kubernetes學習14—Dashboard搭建和認證
本文收錄在容器技術學習系列文章總目錄html
1、介紹
Kubernetes Dashboard是Kubernetes集羣的基於Web的通用UI。它容許用戶管理在羣集中運行的應用程序並對其進行故障排除，以及管理羣集自己。node
2、搭建dashboard
一、編寫yaml文件
借鑑GitHub，修改了image的下載地址和pod的一些配置
git
[root@master ~]# vim dashboard.yamlgithub
# Filename: dashboard.yaml
# Revision: 1.0
# Date: 2018/10/18
# Author: along
# Description: Build kubernetes dashboard
# ------------------- Dashboard Secret ------------------- #
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-certs
namespace: kube-system
type: Opaque
---
# ------------------- Dashboard Service Account ------------------- #
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
---
# ------------------- Dashboard Role & Role Binding ------------------- #
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: kubernetes-dashboard-minimal
namespace: kube-system
rules:
# Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
- apiGroups: [""]
resources: ["secrets"]
verbs: ["create"]
# Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["create"]
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
verbs: ["get", "update", "delete"]
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["kubernetes-dashboard-settings"]
verbs: ["get", "update"]
# Allow Dashboard to get metrics from heapster.
- apiGroups: [""]
resources: ["services"]
resourceNames: ["heapster"]
verbs: ["proxy"]
- apiGroups: [""]
resources: ["services/proxy"]
resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: kubernetes-dashboard-minimal
namespace: kube-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: kubernetes-dashboard-minimal
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kube-system
---
# ------------------- Dashboard Deployment ------------------- #
kind: Deployment
apiVersion: apps/v1beta2
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: kubernetes-dashboard
template:
metadata:
labels:
k8s-app: kubernetes-dashboard
spec:
containers:
- name: kubernetes-dashboard
image: mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.0
ports:
- containerPort: 8443
protocol: TCP
args:
- --auto-generate-certificates
# Uncomment the following line to manually specify Kubernetes API server Host
# If not specified, Dashboard will attempt to auto discover the API server and connect
# to it. Uncomment only if the default does not work.
# - --apiserver-host=http://my-address:port
volumeMounts:
- name: kubernetes-dashboard-certs
mountPath: /certs
# Create on-disk volume to store exec logs
- mountPath: /tmp
name: tmp-volume
livenessProbe:
httpGet:
scheme: HTTPS
path: /
port: 8443
initialDelaySeconds: 30
timeoutSeconds: 30
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
- name: tmp-volume
emptyDir: {}
serviceAccountName: kubernetes-dashboard
# Comment the following tolerations if Dashboard must not be deployed on master
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
---
# ------------------- Dashboard Service ------------------- #
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
type: NodePort
ports:
- port: 443
targetPort: 8443
nodePort: 30000
selector:
k8s-app: kubernetes-dashboard
二、apply yaml文件，搭建dashboard
[root@master ~]# kubectl apply -f dashboard.yamlvim
secret/kubernetes-dashboard-certs createdwindows
