文章目录
前言
一：k8s的WEB界面部署
1.1：两个master节点检查pod资源是否正常
-
[root@master ~]# kubectl get nodes '//检查node节点是否运行正常' NAME STATUS ROLES AGE VERSION 192.168.233.132 Ready <none> 8d v1.12.3 192.168.233.133 Ready <none> 8d v1.12.3 [root@master ~]# kubectl get pods '//检查之前创建的pod资源是否运行正常' NAME READY STATUS RESTARTS AGE nginx-dbddb74b8-5s6h7 1/1 Running 0 7d8h
1.2、master节点上创建dashboard工作目录，并拷贝部署web界面所需的文件到指定目录
-
下载的网址（直接复制即可）：https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard
-
[root@master dashboard]# rz -E rz waiting to receive. [root@master dashboard]# ls dashboard-configmap.yaml dashboard-secret.yaml dashboard-deployment.yaml dashboard-service.yaml dashboard-rbac.yaml k8s-admin.yaml '//configmap.yaml：配置，deployment.yaml：控制器，rbac.yaml：角色控制，访问控制，secret.yaml：安全，service.yaml：服务' -
其中service的文件需要添加node节点的访问端口
-
apiVersion: v1 kind: Service metadata: name: kubernetes-dashboard namespace: kube-system labels: k8s-app: kubernetes-dashboard kubernetes.io/cluster-service: "true" addonmanager.kubernetes.io/mode: Reconcile spec: type: NodePort '//添加类型' selector: k8s-app: kubernetes-dashboard ports: - port: 443 targetPort: 8443 nodePort: 30005 '//添加类型端口' -
还需要自己编写一个admin的yaml文件
apiVersion: v1 kind: ServiceAccount metadata: name: dashboard-admin namespace: kube-system --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: dashboard-admin subjects: - kind: ServiceAccount name: dashboard-admin namespace: kube-system roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io
1.3、根据上传的文件创建相应的pod
-
创建访问控制的pod
[root@master dashboard]# kubectl create -f dashboard-rbac.yaml role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created [root@master dashboard]# kubectl get Role -n kube-system '//Role是dashboard-rbac.yaml文件中指明的Kind，-n是指定namespace，同样在配置文件中可以查看' NAME AGE extension-apiserver-authentication-reader 8d kubernetes-dashboard-minimal 19s '//创建成功' system::leader-locking-kube-controller-manager 8d system::leader-locking-kube-scheduler 8d system:controller:bootstrap-signer 8d system:controller:cloud-provider 8d system:controller:token-cleaner 8d -
创建安全的pod
[root@master dashboard]# kubectl create -f dashboard-secret.yaml secret/kubernetes-dashboard-certs created secret/kubernetes-dashboard-key-holder created [root@master dashboard]# kubectl get Secret -n kube-system NAME TYPE DATA AGE default-token-cnnbv kubernetes.io/service-account-token 3 8d kubernetes-dashboard-certs Opaque 0 33s kubernetes-dashboard-key-holder Opaque 0 33s -
同理创建其他的pod
'//创建配置的pod' [root@master dashboard]# kubectl create -f dashboard-configmap.yaml configmap/kubernetes-dashboard-settings created [root@master dashboard]# kubectl get Configmap -n kube-system NAME DATA AGE extension-apiserver-authentication 1 8d kubernetes-dashboard-settings 0 17s '//创建控制器的pod' [root@master dashboard]# kubectl create -f dashboard-deployment.yaml serviceaccount/kubernetes-dashboard created deployment.apps/kubernetes-dashboard created [root@master dashboard]# kubectl get ServiceAccount -n kube-system NAME SECRETS AGE default 1 8d kubernetes-dashboard 1 22s '//创建service服务pod' [root@master dashboard]# kubectl create -f dashboard-service.yaml service/kubernetes-dashboard created [root@master dashboard]# kubectl get service -n kube-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) kubernetes-dashboard NodePort 10.0.0.139 <none> 443:30005/T '//pod资源只是提供程序应用，一旦service创建了，那么pod资源会被提供出去可以访问，端口伴随着service出现的，通过nodeport端口访问web界面' -
查看创建完成的pod资源
