k8s入门：kubernetes-dashboard 安装

Myth丶恋晨 2023-09-28 13:01 137阅读 0赞

##### 系列文章 #####

--------------------

第一章：✨ [k8s入门：裸机部署 k8s 集群][k8s_ k8s]  
第二章：✨ [k8s入门：部署应用到 k8s 集群][k8s_ k8s 1]  
第三章：✨ [k8s入门：service 简单使用][k8s_service]  
第四章：✨ [k8s入门：StatefulSet 简单使用][k8s_StatefulSet]  
第五章：✨ [k8s入门：存储（storage）][k8s_storage]  
第六章：✨ [K8S 配置 storageclass 使用 nfs 动态申领本地磁盘空间][K8S _ storageclass _ nfs]  
第七章：✨ [k8s入门：配置 ConfigMap & Secret][k8s_ ConfigMap _ Secret]  
第八章：✨ [k8s入门：k8s入门：Helm 构建 MySQL][k8s_k8s_Helm _ MySQL]  
第九章：✨ [k8s入门：kubernetes-dashboard 安装][k8s_kubernetes-dashboard]  
第十章：✨ [k8s入门：kube-prometheus-stack 全家桶搭建（Grafana + Prometheus）][k8s_kube-prometheus-stack _Grafana _ Prometheus]

--------------------

#### 文章目录 ####

*   *   *   *  系列文章
             *  一、简介
             *  二、安装 kubernetes-dashboard
             *   *  1、下载配置文件
                 *  2、 修改默认配置
                 *  3、安装 kubernetes-dashboard
                 *  4、访问 web
                 *  5、获取 token
                 *  6、测试登录
                 *  7、创建新用户

参考：[https://blog.csdn.net/u013068377/article/details/106673434/][https_blog.csdn.net_u013068377_article_details_106673434]  
k8s 官网：[https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/][https_kubernetes.io_docs_tasks_access-application-cluster_web-ui-dashboard]

##### 一、简介 #####

Dashboard 是一个基于 Web 的 Kubernetes 用户界面。您可以使用 Dashboard 将容器化应用程序部署到 Kubernetes 集群、对容器化应用程序进行故障排除以及管理集群资源。您可以使用 Dashboard 了解集群上运行的应用程序的概览，以及创建或修改单个 Kubernetes 资源（例如 Deployment、Jobs、DaemonSet 等）。例如，您可以使用部署向导扩展部署、启动滚动更新、重新启动 pod 或部署新应用程序。

仪表板还提供有关集群中 Kubernetes 资源状态以及可能发生的任何错误的信息。

![在这里插入图片描述][3c2b356c0eff4401875e7637a8f49f7d.png]

##### 二、安装 kubernetes-dashboard #####

使用官网提供的 deploy/recommended.yaml 清单安装 kubernetes-dashboard， 或者使用 Helm 安装，可参考 Artifact Hub 地址：[https://artifacthub.io/packages/helm/k8s-dashboard/kubernetes-dashboard][https_artifacthub.io_packages_helm_k8s-dashboard_kubernetes-dashboard]

###### 1、下载配置文件 ######

可使用如下命令下载 recommended.yaml 修改默认配置

wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.5.0/aio/deploy/recommended.yaml

默认配置安装 kubernetes-dashboard

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.5.0/aio/deploy/recommended.yaml

###### 2、 修改默认配置 ######

修改其中 kubernetes-dashboard 的 service ，指定 nodePort 端口为 18443

kind: Service
    apiVersion: v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
      namespace: kubernetes-dashboard
    spec:
      type: NodePort
      ports:
        - port: 443
          targetPort: 8443
          nodePort: 18443
      selector:
        k8s-app: kubernetes-dashboard

