1. 部署dashboard

文件：https://www.jianshu.com/p/40c0405811ee

1.1 下載部署檔案recommended.yaml 並將映象的地址改為本地映象的地址

wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.3/aio/deploy/recommended.yaml

1.2 下載映象

docker pull kubernetesui/dashboard:v2.0.3
docker tag kubernetesui/dashboard:v2.0.3 harbor.od.com/k8s/dashboard:v2.0.3
docker push harbor.od.com/k8s/dashboard:v2.0.3

docker pull kubernetesui/metrics-scraper:v1.0.4
docker tag kubernetesui/metrics-scraper:v1.0.4 harbor.od.com/k8s/metrics-scraper:v1.0.4
docker push harbor.od.com/k8s/metrics-scraper:v1.0.4
 

1.3 修改yaml檔案

• 註釋掉Dashboard Secret ，不然後面訪問顯示網頁不安全，證書過期，我們自己生成證書

• 將映象修改為映象倉庫地址

• 新增ingress配置

---
kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: kubernetes-dashboard-ingress
  namespace: kubernetes-dashboard
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
spec:
  rules:
    - host: k8s-dashboard.paic.com.cn
      http:
        paths: 
          - path: /
            backend:
              serviceName: kubernetes-dashboard
              servicePort: 443
 

• 生成新的secret

  這裡的secret必須在kubernetes-dashboard 名稱空間生成, 否則dashboard會起不來, dashboard是啟動在kubernetes-dashboard 這個名稱空間, 所以secret 也必須在這個空間生成

mkdir key && cd key
openssl genrsa -out dashboard.key 2048
openssl req -new -out dashboard.csr -key dashboard.key -subj '/CN=192.168.31.10'
openssl x509 -req -in dashboard.csr -signkey dashboard.key -out dashboard.crt
kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt -n kubernetes-dashboard
 

• 部署dashboard

kubectl apply -f recommended.yaml

1.4 設定許可權檔案

• admin-user.yaml

CopyapiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system

• admin-user-role-binding.yaml

CopyapiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system

• 部署許可權檔案

kubectl create -f admin-user.yaml 
kubectl create -f admin-user-role-binding.yaml

1.5 訪問dashboard

• 設定本地dns解析

  因為dashboard是跑在ingress上， 域名所對應的ip設定成ingress-controller 所在的ip地址

kubectl get all -n ingress-nginx -owide

• 本地配置dns (C:\Windows\System32\drivers\etc\hosts)

192.168.31.40 k8s-dashboard.paic.com.cn

• 訪問 k8s-dashboard.paic.com.cn

• master 上檢視token

kubectl describe secret `kubectl get secret -n kube-system |grep admin |awk '{print $1}'` -n kube-system |grep ^token|awk '{print $2}'

2. dashboard 分權