第十三章 k8s的GUI资源管理插件--dashboard

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

1、部署Kubernetes-dashboard

1.1 准备dashboard镜像

在10.4.7.200上操作

[root@hdss7-200 ~]# docker pull k8scn/kubernetes-dashboard-amd64:v1.8.3

[root@hdss7-200 ~]# docker images|grep dashboard

k8scn/kubernetes-dashboard-amd64   v1.8.3                     fcac9aa03fd6   3 years ago     102MB

[root@hdss7-200 ~]# docker tag k8scn/kubernetes-dashboard-amd64:v1.8.3 harbor.od.com/public/dashboard:v1.8.3

[root@hdss7-200 ~]# docker push harbor.od.com/public/dashboard:v1.8.3

1.2 准备dashboard资源配置清单

[root@hdss7-200 ~]# mkdir /data/k8s-yaml/dashboard

[root@hdss7-200 ~]# cd /data/k8s-yaml/dashboard/

创建rbac.yaml

[root@hdss7-200 dashboard]# vim rbac.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

  labels:

    k8s-app: kubernetes-dashboard

    addonmanager.kubernetes.io/mode: Reconcile

  name: kubernetes-dashboard-admin

  namespace: kube-system

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

  name: kubernetes-dashboard-admin

  namespace: kube-system

  labels:

    k8s-app: kubernetes-dashboard

    addonmanager.kubernetes.io/mode: Reconcile

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: cluster-admin

subjects:

- kind: ServiceAccount

  name: kubernetes-dashboard-admin

  namespace: kube-system

创建dp.yaml

[root@hdss7-200 dashboard]# vim dp.yaml

apiVersion: apps/v1

kind: Deployment

metadata:

  name: kubernetes-dashboard

  namespace: kube-system

  labels:

    k8s-app: kubernetes-dashboard

    kubernetes.io/cluster-service: "true"

    addonmanager.kubernetes.io/mode: Reconcile

spec:

  selector:

    matchLabels:

      k8s-app: kubernetes-dashboard

  template:

    metadata:

      labels:

        k8s-app: kubernetes-dashboard

      annotations:

        scheduler.alpha.kubernetes.io/critical-pod: ''

    spec:

      priorityClassName: system-cluster-critical

      containers:

      - name: kubernetes-dashboard

        image: harbor.od.com/public/dashboard:v1.8.3

        resources:

          limits:

            cpu: 100m

            memory: 300Mi

          requests:

            cpu: 50m

            memory: 100Mi

        ports:

        - containerPort: 8443

          protocol: TCP

        args:

          # PLATFORM-SPECIFIC ARGS HERE

          - --auto-generate-certificates

        volumeMounts:

        - name: tmp-volume

          mountPath: /tmp

        livenessProbe:

          httpGet:

            scheme: HTTPS

            path: /

            port: 8443

          initialDelaySeconds: 30

          timeoutSeconds: 30

      volumes:

      - name: tmp-volume

        emptyDir: {}

      serviceAccountName: kubernetes-dashboard-admin

      tolerations:

      - key: "CriticalAddonsOnly"

        operator: "Exists"

      imagePullSecrets:

      - name: harbor

创建svc.yaml

[root@hdss7-200 dashboard]# vim svc.yaml

apiVersion: v1

kind: Service

metadata:

  name: kubernetes-dashboard

  namespace: kube-system

  labels:

    k8s-app: kubernetes-dashboard

    kubernetes.io/cluster-service: "true"

    addonmanager.kubernetes.io/mode: Reconcile

spec:

  selector:

    k8s-app: kubernetes-dashboard

  ports:

  - port: 443

    targetPort: 8443

创建ingress.yaml

[root@hdss7-200 dashboard]# vim ingress.yaml

apiVersion: extensions/v1beta1

kind: Ingress

metadata:

  name: kubernetes-dashboard

  namespace: kube-system

  annotations:

    kubernetes.io/ingress.class: traefik

spec:

  rules:

  - host: dashboard.od.com

    http:

      paths:

      - backend:

          serviceName: kubernetes-dashboard

          servicePort: 443

2.3 依次创建资源

在任意一个运算节点操作

[root@hdss7-21 ~]# kubectl apply -f http://k8s-yaml.od.com/dashboard/rbac.yaml

serviceaccount/kubernetes-dashboard-admin created

clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-admin created

[root@hdss7-21 ~]# kubectl apply -f http://k8s-yaml.od.com/dashboard/dp.yaml

deployment.apps/kubernetes-dashboard created

[root@hdss7-21 ~]# kubectl apply -f http://k8s-yaml.od.com/dashboard/svc.yaml

service/kubernetes-dashboard created

[root@hdss7-21 ~]# kubectl apply -f http://k8s-yaml.od.com/dashboard/ingress.yaml

ingress.extensions/kubernetes-dashboard created

2.4 查看资源

如下，dashboard资源均已被创建

查看pod

[root@hdss7-21 ~]# kubectl get pod -n kube-system|grep dashboard

kubernetes-dashboard-99ff79fcd-5f6pg   1/1     Running   0          2m45s

查看svc

[root@hdss7-21 ~]# kubectl get svc -n kube-system|grep dashboard

kubernetes-dashboard      ClusterIP   192.168.250.65   <none>        443/TCP                  3m18s

查看ingress

[root@hdss7-21 ~]# kubectl get ingress -n kube-system|grep dashboard

kubernetes-dashboard   dashboard.od.com             80      3m23s

2、配置解析域名

在10.4.7.11上操作

[root@hdss7-11 ~]# vim /var/named/od.com.zone

$ORIGIN od.com.

$TTL 600  ; 10 minutes

@       IN SOA  dns.od.com. dnsadmin.od.com. (

        2020010505 ; serial

        10800      ; refresh (3 hours)

        900        ; retry (15 minutes)

        604800     ; expire (1 week)

        86400      ; minimum (1 day)

        )

        NS   dns.od.com.

$TTL 60 ; 1 minute

dns                A    10.4.7.11

harbor             A    10.4.7.200

k8s-yaml           A    10.4.7.200

traefik            A    10.4.7.10

dashboard          A    10.4.7.10

[root@hdss7-11 ~]# systemctl restart named

[root@hdss7-11 ~]# dig -t A dashboard.od.com @10.4.7.11 +short

10.4.7.10

运算节点解析

[root@hdss7-21 ~]# dig -t A dashboard.od.com @192.168.0.2 +short

10.4.7.10

3、配置反向代理认证

3.1 自签证书

在10.4.7.200上操作

[root@hdss7-200 certs]# (umask 007;openssl genrsa -out dashboard.od.com.key 2048)

Generating RSA private key, 2048 bit long modulus

..........................................................+++

..................................................................................................................................................................................................................+++

e is 65537 (0x10001)

[root@hdss7-200 certs]# [root@hdss7-200 certs]# openssl req -new -key dashboard.od.com.key -out dashboard.od.com.csr -subj "/CN=*.od.com/C=CN/ST=BeiJing/L=Beijing/O=od/OU=ops"

[root@hdss7-200 certs]# openssl x509 -req -in dashboard.od.com.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out dashboard.od.com.crt -days 3650

Signature ok

subject=/CN=*.od.com/C=CN/ST=BeiJing/L=Beijing/O=od/OU=ops

Getting CA Private Key

[root@hdss7-200 certs]# ls |grep dashboard

dashboard.od.com.crt

dashboard.od.com.csr

dashboard.od.com.key

[root@hdss7-200 certs]# cfssl-certinfo -cert dashboard.od.com.crt

3.2 拉取证书

在10.4.7.11/12上都要操作

[root@hdss7-11 ~]# mkdir /etc/nginx/certs/

[root@hdss7-11 ~]# cd /etc/nginx/certs/

[root@hdss7-11 certs]# scp root@10.4.7.200:/opt/certs/dashboard.od.com.key .

[root@hdss7-11 certs]# scp root@10.4.7.200:/opt/certs/dashboard.od.com.crt .