###### 3、安装 kubernetes-dashboard ######

[root@master dashboard]# kubectl apply -f recommended.yaml 
    namespace/kubernetes-dashboard created
    serviceaccount/kubernetes-dashboard created
    service/kubernetes-dashboard created
    secret/kubernetes-dashboard-certs created
    secret/kubernetes-dashboard-csrf created
    secret/kubernetes-dashboard-key-holder created
    configmap/kubernetes-dashboard-settings created
    role.rbac.authorization.k8s.io/kubernetes-dashboard created
    clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
    rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
    clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
    deployment.apps/kubernetes-dashboard created
    service/dashboard-metrics-scraper created
    deployment.apps/dashboard-metrics-scraper created

###### 4、访问 web ######

访问指定的 18443 端口，master 节点 IP 为 192.168.25.100，则访问地址：[https://192.168.25.100:18443/][https_192.168.25.100_18443]

![在这里插入图片描述][f5e47d489377421f958f10db240e6279.png]

###### 5、获取 token ######

K8S有两种用户：User 和 Service Account，User 给人用，Service Account 给进程用，让进程有相关权限，Dashboard 是一个进程，我们就可以创建一个Service Account 给它

kubectl get serviceaccount  -n kubernetes-dashboard
    kubectl describe serviceaccount/kubernetes-dashboard -n kubernetes-dashboard
    kubectl get secret -n kubernetes-dashboard
    kubectl describe secret/kubernetes-dashboard-token-28jqz -n kubernetes-dashboard

如下，上面命令可以简化为一条命令（`kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep kubernetes-dashboard | awk '{print $1}')`）  
![在这里插入图片描述][ecb43e0adc3e4ff39636ea5fcef41956.png]

###### 6、测试登录 ######

使用查询到的 token 登录 kubernetes dashboard，登陆成功  
![在这里插入图片描述][a4b92bf15a514428b41d05b06f88982e.png]  
出现上述问题的原因是因为，kubernetes-dashboard 这个账户的角色权限不够

###### 7、创建新用户 ######

创建 dashboard-adminuser.yaml，可参考：[https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md][https_github.com_kubernetes_dashboard_blob_master_docs_user_access-control_creating-sample-user.md]

cat > dashboard-adminuser.yaml << EOF
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: admin-user
      namespace: kubernetes-dashboard
    
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: admin-user
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-admin
    subjects:
    - kind: ServiceAccount
      name: admin-user
      namespace: kubernetes-dashboard  
    EOF

创建登录用户

[root@master dashboard]# kubectl apply -f dashboard-adminuser.yaml
    serviceaccount/admin-user created

说明：上面创建了一个叫 admin-user 的服务账号，并放在kubernetes-dashboard 命名空间下，并将 cluster-admin 角色绑定到admin-user账户，这样admin-user账户就有了管理员的权限。默认情况下，kubeadm创建集群时已经创建了cluster-admin角色，我们直接绑定即可。

查看admin-user账户的token

[root@master dashboard]# kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
    Name:         admin-user-token-6wkxr
    Namespace:    kubernetes-dashboard
    Labels:       <none>
    Annotations:  kubernetes.io/service-account.name: admin-user
                  kubernetes.io/service-account.uid: a90464fd-83bb-4435-90ee-c59493b81889
    
    Type:  kubernetes.io/service-account-token
    
    Data
    ====
    ca.crt:     1099 bytes
    namespace:  20 bytes
    token:      eyJhbGciOiJSUzI1NiIsImtpZCI6InhGU29vbVM3TG90R1NzTzZfT2VlTUVWZTIySXlGbHZxUW5laVZ5T29lRTAifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLTZ3a3hyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJhOTA0NjRmZC04M2JiLTQ0MzUtOTBlZS1jNTk0OTNiODE4ODkiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.gaqvh1E1yH0SmKT-cDhzGOl_-g5aZmiH7SuRLXuAnIdBRAhC1dYFFqmkUenspepRb4zkMX0vojYjq0twGKAP3IAI4h0H24QVXhOBMiMWH1IyZdprZ32K3j2egdCuRkb3BEwm1M0zR8XZlLZRI-__Hl5QCntNwO6Lh21nmRx-f9rG1T-omGSWiZnRn4ZW0kS0N0sunAYFfsRWNKh6Pnd3WzfNqa3rBNaULOeDStlL1DfcO_fhqWbeuWWwnA66Q7fX7Xa3oP5qymt-C_lvM_hod8N3TVzVKY2ToiqMPmGAflQoHf4P-iYdH2sG38_hYM0LJvpmy8zdVvZSo9LNBHsEeQ