serviceaccount/kubernetes-dashboard createdapi
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal createdapp
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created學習
deployment.apps/kubernetes-dashboard createdui
service/kubernetes-dashboard created
三、查看驗證
（1）pod已經建立成功
[root@master ~]# kubectl get pods -n kube-system |grep dashboard
kubernetes-dashboard-68bf55748d-4zzph 1/1 Running 0 2m
（2）service也已經建立成功，而且有映射端口，此時已經能夠登陸了，可是沒法登陸，由於沒有認證
[root@master ~]# kubectl get svc -n kube-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes-dashboard NodePort 10.97.55.246 <none> 443:30000/TCP 2m
3、dashboard與kubernetes集羣的認證，方案一：令牌認證
（1）有兩種認證方法：
口令
kubeconfig
（2）而且在認證的時候，還能夠管理限制dashboard用戶的權限；爲了讓你們進一步理解：
在方案一：口令認證時，dashboard用戶的權限設爲對全部名稱空間都有admin的權限；
在方案二：kubeconfig認證時，dashboard用戶的權限設爲只對default名稱空間有admin權限；
一、受權，對全部名稱空間都有admin的權限
（1）建立serviceaccount
[root@master ~]# kubectl create serviceaccount dashboard-serviceaccount -n kube-system
serviceaccount/dashboard-serviceaccount created
（2）建立clusterrolebinding
使用clusterrolebinding綁定cluster-admin的clusterrole和dashboard-serviceaccount的serviceaccount，這樣dashboard-serviceaccount的serviceaccount就在全部名稱空間有了kubernetes的admin權限
[root@master ~]# kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-serviceaccount
clusterrolebinding.rbac.authorization.k8s.io/dashboard-cluster-admin created
二、獲取令牌
（1）在secret中查找dashboard-serviceaccount
[root@master ~]# kubectl get secret -n kube-system |grep dashboard-serviceaccount-token
dashboard-serviceaccount-token-nz7xd kubernetes.io/service-account-token 3 4m
（2）查看dashboard-serviceaccount中的口令
[root@master ~]# kubectl describe secret dashboard-serviceaccount-token-nz7xd -n kube-system
Name: dashboard-serviceaccount-token-nz7xd Namespace: kube-system Labels: <none> Annotations: kubernetes.io/service-account.name=dashboard-serviceaccount kubernetes.io/service-account.uid=2af6061f-d1f0-11e8-8059-005056277243 Type: kubernetes.io/service-account-token Data ==== ca.crt: 1025 bytes namespace: 11 bytes token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtc2VydmljZWFjY291bnQtdG9rZW4tbno3eGQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLXNlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMmFmNjA2MWYtZDFmMC0xMWU4LTgwNTktMDA1MDU2Mjc3MjQzIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1zZXJ2aWNlYWNjb3VudCJ9.BAJVarqum57S_KepqOgcS1IimNEmDilhu4tIiWQKxaz0o5TKyXBZ5YqN3ZS5tJNQbLvDS6LuRRXdvH-MeKQnUpg08OhYDg1u9XE3Oygr7YF5Ad7yBw4czpPPN6iIJZ5qQJ8laOfPRb8qYVbR0R4MONin08lhzrkLBkRLwhAVJ_6zXXB9vaJLU9asTyA4YmDAZZi06zkYeeO8Rhqr2-Yeu4Ya7miLYVRv_ioqDlkqGEf6ILUriPjeJHohIEbgdslRXTnxgwkt2Uwsv3QRFKF2CisSBSW7P-9muuCrzSb2xQVop7WbAUyROdUuqQFmSON2UC0643e_iEW5DBaAAGQxbw
三、網頁經過令牌登陸
（1）使用https協議打開https://192.168.130.103:30000（任意節點的IP均可以）
輸入dashboard-serviceaccount的口令
（2）打開成功，而且對全部名稱空間都有admin權限
4、dashboard與kubernetes集羣的認證，方案二：configing認證
一、受權，只對default名稱空間有admin的權限
（1）建立serviceaccount
[root@master ~]# kubectl create serviceaccount def-ns-dashboard-sa -n default
serviceaccount/def-ns-dashboard-sa created
（2）建立rolebinding
使用rolebinding綁定cluster-admin的clusterrole和def-ns-dashboard的serviceaccount，這樣def-ns-dashboard的serviceaccount就只有default這一個名稱空間的admin權限
[root@master ~]# kubectl create rolebinding def-ns-dashboard-rb --clusterrole=cluster-admin --serviceaccount=default:def-ns-dashboard-sa
