k8s Dashboard部署

1.下载Dashboard所需要用到的yaml文件

wget https://www.cloudelf.cn/kubernetes/kubernetes-dashboard.yaml

修改此yaml文件为：
1).注释掉Dashboard Secret ，不然后面访问显示网页不安全，证书过期，我们自己生成证书。
2).因为我选择nodeport访问dashboard，所以将service type字段设置为nodeport,并指定nodeport为40000，如下图

image.png

# ------------------- Dashboard Secret ------------------- #
将这些都注释掉
#apiVersion: v1
#kind: Secret
#metadata:
#  labels:
#    k8s-app: kubernetes-dashboard
#  name: kubernetes-dashboard-certs
#  namespace: kube-system
#type: Opaque

#---
# ------------------- Dashboard Service Account ------------------- #
省略
---
# ------------------- Dashboard Role & Role Binding ------------------- #
省略
---
省略
---
# ------------------- Dashboard Deployment ------------------- #

不用修改，省略
# ------------------- Dashboard Service ------------------- #

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kube-system
spec:
  type: NodePort
  ports:
    - port: 443
      nodePort: 40000
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard

生成pod
kubectl apply -f kubernetes-dashboard.yaml

2、搭建完kubernetes在通过谷歌浏览器访问dashboard的时候会有如下提示,这是我自己亲自趟的坑，各大网站翻遍了，至少试了有十几种方法，然而我现在也不敢确定我这种百分百正确，只是实现了，因为中间试的方法太多了。

既然都趟完坑了，那我就一开始告诉你们，从源头解决它，
能够顺利通过谷歌浏览器打开自己部署的kubernetes UI界面

mkdir key && cd key
#生成证书
openssl genrsa -out dashboard.key 2048 
#我这里写的自己的node1节点，因为我是通过nodeport访问的；如果通过apiserver访问，可以写成自己的master节点ip
openssl req -new -out dashboard.csr -key dashboard.key -subj '/CN=192.168.135.129'
openssl x509 -req -in dashboard.csr -signkey dashboard.key -out dashboard.crt 
#删除原有的证书secret
kubectl delete secret kubernetes-dashboard-certs -n kube-system
#创建新的证书secret
kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt -n kube-system
#查看pod
kubectl get pod -n kube-system
#重启pod
kubectl delete pod kubernetes-dashboard-78dc5f9d6b-zgvr6  -n kube-system

再一次创建dashboard pod
kubectl apply -f kubernetes-dashboard.yaml

3.创建绑定用户

1.创建一个叫admin-user的服务账号:
[root@k8s01 ~]# cat admin-user.yaml 
# admin-user.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system
[root@k8s01 ~]# kubectl create -f admin-user.yaml

2.直接绑定admin角色:
[root@k8s01 ~]# cat admin-user-role-binding.yaml 
# admin-user-role-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system
[root@k8s01 ~]# kubectl create -f  admin-user-role-binding.yaml

查看绑定信息

4.Heapster是容器集群监控和性能分析工具（非必须）

wget https://www.cloudelf.cn/kubernetes/influxdb.yaml
wget https://www.cloudelf.cn/kubernetes/grafana.yaml
wget https://www.cloudelf.cn/kubernetes/heapster.yaml
wget https://www.cloudelf.cn/kubernetes/heapster-rbac.yaml
[root@k8s01 ~] # kubectl create -f influxdb.yaml
[root@k8s01 ~] # kubectl create -f grafana.yaml
[root@k8s01 ~] # kubectl create -f heapster.yaml
[root@k8s01 ~] # kubectl create -f heapster-rbac.yaml
[root@k8s01 ~] # kubectl get pods --namespace=kube-system
NAME                                READY       STATUS     RESTARTS    AGE
heapster-844d66dcb7-xzhjs           1/1           Running       0     1h
kubernetes-dashboard-78dc5f9d6b-qglnd 1/1         Running       0     2h
monitoring-grafana-555bb9c5c9-597j7 1/1           Running       0     1h
monitoring-influxdb-ddbcd4f99-8lp7z 1/1           Running       0     1h

[root@master yaml]# kubectl cluster-info
Kubernetes master is running at http://localhost:8080
Heapster is running at http://localhost:8080/api/v1/namespaces/kube-system/services/heapster/proxy
monitoring-grafana is running at http://localhost:8080/api/v1/namespaces/kube-system/services/monitoring-grafana/proxy
monitoring-influxdb is running at http://localhost:8080/api/v1/namespaces/kube-system/services/monitoring-influxdb/proxy

[root@master yaml]# kubectl -n kube-system get service 
NAME                   TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE
heapster               ClusterIP   10.0.0.206           80/TCP          3h
kubernetes-dashboard   NodePort    10.0.0.30            443:40000/TCP   1h
monitoring-grafana     ClusterIP   10.0.0.152           80/TCP          3h
monitoring-influxdb    ClusterIP   10.0.0.32            8086/TCP        3h

5.谷歌浏览器访问 https://192.168.135.129:40000

登陆所需要的token 获取方法：

kubectl -n kube-system get secret

查询该用户token认证，复制此token

kubectl -n kube-system describe secret admin-user-token-wvlxs

image.png

成功

问题汇总：若master 指定nodeport 在node 查看端口没有起来，查看kube-proxy是否正常running
若端口起来，但是telnet 连不进去端口，开启路由转发

image.png