前言：
多節點基礎上部署web管理頁面
web頁面管理pod資源
文章目錄
一：部署前先檢查狀態
[root@master1 ~]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
192.168.247.143 NotReady <none> 7d22h v1.12.3
192.168.247.144 Ready <none> 7d21h v1.12.3
[root@master1 ~]# kubectl get pod
NAME READY STATUS RESTARTS AGE
nginx-dbddb74b8-sx4m6 1/1 Running 0 5d14h
二：部署UI界面到master節點
2.1 創建dashboard工作目錄
[root@master1 ~]# mkdir /k8s/dashboard
2.2 推送官方的文件到本地
備註：
k8s創建pod資源有兩種方式
-
命令工具kubectl創建
kubectl run --image=
-
使用yaml文件格式進行創建
kubectl create -f （yaml文件）
https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard
紅線標註的是配置文件，md是官方文檔
這五個文件很重要
dashboard-configmap.yaml 配置映射服務
dashboard-deployment.yaml 控制器
dashboard-rbac.yaml 角色控制，訪問控制
dashboard-secret.yaml 安全
dashboard-service.yaml 服務
這些資源創建時，先創建①身份角色②安全③配置映射④控制器⑤服務
這裏我使用dashboard的1.8.4版本
1.8.4版本中有一個配置文件叫controller.yaml,現在的是1.10版本，名稱改爲deployment.yaml，都是控制器
[root@master1 ~]# cd /k8s/dashboard/
[root@master1 dashboard]# ls
[root@master1 dashboard]# ls
dashboard-configmap.yaml dashboard-controller.yaml dashboard-rbac.yaml dashboard-secret.yaml dashboard-service.yaml k8s-admin.yaml
除了那五個文件，還有一個k8s-admin.yaml文件，後面會提到
2.3 查看這些文件的詳細參數
- dashboard-rbac.yaml
[root@master1 dashboard]# cat dashboard-rbac.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
addonmanager.kubernetes.io/mode: Reconcile
name: kubernetes-dashboard-minimal
namespace: kube-system
rules:
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
verbs: ["get", "update", "delete"]
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["kubernetes-dashboard-settings"]
verbs: ["get", "update"]
# Allow Dashboard to get metrics from heapster.
- apiGroups: [""]
resources: ["services"]
resourceNames: ["heapster"]
verbs: ["proxy"]
- apiGroups: [""]
resources: ["services/proxy"]
resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: kubernetes-dashboard-minimal
namespace: kube-system
labels:
k8s-app: kubernetes-dashboard
addonmanager.kubernetes.io/mode: Reconcile
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: kubernetes-dashboard-minimal
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kube-system
[root@master1 dashboard]#
- dashboard-rbac.yaml
[root@master1 dashboard]# cat dashboard-rbac.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
addonmanager.kubernetes.io/mode: Reconcile
name: kubernetes-dashboard-minimal
namespace: kube-system
rules:
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
verbs: ["get", "update", "delete"]
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["kubernetes-dashboard-settings"]
verbs: ["get", "update"]
# Allow Dashboard to get metrics from heapster.
- apiGroups: [""]
resources: ["services"]
resourceNames: ["heapster"]
verbs: ["proxy"]
- apiGroups: [""]
resources: ["services/proxy"]
resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: kubernetes-dashboard-minimal
namespace: kube-system
labels:
k8s-app: kubernetes-dashboard
addonmanager.kubernetes.io/mode: Reconcile
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: kubernetes-dashboard-minimal
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kube-system
[root@master1 dashboard]# ls
dashboard-configmap.yaml dashboard-controller.yaml dashboard-rbac.yaml dashboard-secret.yaml dashboard-service.yaml k8s-admin.yaml
