Kubernetes Dashboard 是 Kubernetes 的官方 Web UI。使用 Kubernetes Dashboard,您可以:
例如:您可以伸缩一个 Deployment、执行滚动更新、重启一个 Pod 或部署一个新的应用程序
以上文字翻译自 Kubernetes 官方文档。Kuboard 的定位和 Dashboard 是相似的,主要的区别 在于:
为了帮助大家选择适合自己的工具,本文将详细描述如何在 Kubernetes 集群中安装 Kubernetes Dashboard。
参考文章:https://kuboard.cn/install/install-k8s-dashboard.html#
#在master上下载,安装dashboard只要在master节点操作
wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta4/aio/deploy/recommended.yaml
PS:如果发现该链接失效,请访问https://github.com/kubernetes/dashboard,然后查找最新的链接。
修改yaml文件,这里由于使用自签证书,要重建secret ,需要删除secret部分
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-certs
namespace: kubernetes-dashboard
type: Opaque
---
这里顺便修改一下service资源对象,更改为nodeport类型,以供外网访问。
---
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
# 添加Service的type为NodePort,注意大小写
type: NodePort
ports:
- port: 443
targetPort: 8443
# 添加映射到虚拟机的端口,k8s只支持30000以上的端口
nodePort: 32201
selector:
k8s-app: kubernetes-dashboard
---
创建SSL证书需要私钥和证书签名请求。这些可以通过一些简单的命令生成。当openssl req命令要求输入“密码”时,只需按回车键,密码为空。
#创建一个dashboard的私钥
openssl genrsa -out dashboard.key 2048
#生成一个证书签署请求
openssl req -new -key dashboard.key -out dashboard.csr
#通过.key和.crt签署证书,dashboard.crt文件是适用于仪表板和dashboard.key私钥的证书。
openssl x509 -req -sha256 -days 365 -in dashboard.csr -signkey dashboard.key -out dashboard.crt
[root@master .kube]# ls
cache config dashboard.crt dashboard.csr dashboard.key http-cache recommended.yaml
--from-file= 是证书的所在地
kubectl create secret generic kubernetes-dashboard-certs -n kubernetes-dashboard --from-file=dashboard.crt=./dashboard.crt --from-file=dashboard.key=./dashboard.key
[root@master .kube]# kubectl create -f recommended.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created
[root@master .kube]# kubectl get -n kubernetes-dashboard pod
NAME READY STATUS RESTARTS AGE
dashboard-metrics-scraper-566cddb686-ffdpp 1/1 Running 0 11m
kubernetes-dashboard-7b5bf5d559-rb4j2 1/1 Running 0 67s
[root@master .kube]# kubectl get -n kubernetes-dashboard svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
dashboard-metrics-scraper ClusterIP 10.104.247.1 <none> 8000/TCP 13m
kubernetes-dashboard NodePort 10.110.34.66 <none> 443:32201/TCP 13m
[root@master .kube]#
这时访问 https://ip:port ,已可以到达登录界面,需要输入(令牌)token登录
该ServiceAccount的secret作为登录dashboard的凭证。因为官方给的默认权限是最小的,所以我们要自建一个最大权限的SA。
[root@master .kube]# cat dashboard-sa.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: dashboard-admin
namespace: kubernetes-dashboard
[root@master .kube]# cat dashboard-clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: dashboard-admin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: dashboard-admin
namespace: kubernetes-dashboard
kubectl create -f dashboard-sa.yaml
kubectl create -f dashboard-clusterrolebinding.yaml
[root@master .kube]# kubectl describe secret -n kubernetes-dashboard $(kubectl get secret -n kubernetes-dashboard | grep dashboard-admin | awk '{print $1}')
Name: dashboard-admin-token-c5n4q
Namespace: kubernetes-dashboard
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: c5165903-7c0b-479d-8053-b5389436effd
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1025 bytes
namespace: 20 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkJVUHMtak40ZGNVNlNCLTRjMlFHdHFTZ3NCQllUTkJ0MVEyX2VBLWRQZUUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tYzVuNHEiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiYzUxNjU5MDMtN2MwYi00NzlkLTgwNTMtYjUzODk0MzZlZmZkIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.QYlcgHqj-bVv0oZs_YSVBkiGmveBuFVB_rIKmrhJ617Vxe2HvY-yvqiHew3CZFFo7XlxlYp6A1ziaJdJbrlDar8hM53vXGLtMFv-oxP3zOxXmpmjxAqwOPeGR0I1UPRCeAVAJnLEe-bsIreJv9CVN0bI6PiF-4E4Ex8q6wztjFfiuXwZXkXoQrxuJP2t0WjT8HTqXwcL4t1f-AN3Z5D3Z9zHd_JyaR74jRbRiP9PCe3NfoU-JZ36hn-jjlmg32V-SIl1Wcl0G8oTW56oZ8TR_4yzSqeQLfk5y2L6hL152mBhAK1KWNgkNViPZ5Wn5TplIA1U_5T4x5WGp1fme8383g
至此,dashboard已经搭建完成
参考文档:
https://github.com/kubernetes/dashboard
https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md
https://www.jianshu.com/p/be2a12a8bc0b
原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。
如有侵权,请联系 cloudcommunity@tencent.com 删除。
原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。
如有侵权,请联系 cloudcommunity@tencent.com 删除。