rolebinding.rbac.authorization.k8s.io/def-ns-dashboard-rb created
二、獲取令牌
（1）在secret中查找def-ns-dashboard-sa
[root@master ~]# kubectl get secret
NAME TYPE DATA AGE
def-ns-dashboard-sa-token-b8plm kubernetes.io/service-account-token 3 1m
（2）查看def-ns-dashboard-sa中的口令
[root@master ~]# kubectl describe secret def-ns-dashboard-sa-token-b8plm
Name: def-ns-dashboard-sa-token-b8plm Namespace: default Labels: <none> Annotations: kubernetes.io/service-account.name=def-ns-dashboard-sa kubernetes.io/service-account.uid=8b040303-d287-11e8-be88-005056277243 Type: kubernetes.io/service-account-token Data ==== ca.crt: 1025 bytes namespace: 7 bytes token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1kYXNoYm9hcmQtc2EtdG9rZW4tYjhwbG0iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVmLW5zLWRhc2hib2FyZC1zYSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjhiMDQwMzAzLWQyODctMTFlOC1iZTg4LTAwNTA1NjI3NzI0MyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZi1ucy1kYXNoYm9hcmQtc2EifQ.VqAgyqN8_F4mjawWtZ5TzvFioKA50u4MUL_4ypBxWrr-XU8TciM8EX1OcGm9vAjUW_m5QZangS7VW3rVYPcqKMqaYKE8vN-l9wTC5CzTnxPHMghTx8sTTkPWnqHt7C7v8cVRNfeRAWygWMp1B8Chx5pAK2l9t095uZy_w59qFQdoAKeAcxiH5K6kz9sx8VwEXVr9nRH8bFqvtr3yXCdYo2e2qSQXOpNddlyrEOYXrIUlamNyImgcbfkNLV0Qkt5sdfSLSJdaB2opLWD8pST88m73r6KG2c_aMmyZ7mTCUeNd1BwCOnLSto4V2xPXCtHA6ELvB5afh9irpCj4e5VgPw
三、定義一個kubeconfig認證文件
（1）在一個新的kubeconfig文件下，建立一個集羣dashboard
[root@master ~]# kubectl config set-cluster dashboard --certificate-authority=/etc/kubernetes/pki/ca.crt --server="https://192.168.130.103:6443" --embed-certs=true --kubeconfig=/root/def-ns-dashboard.conf
Cluster "dashboard" set.
/root/def-ns-dashboard.conf 文件已經生成
[root@master ~]# ll /root/def-ns-dashboard.conf
-rw------- 1 root root 1568 Oct 18 13:36 /root/def-ns-dashboard.conf
（2）使用def-ns-dashboard-sa的serviceaccount，建立一個用戶def-ns-dashboard-user
[root@master ~]# kubectl config set-credentials def-ns-dashboard-user --kubeconfig=/root/def-ns-dashboard.conf --token=eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1kYXNoYm9hcmQtc2EtdG9rZW4tYjhwbG0iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVmLW5zLWRhc2hib2FyZC1zYSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjhiMDQwMzAzLWQyODctMTFlOC1iZTg4LTAwNTA1NjI3NzI0MyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZi1ucy1kYXNoYm9hcmQtc2EifQ.VqAgyqN8_F4mjawWtZ5TzvFioKA50u4MUL_4ypBxWrr-XU8TciM8EX1OcGm9vAjUW_m5QZangS7VW3rVYPcqKMqaYKE8vN-l9wTC5CzTnxPHMghTx8sTTkPWnqHt7C7v8cVRNfeRAWygWMp1B8Chx5pAK2l9t095uZy_w59qFQdoAKeAcxiH5K6kz9sx8VwEXVr9nRH8bFqvtr3yXCdYo2e2qSQXOpNddlyrEOYXrIUlamNyImgcbfkNLV0Qkt5sdfSLSJdaB2opLWD8pST88m73r6KG2c_aMmyZ7mTCUeNd1BwCOnLSto4V2xPXCtHA6ELvB5afh9irpCj4e5VgPw
User "def-ns-dashboard-user" set.
（3）在這個kubeconfig文件下，建立一個上下文關係def-ns-dashboard-user@dashboard
[root@master ~]# kubectl config set-context def-ns-dashboard-user@dashboard --cluster=dashboard --user=def-ns-dashboard-user --kubeconfig=/root/def-ns-dashboard.conf
Context "def-ns-dashboard-user@dashboard" created.
（4）在這個kubeconfig文件下，使用def-ns-dashboard-user@dashboard這個上下文關係
[root@master ~]# kubectl config use-context def-ns-dashboard-user@dashboard --kubeconfig=/root/def-ns-dashboard.conf
Switched to context "def-ns-dashboard-user@dashboard".