[root@master1 dashboard]# cat dashboard-secret.yaml
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
# Allows editing resource and makes sure it is created first.
addonmanager.kubernetes.io/mode: EnsureExists
name: kubernetes-dashboard-certs
namespace: kube-system
type: Opaque
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
# Allows editing resource and makes sure it is created first.
addonmanager.kubernetes.io/mode: EnsureExists
name: kubernetes-dashboard-key-holder
namespace: kube-system
type: Opaque
- dashboard-secret.yaml
[root@master1 dashboard]# cat dashboard-secret.yaml
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
# Allows editing resource and makes sure it is created first.
addonmanager.kubernetes.io/mode: EnsureExists
name: kubernetes-dashboard-certs
namespace: kube-system
type: Opaque
---
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
# Allows editing resource and makes sure it is created first.
addonmanager.kubernetes.io/mode: EnsureExists
name: kubernetes-dashboard-key-holder
namespace: kube-system
type: Opaque
[root@master1 dashboard]# cat dashboard-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
labels:
k8s-app: kubernetes-dashboard
# Allows editing resource and makes sure it is created first.
addonmanager.kubernetes.io/mode: EnsureExists
name: kubernetes-dashboard-settings
namespace: kube-system
- dashboard-controller.yaml
[root@master1 dashboard]# cat dashboard-controller.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
k8s-app: kubernetes-dashboard
addonmanager.kubernetes.io/mode: Reconcile
name: kubernetes-dashboard
namespace: kube-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: kubernetes-dashboard
namespace: kube-system
labels:
k8s-app: kubernetes-dashboard
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
spec:
selector:
matchLabels:
k8s-app: kubernetes-dashboard
template:
metadata:
labels:
k8s-app: kubernetes-dashboard
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ''
seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
spec:
priorityClassName: system-cluster-critical
containers:
- name: kubernetes-dashboard
image: siriuszg/kubernetes-dashboard-amd64:v1.8.3
resources:
limits:
cpu: 100m
memory: 300Mi
requests:
cpu: 50m
memory: 100Mi
ports:
- containerPort: 8443
protocol: TCP
args:
# PLATFORM-SPECIFIC ARGS HERE
- --auto-generate-certificates
volumeMounts:
- name: kubernetes-dashboard-certs
mountPath: /certs
- name: tmp-volume
mountPath: /tmp
livenessProbe:
httpGet:
scheme: HTTPS
path: /
port: 8443
initialDelaySeconds: 30
timeoutSeconds: 30
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
- name: tmp-volume
emptyDir: {}
serviceAccountName: kubernetes-dashboard
tolerations:
- key: "CriticalAddonsOnly"
operator: "Exists"
- dashboard-service.yaml
[root@master1 dashboard]# cat dashboard-service.yaml
apiVersion: v1
kind: Service
metadata:
name: kubernetes-dashboard
namespace: kube-system
labels:
k8s-app: kubernetes-dashboard
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
spec:
type: NodePort
selector:
k8s-app: kubernetes-dashboard
ports:
- port: 443
targetPort: 8443
nodePort: 30001
- k8s-admin.yaml
[root@master1 dashboard]# cat k8s-admin.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: dashboard-admin
namespace: kube-system
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: dashboard-admin
subjects:
- kind: ServiceAccount
name: dashboard-admin
namespace: kube-system
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
2.4 基於yaml文件創建pod資源
按順序創建
①身份角色②安全③配置映射④控制器⑤服務
2.4.1 先rbac角色控制管理
2.4.1.1 查看當前各資源狀態
當前命名空間狀態
[root@master1 dashboard]# kubectl get ns
NAME STATUS AGE
default Active 7d23h
kube-public Active 7d23h
kube-system Active 7d23h
[root@master1 dashboard]# kubectl get pod
NAME READY STATUS RESTARTS AGE
nginx-dbddb74b8-sx4m6 1/1 Running 0 5d14h
[root@master1 dashboard]# kubectl get pod -n kube-system
No resources found.