注销重新使用 admin-user 服务账号的 token 登录即可

![在这里插入图片描述][6b95f30805624257b97787e9ea2f4f91.png]  
8、设置 token 过期时间

用 token 登陆 kubernetes-dashboard，默认的 token 认证时间是 900s/15 分钟，失效需要重新登录灰常麻烦，下面添加 `- --token-ttl=604800` （单位 s）参数修改 token 过期时间为 7 天。 kubernetes-dashboard 平台可使用如下方法，你也可以选择修改 recommended.yaml 文件，重新 apply 即可

步骤：

*  选择 `kubernetes-dashboard` 命名空间
 *  编辑 `deployment/kubernetes-dashboard` 配置文件
 *  在对应位置添加 `- --token-ttl=604800` （单位 s）
 *  点击更新即可生效  
    ![在这里插入图片描述][c57c96152ec146929daf2dac75869b14.png]

[k8s_ k8s]: https://blog.csdn.net/qq_41538097/article/details/124869179
[k8s_ k8s 1]: https://blog.csdn.net/qq_41538097/article/details/124884400
[k8s_service]: https://blog.csdn.net/qq_41538097/article/details/125175685
[k8s_StatefulSet]: https://blog.csdn.net/qq_41538097/article/details/125189618
[k8s_storage]: https://blog.csdn.net/qq_41538097/article/details/125215989
[K8S _ storageclass _ nfs]: https://blog.csdn.net/qq_41538097/article/details/125380287
[k8s_ ConfigMap _ Secret]: https://blog.csdn.net/qq_41538097/article/details/125387461
[k8s_k8s_Helm _ MySQL]: https://yixiu.blog.csdn.net/article/details/125442282
[k8s_kubernetes-dashboard]: https://blog.csdn.net/qq_41538097/article/details/125561769
[k8s_kube-prometheus-stack _Grafana _ Prometheus]: https://blog.csdn.net/qq_41538097/article/details/125564711
[https_blog.csdn.net_u013068377_article_details_106673434]: https://blog.csdn.net/u013068377/article/details/106673434/
[https_kubernetes.io_docs_tasks_access-application-cluster_web-ui-dashboard]: https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/
[3c2b356c0eff4401875e7637a8f49f7d.png]: https://img-blog.csdnimg.cn/3c2b356c0eff4401875e7637a8f49f7d.png
[https_artifacthub.io_packages_helm_k8s-dashboard_kubernetes-dashboard]: https://artifacthub.io/packages/helm/k8s-dashboard/kubernetes-dashboard
[https_192.168.25.100_18443]: https://192.168.25.100:18443/
[f5e47d489377421f958f10db240e6279.png]: https://img-blog.csdnimg.cn/f5e47d489377421f958f10db240e6279.png
[ecb43e0adc3e4ff39636ea5fcef41956.png]: https://img-blog.csdnimg.cn/ecb43e0adc3e4ff39636ea5fcef41956.png
[a4b92bf15a514428b41d05b06f88982e.png]: https://img-blog.csdnimg.cn/a4b92bf15a514428b41d05b06f88982e.png
[https_github.com_kubernetes_dashboard_blob_master_docs_user_access-control_creating-sample-user.md]: https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md
[6b95f30805624257b97787e9ea2f4f91.png]: https://img-blog.csdnimg.cn/6b95f30805624257b97787e9ea2f4f91.png
[c57c96152ec146929daf2dac75869b14.png]: https://img-blog.csdnimg.cn/c57c96152ec146929daf2dac75869b14.png