3.3 配置nginx代理，使用https

在10.4.7.11/12两台代理服务器上操作

[root@hdss7-11 ~]# vim /etc/nginx/conf.d/dashboard.conf

server {

    listen       80;

    server_name  dashboard.od.com;

    rewrite ^(.*)$ https://${server_name}$1 permanent;

}

server {

    listen       443 ssl;

    server_name  dashboard.od.com;

    ssl_certificate "certs/dashboard.od.com.crt";

    ssl_certificate_key "certs/dashboard.od.com.key";

    ssl_session_cache shared:SSL:1m;

    ssl_session_timeout  10m;

    ssl_ciphers HIGH:!aNULL:!MD5;

    ssl_prefer_server_ciphers on;

    location / {

        proxy_pass http://default_backend_traefik;

        proxy_set_header Host       $http_host;

        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;

    }

}

[root@hdss7-11 certs]# nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

[root@hdss7-11 certs]# nginx -s reload

4、浏览器访问

尝试访问dashboard页面http://dashboard.od.com/

在运算节点上查看登录令牌token

[root@hdss7-21 ~]# kubectl get secret -n kube-system

NAME                                     TYPE                                  DATA   AGE

coredns-token-xkclr                      kubernetes.io/service-account-token   3      3d22h

default-token-xqn4c                      kubernetes.io/service-account-token   3      10d

kubernetes-dashboard-admin-token-mhmvg   kubernetes.io/service-account-token   3      10m

kubernetes-dashboard-key-holder          Opaque                                2      23h

traefik-ingress-controller-token-dr7cs   kubernetes.io/service-account-token   3      31m

[root@hdss7-21 ~]# kubectl describe secret kubernetes-dashboard-admin-token-mhmvg  -n kube-system

Name:         kubernetes-dashboard-admin-token-mhmvg

Namespace:    kube-system

Labels:       <none>

Annotations:  kubernetes.io/service-account.name: kubernetes-dashboard-admin

              kubernetes.io/service-account.uid: d15809d2-ebb8-11eb-bb04-000c29e396b1

Type:  kubernetes.io/service-account-token

Data

====

ca.crt:     1346 bytes

namespace:  11 bytes

token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbi10b2tlbi1taG12ZyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImQxNTgwOWQyLWViYjgtMTFlYi1iYjA0LTAwMGMyOWUzOTZiMSIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTprdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbiJ9.Uc6nhJprnjerB4IaTxMlDwVv_fE_mFwyikAB7wA9ZLyIh79a_KDGS--bZu_L0tfoctb9cpn3nYrwfnkB5C6Iie-3DQTbRoygOptORvh5Q3HwBvkHUo54HK4ylFK7oukaZJW0Mer_5ZnWWdRPy764pOUGi3Cy3pYrv6dWX5ZCTEugjJmskLfwDfr8cWVEkH6qQwdTpVmZuX-RlgoVLI2ZnPjvtOPu_bUerZXLyC013RfcTvmN5rXrXOoNUBSNUIHaMEj4K9o5PtTMfK_H4PliK_4Tl-LASJu_zOCRuZZHHfqYvqTDr1tf03RrlTxcQJfuWgGa7kBrXF76lOdI7xwZoA

使用令牌登录就用上面的token信息就行

直接跳过就行了，如下是dashboard的页面详情

5、使用1.10.1版本镜像

在10.4.7.200服务器上

修改dp.yaml文件中的镜像（经常版本修改程1.10.1）

[root@hdss7-200 dashboard]# vim dp.yaml

image: harbor.od.com/public/dashboard:v1.10.1

保存退出

在任意运算节点上（10.4.7.21、22）

删除原来的deployment资源

[root@hdss7-21 ~]# kubectl delete -f http://k8s-yaml.od.com/dashboard/dp.yaml

deployment.apps "kubernetes-dashboard" deleted

创建新的deployment资源

[root@hdss7-21 ~]# kubectl apply -f http://k8s-yaml.od.com/dashboard/dp.yaml

deployment.apps/kubernetes-dashboard created

查看token

[root@hdss7-21 ~]# kubectl get secret -n kube-system

NAME                                     TYPE                                  DATA   AGE

coredns-token-xkclr                      kubernetes.io/service-account-token   3      4d18h

default-token-xqn4c                      kubernetes.io/service-account-token   3      11d

kubernetes-dashboard-admin-token-mhmvg   kubernetes.io/service-account-token   3      19h

kubernetes-dashboard-key-holder          Opaque                                2      42h

traefik-ingress-controller-token-dr7cs   kubernetes.io/service-account-token   3      19h

[root@hdss7-21 ~]# kubectl describe secret kubernetes-dashboard-admin-token-mhmvg -n kube-system

