kubernets網站頁面dashboard

dashboard 儀表盤
K8S Dashboard是官方的一個基于WEB的用戶界面，專門用來管理K8S集群，并可展示集群的狀態，K8S集群安裝好后默認沒有包含Dashboard，所以需要額外創建，

RBAC
K8S 1.6引進，是讓用戶能夠訪問 k8S API 資源的授權方式【不授權就沒有資格訪問K8S的資源】
用戶
K8S有兩種用戶：User和Service Account，其中，User給人用，Service Account給行程用，讓行程有相關權限，如Dashboard就是一個行程，我們就可以創建一個Service Account給它
角色
Role是一系列權限的集合，例如一個Role可包含讀取和列出 Pod的權限【 ClusterRole 和 Role 類似，其權限范圍是整個集群】
角色系結
RoleBinding把角色映射到用戶，從而讓這些用戶擁有該角色的權限【ClusterRoleBinding 和RoleBinding 類似，可讓用戶擁有 ClusterRole 的權限】
Secret
Secret是一個包含少量敏感資訊如密碼，令牌，或秘鑰的物件，把這些資訊保存在 Secret物件中，可以在這些資訊被使用時加以控制，并可以降低資訊泄露的風險

//網站頁面
需要
dashboard-configmap.yaml 組態檔
dashboard-doployment.yaml 部署資源 dashboard安裝依賴于doployment
dashboard-service.yaml 服務
dashboard-rbac.yaml 安全 授權管理
dashboard-secret.yaml 安全 證書驗證
k8s-admin.yaml 管理證書

資源創建 create apply
資源重新部署，更新 apply
kubectl create -f //創建資源
-f：參考

在apply始終檢測不到檔案時，把檔案delete掉，重新apply
//在master01上操作
//創建dashborad作業目錄

[root@master ~]# cd k8s/
[root@master k8s]# mkdir dashboard
[root@master k8s]# cd dashboard/
[root@master dashboard]# 

//拷貝官方的檔案
https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard

[root@master dashboard]# ls
dashboard-configmap.yaml   dashboard-rbac.yaml    dashboard-service.yaml
dashboard-controller.yaml  dashboard-secret.yaml  k8s-admin.yaml

//創建資源

[root@master dashboard]# kubectl create -f dashboard-rbac.yaml 
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created

[root@master dashboard]# kubectl create -f dashboard-secret.yaml 
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created

[root@master dashboard]# kubectl create -f dashboard-configmap.yaml 
configmap/kubernetes-dashboard-settings created

[root@master dashboard]# kubectl create -f dashboard-controller.yaml 
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created

[root@master dashboard]# kubectl create -f dashboard-service.yaml 
service/kubernetes-dashboard created

//完成后查看創建在指定的kube-system命名空間下

[root@master dashboard]# kubectl get pods -n kube-system
NAME                                    READY   STATUS    RESTARTS   AGE
kubernetes-dashboard-65f974f565-7bjjq   1/1     Running   0          24s

//查看如何訪問

[root@master dashboard]# kubectl get pods,svc -n kube-system
NAME                                        READY   STATUS    RESTARTS   AGE
pod/kubernetes-dashboard-65f974f565-7bjjq   1/1     Running   0          50s

NAME                           TYPE       CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE
service/kubernetes-dashboard   NodePort   10.0.0.224   <none>        443:30001/TCP   41s

[root@master dashboard]# kubectl get pods,svc -n kube-system -o wide
NAME                                        READY   STATUS    RESTARTS   AGE   IP            NODE            NOMINATED NODE
pod/kubernetes-dashboard-65f974f565-7bjjq   1/1     Running   0          82s   172.17.59.2   192.168.20.30   <none>

NAME                           TYPE       CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE   SELECTOR
service/kubernetes-dashboard   NodePort   10.0.0.224   <none>        443:30001/TCP   73s   k8s-app=kubernetes-dashboard

