kubernetes 部署Dashboard

下载配置文件并生效

[root@k8s001 soft]# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta4/aio/deploy/recommended.yaml
[root@k8s001 soft]#  kubectl apply -f recommended.yaml

查看pod状态

[root@k8s001 soft]# kubectl get pods --all-namespaces | grep dashboard
kubernetes-dashboard   dashboard-metrics-scraper-665b55f67d-mbxw2   1/1     Running   0          52s
kubernetes-dashboard   kubernetes-dashboard-5b5bd8dd4c-jb6nf        1/1     Running   0          52s

创建用户

[root@k8s001 soft]# vi dashboard-adminuser.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system
[root@k8s001 soft]# kubectl apply -f dashboard-adminuser.yaml
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user created

生成证书

[root@k8s001 soft]# grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt
[root@k8s001 soft]# grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key
[root@k8s001 soft]# openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name "kubernetes-client"
Enter Export Password:
Verifying - Enter Export Password:
# 提示密码直接按回车跳过
[root@k8s001 soft]# ll |grep kubecfg
-rw-r--r-- 1 root root     1147 May 11 11:31 kubecfg.crt
-rw-r--r-- 1 root root     1675 May 11 11:31 kubecfg.key
-rw-r--r-- 1 root root     2512 May 11 11:31 kubecfg.p12
# kubecfg.p12即需要导入客户端机器的证书. 将证书拷贝到本机, 导入即可

登录界面

访问地址：https://<公网ip>:6443/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/#/login，选择对应证书即可

image.png

获取token

[root@k8s001 soft]# kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
Name:         admin-user-token-xhc7v
Namespace:    kube-system
Labels:       
Annotations:  kubernetes.io/service-account.name: admin-user
              kubernetes.io/service-account.uid: 81bbba91-f394-427f-9ec8-468719a08573

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1066 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6Im4zTHBXMl9oVVczcHlXOXFUazlPYzN1bUItV1ZjckhoYnJ5azk5MlJRejAifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLXhoYzd2Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI4MWJiYmE5MS1mMzk0LTQyN2YtOWVjOC00Njg3MTlhMDg1NzMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.4fTwag3cKWr7ukrW3mOFQYG2bj_-7UaRw9MuEgcnEXCbkr68IhqgT1XXHvrVsZRSd3uxVTFf7P2NFjFJ6uLtl9B4HeCB22JwDJhLTvF3m-Ewqqo_mZeiRHN-rX7jOaFjHEAyySykH-LVTmx83S9q5U0gvCmC2jxDMkem9No8Qb17i3n1BRZp5eRhY2DTa58VpPDnnrXYMecCnx5A7XWiqdz7Nmrtpn0vQ1IVVFFqPsu6Q5RBAeuyftiYys3-VMUICfvUZsP-W-gtz2yQS5ISThFa1mVxwhHDaumTRA4WcyE2EClBunkEhQCxT9jTU6OY3EUUteED4l5lT0W-wIr_Rg

将对应token填入，即可登录页面

image.png