K8s(7)-安裝Web UI

　　儀表板是基於Web的Kubernetes用戶界面。您能夠使用儀表板將容器化應用程序部署到Kubernetes集羣，對容器化應用程序進行故障排除，以及管理集羣資源。您能夠使用儀表板來概述羣集上運行的應用程序，以及建立或修改單個Kubernetes資源（例如部署，做業，守護進程等）。例如，您能夠使用部署嚮導擴展部署，啓動滾動更新，從新啓動Pod或部署新應用程序。

儀表板還提供有關羣集中Kubernetes資源狀態以及可能發生的任何錯誤的信息。

 

安裝

1. 製做證書

openssl genrsa -des3 -passout pass:x -out dashboard.pass.key 2048
openssl rsa -passin pass:x -in dashboard.pass.key -out dashboard.key
rm dashboard.pass.key
＃編寫RSA密鑰
openssl req -new -key dashboard.key -out dashboard.csr -subj "/C=CN/ST=GuangDong/L=ShenZhen/O=Sin/OU=IT/CN=192.168.1.101"

　　

生成三個證書

root@scott-Lenovo:/etc/kubernetes/pki# ll dashboard.*
-rw-rw-r-- 1 root root 1034 1月  26 12:04 dashboard.crt
-rw-rw-r-- 1 root root  920 1月  26 12:04 dashboard.csr
-rw-rw-r-- 1 root root 1675 1月  26 12:04 dashboard.key

 2.  用自定義證書建立secret

kubectl -n kube-system create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt

　　

 

2. 從官網下載yaml文件

wegt https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml

　　yaml文件須要修改三個地方

鏡像地址：

     image: mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1

部署方式：

     

kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
type: NodePort
ports:
- port: 443
nodePort: 30000
targetPort: 8443
selector:
k8s-app: kubernetes-dashboard

 

註釋掉自動生成證書，不然沒法用google和IE瀏覽器訪問。

# ------------------- Dashboard Secret ------------------- #

#apiVersion: v1
#kind: Secret
#metadata:
# labels:
# k8s-app: kubernetes-dashboard
# name: kubernetes-dashboard-certs
# namespace: kube-system
#type: Opaque

　　

2. 建立服務

kubectl apply -f kubernetes-dashboard.yaml

　　

3. 查看NodePod，並訪問服務

[root@master yaml]# kubectl get service  -n kube-system
NAME                   TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
kube-dns               ClusterIP   10.96.0.10      <none>        53/UDP,53/TCP   2d16h
kubernetes-dashboard   NodePort    10.111.126.84   <none>        443:31943/TCP   5m10s

　　添加例外訪問。

 

 

在k8s中 dashboard能夠有兩種訪問方式：kubeconfig（HTTPS）和token（http）

一、token認證

scott@scott-Lenovo:/etc/kubernetes/pki$ sudo kubectl create serviceaccount def-ns-admin -n default
serviceaccount/def-ns-admin created

scott@scott-Lenovo:/etc/kubernetes/pki$ sudo kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin
rolebinding.rbac.authorization.k8s.io/def-ns-admin created

scott@scott-Lenovo:/etc/kubernetes/pki$ sudo  kubectl describe secret
Name:         def-ns-admin-token-4qm8p
Namespace:    default
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: def-ns-admin
              kubernetes.io/service-account.uid: d7b60993-2120-11e9-acd0-646e69e2bebb

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  7 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi00cW04cCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJkN2I2MDk5My0yMTIwLTExZTktYWNkMC02NDZlNjllMmJlYmIiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.Y55NP3aDJNzvhia2yLZNcr4Y0i0NWv3YJPuGdikMIspVXxiQGWKM9kubpvUzjkwP9eL6cehyX3J7isunqJ0aI27rbuFgfszjEEl4nognOcLO6iqQAyvDoydjCOafxoT8Zua3ewASnuv6Lmqqaxs0aBj_iNWWyBClm4u8rm_EgGDMZfq8Z2-r-cmvm5gMTvzlgcz0gi5J7kR-NNpjW2o-2hl8-iLlBfaR9Dtcu-4Aksrf7dO_I6f8IictldNj-j6ly0PQMADDi594CODLL5Yti26FBaTO4dR0ykxvGkgVoYmy4r8i9OzQqY0jcN3vcZTQBTf9--XlQEEgpPgxioVBDA


Name:         default-token-lq7ct
Namespace:    default
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: default
              kubernetes.io/service-account.uid: 578bc521-20b3-11e9-acd0-646e69e2bebb

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  7 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZmF1bHQtdG9rZW4tbHE3Y3QiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVmYXVsdCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjU3OGJjNTIxLTIwYjMtMTFlOS1hY2QwLTY0NmU2OWUyYmViYiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZmF1bHQifQ.X9O3i041VXqASe8fJvRsXecec6m0vv9u-ksyEkJgNfoFXsyiATZZOBdXaWhPTbmI5fUsciAjvjI5VTavB2-hsp2XGbZfcMSqqOhtiB626xEPi9UWsNhnbFJbye2ighzwjeAO2DW4YhVXkzCFihSEhvynTWuux14a-R3GWiNPuBFPqddE8NcROnCZC5scp3HsFHgRM_kuwazc84cvpyJu8AExuFeiEGLDvztQpWCeYN7WUTtOqWr-SiauDiEgolEqrjffKCOgBMWhpK77Sz6RUHJY-uOKLFfUghjSuP1_Ma4HZOOTlBc-uiPED28Y0jIwbJ56gVaJ8rNnDzG8SGY9mA

   咱們複製名字爲def-ns-admin-token-4qm8p的token至瀏覽器，便可登錄。