[root@node2 cfg]# docker ps -a
CONTAINER ID        IMAGE                                                                 COMMAND                  CREATED              STATUS                           PORTS               NAMES
6294ae449a5b        siriuszg/kubernetes-dashboard-amd64                                   "/dashboard --insecu…"   About a minute ago   Up About a minute                                    k8s_kubernetes-dashboard_kubernetes-dashboard-65f974f565-7bjjq_kube-system_8a4fb83f-0975-11eb-aede-000c29959657_0
170d1c0fb152        registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0   "/pause"                 2 minutes ago        Up 2 minutes                                         k8s_POD_kubernetes-dashboard-65f974f565-7bjjq_kube-system_8a4fb83f-0975-11eb-aede-000c29959657_0
36f7e070b4fd        centos:7                                                              "/bin/bash"              2 hours ago          Exited (130) About an hour ago                       frosty_bartik

//訪問nodeIP就可以訪問

https://192.168.20.30:30001/

這里使用谷歌瀏覽器，會出現如下情況，需要自行制作證書

[root@master dashboard]# vim dashboard-cert.sh
cat > dashboard-csr.json <<EOF
{
   "CN": "Dashboard",
   "hosts": [],
   "key": {
       "algo": "rsa",
       "size": 2048
   },
   "names": [
       {
           "C": "CN",
           "L": "BeiJing",
           "ST": "BeiJing"
       }
   ]
}
EOF

K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | c
fssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system

增加證書兩行，然后apply

[root@localhost dashboard]# vim dashboard-controller.yaml
        args:
          # PLATFORM-SPECIFIC ARGS HERE
          - --auto-generate-certificates
          - --tls-key-file=dashboard-key.pem
          - --tls-cert-file=dashboard.pem

[root@master dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/
2020/10/08 22:57:18 [INFO] generate received request
2020/10/08 22:57:18 [INFO] received CSR
2020/10/08 22:57:18 [INFO] generating key: rsa-2048
2020/10/08 22:57:18 [INFO] encoded CSR
2020/10/08 22:57:18 [INFO] signed certificate with serial number 447633174051868055331633690754042067283491175690
2020/10/08 22:57:18 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
secret "kubernetes-dashboard-certs" deleted
secret/kubernetes-dashboard-certs created

//重新部署

[root@localhost dashboard]# kubectl apply -f dashboard-controller.yaml 
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
serviceaccount/kubernetes-dashboard configured
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
deployment.apps/kubernetes-dashboard configured

//生成令牌

[root@master dashboard]# kubectl create -f k8s-admin.yaml
serviceaccount/dashboard-admin created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
//保存
[root@master dashboard]# kubectl get secret -n kube-system 
NAME                               TYPE                                  DATA   AGE
dashboard-admin-token-fmksp        kubernetes.io/service-account-token   3      28s
default-token-8mhqw                kubernetes.io/service-account-token   3      89m
kubernetes-dashboard-certs         Opaque                                11     2m40s
kubernetes-dashboard-key-holder    Opaque                                2      10m
kubernetes-dashboard-token-clssw   kubernetes.io/service-account-token   3      9m58s

//查看令牌

[root@master dashboard]# kubectl describe secret dashboard-admin-token-fmksp -n kube-system
Name:         dashboard-admin-token-fmksp
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: de923e3d-0976-11eb-aede-000c29959657

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1359 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tZm1rc3AiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZGU5MjNlM2QtMDk3Ni0xMWViLWFlZGUtMDAwYzI5OTU5NjU3Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.Wi8CNzkhjUVjOxxnJhM-VwRaw9TycHQUYe4lxTqIw9aVWHjZOoQrtj2ERBTw_SFFVk94_Lsi3T8How3Yzh5xhvXdIQBNYdZnZMHNCEoR313T1fMVyQXVYzj0TJ_kw1pgepuTnYQnt2dVHfqaNJb7KRubTYmZ0UJFUYKANHrjwAGCI1qKQvtExCUfhv2InyGzvNxIvs120pzOAL2erwkb_DVsxJvw6a3exL5GTLyJtilapS0FnClbsgDyBmPZAnvIDpzbtE1cTSePjimUcQih4g3vgNv4oUhehBNW6IoNvjdnpL6Diq_2amnotM0nUrdRj6MEn6d5rA0-q4Cze_sokg

復制下令牌eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJu

重繪網頁
選擇令牌，然后把令牌復制進去選擇登錄
使用火狐瀏覽器