-proxy-node2                        1/1       Running   1          23h       192.168.1.122   node2
kube-proxy-node3                        1/1       Running   1          23h       192.168.1.123   node3
kube-proxy-node4                        1/1       Running   1          23h       192.168.1.124   node4
kube-scheduler-node1                    1/1       Running   2          23h       192.168.1.121   node1
kubedns-autoscaler-86c47697df-dh4lr     1/1       Running   1          23h       10.233.71.51    node3
kubernetes-dashboard-7486b894c6-rshss   1/1       Running   0          51m       10.233.71.58    node3
nginx-proxy-node2                       1/1       Running   1          23h       192.168.1.122   node2
nginx-proxy-node3                       1/1       Running   1          23h       192.168.1.123   node3
nginx-proxy-node4                       1/1       Running   1          23h       192.168.1.124   node4

[root@node1 ~]# kubectl get svc -n kube-system  
NAME                   TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)         AGE
dnsmasq                ClusterIP   10.233.0.2            53/TCP,53/UDP   23h
kube-dns               ClusterIP   10.233.0.3            53/UDP,53/TCP   23h
kubernetes-dashboard   NodePort    10.233.0.93           443:31805/TCP   52m

四、访问

Dashboard大多数问题就出现在访问上

1.7及以上访问

我们这里直接使用API Server访问

地址是：

https://192.168.1.121:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/

结果是：Unauthorized未授权

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {
    
  },
  "status": "Failure",
  "message": "Unauthorized",
  "reason": "Unauthorized",
  "code": 401
}

这时我们只需要把admin证书导入浏览器就可以，上传之前转换一下

openssl pkcs12 -export -in admin-node1.pem -out admin.p12 -inkey admin-node1-key.pem

把生成的证书admin.p12导入浏览器。就可以访问了

五、授权

dashboard1.7及以上版本支持使用token或kubeconfig文件做登录认证

token

创建一个 admin 用户并授予 admin 角色绑定，使用下面的 yaml 文件创建 admin 用户并赋予他管理员权限，然后可以通过 token 登陆 dashbaord

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: admin
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: admin
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: kube-system
  labels:
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile

对于其他命名空间的其他用户只要修改上述 yaml 中的 name 和 namespace 字段即可

[root@node1 ~]# kubectl -n kube-system get secret|grep admin-token
admin-token-m7m8b                             kubernetes.io/service-account-token   3         41s


[root@node1 ~]# kubectl -n kube-system describe secret admin-token-m7m8b
Name:         admin-token-m7m8b
Namespace:    kube-system
Labels:       
Annotations:  kubernetes.io/service-account.name=admin
              kubernetes.io/service-account.uid=6ceade3d-dcdc-11e7-b30c-080027926e0a

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1090 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi10b2tlbi1tN204YiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJhZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjZjZWFkZTNkLWRjZGMtMTFlNy1iMzBjLTA4MDAyNzkyNmUwYSIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTphZG1pbiJ9.Nlcmuv6e8A78y8XKr-Qv2Bj1jddPvC6rYiHYqwfkf0IwzTIqM1mTyY34XEuuOTzE0pxAoI_uBlFyT7uadw9_cQhGEHNXRvtbr4J_K1bUAV-o1cQ_s9tiTeT4CJY_X2q72uVV5xfcrNKEgcbX1B2g5FzwaQ3N57Q5UiNyh4mI4hj5nmmZksHgnh9UAJaQF7wX83JKPHIy_ectuPJbdfRunARymWkl4hd7uvPBDJi5XV9VnC4HzUMV-k4SWU815OhkPhk5M0bkisDe-WOTvZIxTwCAwvWzJZB4tyzb9UHu0fpHv-XYG0M1eumj6vRCpHDd_gsEw66m1N3Nzxys6P_tCg

使用获取的token登录即可。

把获取到的token加入到你目前使用的kubeconfig文件中，就可以直接使用文件登录了

例如：

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JS......
    server: https://192.168.1.121:6443
  name: cluster.local
contexts:
- context:
    cluster: cluster.local
    namespace: kube-system
    user: test
  name: admin-cluster
current-context: admin-cluster
kind: Config
preferences: {}
users:
- name: test
  user:
    as-user-extra: {}
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk.....
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLR.....
    token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVC.....