[root@master dashboard]# kubectl get pods -n kube-system '//查看创建在指定的kube-system命名空间下的资源' NAME READY STATUS RESTARTS AGE kubernetes-dashboard-65f974f565-gxg98 1/1 Running 0 9m45s '//可以缩写，可以同时查看多个资源' [root@master dashboard]# kubectl get pods,svc -n kube-system NAME READY STATUS RESTARTS AGE pod/kubernetes-dashboard-65f974f565-gxg98 1/1 Running 0 12m NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/kubernetes-dashboard NodePort 10.0.0.139 <none> 443:30005/TCP 5m21s -
查看pod资源在哪个节点
[root@master dashboard]# kubectl get pods -n kube-system -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE kubernetes-dashboard-65f974f565-gxg98 1/1 Running 0 12m 172.17.4.2 192.168.233.133 <none> -
查看pod资源日志
[root@master dashboard]# kubectl logs kubernetes-dashboard-65f974f565-gxg98 -n kube-system -
总结一下：k8s创建pod资源有两种方式
1、使用kubectl 命令创建：kubectl run 名称 --image= 镜像
2、使用yaml文件格式进行创建：kubectl create -f yaml文件
1.4：访问web界面，并解决访问问题
-
访问网址：https://192.168.233.133:30005，打开开发者工具，查看security发现缺少证书
-
-
为谷歌浏览器写一个证书
-
[root@master dashboard]# vim dashboard-cert.sh cat > dashboard-csr.json <<EOF { "CN": "Dashboard", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "BeiJing", "ST": "BeiJing" } ] } EOF K8S_CA=$1 cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | cfssljson -bare dashboard kubectl delete secret kubernetes-dashboard-certs -n kube-system kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system -
生成证书到指定目录
-
[root@master dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/ -
修改控制的配置文件
[root@master dashboard]# vim dashboard-deployment.yaml ...省略内容 ports: - containerPort: 8443 protocol: TCP args: # PLATFORM-SPECIFIC ARGS HERE - --auto-generate-certificates - --tls-key-file=dashboard-key.pem '//下方添加这两行内容' - --tls-cert-file=dashboard.pem -
重新部署更新，使用apply命令
[root@master dashboard]# kubectl apply -f dashboard-deployment.yaml Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply serviceaccount/kubernetes-dashboard configured Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply deployment.apps/kubernetes-dashboard configured [root@master dashboard]# kubectl get pods -n kube-system -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE kubernetes-dashboard-7dffbccd68-58qms 1/1 Running 0 26s 172.17.26.3 192.168.233.132 <none> '//节点变了' -
再次访问web界面
1.5：选择使用令牌访问
-
生成令牌：
[root@master dashboard]# kubectl create -f k8s-admin.yaml serviceaccount/dashboard-admin created clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created [root@master dashboard]# kubectl get secret -n kube-system NAME TYPE DATA AGE dashboard-admin-token-zwktc kubernetes.io/service-account-token 3 14s '//生成了令牌' default-token-cnnbv kubernetes.io/service-account-token 3 8d kubernetes-dashboard-certs Opaque 11 9m58s kubernetes-dashboard-key-holder Opaque 2 35m kubernetes-dashboard-token-qgppd kubernetes.io/service-account-token 3 32m -
查看令牌
[root@master dashboard]# kubectl describe secret dashboard-admin-token-zwktc -n kube-system Name: dashboard-admin-token-zwktc Namespace: kube-system Labels: <none> Annotations: kubernetes.io/service-account.name: dashboard-admin kubernetes.io/service-account.uid: ec6e301f-90d4-11ea-8c4f-000c294b2dd3 Type: kubernetes.io/service-account-token Data ==== ca.crt: 1359 bytes namespace: 11 bytes token: '//复制下方令牌，填写到浏览器中即可' eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tendrdGMiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZWM2ZTMwMWYtOTBkNC0xMWVhLThjNGYtMDAwYzI5NGIyZGQzIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.n8a101tY2bjlv99A3WHiEsdlLBBnTXXeJED32lOBjJ6M66_rFDVyxzpAWqxY146NkRdaXK0eVdNzIkAPRXWEO1uHjU17T3iHeWBqSzQgzxvN2NgnAam4zQmBE4XaeO2HFv63MX4VDzvwsu8k8MeiryUEBw86DTndCfgvnxcPszq2rZR5QwiHMjAxFQMIA7SQvWj2-rDO7ln6gkqVU5fH04ujz7p2sXI_QQezFjMDTtKWFcMegT3T2gq65-CMB34MyEcxZxGWPQeDu4A4S7PLPlbr0CLdO7YVBWU_pEab0LHBlN8KsJYeZd49kBMgA-EdY5uMQJbH_XFHyGXq3VShwA -
再次访问web界面