（5）經過view查看驗證
[root@master ~]# kubectl config view --kubeconfig=/root/def-ns-dashboard.conf
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: REDACTED
server: https://192.168.130.103:6443
name: dashboard
contexts:
- context:
cluster: dashboard
user: def-ns-dashboard-user
name: def-ns-dashboard-user@dashboard
current-context: def-ns-dashboard-user@dashboard
kind: Config
preferences: {}
users:
- name: def-ns-dashboard-user
user:
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1kYXNoYm9hcmQtc2EtdG9rZW4tYjhwbG0iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVmLW5zLWRhc2hib2FyZC1zYSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjhiMDQwMzAzLWQyODctMTFlOC1iZTg4LTAwNTA1NjI3NzI0MyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZi1ucy1kYXNoYm9hcmQtc2EifQ.VqAgyqN8_F4mjawWtZ5TzvFioKA50u4MUL_4ypBxWrr-XU8TciM8EX1OcGm9vAjUW_m5QZangS7VW3rVYPcqKMqaYKE8vN-l9wTC5CzTnxPHMghTx8sTTkPWnqHt7C7v8cVRNfeRAWygWMp1B8Chx5pAK2l9t095uZy_w59qFQdoAKeAcxiH5K6kz9sx8VwEXVr9nRH8bFqvtr3yXCdYo2e2qSQXOpNddlyrEOYXrIUlamNyImgcbfkNLV0Qkt5sdfSLSJdaB2opLWD8pST88m73r6KG2c_aMmyZ7mTCUeNd1BwCOnLSto4V2xPXCtHA6ELvB5afh9irpCj4e5VgPw
四、網頁經過kubeconfig登陸
（1）將/root/def-ns-dashboard.conf 文件上傳到windows機器上，把/root/def-ns-dashboard.conf這個kubeconfig文件導入到登陸時的頁面，就能夠成功登陸
（2）登陸成功，可是隻有default這個名稱空間的admin權限
至此，咱們已經成功搭建了dashboard；而且完成了對K8S集羣的認證；
咱們能夠經過dashboard建立和管理Pod、service、存儲卷... ... 這裏就再也不演示了。
- 1. kubernetes學習14—Dashboard搭建和認證
- 2. Kubernetes學習之路（十九）之Kubernetes dashboard認證訪問
- 3. Kubernets搭建Kubernetes-dashboard
- 4. Kubernetes入門學習-十八-dashboard認證及分級受權
- 5. Kubernetes之（十六）Dashboard認證訪問
- 6. Kubernetes的UI界面Kubernetes Dashboard的搭建
- 7. kubernetes學習筆記之十一：kubernetes dashboard認證及分級授權
- 8. 建立kubernetes-dashboard
- 9. kubernetes實戰篇之dashboard搭建
- 10. Kubernetes學習之認識Kubernetes
- 更多相關文章...
- • Swift 環境搭建 - Swift 教程
- • Rust 環境搭建 - RUST 教程
- • 適用於PHP初學者的學習線路和建議
- • Tomcat學習筆記（史上最全tomcat學習筆記）
-
每一个你不满意的现在，都有一个你没有努力的曾经。
- 1. 跳槽面試的幾個實用小技巧，不妨看看！
- 2. Mac實用技巧 |如何使用Mac系統中自帶的預覽工具將圖片變成黑白色?
- 3. Mac實用技巧 |如何使用Mac系統中自帶的預覽工具將圖片變成黑白色?
- 4. 如何使用Mac系統中自帶的預覽工具將圖片變成黑白色?
- 5. Mac OS非兼容Windows軟件運行解決方案——「以VMware & Microsoft Access爲例「
- 6. 封裝 pyinstaller -F -i b.ico excel.py
- 7. 數據庫作業三ER圖待完善
- 8. nvm安裝使用低版本node.js(非命令安裝)
- 9. 如何快速轉換圖片格式
- 10. 將表格內容分條轉換爲若干文檔
- 1. kubernetes學習14—Dashboard搭建和認證
- 2. Kubernetes學習之路（十九）之Kubernetes dashboard認證訪問
- 3. Kubernets搭建Kubernetes-dashboard
- 4. Kubernetes入門學習-十八-dashboard認證及分級受權
- 5. Kubernetes之（十六）Dashboard認證訪問
- 6. Kubernetes的UI界面Kubernetes Dashboard的搭建
- 7. kubernetes學習筆記之十一：kubernetes dashboard認證及分級授權
- 8. 建立kubernetes-dashboard
- 9. kubernetes實戰篇之dashboard搭建
- 10. Kubernetes學習之認識Kubernetes