kubernetes1.18.5安装kubernetes-dashboard2.0.0版本

Kubernetes dashboard是Kubernetes集群的基于Web的通用UI。它允许用户管理集群中运行的应用程序并对其进行故障排除，以及管理集群本身。

一、查看系统pod

[root@master69 kubernetes]# kubectl get pods -n kube-system -o wide
NAME                               READY   STATUS    RESTARTS   AGE     IP             NODE             NOMINATED NODE   READINESS GATES
coredns-66bff467f8-7kbhf           1/1     Running   0          42h     10.244.8.164   redis-02.hlqxt   <none>           <none>
coredns-66bff467f8-v6bw2           1/1     Running   0          42h     10.244.7.201   redis-01.hlqxt   <none>           <none>
etcd-master69                      1/1     Running   0          3d17h   172.28.18.69   master69         <none>           <none>
kube-apiserver-master69            1/1     Running   0          3d16h   172.28.18.69   master69         <none>           <none>
kube-controller-manager-master69   1/1     Running   1          3d17h   172.28.18.69   master69         <none>           <none>
kube-flannel-ds-5tthk              1/1     Running   0          41h     172.28.5.124   redis-02.hlqxt   <none>           <none>
kube-flannel-ds-7mr6j              1/1     Running   0          41h     172.28.18.69   master69         <none>           <none>
kube-flannel-ds-9ml9m              1/1     Running   0          41h     172.28.5.120   redis-01.hlqxt   <none>           <none>
kube-flannel-ds-ws8sc              1/1     Running   0          41h     172.28.5.125   redis-03.hlqxt   <none>           <none>
kube-proxy-6pzzk                   1/1     Running   0          41h     172.28.5.125   redis-03.hlqxt   <none>           <none>
kube-proxy-99jjj                   1/1     Running   1          41h     172.28.18.69   master69         <none>           <none>
kube-proxy-h7nl7                   1/1     Running   0          41h     172.28.5.124   redis-02.hlqxt   <none>           <none>
kube-proxy-lktgm                   1/1     Running   0          41h     172.28.5.120   redis-01.hlqxt   <none>           <none>
kube-scheduler-master69            1/1     Running   1          3d17h   172.28.18.69   master69         <none>           <none>

二、下载recommended.yaml文件

[root@master69 kubernetes]# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml

三、修改recommended.yaml文件

修改service(nodeport)方式

[root@master69 kubernetes]# vim recommended.yaml 

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  type: NodePort   #增加
  ports:
    - port: 443
      targetPort: 8443
      nodePort: 31000  #增加
  selector:
    k8s-app: kubernetes-dashboard

因为自动生成的证书很多浏览器无法使用，所以我们自己创建，注释掉kubernetes-dashboard-certs对象声明

#apiVersion: v1
#kind: Secret
#metadata:
#  labels:
#    k8s-app: kubernetes-dashboard
#  name: kubernetes-dashboard-certs
#  namespace: kubernetes-dashboard
#type: Opaque

四、创建证书

[root@master69 kubernetes]# mkdir /etc/kubernetes/dashboard-certs

[root@master69 kubernetes]# cd dashboard-certs/

1、创建namespace

[root@master69 dashboard-certs]# kubectl create namespace kubernetes-dashboard

2、创建私钥key文件

[root@master69 dashboard-certs]# openssl genrsa -out dashboard.key 2048
Generating RSA private key, 2048 bit long modulus
.......+++
...............................+++
e is 65537 (0x10001)
[root@master69 dashboard-certs]# ll
总用量 4
-rw-r--r-- 1 root root 1675 1月  13 13:48 dashboard.key

3、使用openssl req 生成证书请求文件

生成证书请求文件需要将申请者的私钥以及公钥放入证书请求中，但在实际操作中，只需要提供私钥，openssl会自动从私钥中提取公钥另外，还需要将提供的数据进行数字签名(使用单向加密)，保证该证书请求文件的完整性和一致性，防止他人盗取后进行篡改，例如黑客将为www.baidu.com所申请的证书请求文件中的公司名改成对方的公司名称，如果能够篡改成功，则签署该证书请求时，所颁发的证书信息中将变成他人信息。

