仪表板是基于Web的Kubernetes用户界面。您可以使用仪表板将容器化应用程序部署到Kubernetes集群，对容器化应用程序进行故障排除，以及管理集群资源。您可以使用仪表板来概述群集上运行的应用程序，以及创建或修改单个Kubernetes资源（例如部署，作业，守护进程等）。例如，您可以使用部署向导扩展部署，启动滚动更新，重新启动Pod或部署新应用程序。
仪表板还提供有关群集中Kubernetes资源状态以及可能发生的任何错误的信息。
安装
1. 制作证书
openssl genrsa -des3 -passout pass:x -out dashboard.pass.key 2048 openssl rsa -passin pass:x -in dashboard.pass.key -out dashboard.key rm dashboard.pass.key openssl req -new -key dashboard.key -out dashboard.csr -subj "/O=public/CN=192.168.1.101" openssl x509 -req -sha256 -days 365 -in dashboard.csr -signkey dashboard.key -out dashboard.crt
生成三个证书
root@scott-Lenovo:/etc/kubernetes/pki# ll dashboard.* -rw-rw-r-- 1 root root 1034 1月 26 12:04 dashboard.crt -rw-rw-r-- 1 root root 920 1月 26 12:04 dashboard.csr -rw-rw-r-- 1 root root 1675 1月 26 12:04 dashboard.key
2. 用自定义证书创建secret
kubectl create secret generic dashboard-cert -n kube-system --from-file=./dashboard.crt --from-file=dashboard.key=./dashboard.key
2. 从官网下载yaml文件
wegt https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
需要修改两个地方，一个是镜像的地址，还一个是启用NodePod
# Copyright 2017 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ------------------- Dashboard Secret ------------------- #
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-certs
namespace: kube-system
type: Opaque
---
# ------------------- Dashboard Service Account ------------------- #
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
---
# ------------------- Dashboard Role & Role Binding ------------------- #
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: kubernetes-dashboard-minimal
namespace: kube-system
rules:
# Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
- apiGroups: [""]
resources: ["secrets"]
verbs: ["create"]
# Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["create"]
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
verbs: ["get", "update", "delete"]
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["kubernetes-dashboard-settings"]
verbs: ["get", "update"]
# Allow Dashboard to get metrics from heapster.
- apiGroups: [""]
resources: ["services"]
resourceNames: ["heapster"]
verbs: ["proxy"]
- apiGroups: [""]
resources: ["services/proxy"]
resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: kubernetes-dashboard-minimal
namespace: kube-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: kubernetes-dashboard-minimal
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kube-system
---
# ------------------- Dashboard Deployment ------------------- #
kind: Deployment
apiVersion: apps/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: kubernetes-dashboard
template:
metadata:
labels:
k8s-app: kubernetes-dashboard
spec:
containers:
- name: kubernetes-dashboard
image: mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1
ports:
- containerPort: 8443
protocol: TCP
args:
- --auto-generate-certificates
# Uncomment the following line to manually specify Kubernetes API server Host
# If not specified, Dashboard will attempt to auto discover the API server and connect
# to it. Uncomment only if the default does not work.
# - --apiserver-host=http://my-address:port
volumeMounts:
- name: kubernetes-dashboard-certs
mountPath: /certs
# Create on-disk volume to store exec logs
- mountPath: /tmp
name: tmp-volume
livenessProbe:
httpGet:
scheme: HTTPS
path: /
port: 8443
initialDelaySeconds: 30
timeoutSeconds: 30
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
- name: tmp-volume
emptyDir: {}
serviceAccountName: kubernetes-dashboard
# Comment the following tolerations if Dashboard must not be deployed on master
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
---
# ------------------- Dashboard Service ------------------- #
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
type: NodePort
ports:
- port: 443
targetPort: 8443
selector:
k8s-app: kubernetes-dashboard
2. 创建服务
kubectl apply -f kubernetes-dashboard.yaml
3. 查看NodePod，并访问服务
[root@master yaml]# kubectl get service -n kube-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP 2d16h kubernetes-dashboard NodePort 10.111.126.84 <none> 443:31943/TCP 5m10s
添加例外访问。
在k8s中 dashboard可以有两种访问方式：kubeconfig（HTTPS）和token（http）
1、token认证
scott@scott-Lenovo:/etc/kubernetes/pki$ sudo kubectl create secret generic dashboard-cert -n kube-system --from-file=./dashboard.crt --from-file=dashboard.key=./dashboard.key secret/dashboard-cert created
scott@scott-Lenovo:/etc/kubernetes/pki$ sudo kubectl get secret -n kube-system |grep dashboard dashboard-cert Opaque 2 97s kubernetes-dashboard-certs Opaque 0 92m kubernetes-dashboard-key-holder Opaque 2 91m kubernetes-dashboard-token-qmdrl kubernetes.io/service-account-token 3 92m
scott@scott-Lenovo:/etc/kubernetes/pki$ sudo kubectl create serviceaccount def-ns-admin -n default serviceaccount/def-ns-admin created
scott@scott-Lenovo:/etc/kubernetes/pki$ sudo kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin rolebinding.rbac.authorization.k8s.io/def-ns-admin created
scott@scott-Lenovo:/etc/kubernetes/pki$ sudo kubectl describe secret Name: def-ns-admin-token-4qm8p Namespace: default Labels: <none> Annotations: kubernetes.io/service-account.name: def-ns-admin kubernetes.io/service-account.uid: d7b60993-2120-11e9-acd0-646e69e2bebb Type: kubernetes.io/service-account-token Data ==== ca.crt: 1025 bytes namespace: 7 bytes token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi00cW04cCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJkN2I2MDk5My0yMTIwLTExZTktYWNkMC02NDZlNjllMmJlYmIiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.Y55NP3aDJNzvhia2yLZNcr4Y0i0NWv3YJPuGdikMIspVXxiQGWKM9kubpvUzjkwP9eL6cehyX3J7isunqJ0aI27rbuFgfszjEEl4nognOcLO6iqQAyvDoydjCOafxoT8Zua3ewASnuv6Lmqqaxs0aBj_iNWWyBClm4u8rm_EgGDMZfq8Z2-r-cmvm5gMTvzlgcz0gi5J7kR-NNpjW2o-2hl8-iLlBfaR9Dtcu-4Aksrf7dO_I6f8IictldNj-j6ly0PQMADDi594CODLL5Yti26FBaTO4dR0ykxvGkgVoYmy4r8i9OzQqY0jcN3vcZTQBTf9--XlQEEgpPgxioVBDA Name: default-token-lq7ct Namespace: default Labels: <none> Annotations: kubernetes.io/service-account.name: default kubernetes.io/service-account.uid: 578bc521-20b3-11e9-acd0-646e69e2bebb Type: kubernetes.io/service-account-token Data ==== ca.crt: 1025 bytes namespace: 7 bytes token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZmF1bHQtdG9rZW4tbHE3Y3QiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVmYXVsdCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjU3OGJjNTIxLTIwYjMtMTFlOS1hY2QwLTY0NmU2OWUyYmViYiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZmF1bHQifQ.X9O3i041VXqASe8fJvRsXecec6m0vv9u-ksyEkJgNfoFXsyiATZZOBdXaWhPTbmI5fUsciAjvjI5VTavB2-hsp2XGbZfcMSqqOhtiB626xEPi9UWsNhnbFJbye2ighzwjeAO2DW4YhVXkzCFihSEhvynTWuux14a-R3GWiNPuBFPqddE8NcROnCZC5scp3HsFHgRM_kuwazc84cvpyJu8AExuFeiEGLDvztQpWCeYN7WUTtOqWr-SiauDiEgolEqrjffKCOgBMWhpK77Sz6RUHJY-uOKLFfUghjSuP1_Ma4HZOOTlBc-uiPED28Y0jIwbJ56gVaJ8rNnDzG8SGY9mA
我们复制名字为def-ns-admin-token-4qm8p的token至浏览器，即可登陆。
