dashboard 仪表盘
K8S Dashboard是官方的一个基于WEB的用户界面，专门用来管理K8S集群，并可展示集群的状态。K8S集群安装好后默认没有包含Dashboard，所以需要额外创建。
RBAC
K8S 1.6引进，是让用户能够访问 k8S API 资源的授权方式【不授权就没有资格访问K8S的资源】
用户
K8S有两种用户：User和Service Account。其中，User给人用，Service Account给进程用，让进程有相关权限。如Dashboard就是一个进程，我们就可以创建一个Service Account给它
角色
Role是一系列权限的集合，例如一个Role可包含读取和列出 Pod的权限【 ClusterRole 和 Role 类似，其权限范围是整个集群】
角色绑定
RoleBinding把角色映射到用户，从而让这些用户拥有该角色的权限【ClusterRoleBinding 和RoleBinding 类似，可让用户拥有 ClusterRole 的权限】
Secret
Secret是一个包含少量敏感信息如密码，令牌，或秘钥的对象。把这些信息保存在 Secret对象中，可以在这些信息被使用时加以控制，并可以降低信息泄露的风险//网站页面
需要
dashboard-configmap.yaml 配置文件
dashboard-doployment.yaml 部署资源 dashboard安装依赖于doployment
dashboard-service.yaml 服务
dashboard-rbac.yaml 安全 授权管理
dashboard-secret.yaml 安全 证书验证
k8s-admin.yaml 管理证书资源创建 create apply
资源重新部署，更新 apply
kubectl create -f //创建资源
-f：引用在apply始终检测不到文件时，把文件delete掉，重新apply
//在master01上操作
//创建dashborad工作目录[root@master ~]# cd k8s/
[root@master k8s]# mkdir dashboard
[root@master k8s]# cd dashboard/
[root@master dashboard]#//拷贝官方的文件
https:///kubernetes/kubernetes/tree/master/cluster/addons/dashboard
[root@master dashboard]# ls
dashboard-configmap.yaml dashboard-rbac.yaml dashboard-service.yaml
dashboard-controller.yaml dashboard-secret.yaml k8s-admin.yaml//创建资源
[root@master dashboard]# kubectl create -f dashboard-rbac.yaml
/kubernetes-dashboard-minimal created
/kubernetes-dashboard-minimal created
[root@master dashboard]# kubectl create -f dashboard-secret.yaml
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created
[root@master dashboard]# kubectl create -f dashboard-configmap.yaml
configmap/kubernetes-dashboard-settings created
[root@master dashboard]# kubectl create -f dashboard-controller.yaml
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
[root@master dashboard]# kubectl create -f dashboard-service.yaml
service/kubernetes-dashboard created//完成后查看创建在指定的kube-system命名空间下
[root@master dashboard]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
kubernetes-dashboard-65f974f565-7bjjq 1/1 Running 0 24s//查看如何访问
[root@master dashboard]# kubectl get pods,svc -n kube-system
NAME READY STATUS RESTARTS AGE
pod/kubernetes-dashboard-65f974f565-7bjjq 1/1 Running 0 50s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes-dashboard NodePort 10.0.0.224 <none> 443:30001/TCP 41s
[root@master dashboard]# kubectl get pods,svc -n kube-system -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod/kubernetes-dashboard-65f974f565-7bjjq 1/1 Running 0 82s 172.17.59.2 192.168.20.30 <none>
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service/kubernetes-dashboard NodePort 10.0.0.224 <none> 443:30001/TCP 73s k8s-app=kubernetes-dashboard
[root@node2 cfg]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
6294ae449a5b siriuszg/kubernetes-dashboard-amd64 "/dashboard --insecu…" About a minute ago Up About a minute k8s_kubernetes-dashboard_kubernetes-dashboard-65f974f565-7bjjq_kube-system_8a4fb83f-0975-11eb-aede-000c29959657_0
170d1c0fb152 /google-containers/pause-amd64:3.0 "/pause" 2 minutes ago Up 2 minutes k8s_POD_kubernetes-dashboard-65f974f565-7bjjq_kube-system_8a4fb83f-0975-11eb-aede-000c29959657_0
36f7e070b4fd centos:7 "/bin/bash" 2 hours ago Exited (130) About an hour ago frosty_bartik//访问nodeIP就可以访问
https://192.168.20.30:30001/这里使用谷歌浏览器，会出现如下情况，需要自行制作证书
[root@master dashboard]# vim
cat > dashboard-csr.json <<EOF
{
"CN": "Dashboard",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "BeiJing",
"ST": "BeiJing"
}
]
}
EOF
K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | c
fssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system增加证书两行，然后apply
[root@localhost dashboard]# vim dashboard-controller.yaml
args:
# PLATFORM-SPECIFIC ARGS HERE
- --auto-generate-certificates
- --tls-key-file=dashboard-key.pem
- --tls-cert-file=dashboard.pem
[root@master dashboard]# bash /root/k8s/k8s-cert/
2020/10/08 22:57:18 [INFO] generate received request
2020/10/08 22:57:18 [INFO] received CSR
2020/10/08 22:57:18 [INFO] generating key: rsa-2048
2020/10/08 22:57:18 [INFO] encoded CSR
2020/10/08 22:57:18 [INFO] signed certificate with serial number 447633174051868055331633690754042067283491175690
2020/10/08 22:57:18 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
secret "kubernetes-dashboard-certs" deleted
secret/kubernetes-dashboard-certs created//重新部署
[root@localhost dashboard]# kubectl apply -f dashboard-controller.yaml
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
serviceaccount/kubernetes-dashboard configured
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
deployment.apps/kubernetes-dashboard configured//生成令牌
[root@master dashboard]# kubectl create -f k8s-admin.yaml
serviceaccount/dashboard-admin created
cluster/dashboard-admin created
//保存
[root@master dashboard]# kubectl get secret -n kube-system
NAME TYPE DATA AGE
dashboard-admin-token-fmksp kubernetes.io/service-account-token 3 28s
default-token-8mhqw kubernetes.io/service-account-token 3 89m
kubernetes-dashboard-certs Opaque 11 2m40s
kubernetes-dashboard-key-holder Opaque 2 10m
kubernetes-dashboard-token-clssw kubernetes.io/service-account-token 3 9m58s//查看令牌
[root@master dashboard]# kubectl describe secret dashboard-admin-token-fmksp -n kube-system
Name: dashboard-admin-token-fmksp
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/: dashboard-admin
kubernetes.io/service-account.uid: de923e3d-0976-11eb-aede-000c29959657
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1359 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tZm1rc3AiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZGU5MjNlM2QtMDk3Ni0xMWViLWFlZGUtMDAwYzI5OTU5NjU3Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.Wi8CNzkhjUVjOxxnJhM-VwRaw9TycHQUYe4lxTqIw9aVWHjZOoQrtj2ERBTw_SFFVk94_Lsi3T8How3Yzh5xhvXdIQBNYdZnZMHNCEoR313T1fMVyQXVYzj0TJ_kw1pgepuTnYQnt2dVHfqaNJb7KRubTYmZ0UJFUYKANHrjwAGCI1qKQvtExCUfhv2InyGzvNxIvs120pzOAL2erwkb_DVsxJvw6a3exL5GTLyJtilapS0FnClbsgDyBmPZAnvIDpzbtE1cTSePjimUcQih4g3vgNv4oUhehBNW6IoNvjdnpL6Diq_2amnotM0nUrdRj6MEn6d5rA0-q4Cze_sokg复制下令牌eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJu
刷新网页
选择令牌，然后把令牌复制进去选择登录
使用火狐浏览器
本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。