根据私钥生成一个证书请求文件

[root@master69 dashboard-certs]# openssl req -days 36000 -new -out dashboard.csr -key dashboard.key -subj '/CN=dashboard-cert' 

查看证书请求文件

[root@master69 dashboard-certs]# openssl req -in dashboard.csr -text

验证证书请求文件

[root@master69 dashboard-certs]# openssl req -verify -in dashboard.csr 
verify OK
-----BEGIN CERTIFICATE REQUEST-----
MIICXjCCAUYCAQAwGTEXMBUGA1UEAwwOZGFzaGJvYXJkLWNlcnQwggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRK3gJoOGpB+cxJJNvE0dl4/6xZgVFS1Sq
sx35t6dmiysf7Za+GwYWQbfHHXOjMvRMVSmBpodyQJirXUn0pnV+q2QIihOAub9f
8jsQO2e2uTSWKZ08OnAFqGaGQLMtzwHdsG1wqytVtA82afQsBkMK/rhACHxEwz8L
jesfeUqHc5jO86rjxN/AI70ndFMhq66L9WJGVVh5AAvfttQJC2TmYMlAC/nQesBi
L60TasrqB1NvyS0ko/VWAjqEIAeO93kEL2kx0GoOVwsddfI25POEsgTGjbAx+ir1
QLa8eyfl6nqrb/zKdQHVHBd/5Bsz/2ST2sbtsjqgDXoVY9NXV5AbAgMBAAGgADAN
BgkqhkiG9w0BAQsFAAOCAQEAYisttfpJfmyrkKej6Cvxq9VaW2OwBPX8z31fECU1
sGi7nCgk97mYMUqkhuVG6VzEw6ddrVMn4yCxssmKX4cGP0yJ8WeqjzygVGY7GDRc
HFucNqF2sljYHppSPgGWzxwCVGfq9RKc2bQPndY0FZbV97m2O5I5Rl81yz3NxEoO
vlN3G6h5KahAvv6LmwCowDGoBkn7is892EMZHHyhm3qLCBvFDQTuy/xwKcbIIJc7
yS57125PxoJNf/d3Ay75d+ABtiRGCkX7BalcGvLbnoNQnhKy2+1FBxBT+yFOAHvx
geBHvVxJP1rCCsu9yPnga6/mHpAfOLDQ+wQcPusO32xi7A==
-----END CERTIFICATE REQUEST-----

4、自签证书

[root@master69 dashboard-certs]# openssl x509 -req -in dashboard.csr -signkey dashboard.key  -out dashboard.crt -days 3650
Signature ok
subject=/CN=dashboard-cert
Getting Private key
[root@master69 dashboard-certs]# 

查看证书有效期

[root@master69 dashboard-certs]# openssl x509 -in dashboard.crt -noout -dates
notBefore=Jan 13 06:47:32 2021 GMT
notAfter=Jan 11 06:47:32 2031 GMT
[root@master69 dashboard-certs]#

六、创建kubernetes-dashboard-certs对象

[root@master69 dashboard-certs]# kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt -n kubernetes-dashboard
secret/kubernetes-dashboard-certs created

[root@master69 dashboard-certs]# kubectl get secrets -n kubernetes-dashboard
NAME                   TYPE                                  DATA   AGE
default-token-nnxdk    kubernetes.io/service-account-token   3      65m
kubernetes-dashboard-certs   Opaque                                2      22s

七、创建dashboard

[root@master69 kubernetes]# kubectl create -f recommended.yaml            
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created
Error from server (AlreadyExists): error when creating "recommended.yaml": clusterroles.rbac.authorization.k8s.io "kubernetes-dashboard" already exists
Error from server (AlreadyExists): error when creating "recommended.yaml": clusterrolebindings.rbac.authorization.k8s.io "kubernetes-dashboard" already exists

结尾的报错信息，是因为前面创建证书时，已经手动建立了namespace空间。

查看kubernetes-dashboard空间的资源

[root@master69 kubernetes]# kubectl get all -n kubernetes-dashboard
NAME                                             READY   STATUS              RESTARTS   AGE
pod/dashboard-metrics-scraper-6b4884c9d5-dzhdh   1/1     Running             0          5m29s
pod/kubernetes-dashboard-7b544877d5-f9kg8        0/1     ContainerCreating   0          5m29s

