版权声明：转载注明出处 https://blog.csdn.net/AtlanSI/article/details/88544500
K8s集群配置dashboard
1.环境描述
其余细节环境和上一篇文章一样
https://blog.csdn.net/AtlanSI/article/details/87946010
| 主机名 | IP | 集群角色 |
|---|---|---|
| C7-1 | 192.168.8.70 | master |
| C7-2 | 192.168.8.71 | node1 |
| C7-3 | 192.168.8.72 | node2 |
2.安装dashboard
访问dashboard项目官方地址：https://github.com/kubernetes/dashboard
2.1 在master上执行如下命令
[root@C7-1 ~]# kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
查看一下pod的运行状况
[root@C7-1 ~]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-86c58d9df4-r7kp9 1/1 Running 196 15d
coredns-86c58d9df4-sfwmp 1/1 Running 199 15d
etcd-c7-1 1/1 Running 13 15d
kube-apiserver-c7-1 1/1 Running 16 15d
kube-controller-manager-c7-1 1/1 Running 16 15d
kube-flannel-ds-amd64-h7kmx 1/1 Running 19 15d
kube-flannel-ds-amd64-jxpdq 1/1 Running 13 15d
kube-flannel-ds-amd64-r2pm6 1/1 Running 16 15d
kube-proxy-7sh9j 1/1 Running 12 15d
kube-proxy-qpb99 1/1 Running 16 15d
kube-proxy-tt2c4 1/1 Running 14 15d
kube-scheduler-c7-1 1/1 Running 17 15d
kubernetes-dashboard-57df4db6b-bqj5p 1/1 Running 0 8s
查看一下dashboard的pod运行状况，为Running，即可开始后续操作。如显示ImagePullError，进入下方操作
在K8S集群的所有node节点上运行如下命令
[root@C7-2 ~]# docker pull mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1
[root@C7-2 ~]# docker tag mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1 k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
[root@C7-3 ~]# docker pull mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1
[root@C7-3 ~]# docker tag mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1 k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
2.2 配置Service
查看创建时的yaml文件发现，默认没有将端口发布出去
于是才用打补丁的方式，将dashboard的端口发布出去
[root@C7-1 ~]# kubectl get svc -n kube-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP 15d
kubernetes-dashboard ClusterIP 10.106.249.245 <none> 443/TCP 10m
[root@C7-1 ~]# kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kube-system
[root@C7-1 ~]# kubectl get svc -n kube-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP 15d
kubernetes-dashboard NodePort 10.106.249.245 <none> 443:30115/TCP 147m
2.3 测试访问
浏览器输入https://集群任意IP:端口号
注意是https
到了此步骤可以发现K8S dashboard一共有两种登陆方式，本文会介绍两种方式
3.认证配置
3.1 令牌方式
== 认证时的账号必须为ServiceAccount：被dashboard pod拿来由kubernetes进行认证==
3.1.1 集权全部权限
3.1.1.1 创建ServiceAccount
[root@C7-1 ~]# kubectl create serviceaccount dashboard-admin -n kube-system
3.1.1.2 绑定相关role
[root@C7-1 ~]# kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
- –clusterrole:指定使用的集群角色,系统默认自带很多，
- –serviceaccount：指定认证使用的ServiceAccount,由第一步创建
3.1.1.3 获取ServiceAccount使用的Secret
[root@C7-1 ~]# kubectl describe sa dashboard-admin -n kube-system
Name: dashboard-admin
Namespace: kube-system
Labels: <none>
Annotations: <none>
Image pull secrets: <none>
Mountable secrets: dashboard-admin-token-vfgqh
Tokens: dashboard-admin-token-vfgqh
Events: <none>
由此可知 dashboard-admin-token-vfgqh为使用的Secret
3.1.1.4 获取token
[root@C7-1 ~]# kubectl describe secret dashboard-admin-token-vfgqh -n kube-system
Name: dashboard-admin-token-vfgqh
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: 3669b2a5-458d-11e9-aa4f-000c29724115
