17. dashboard

dashboard的安装步骤：

wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta1/aio/deploy/recommended.yaml
修改成可以外网访问：

[root@k8s-master ~]# kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kubernetes-dashboard

或者直接修改yaml资源文件，找到Service配置部分,修改service的type

kind: Service

apiVersion: v1

metadata:

  labels:

    k8s-app: kubernetes-dashboard

  name: kubernetes-dashboard

  namespace: kubernetes-dashboard

spec:

  type: NodePort   #在这个位子添加这一行

  ports:

    - port: 443

      targetPort: 8443

  selector:

    k8s-app: kubernetes-dashboard

kubectl apply -f recommended.yaml
创建登录dashboard的serviceaccount

[root@k8s-master manifests]# cat dashboard-sa.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

  name: admin-user

  namespace: kubernetes-dashboard

[root@k8s-master manifests]# cat dashboard-clusterbinding.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

  name: admin-user

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: cluster-admin

subjects:

- kind: ServiceAccount

  name: admin-user

  namespace: kubernetes-dashboard

kubectl apply -f dashboard-sa.yaml

kubectl apply -f dashboard-clusterbinding.yaml

查看分配的dashboard service对外访问的端口号

[root@k8s-master manifests]# kubectl get svc -n kubernetes-dashboard

NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE

dashboard-metrics-scraper   ClusterIP   10.107.174.193   <none>        8000/TCP        146m

kubernetes-dashboard        NodePort    10.108.37.234    <none>        443:31077/TCP   146m

可以看到分配的端口是31077

通过火狐浏览器访问https://nodeip:31077

https://10.250.0.89:31077
注意：这里我测试是必须要用火狐浏览器，当我使用360以及谷歌浏览器的时候就会在后面的使用token登录时候点击Sign in一直没反应的情况，目前还没查出来原因。
使用token登录

找到secret中对应的admin-user，然后通过describe查看到对应的token值

[root@k8s-master manifests]# kubectl get secret -n kubernetes-dashboard

NAME                               TYPE                                  DATA   AGE

admin-user-token-pnszj             kubernetes.io/service-account-token   3      136m

default-token-ddt24                kubernetes.io/service-account-token   3      154m

kubernetes-dashboard-certs         Opaque                                0      154m

kubernetes-dashboard-csrf          Opaque                                1      154m

kubernetes-dashboard-key-holder    Opaque                                2      154m

kubernetes-dashboard-token-lnm2h   kubernetes.io/service-account-token   3      154m

[root@k8s-master manifests]# kubectl describe secret admin-user-token-pnszj   -n kubernetes-dashboard

Name:         admin-user-token-pnszj

Namespace:    kubernetes-dashboard

Labels:       <none>

Annotations:  kubernetes.io/service-account.name: admin-user

              kubernetes.io/service-account.uid: 7ea6f585-9a1b-11e9-bb28-000c299c8399

Type:  kubernetes.io/service-account-token

Data

====

token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLXBuc3pqIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI3ZWE2ZjU4NS05YTFiLTExZTktYmIyOC0wMDBjMjk5YzgzOTkiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.QynjhkMhknnqfblzgE71on6ojdZg7a66nCpoOPhHKVBQ6ySjt4BO_Iw_EbM4qPdygLsMsnpUwA3RjoK0a0qtSX-jZDPPQXv6A5rKl5NrawDjlcO2dIUxtSuy79pWqH16li0oHcgHm5ye0qNq6XbOYYx2C84N6Eq6uv-1MTgKgfMb1HJYE5xHURpbSg7luxRcl2VIGaPZCTpLVCTbQN6xVZRwPbCNEFT2ft-ESSJr8u4kOJTPzqIDseNThKYIitHhOKxTIhf1kuCp3kdOmOSg42dA-DjRWywTCqbSZdzCCS673pIPymiWKFL0AkMCNOnjd0ocZRMz52p_oUxF_N0JAg

ca.crt:     1025 bytes

namespace:  20 bytes

使用复制下来的token值登录dashboard

下面是通过proxy的方式配置外网访问dashboard,自己测试还有点问题，后续补充了

这里使用proxy方法：

[root@k8s-master ~]# kubectl proxy --address='0.0.0.0'  --accept-hosts='^*$'

--address='0.0.0.0'   指定监听的地址

--accept-hosts='^*$'   设置可以访问的ip的权限  如果没有这个授权会报错forbiden

然后通过下面的url访问：

http://10.250.0.89:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/.

[root@k8s-master ~]# kubectl create serviceaccount dashboard-admin -n kubernetes-dashboard

[root@k8s-master ~]# kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin

eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tcGRwbWIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMDAyNDg2YzAtOTlkOS0xMWU5LWJiMjgtMDAwYzI5OWM4Mzk5Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.au7S7c3mvf4LCeyauCCYV3pXY2WUCjx719bJ7X9SvMzHZeuz1rALm-sZ-Ate5tXZ1hLOwgTCBj4fNlKCgWR7M9io7M1PCQCHzWfXKYmZ9KI4N0EzSffXonoV9VDvpn2I42YtwypepDVvitxP5q-hHWkj43kvt_ObWTDmJETl3gcBSV1kYNhpHkC4N2uLPD2UXzukPMOH-Z_fIvdUT7BuaxwqTEa_l5NJPlhNsnCpBqvijXUyzNFPx_jH7WOMTS6ohSu85lGi5OLQcXDfxZlr4_p_xCt7DaQ9Uh6zWDOZQMCujhpP7SPRE90IilJUGLrkuSWu0VJCQTWk-8Yiz77bvQ

kubectl -n kubenetes-dashboard describe secret $(kubectl -n kubenetes-dashboard get secret | grep admin-user | awk '{print $1}')