K8s dashboard 安装过程(Chrome无法打开)

通过k8s官网安装dashboard完成之后，结果通过Chrome无法打开k8s kubernetes dashboard，报错误：您的链接不是私密链接。查了一番资料，发现是dashboard证书无效，需要更新证书才可访问。一下是本人问题解决的过程，供大家参考。

1. 第一步：通过官方yaml文档安装kubernetes dashboard
2. 第二步：更新无效的secrete，通过自签证书重新创建secrete

1. 通过官方文档安装其实很简单，直接通过官方的yaml文件创建dashboard即可

# 先使用官方默认配置创建dashboard
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml

# 如果获取yaml文件失败，可以先通过浏览器打开该yaml文件，然后复制所有内容再本地创建一个yaml文件
# kubectl apply -f 本地的.yaml文件

查看是否安装成功

» kubectl get svc -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.103.214.52           8000/TCP        14d
kubernetes-dashboard        ClusterIP   10.102.132.61           443/TCP         14d

# 拥有kubernetes-dashboard service则表示安装成功

2. 更新无效的secrete，通过自签证书重新创建secrete

1. 更改dashboard的service类型为Nodeport, 这样就可以直接将服务映射到本地, 通过端口访问

» kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard
1 # Please edit the object below. Lines beginning with a '#' will be ignored,
2 # and an empty file will abort the edit. If an error occurs while saving this file will be
3 # reopened with the relevant failures.
4 #
5 apiVersion: v1
6 kind: Service
7 metadata:
8   creationTimestamp: "2020-04-21T17:34:01Z"
9   labels:
10     k8s-app: kubernetes-dashboard
11   name: kubernetes-dashboard
12   namespace: kubernetes-dashboard
16 spec:
17   clusterIP: 10.105.195.26
18   ports:
19   - port: 443
20     protocol: TCP
21     targetPort: 8443
22   selector:
23     k8s-app: kubernetes-dashboard
24   sessionAffinity: None
25   type: ClusterIP    # < ----- 改为 NodePort

验证svc是否修改成功

» kubectl get svc -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.103.214.52           8000/TCP        14d
kubernetes-dashboard        NodePort    10.102.132.61           443:30000/TCP   14d

# service 的类型变为NodePort, 表明修改成功

2. 删除默认的secret：kubernetes-dashboard-certs

» kubectl delete secret -n kubernetes-dashboard kubernetes-dashboard-certs

3. 自己签发证书（为访问的ip，以192.168.246.200为例）

» mkdir keys & cd keys

» openssl genrsa -out tls.key 2048

» openssl req -new -out tls.csr -key tls.key -subj '/CN=192.168.246.200'

» openssl x509 -req -in tls.csr -signkey tls.key -out tls.crt

» ls
tls.crt tls.csr tls.key

4. 根据新的证书，创建secret

» cd keys # 如果本身就在keys文件夹下，则可以省略该步骤

» kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kubernetes-dashboard

5. 修改kubernetes-dashboard deployment,启用新的secret

» kubectl edit deploy kubernetes-dashboard -n kubernetes-dashboard
...
 31   template:
 32     metadata:
 33       creationTimestamp: null
 34       labels:
 35         k8s-app: kubernetes-dashboard
 36     spec:
 37       containers:
 38       - args:
 41         - --auto-generate-certificates
 42         - --namespace=kubernetes-dashboard
 43         image: kubernetesui/dashboard:v2.0.0
 44         imagePullPolicy: Always
...

# 在args中添加两行
       containers:
       - args:
         - --tls-cert-file=/tls.crt
         - --tls-key-file=/tls.key
      
      
# 添加之后
...
 31   template:
 32     metadata:
 33       creationTimestamp: null
 34       labels:
 35         k8s-app: kubernetes-dashboard
 36     spec:
 37       containers:
 38       - args:
 39         - --tls-cert-file=/tls.crt   < ----- 这里
 40         - --tls-key-file=/tls.key    < ----- 这里
 41         - --auto-generate-certificates
 42         - --namespace=kubernetes-dashboard
 43         image: kubernetesui/dashboard:v2.0.0
 44         imagePullPolicy: Always
 ...

6. 查询出kubernetes-dashboard的service所映射的端口，通过ip+端口访问即可

» kubectl get svc -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.103.214.52           8000/TCP        14d
kubernetes-dashboard        NodePort    10.102.132.61           443:30000/TCP   14d

# kubernetes-dashboard service 映射到本地的端口为 3000

浏览器打开（以192.168.246.200为dashboard所在节点）https://192.168.246.200:30000/#/login