Name:         kubernetes-dashboard-admin-token-mhmvg

Namespace:    kube-system

Labels:       <none>

Annotations:  kubernetes.io/service-account.name: kubernetes-dashboard-admin

              kubernetes.io/service-account.uid: d15809d2-ebb8-11eb-bb04-000c29e396b1

Type:  kubernetes.io/service-account-token

Data

====

ca.crt:     1346 bytes

namespace:  11 bytes

token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbi10b2tlbi1taG12ZyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImQxNTgwOWQyLWViYjgtMTFlYi1iYjA0LTAwMGMyOWUzOTZiMSIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTprdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbiJ9.Uc6nhJprnjerB4IaTxMlDwVv_fE_mFwyikAB7wA9ZLyIh79a_KDGS--bZu_L0tfoctb9cpn3nYrwfnkB5C6Iie-3DQTbRoygOptORvh5Q3HwBvkHUo54HK4ylFK7oukaZJW0Mer_5ZnWWdRPy764pOUGi3Cy3pYrv6dWX5ZCTEugjJmskLfwDfr8cWVEkH6qQwdTpVmZuX-RlgoVLI2ZnPjvtOPu_bUerZXLyC013RfcTvmN5rXrXOoNUBSNUIHaMEj4K9o5PtTMfK_H4PliK_4Tl-LASJu_zOCRuZZHHfqYvqTDr1tf03RrlTxcQJfuWgGa7kBrXF76lOdI7xwZoA

访问新的dashboard页面，登录页面没有skip选项，必须要使用密码文件或者token令牌进行登录，增加了安全性

正文

1、部署Kubernetes-dashboard

1.1 准备dashboard镜像

1.2 准备dashboard资源配置清单
`[root@hdss7-200 ~]# mkdir /data/k8s-yaml/dashboard [root@hdss7-200 ~]# cd /data/k8s-yaml/dashboard/`

2.3 依次创建资源

2.4 查看资源

2、配置解析域名

3、配置反向代理认证

3.1 自签证书

3.2 拉取证书

3.3 配置nginx代理，使用https

4、浏览器访问

5、使用1.10.1版本镜像

相关阅读

【大数据】【No433】Docker 和K8S 详细讲解视频教程

2018年docker入门与实战与k8s（包含kubernetes）五年运维工程师主讲视频教程

【编程开发技术】K8S微服务核心架构学习指南 ASP.NET Core微服务基于K8S 架构师必备Kubernetes教程

【数据库】【No373】2018年docker入门与实战与k8s（包含kubernetes）五年运维工程师主讲视频教程

k8s中redis主从切换，redis cluster 主从切换命令

游戏角色扮演为啥好玩，角色扮演游戏好处

像素射击游戏解说加特林，像素射击加特林配置

thinkphp开发网站，thinkphp搭建网站

目录[+]

1、部署Kubernetes-dashboard

1.1 准备dashboard镜像

1.2 准备dashboard资源配置清单 [root@hdss7-200 ~]# mkdir /data/k8s-yaml/dashboard [root@hdss7-200 ~]# cd /data/k8s-yaml/dashboard/

2.3 依次创建资源

2.4 查看资源

2、配置解析域名

3、配置反向代理认证

3.1 自签证书

3.2 拉取证书

3.3 配置nginx代理，使用https

4、浏览器访问

5、使用1.10.1版本镜像

相关阅读

【大数据】【No433】Docker 和K8S 详细讲解视频教程

2018年docker入门与实战与k8s（包含kubernetes）五年运维工程师主讲视频教程

【编程开发技术】K8S微服务核心架构学习指南 ASP.NET Core微服务基于K8S 架构师必备Kubernetes教程

【数据库】【No373】2018年docker入门与实战与k8s（包含kubernetes）五年运维工程师主讲视频教程

k8s中redis主从切换，redis cluster 主从切换命令

游戏角色扮演为啥好玩，角色扮演游戏好处

像素射击游戏解说加特林，像素射击加特林配置

thinkphp开发网站，thinkphp搭建网站

目录[+]

1.2 准备dashboard资源配置清单
`[root@hdss7-200 ~]# mkdir /data/k8s-yaml/dashboard [root@hdss7-200 ~]# cd /data/k8s-yaml/dashboard/`