二进制安装-k8s高可用集群17-集群插件之dashboard
2021-09-02 本文已影响0人
Chris0Yang
1、修改配置文件
将下载的 kubernetes-server-linux-amd64.tar.gz 解压后，再解压其中的 kubernetes-src.tar.gz 文件
dashboard 对应的目录是：cluster/addons/dashboard
pwd
/home/k8s/k8s/kubernetes/cluster/addons/dashboard
cp dashboard-controller.yaml{,.orig}
#修改第33行镜像tag，并pull好自己定义的对应tag的镜像。
vim dashboard-controller.yaml
#修改前后对比
diff dashboard-controller.yaml{,.orig}
33c33
< image: cnych/kubernetes-dashboard-amd64:v1.8.3
---
> image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3
cp dashboard-service.yaml{,.orig}
#在第十一行添加一个labels，定义端口类型为NodePort。
vim dashboard-service.yaml
#修改前后对比
diff dashboard-service.yaml.orig dashboard-service.yaml
10a11
> type: NodePort
指定端口类型为 NodePort，这样外界可以通过地址 nodeIP:nodePort 访问 dashboard
2、执行所有定义文件
ls *.yaml
dashboard-configmap.yaml dashboard-controller.yaml dashboard-rbac.yaml dashboard-secret.yaml dashboard-service.yaml
kubectl create -f .
3、查看分配的 NodePort
kubectl get deployment kubernetes-dashboard -n kube-system
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
kubernetes-dashboard 1 1 1 1 15h
kubectl --namespace kube-system get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE
coredns-77c989547b-j77lp 1/1 Running 0 15h 172.30.84.3 kube-node1
coredns-77c989547b-t6mxc 1/1 Running 0 15h 172.30.29.3 kube-node3
kubernetes-dashboard-5bb8d4d76c-8kkwt 1/1 Running 0 15h 172.30.84.5 kube-node1
kubectl get svc kubernetes-dashboard -n kube-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes-dashboard NodePort 10.254.147.2 <none> 443:8605/TCP 15h
- dashboard pod 443 端口通过 NodePort 映射到 node 的 8605 端口
dashboard 的 --authentication-mode 支持 token、basic，默认为 token。如果使用 basic，则 kube-apiserver 必须配置 ‘--authorization-mode=ABAC’ 和 ‘--basic-auth-file’ 参数
4、查看 dashboard 支持的命令行参数
kubectl exec --namespace kube-system -it kubernetes-dashboard-5bb8d4d76c-8kkwt -- /dashboard --help
20XX/XX/XX XX:XX:XX Starting overwatch
Usage of /dashboard:
--alsologtostderr log to standard error as well as files
--apiserver-host string The address of the Kubernetes Apiserver to connect to in the format of protocol://address:port, e.g., http://localhost:8080. If not specified, the assumption is that the binary runs inside a Kubernetes cluster and local discovery is attempted.
--authentication-mode stringSlice Enables authentication options that will be reflected on login screen. Supported values: token, basic. Default: token.Note that basic option should only be used if apiserver has '--authorization-mode=ABAC' and '--basic-auth-file' flags set. (default [token])
--auto-generate-certificates When set to true, Dashboard will automatically generate certificates used to serve HTTPS. Default: false.
--bind-address ip The IP address on which to serve the --secure-port (set to 0.0.0.0 for all interfaces). (default 0.0.0.0)
--default-cert-dir string Directory path containing '--tls-cert-file' and '--tls-key-file' files. Used also when auto-generating certificates flag is set. (default "/certs")
--disable-settings-authorizer When enabled, Dashboard settings page will not require user to be logged in and authorized to access settings page.
--enable-insecure-login When enabled, Dashboard login view will also be shown when Dashboard is not served over HTTPS. Default: false.
--heapster-host string The address of the Heapster Apiserver to connect to in the format of protocol://address:port, e.g., http://localhost:8082. If not specified, the assumption is that the binary runs inside a Kubernetes cluster and service proxy will be used.
--insecure-bind-address ip The IP address on which to serve the --port (set to 0.0.0.0 for all interfaces). (default 127.0.0.1)
--insecure-port int The port to listen to for incoming HTTP requests. (default 9090)
--kubeconfig string Path to kubeconfig file with authorization and master location information.
--log_backtrace_at traceLocation when logging hits line file:N, emit a stack trace (default :0)
--log_dir string If non-empty, write log files in this directory
--logtostderr log to standard error instead of files
--metric-client-check-period int Time in seconds that defines how often configured metric client health check should be run. Default: 30 seconds. (default 30)
--port int The secure port to listen to for incoming HTTPS requests. (default 8443)
--stderrthreshold severity logs at or above this threshold go to stderr (default 2)
--system-banner string When non-empty displays message to Dashboard users. Accepts simple HTML tags. Default: ''.
--system-banner-severity string Severity of system banner. Should be one of 'INFO|WARNING|ERROR'. Default: 'INFO'. (default "INFO")
--tls-cert-file string File containing the default x509 Certificate for HTTPS.
--tls-key-file string File containing the default x509 private key matching --tls-cert-file.
