kuberneter dashboard 安装番外篇（无数次重装）

kuberneter dashboard 安装番外篇（无数次重装）

@(k8s)

安装heapster，解决健康检查报错

[root@k8s-master01 dashboard4friend]# pwd
/root/dashboard4friend
[root@k8s-master01 dashboard4friend]# ll
total 48
drwxr-xr-x 2 root root  4096 Sep 23 15:51 after-baocuo
-rw-r--r-- 1 root root 35425 Sep 23 15:55 history.log
-rw-r--r-- 1 root root  4712 Sep 18 16:13 kubernetes-dashboard1.10.1.yaml
[root@k8s-master01 dashboard4friend]# 

  763  mkdir after-baocuo
  764  cd after-baocuo/
 765  wget https://raw.githubusercontent.com/kubernetes/heapster/master/deploy/kube-config/influxdb/grafana.yaml
  766  wget https://raw.githubusercontent.com/kubernetes/heapster/master/deploy/kube-config/influxdb/influxdb.yaml
  767  wget https://raw.githubusercontent.com/kubernetes/heapster/master/deploy/kube-config/influxdb/heapster.yaml
  768  wget https://raw.githubusercontent.com/kubernetes/heapster/master/deploy/kube-config/rbac/heapster-rbac.yaml
  769  ll
  770   cat  heapster.yaml | grep image
  771   cat  grafana.yaml | grep image
  772   cat  influxdb.yaml | grep image
  773  vim heapster-rbac.yaml 
  774  docker pull mirrorgooglecontainers/heapster-grafana-amd64:v5.0.4
  775  docker pull mirrorgooglecontainers/heapster-amd64:v1.5.4
  776  docker pull mirrorgooglecontainers/heapster-influxdb-amd64:v1.5.2
  777  docker images |grep heapster
  778  docker tag mirrorgooglecontainers/heapster-grafana-amd64:v5.0.4  k8s.gcr.io/heapster-grafana-amd64:v5.0.4
  779  docker tag mirrorgooglecontainers/heapster-amd64:v1.5.4 k8s.gcr.io/heapster-amd64:v1.5.4
  780  docker tag mirrorgooglecontainers/heapster-influxdb-amd64:v1.5.2 k8s.gcr.io/heapster-influxdb-amd64:v1.5.2
   781  ll
  782  kubectl apply -f .
  783  kubectl delete -f .
  784  vim heapster.yaml
  785  vim heapster-rbac.yaml 
  786  kubectl apply -f .

下载镜像，配了阿里镜像加速器后飞快

修改配置文件：

修改 kubernetes-dashboard1.10.1.yaml

修改 heapster.yaml

修改 grafana.yaml

修改 influxdb.yaml

kubectl apply -f .

[root@k8s-master01 after-baocuo]# kubectl get pods -A -o wide

安装dashboard

726  cd dashboard4friend/
  727  ll
  728  vim kubernetes-dashboard1.10.1.yaml 
  729  kubectl apply -f kubernetes-dashboard1.10.1.yaml 
  730  vim kubernetes-dashboard1.10.1.yaml 
  731  docker images
  732  docker pull gcr.azk8s.cn/google-containers/kubernetes-dashboard-amd64:v1.10.1
  733  docker images
  734  docker tag gcr.azk8s.cn/google-containers/kubernetes-dashboard-amd64:v1.10.1 k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
  735  docker images

docker pull gcr.azk8s.cn/google-containers/kubernetes-dashboard-amd64:v1.10.1
docker tag gcr.azk8s.cn/google-containers/kubernetes-dashboard-amd64:v1.10.1 k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
docker rmi gcr.azk8s.cn/google-containers/kubernetes-dashboard-amd64:v1.10.1

下载镜像

apply

获取token:

[root@k8s-worker02 ~]# kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep kubernetes-dashboard-token | awk '{print $1}')

用火狐浏览器访问集群内任意一节点ip:30001

粘贴上面获取到的token:

成功：

配置外网域名访问

先在master节点上导出客户端证书，用于nginx做证书代理

# 生成client-certificate-data
grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt

# 生成client-key-data
grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key

nginx – k8s-dashboard.conf

upstream k8s-dashboard {
 server 192.168.0.112:30001;
}

server {
  server_name k8s-dashboard.xxx.com;
  charset utf-8;
  client_max_body_size 200M;
  listen 443 ssl;
  ssl_certificate /home/admin/tencent_ssl//Nginx/1_xxx.com_bundle.crt;
  ssl_certificate_key /home/admin/tencent_ssl/Nginx/2_xxx.com.key;
  ssl_session_timeout 5m;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
  ssl_prefer_server_ciphers on;

  
  location / {
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_ssl_trusted_certificate /home/admin/k8s-ssl/ca.crt;   # Kubernetes CA证书
    proxy_ssl_certificate /home/admin/k8s-ssl/kubecfg.crt;      # 客户端证书
    proxy_ssl_certificate_key /home/admin/k8s-ssl/kubecfg.key; 
    proxy_pass https://k8s-dashboard;
 }
}

server{
	if ($host = k8s-dashboard.xxx.com) {
		return 301 https://$host$request_uri;
	}

	listen 80;
	server_name k8s-dashboard.xxx.com;
	return 404;
}

用火狐访问：https://k8s-dashboard.xxx.com