kubectl get all #這個all 包含pod、deployment、service和副本replicaset四個資源
[root@master1 dashboard]# kubectl get all #這個all 包含pod、deployment、service和副本replicaset四個個資源
NAME READY STATUS RESTARTS AGE
pod/nginx-dbddb74b8-sx4m6 1/1 Running 0 5d14h
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.0.0.1 <none> 443/TCP 7d23h
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
deployment.apps/nginx 1 1 1 1 5d14h
NAME DESIRED CURRENT READY AGE
replicaset.apps/nginx-dbddb74b8 1 1 1 5d14h
查看當前k8s中的角色
[root@master1 dashboard]# kubectl get Role -n kube-system
NAME AGE
extension-apiserver-authentication-reader 7d23h
system::leader-locking-kube-controller-manager 7d23h
system::leader-locking-kube-scheduler 7d23h
system:controller:bootstrap-signer 7d23h
system:controller:cloud-provider 7d23h
system:controller:token-cleaner 7d23h
2.4.1.2 開始創建rbac資源
[root@master1 dashboard]# kubectl create -f dashboard-rbac.yaml
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
2.4.1.3 查看創建後的資源狀態
[root@master1 dashboard]# kubectl get all
NAME READY STATUS RESTARTS AGE
pod/nginx-dbddb74b8-sx4m6 1/1 Running 0 5d14h
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.0.0.1 <none> 443/TCP 7d23h
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
deployment.apps/nginx 1 1 1 1 5d14h
NAME DESIRED CURRENT READY AGE
replicaset.apps/nginx-dbddb74b8 1 1 1 5d14h
查看角色，在配置文件中，角色的命名空間指定的是kube-system，所以查看的時候要-n指定
[root@master1 dashboard]# kubectl get role
No resources found.
[root@master1 dashboard]# kubectl get role -n kube-system
NAME AGE
extension-apiserver-authentication-reader 7d23h
kubernetes-dashboard-minimal 3m
system::leader-locking-kube-controller-manager 7d23h
system::leader-locking-kube-scheduler 7d23h
system:controller:bootstrap-signer 7d23h
system:controller:cloud-provider 7d23h
system:controller:token-cleaner 7d23h
2.4.2 創建安全secret資源
2.4.2.1 先查看狀態
[root@master1 dashboard]# kubectl get secret #不指向命名空間代表默認空間
NAME TYPE DATA AGE
default-token-qm9rm kubernetes.io/service-account-token 3 7d23h
[root@master1 dashboard]# kubectl get secret -n kube-system
NAME TYPE DATA AGE
default-token-w9vck kubernetes.io/service-account-token 3 7d23h
2.4.2.2 創建secret資源
[root@master1 dashboard]# kubectl create -f dashboard-secret.yaml
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created
2.4.2.3 再次查看狀態
[root@master1 dashboard]# kubectl get secret -n kube-system
NAME TYPE DATA AGE
default-token-w9vck kubernetes.io/service-account-token 3 7d23h
kubernetes-dashboard-certs Opaque 0 26s
kubernetes-dashboard-key-holder Opaque 0 26s
2.4.3 創建配置映射資源configmap
2.4.3.1 先查看狀態
[root@master1 dashboard]# kubectl get ConfigMap
No resources found.