--token-ttl int Expiration time (in seconds) of JWE tokens generated by dashboard. Default: 15 min. 0 - never expires (default 900)
-v, --v Level log level for V logs
--vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered logging
command terminated with exit code 2
5、访问 dashboard
为了集群安全，从 1.7 开始，dashboard 只允许通过 https 访问，如果使用 kube proxy 则必须监听 localhost 或 127.0.0.1，对于 NodePort 没有这个限制，但是仅建议在开发环境中使用。
对于不满足这些条件的登录访问，在登录成功后浏览器不跳转，始终停在登录界面。
参考： https://github.com/kubernetes/dashboard/wiki/Accessing-Dashboard—1.7.X-and-above https://github.com/kubernetes/dashboard/issues/2540
- kubernetes-dashboard 服务暴露了 NodePort，可以使用 https://NodeIP:NodePort 地址访问 dashboard；
- 通过 kube-apiserver 访问 dashboard；
- 通过 kubectl proxy 访问 dashboard：
1）通过 kubectl proxy 访问 dashboard（了解）
启动代理：
kubectl proxy --address='localhost' --port=8086 --accept-hosts='^*$'
Starting to serve on 127.0.0.1:8086
- --address 必须为 localhost 或 127.0.0.1；
- 需要指定 --accept-hosts 选项，否则浏览器访问 dashboard 页面时提示 “Unauthorized”；
浏览器访问 URL：http://127.0.0.1:8086/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy
2）通过 kube-apiserver 访问 dashboard（应用）
获取集群服务地址列表：
kubectl cluster-info
Kubernetes master is running at https://172.68.96.110:8443
CoreDNS is running at https://172.68.96.110:8443/api/v1/namespaces/kube-system/services/coredns:dns/proxy
kubernetes-dashboard is running at https://172.68.96.110:8443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
必须通过 kube-apiserver 的安全端口 (https) 访问 dashbaord，访问时浏览器需要使用自定义证书，否则会被 kube-apiserver 拒绝访问。
创建和导入自定义证书的步骤和参考：
A. 浏览器访问 kube-apiserver 安全端口
浏览器访问 URL：https://xxxx:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/ 对于 virtuabox 做了端口映射： http://127.0.0.1:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/
现在，直接使用刚刚通过kubectl cluster-info获取到的地址进行访问：https://xxxx:8443
image.png
6、创建登录 Dashboard 的 token 和 kubeconfig 配置文件
上面提到，Dashboard 默认只支持 token 认证，所以如果使用 KubeConfig 文件，需要在该文件中指定 token，不支持使用 client 证书认证
1）创建登录 token
kubectl create sa dashboard-admin -n kube-system
kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep dashboard-admin | awk '{print $1}')
Name: dashboard-admin-token-r2kh8
Namespace: kubernetes-dashboard
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: 834a0b4b-c002-4feb-98bd-d71bc710a9e2
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1099 bytes
namespace: 20 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6InZtMldLcU1ZalhLYVVhN293Y2k1TFUtWVc2ZkxzSkhxb0dKeFpERTV3TjgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tcjJraDgiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiODM0YTBiNGItYzAwMi00ZmViLTk4YmQtZDcxYmM3MTBhOWUyIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.khLRLjAXwTLMYOcIAbhfMQw43sW8cYq4xU1h2tigFdFWg5gpXb6AfmWxh-CKi9fq2mvTa1j8O3VrYiCZ1mrwLLQOtZ4h9L-gXHopu0RQUYyBkapaFgbkz_WAVOZISPLOSI48vQrOKu_LayJwiCXOu1TrBdyTr9SOjJFthcmCP_8T2-xelHOGOTts4n3ldWl_5lhs5IcvxzKVmHxJuB_KtUZjYDCSUD4iJwnrkTfhKgAmf5CU8MAL7-VZCP_QSZcVEmCCiH4dFMq3h1fzzus4P-0esBROrkQmgXr30NEn7WDtzCyjQM1xgGP4uN2LSLfhWU1pPS3-3c0wbTVXzGI_dA
将上边输出的 token 输入到刚刚 dashboard 需要验证的界面，点击令牌，然后复制进去
image.png
点击登录即可访问首页了
image.png
2）创建使用 token 的 KubeConfig 文件
source /opt/k8s/bin/environment.sh
# 设置集群参数
kubectl config set-cluster kubernetes \
--certificate-authority=/etc/kubernetes/cert/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=dashboard.kubeconfig
# 设置客户端认证参数，使用上面创建的 Token
kubectl config set-credentials dashboard_user \
--token=${DASHBOARD_LOGIN_TOKEN} \
--kubeconfig=dashboard.kubeconfig
# 设置上下文参数
kubectl config set-context default \
--cluster=kubernetes \
--user=dashboard_user \
--kubeconfig=dashboard.kubeconfig
# 设置默认上下文
kubectl config use-context default --kubeconfig=dashboard.kubeconfig
将如上操作所生成的 dashboard.kubeconfig 下载到本地，然后在登录界面，选择 kubeconfig 的方式，将刚刚本地的 config 文件导入进来，点击登录登入到 Dashboard
image.png
由于缺少 Heapster 插件，当前 dashboard 不能展示 Pod、Nodes 的 CPU、内存等统计数据和图表
7、参考
https://github.com/kubernetes/dashboard/wiki/Access-control https://github.com/kubernetes/dashboard/issues/2558 https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/
8、dashboard配置里面，添加英文改为中文语言的参数
---
kind: Deployment
apiVersion: apps/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: kubernetes-dashboard
template:
metadata:
labels:
k8s-app: kubernetes-dashboard
spec:
containers:
- name: kubernetes-dashboard
image: kubernetesui/dashboard:v2.0.0-beta5
imagePullPolicy: Always
ports:
- containerPort: 8443
protocol: TCP
# 设置语言
env:
- name: ACCEPT_LANGUAGE
value: zh # 中文
value: english # 英文
args:
- --auto-generate-certificates
- --namespace=kubernetes-dashboard
# Uncomment the following line to manually specify Kubernetes API server Host
# If not specified, Dashboard will attempt to auto discover the API server and connect
# to it. Uncomment only if the default does not work.
# - --apiserver-host=http://my-address:port
.......
重新部署Deployment.yaml文件
kubectl apply -f Deployment.yaml