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1025 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tdmZncWgiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMzY2OWIyYTUtNDU4ZC0xMWU5LWFhNGYtMDAwYzI5NzI0MTE1Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.Gzu_tcSftPD5i8n_cQGeDn46HIAS75CfzbBcp3LVh2hpDwayVr7VdWVt_F3sLYAkOCfAzuGurC7Dby_4dTw18x1AuRJL1PGR5oklvzqTj5kmiF0ek6jDb6tl6OkMVSka5xFZMbaLkX48fs8M5SQbi1GtshAC1AKKY6vzirHccB0Rjzpb_qRqii83-azjXFmsR-V5mlMxaI9z1YhCXX95-IAvoVVVHOzQ1b4MP88oVOJ8Z34vj2x1hu4mUWaQbBFvZNQzJdkdB7Ez9F2OeV-HPrpzF0McQW34jrgFSToiH06t_zK3NANLN-f7z2Sqs-VgXCta91l_pfmSkle6YPpZWA
上方命令输出的最后一行，即是认证token，全部复制到登陆页面即可登陆
3.1.1.5 验证
3.1.2 部分权限
此处使用RBAC中rolebinding的特性
3.1.2.1 创建ServiceAccount
[root@C7-1 ~]# kubectl create serviceaccount def-ns-admin
3.1.2.2 绑定相关role
[root@C7-1 ~]# kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin
3.1.2.3 获取ServiceAccount使用的Secret
[root@C7-1 ~]# kubectl get sa
NAME SECRETS AGE
admin 1 3d7h
def-ns-admin 1 20m
default 1 15d
[root@C7-1 ~]# kubectl describe sa def-ns-admin
Name: def-ns-admin
Namespace: default
Labels: <none>
Annotations: <none>
Image pull secrets: <none>
Mountable secrets: def-ns-admin-token-c2d99
Tokens: def-ns-admin-token-c2d99
Events: <none>
由此可知 def-ns-admin-token-c2d99 为使用的Secret
3.1.2.4 获取token
[root@C7-1 ~]# kubectl describe secret def-ns-admin-token-c2d99
Name: def-ns-admin-token-c2d99
Namespace: default
Labels: <none>
Annotations: kubernetes.io/service-account.name: def-ns-admin
kubernetes.io/service-account.uid: 60f41626-458e-11e9-aa4f-000c29724115
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1025 bytes
namespace: 7 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi1jMmQ5OSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI2MGY0MTYyNi00NThlLTExZTktYWE0Zi0wMDBjMjk3MjQxMTUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.hOdcw0vu8oqE4ACXVwSEXWGe6ZS_lKUUeiWbRBZGM_Us0cY_6eriL-T0ru6kbEpUe3vnynBylaf9cIGroG99Jn8dycaYF_HIxOeCyMntUWJAnOa5ab1qUENrihi2sbCt7VmKNzBWCSYHvycpWwSD-4quDE3FRRxdCXwLjJQNI3w7S_S7MZOS0haRWaS6ax9Opkrh7eUaqA--iSdiZ421F7_GiM44oJbCEkT9MxwLwwegE22tl022qpkAzpngDtxV11ZvjCimKFGFSwJrtNLxLhzwgX24dCUw47iuLcAm97eNDMjO-C3MuM05kYU2gOm7A1mBTIBaKd-Hlc4v2-_LEA
上方命令输出的最后一行，即是认证token，全部复制到登陆页面即可登陆
3.1.2.5 验证
3.2 kubeconfig认证方式
此认证方式相对麻烦，此处才用RBAC中的特性set-credentials
如果不适用上述方式，则需要使用k8s的ca对新用户进行签证，Secret中使用签发的证书
此处才用上方部分权限中的token
为了省事，此处直接才用上方的SeriveAccount
如不想使用，请重复上方 创建ServiceAccount 绑定相关role 获取ServiceAccount使用的Secret
3.2.1 获取解码后的token
[root@C7-1 ~]# DEF_NS_ADMIN_SECRET=$(kubectl get secret def-ns-admin-token-c2d99 -o jsonpath={.data.token} | base64 -d )
3.2.2 生成配置文件
[root@C7-1 ~]# kubectl config set-cluster kubernetes --kubeconfig=/root/def-ns-admin.conf
#设置集群 保存到文件
[root@C7-1 ~]# kubectl config set-credentials def-ns-admin --token=$DEF_NS_ADMIN_SECRET --kubeconfig=/root/def-ns-admin.conf
#设置用户，credentials 保存到文件
[root@C7-1 ~]# kubectl config set-context def-ns-admin@kubernetes --cluster=kubernetes --user=def-ns-admin --kubeconfig=/root/def-ns-admin.conf
#设置用户和集群的关系 保存到文件
[root@C7-1 ~]# kubectl config use-context def-ns-admin@kubernetes --kubeconfig=/root/def-ns-admin.conf
#设置使用那个用户 保存到文件
将文件复制出来
3.2.3 验证