[root@master1 dashboard]# kubectl get configmap -n kube-system
NAME DATA AGE
extension-apiserver-authentication 1 8d
2.4.3.2 開始創建
[root@master1 dashboard]# kubectl create -f dashboard-configmap.yaml
configmap/kubernetes-dashboard-settings created
2.4.3.3 再次查看狀態
[root@master1 dashboard]# kubectl get configmap -n kube-system
NAME DATA AGE
extension-apiserver-authentication 1 8d
kubernetes-dashboard-settings 0 28s
2.4.4 創建控制器資源
[root@master1 dashboard]# kubectl create -f dashboard-controller.yaml
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
可以發現創建了兩種資源
serviceaccount deployment.apps
服務訪問和deployment控制器資源
[root@master1 dashboard]# kubectl get serviceaccount -n kube-system
NAME SECRETS AGE
default 1 7d23h
kubernetes-dashboard 1 2m16s
[root@master1 dashboard]# kubectl get deployment.apps -n kube-system
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
kubernetes-dashboard 1 1 1 1 2m34s
[root@master1 dashboard]# kubectl get deployment.apps
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
nginx 1 1 1 1 5d15h
2.4.5 創建service資源
備註：
創建的pod資源只是提供業務，還需要其他資源調配一起配合使用
kubectl get all種包含pod、deployment、service和副本replicaset四個資源
deployment和replica會隨着pod自動創建
在pod運行的情況下，
一旦開啓service資源，那麼服務就會被啓用，開啓端口
[root@master1 dashboard]# cat dashboard-service.yaml
apiVersion: v1
kind: Service
metadata:
name: kubernetes-dashboard
namespace: kube-system
labels:
k8s-app: kubernetes-dashboard
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
spec:
type: NodePort
selector:
k8s-app: kubernetes-dashboard
ports:
- port: 443 #開啓的是443端口
targetPort: 8443
nodePort: 30001 #節點端口
查看當前狀態
[root@master1 dashboard]# kubectl get service
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.0.0.1 <none> 443/TCP 8d
開始創建
[root@master1 dashboard]# kubectl create -f dashboard-service.yaml
service/kubernetes-dashboard created
查看狀態
[root@master1 dashboard]# kubectl get service -n kube-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes-dashboard NodePort 10.0.0.237 <none> 443:30001/TCP 20s
2.5 統一查看狀態
查看kube-system命名空間的狀態，可以發現pod已經創建出來，服務也已經開啓
[root@master1 dashboard]# kubectl get all -n kube-system
NAME READY STATUS RESTARTS AGE
pod/kubernetes-dashboard-65f974f565-5hzk7 1/1 Running 0 12m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes-dashboard NodePort 10.0.0.237 <none> 443:30001/TCP 86s
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
deployment.apps/kubernetes-dashboard 1 1 1 1 12m
NAME DESIRED CURRENT READY AGE
replicaset.apps/kubernetes-dashboard-65f974f565 1 1 1 12m
-o 查看網絡狀態
[root@master1 dashboard]# kubectl get all -n kube-system -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod/kubernetes-dashboard-65f974f565-5hzk7 1/1 Running 0 19m 172.17.42.4 192.168.247.144 <none>
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service/kubernetes-dashboard NodePort 10.0.0.237 <none> 443:30001/TCP 8m9s k8s-app=kubernetes-dashboard
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR
deployment.apps/kubernetes-dashboard 1 1 1 1 19m kubernetes-dashboard siriuszg/kubernetes-dashboard-amd64:v1.8.3 k8s-app=kubernetes-dashboard
NAME DESIRED CURRENT READY AGE CONTAINERS IMAGES SELECTOR
replicaset.apps/kubernetes-dashboard-65f974f565 1 1 1 19m kubernetes-dashboard siriuszg/kubernetes-dashboard-amd64:v1.8.3 k8s-app=kubernetes-dashboard,pod-template-hash=65f974f565
由此可以發現，訪問https://192.168.247.144:30001便可以訪問dashboard
get查看時可以縮寫，支持同時查看多個
查看日誌
[root@master1 dashboard]# kubectl logs kubernetes-dashboard-65f974f565-5hzk7
Error from server (NotFound): pods "kubernetes-dashboard-65f974f565-5hzk7" not found
[root@master1 dashboard]# kubectl logs kubernetes-dashboard-65f974f565-5hzk7 -n kube-system
2020/05/08 02:38:54 Starting overwatch
2020/05/08 02:38:54 Using in-cluster config to connect to apiserver
2020/05/08 02:38:54 Using service account token for csrf signing
2020/05/08 02:38:54 No request provided. Skipping authorization
2020/05/08 02:38:54 Successful initial request to the apiserver, version: v1.12.3
2020/05/08 02:38:54 Generating JWE encryption key
2020/05/08 02:38:54 New synchronizer has been registered: kubernetes-dashboard-key-holder-kube-system. Starting
2020/05/08 02:38:54 Starting secret synchronizer for kubernetes-dashboard-key-holder in namespace kube-system
2020/05/08 02:38:55 Initializing JWE encryption key from synchronized object
2020/05/08 02:38:55 Creating in-cluster Heapster client
2020/05/08 02:38:56 Metric client health check failed: the server could not find the requested resource (get services heapster). Retrying in 30 seconds.
