Kubernetes Dashboard安装步骤

2024-01-04 12:20:10

一、Kubernetes Dashboard安装步骤

1. 集群master节点执行如下命令：

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.2.0/aio/deploy/recommended.yaml

2.查看pod运行情况,Runing说明正常运行

kubectl get pod -n kubernetes-dashboard
NAME                                         READY   STATUS    RESTARTS   AGE
dashboard-metrics-scraper-78f5d9f487-l8xfs   1/1     Running   0          2m19s
kubernetes-dashboard-577bd97bc-69fq5         1/1     Running   0          2m19s

3.查看dashboard的service状况，默认为ClusterIP，只能在集群内部访问

kubectl get svc -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
dashboard-metrics-scraper   ClusterIP   10.96.105.243   <none>        8000/TCP   3m43s
kubernetes-dashboard        ClusterIP   10.100.158.78   <none>        443/TCP    3m43s

4.修改dashboard的service为NodePort

 kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kubernetes-dashboard

通过打补丁的方式修改service的type为NodePort

kubectl get svc -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.96.105.243   <none>        8000/TCP        7m28s
kubernetes-dashboard        NodePort    10.100.158.78   <none>        443:30377/TCP   7m28s

再次查看service类型已经修改为NodePort，端口为30377，随机生成，用于后面登录

5.查看serviceaccount用户名字

kubectl get serviceaccount -n kubernetes-dashboard
NAME                   SECRETS   AGE
default                1         3m2s
kubernetes-dashboard   1         3m2s

该用户用于登录dashboard，管理集群相关信息。

6.查看kubernetes-dashboard用户信息

kubectl describe serviceaccounts  kubernetes-dashboard -n kubernetes-dashboard 
Name:                kubernetes-dashboard
Namespace:           kubernetes-dashboard
Labels:              k8s-app=kubernetes-dashboard
Annotations:         Image pull secrets:  <none>
Mountable secrets:   kubernetes-dashboard-token-kq9mm
Tokens:              kubernetes-dashboard-token-kq9mm
Events:              <none>

7.获取kubernetes-dashboard用户的token信息，用于ssl登录认证

kubectl describe secrets kubernetes-dashboard-token-kq9mm -n kubernetes-dashboard
Name:         kubernetes-dashboard-token-kq9mm
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: kubernetes-dashboard
              kubernetes.io/service-account.uid: 7162662b-327f-450f-9043-2f37776da296

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IjRlYjhnb2ZPYndKYThsSWJJZUpCcWtOWlNtMlVESHgzQ0hvOVQ3VjIyNVkifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC10b2tlbi1rcTltbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjcxNjI2NjJiLTMyN2YtNDUwZi05MDQzLTJmMzc3NzZkYTI5NiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDprdWJlcm5ldGVzLWRhc2hib2FyZCJ9.bNqFeGg4NhZs3oVf7tUh1Nvw2yM3W6BXJ4qNVCfBKOjhHM15V_uGAU7rt22Phihy3gUW2kK9IPu_FvzdclThDYkF1d7wkaCIy_erfzFtv7t79Vv5vKuQfbNri1OP5W-V3a9d5yOHF0gAKNqKOhAb-VTuR9NtCafgpe7nulUwT1b9mEO6pjNICOBy-ilLOCPcqvo0ARufcErA6Adt9LP15fE0y43Rjq3Var7QWK22FxsiN-riuloXRPciLN9a5Z3cnFm0NRZTZK7Bv7VUV5vx6XGEddYMbYC-o9EqCaa9b-GGha1Tf0yhgX0lY90ifMMase40ya2QRFHdjmzIalMIyw

8.访问master节点30377端口，注意为https协议。

https://10.0.0.21:30377

点击继续前往，也可以直接在键盘输入
thisisnotsafe，回车即可。

选择token，复制第7步查到的token，点击登录。

登录之后会发现有许多错误信息，是因为dashboard默认创建的用户所绑定的角色权限不够。

9.查看kubernetes-dashboard用户绑定的集群角色，为kubernetes-dashboard角色

kubectl describe clusterrolebinding kubernetes-dashboard -n kubernetes-dashboard
Name:         kubernetes-dashboard
Labels:       <none>
Annotations:  Role:
  Kind:       ClusterRole
  Name:       kubernetes-dashboard
Subjects:
  Kind            Name                  Namespace
  ----            ----                  ---------
  ServiceAccount  kubernetes-dashboard  kubernetes-dashboard

10.查看kubernetes-dashboard角色权限信息，发现只有node和pod的get，list，watch权限

kubectl describe clusterrole kubernetes-dashboard
Name:                   kubernetes-dashboard
Labels:                 k8s-app=kubernetes-dashboard
Annotations:            PolicyRule:
  Resources             Non-Resource URLs  Resource Names  Verbs
  ---------             -----------------  --------------  -----
  nodes.metrics.k8s.io  []                 []              [get list watch]
  pods.metrics.k8s.io   []                 []              [get list watch]

11.创建一个新的用户dashboard-admin

kubectl create serviceaccount dashboard-admin -n kubernetes-dashboard

12.为该用户绑定cluster-admin权限，该权限拥有管理员权限

kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kubernetes-dashboard:dashboard-admin

13.获取新管理员用户的token

kubectl describe sa dashboard-admin -n kubernetes-dashboard
Name:                dashboard-admin
Namespace:           kubernetes-dashboard
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   dashboard-admin-token-jq8t4
Tokens:              dashboard-admin-token-jq8t4
Events:              <none>

kubectl describe secrets dashboard-admin-token-jq8t4 -n kubernetes-dashboard
Name:         dashboard-admin-token-jq8t4
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 507a6b02-7747-43f9-a7bb-38c52f2eb85f

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IjRlYjhnb2ZPYndKYThsSWJJZUpCcWtOWlNtMlVESHgzQ0hvOVQ3VjIyNVkifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tanE4dDQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNTA3YTZiMDItNzc0Ny00M2Y5LWE3YmItMzhjNTJmMmViODVmIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.UR0bmhfcPtgIVF41Ozqx6peKu-VRlIExX6Is8Xhwq0kl0vL64vP187iRXtED-WoRPCF55BR87qL9wwSe6qTr76MCFHuEFU4gycscy6A0ahRklI5nYROkEHskV4B_lCrA-Q_IcGECEwPIhL91KH47sWNxUe5D1UL3k1j0rmw98Ur3oKhTRLN96L28rir7RSk1rAEFSGjjmqoT_Xi4pbmiMHjveI-XiSKZMEtrSgnPc-txGceQxhmUqXCjMqE2VSKetKfXgTyNmTR9y4xcHsaYYg_UwaICVMmWLg-xwgQmrKHGZmpHk6x-2lQPBuKFD8YNMYNC8nj_mRLQWYPq_xegyg

14.使用新管理员用户的token登录

一切显示正常。

码农公寓