k8s Dashboard部署

我会带着你远行 2022-01-22 11:13 411阅读 0赞

##### 1.下载Dashboard所需要用到的yaml文件 #####

wget https://www.cloudelf.cn/kubernetes/kubernetes-dashboard.yaml

修改此yaml文件为：  
1).注释掉Dashboard Secret ，不然后面访问显示网页不安全，证书过期，我们自己生成证书。  
2).因为我选择nodeport访问dashboard，所以将service type字段设置为nodeport,并指定nodeport为40000，如下图

![image.png][]

# ------------------- Dashboard Secret ------------------- #
    将这些都注释掉
    #apiVersion: v1
    #kind: Secret
    #metadata:
    #  labels:
    #    k8s-app: kubernetes-dashboard
    #  name: kubernetes-dashboard-certs
    #  namespace: kube-system
    #type: Opaque
    
    #---
    # ------------------- Dashboard Service Account ------------------- #
    省略
    ---
    # ------------------- Dashboard Role & Role Binding ------------------- #
    省略
    ---
    省略
    ---
    # ------------------- Dashboard Deployment ------------------- #
    
    不用修改，省略
    # ------------------- Dashboard Service ------------------- #
    
    kind: Service
    apiVersion: v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
      namespace: kube-system
    spec:
      type: NodePort
      ports:
        - port: 443
          nodePort: 40000
          targetPort: 8443
      selector:
        k8s-app: kubernetes-dashboard

生成pod
    kubectl apply -f kubernetes-dashboard.yaml

##### 2、搭建完kubernetes在通过谷歌浏览器访问dashboard的时候会有如下提示,这是我自己亲自趟的坑，各大网站翻遍了，至少试了有十几种方法，然而我现在也不敢确定我这种百分百正确，只是实现了，因为中间试的方法太多了。 #####

![format_png][]

> 既然都趟完坑了，那我就一开始告诉你们，从源头解决它，  
> 能够顺利通过谷歌浏览器打开自己部署的kubernetes UI界面

mkdir key && cd key
    #生成证书
    openssl genrsa -out dashboard.key 2048 
    #我这里写的自己的node1节点，因为我是通过nodeport访问的；如果通过apiserver访问，可以写成自己的master节点ip
    openssl req -new -out dashboard.csr -key dashboard.key -subj '/CN=192.168.135.129'
    openssl x509 -req -in dashboard.csr -signkey dashboard.key -out dashboard.crt 
    #删除原有的证书secret
    kubectl delete secret kubernetes-dashboard-certs -n kube-system
    #创建新的证书secret
    kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt -n kube-system
    #查看pod
    kubectl get pod -n kube-system
    #重启pod
    kubectl delete pod kubernetes-dashboard-78dc5f9d6b-zgvr6  -n kube-system

![format_png 1][]  
![format_png 2][]

> 再一次创建dashboard pod  
> kubectl apply -f kubernetes-dashboard.yaml

##### 3.创建绑定用户 #####

1.创建一个叫admin-user的服务账号:
    [root@k8s01 ~]# cat admin-user.yaml 
    # admin-user.yaml
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: admin-user
      namespace: kube-system
    [root@k8s01 ~]# kubectl create -f admin-user.yaml
    
    2.直接绑定admin角色:
    [root@k8s01 ~]# cat admin-user-role-binding.yaml 
    # admin-user-role-binding.yaml
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
      name: admin-user
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-admin
    subjects:
    - kind: ServiceAccount
      name: admin-user
      namespace: kube-system
    [root@k8s01 ~]# kubectl create -f  admin-user-role-binding.yaml

查看绑定信息![format_png 3][]

##### 4.Heapster是容器集群监控和性能分析工具（非必须） #####

wget https://www.cloudelf.cn/kubernetes/influxdb.yaml
    wget https://www.cloudelf.cn/kubernetes/grafana.yaml
    wget https://www.cloudelf.cn/kubernetes/heapster.yaml
    wget https://www.cloudelf.cn/kubernetes/heapster-rbac.yaml
    [root@k8s01 ~] # kubectl create -f influxdb.yaml
    [root@k8s01 ~] # kubectl create -f grafana.yaml
    [root@k8s01 ~] # kubectl create -f heapster.yaml
    [root@k8s01 ~] # kubectl create -f heapster-rbac.yaml
    [root@k8s01 ~] # kubectl get pods --namespace=kube-system
    NAME                                READY       STATUS     RESTARTS    AGE
    heapster-844d66dcb7-xzhjs           1/1           Running       0     1h
    kubernetes-dashboard-78dc5f9d6b-qglnd 1/1         Running       0     2h
    monitoring-grafana-555bb9c5c9-597j7 1/1           Running       0     1h
    monitoring-influxdb-ddbcd4f99-8lp7z 1/1           Running       0     1h
    
    [root@master yaml]# kubectl cluster-info
    Kubernetes master is running at http://localhost:8080
    Heapster is running at http://localhost:8080/api/v1/namespaces/kube-system/services/heapster/proxy
    monitoring-grafana is running at http://localhost:8080/api/v1/namespaces/kube-system/services/monitoring-grafana/proxy
    monitoring-influxdb is running at http://localhost:8080/api/v1/namespaces/kube-system/services/monitoring-influxdb/proxy
    
    [root@master yaml]# kubectl -n kube-system get service 
    NAME                   TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE
    heapster               ClusterIP   10.0.0.206   <none>        80/TCP          3h
    kubernetes-dashboard   NodePort    10.0.0.30    <none>        443:40000/TCP   1h
    monitoring-grafana     ClusterIP   10.0.0.152   <none>        80/TCP          3h
    monitoring-influxdb    ClusterIP   10.0.0.32    <none>        8086/TCP        3h

##### 5.谷歌浏览器访问 https://192.168.135.129:40000 #####

![format_png 4][]

登陆所需要的token 获取方法：

kubectl -n kube-system get secret

![format_png 5][]

查询该用户token认证，复制此token

kubectl -n kube-system describe secret admin-user-token-wvlxs

![image.png][image.png 1]

##### 成功! #####

![format_png 6][]

**问题汇总：若master 指定nodeport 在node 查看端口没有起来，查看kube-proxy是否正常running  
若端口起来，但是telnet 连不进去端口，开启路由转发**

![image.png][image.png 2]

[image.png]: /images/20220122/0d9bd99cbf0a473ea6e4d5c17f9120f8.png
[format_png]: /images/20220122/47afb3a736884b91a81c203b82761c15.png
[format_png 1]: /images/20220122/823da5e67c644e83a63b4d494dbfd9f7.png
[format_png 2]: /images/20220122/ed1953a9e5c14077b4279ccc105ee674.png
[format_png 3]: /images/20220122/153b00c12add46d090cb0bfca83ad032.png
[format_png 4]: /images/20220122/f69697ebbe66427d8467d274b3c7712c.png
[format_png 5]: /images/20220122/9d14b164ce4747e19ae9bcf17618f861.png
[image.png 1]: /images/20220122/1e94a5ff77e74ce6b761111dd58605eb.png
[format_png 6]: /images/20220122/b121c3a06e464bc09f30df08d53d4bd2.png
[image.png 2]: /images/20220122/2803b59e0324462895be10f512e34024.png