2020/05/08 02:38:56 Auto-generating certificates
2020/05/08 02:38:56 Successfully created certificates
2020/05/08 02:38:56 Serving securely on HTTPS port: 8443
2020/05/08 02:39:26 Metric client health check failed: the server could not find the requested resource (get services heapster). Retrying in 30 seconds.
2020/05/08 02:39:56 Metric client health check failed: the server could not find the requested resource (get services heapster). Retrying in 30 seconds.
三：訪問web
此時就可以去訪問nodeIPhttps://192.168.247.144:30001驗證，使用谷歌瀏覽器發現無法訪問
3.1 查看開發人員工具
在安全中發現是不信任的證書
右邊顯示證書是不被信任的
3.2 解決當前瀏覽器無法訪問的問題
3.2.1 頒發證書
編輯生成證書的腳本
[root@master1 dashboard]# vim dashboard-cert.sh
cat > dashboard-csr.json << EOF
{
"CN":"Dashboard",
"hosts":[],
"key":{
"algo":"rsa",
"size":2048
},
"names":[
{
"C":"CN",
"L":"BeiJing",
"ST":"BeiJing"
}
]
}
EOF
K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | cfssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system
查看材料文件路徑
[root@master1 dashboard]# ls /k8s/ssl/
ca-key.pem ca.pem server-key.pem server.pem
[root@master1 dashboard]# ls /root/k8s/k8s-cert/
admin.csr admin.pem ca-csr.json k8s-cert.sh kube-proxy-key.pem server-csr.json
admin-csr.json ca-config.json ca-key.pem kube-proxy.csr kube-proxy.pem server-key.pem
admin-key.pem ca.csr ca.pem kube-proxy-csr.json server.csr server.pem
生成證書
[root@master1 dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/
dashboard-cert.sh: line 20: cfssjson: command not found
2020/05/08 11:19:20 [INFO] generate received request
2020/05/08 11:19:20 [INFO] received CSR
2020/05/08 11:19:20 [INFO] generating key: rsa-2048
2020/05/08 11:19:20 [INFO] encoded CSR
2020/05/08 11:19:20 [INFO] signed certificate with serial number 292722549079728181346404671844966168885415575748
2020/05/08 11:19:20 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
secret "kubernetes-dashboard-certs" deleted
secret/kubernetes-dashboard-certs created
[root@master1 dashboard]# ls #只看新增的文件
dashboard-cert.sh dashboard.pem
dashboard-csr.json dashboard-key.pem
編輯secret資源的yaml文件
[root@master1 dashboard]# vim dashboard-controller.yaml
45 args:
46 # PLATFORM-SPECIFIC ARGS HERE
47 - --auto-generate-certificates
48 - --tls-key-file=dashboard-key.pem #新增
49 - --tls-cert-file=dashboard.pem #新增
重新部署
[root@master1 dashboard]# kubectl apply -f dashboard-controller.yaml
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
serviceaccount/kubernetes-dashboard configured
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
deployment.apps/kubernetes-dashboard configured
查看此時狀態
MatchInterPodAffinity：根據pod之間的親和性做判斷
pod依舊在192.168.247.144上
[root@master1 dashboard]# kubectl get all -n kube-system -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod/kubernetes-dashboard-7dffbccd68-l4tcd 1/1 Running 0 2m32s 172.17.42.5 192.168.247.144 <none>
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service/kubernetes-dashboard NodePort 10.0.0.237 <none> 443:30001/TCP 51m k8s-app=kubernetes-dashboard