NAME                                TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)         AGE
service/dashboard-metrics-scraper   ClusterIP   10.105.4.217   <none>        8000/TCP        5m29s
service/kubernetes-dashboard        NodePort    10.98.91.216   <none>        443:31000/TCP   5m29s

NAME                                        READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/dashboard-metrics-scraper   1/1     1            1           5m29s
deployment.apps/kubernetes-dashboard        0/1     1            0           5m29s

NAME                                                   DESIRED   CURRENT   READY   AGE
replicaset.apps/dashboard-metrics-scraper-6b4884c9d5   1         1         1       5m29s
replicaset.apps/kubernetes-dashboard-7b544877d5        1         1         0       5m29s
[root@master69 kubernetes]# 

八、创建dashboard管理员

1、创建dashboard-admin.yaml文件

[root@master69 kubernetes]# vim dashboard-admin.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: dashboard-admin
  namspace: kubernetes-dashboard

保存退出，创建用户

[root@master69 kubernetes]# kubectl create -f dashboard-admin.yaml 
serviceaccount/dashboard-admin created
[root@master69 kubernetes]# 

[root@master69 kubernetes]# kubectl get ServiceAccount -n kubernetes-dashboard   
NAME                   SECRETS   AGE
dashboard-admin        1         40s
default                1         15m
kubernetes-dashboard   1         15m

2、为用户分配权限

创建dashboard-admin-bind-cluster-role.yaml文件

[root@master69 kubernetes]# vim dashboard-admin-bind-cluster-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin-bind-cluster-role
  labels:
    k8s-app: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin   #绑定到cluster-admin角色
subjects:
- kind: ServiceAccount
  name: dashboard-admin
  namespace: kubernetes-dashboard

执行分配权限

[root@master69 kubernetes]# kubectl create -f dashboard-admin-bind-cluster-role.yaml 
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin-bind-cluster-role created
[root@master69 kubernetes]# 

3、查看用户的token数据

首先查看kubernetes-admin用户的secret

[root@master69 kubernetes]# kubectl get secret -n kubernetes-dashboard -o wide|grep dashboard-admin
dashboard-admin-token-znrr4        kubernetes.io/service-account-token   3      23m
[root@master69 kubernetes]# 

查看详细信息

[root@master69 kubernetes]# kubectl describe secret dashboard-admin-token-znrr4 -n kubernetes-dashboard     
Name:         dashboard-admin-token-znrr4
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 24dd4aab-75fa-40dc-9d9b-851c4efa0c2d

Type:  kubernetes.io/service-account-token

Data
====
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6ImktcWNVbUZtdkZ1VGxsbEJINld0ZW9YZzdua0JJRmNmNlhrR005eERDc00ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tem5ycjQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMjRkZDRhYWItNzVmYS00MGRjLTlkOWItODUxYzRlZmEwYzJkIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.WaDgJJmVIUy78-YhBqDojhpG_swWUksa9bbxOHdyHX3bEitB1ccttEhD-CwonMcNPH1R0rdx5QJTZIKeKlYbIqJ_eJ7dtfKE-DO-pxnbd6JpeyKW9nIcVs5iCFgyL_rFVEiuYYgEVu-CRaIVaqb0zQCmzQPaeTiy_vzS0QCUHj4TYvpmZWclyE_BruuH57BS24-n2EA0iyvbHDwfb-t5aS87c9nhCeZ1XIPYVE8hF_nbKvbGdzd5PGUvvjV-5a2Q-SHFIau7JZFb2DenopnDlzMhPt_S_vrEOXJujCfeEV_28ovCvfgSZo1ITSRbeRkVHxoxs3O41Dd1RZ93gERtfg
ca.crt:     1025 bytes
namespace:  20 bytes
[root@master69 kubernetes]# 

将token值复制出来

九、浏览器打开https://masterip:31000

 输入token,登录

我们查看工作量-pods

 CPU和内存使用率没有显示，因为我们还没有安装Metrics-Server服务，请参考： kubernetes1.18安装metrics-server服务

安装以后，显示如下