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR
deployment.apps/kubernetes-dashboard 1 1 1 1 62m kubernetes-dashboard siriuszg/kubernetes-dashboard-amd64:v1.8.3 k8s-app=kubernetes-dashboard
NAME DESIRED CURRENT READY AGE CONTAINERS IMAGES SELECTOR
replicaset.apps/kubernetes-dashboard-65f974f565 0 0 0 62m kubernetes-dashboard siriuszg/kubernetes-dashboard-amd64:v1.8.3 k8s-app=kubernetes-dashboard,pod-template-hash=65f974f565
replicaset.apps/kubernetes-dashboard-7dffbccd68 1 1 1 14m kubernetes-dashboard siriuszg/kubernetes-dashboard-amd64:v1.8.3 k8s-app=kubernetes-dashboard,pod-template-hash=7dffbccd68
清空歷史記錄訪問此時節點
繼續前往
四：使用令牌訪問
4.1 生成令牌
k8s-admin.yaml的作用就出現了
[root@master1 dashboard]# kubectl create -f k8s-admin.yaml
serviceaccount/dashboard-admin created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
4.2 查看狀態
[root@master1 dashboard]# kubectl get secret -n kube-system
NAME TYPE DATA AGE
dashboard-admin-token-dmlzw kubernetes.io/service-account-token 3 65s
default-token-w9vck kubernetes.io/service-account-token 3 8d
kubernetes-dashboard-certs Opaque 11 12m
kubernetes-dashboard-key-holder Opaque 2 72m
kubernetes-dashboard-token-7dhnw kubernetes.io/service-account-token 3 66m
[root@master1 dashboard]# kubectl get serviceaccount -n kube-system
NAME SECRETS AGE
dashboard-admin 1 96s
default 1 8d
kubernetes-dashboard 1 67m
[root@master1 dashboard]# kubectl get clusterrolebinding.rbac.authorization.k8s.io -n kube-system
NAME AGE
cluster-admin 8d
cluster-system-anonymous 5d15h
dashboard-admin 2m1s
·······
4.3 查看令牌詳細信息
[root@master1 dashboard]# kubectl describe serviceaccount dashboard-admin -n kube-system
Name: dashboard-admin
Namespace: kube-system
Labels: <none>
Annotations: <none>
Image pull secrets: <none>
Mountable secrets: dashboard-admin-token-dmlzw
Tokens: dashboard-admin-token-dmlzw
Events: <none>
[root@master1 dashboard]# kubectl describe tokens dashboard-admin-token-dmlzw -n kube-system
error: the server doesn't have a resource type "tokens"
[root@master1 dashboard]# kubectl describe secret dashboard-admin-token-dmlzw -n kube-system
Name: dashboard-admin-token-dmlzw
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: 34604321-90de-11ea-a668-000c29db840b
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1359 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tZG1senciLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMzQ2MDQzMjEtOTBkZS0xMWVhLWE2NjgtMDAwYzI5ZGI4NDBiIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.iK6wXehw9ZlK4Qjln4uiPR5Ww1K14t23rvJ-pmn56ynHw1KXow1Pg1Qi2hUY01ncCBjbyjaJBtcVNez-XFr7VQXO7lCPbnxlXat0euD2Qg8DPy-PQBnyAd2Jgh_y1e_OIgcrMowhyKUhkqaNPxDG4HWUqIFzcnHdaxOtCPZQ3GTV8XfoAe4aLemCdIHsZHoCeWKbwFJgnczvbBnzyZ0w91JdoAYK6xVc-fpVz4Pin5IodQ81TOFS2uwLyTQ8aGyrK-HuOs-mTPqDMBS8fWvsJttRtgI2UUwdsSodxEgRREXWUNg15swcVVF9_fiO7wsoXk7IhXAaAnNCd7gIF419Lw
token：後面便是令牌，複製保存
4.4 複製登錄
