K8S—多節點部署—UI界面
搭建k8s的Dashboard
1.創建目錄,上次yaml文件
[root@localhost k8s]# mkdir dashboard
[root@localhost k8s]# cd dashboard/
[root@localhost dashboard]# ls
dashboard-configmap.yaml dashboard-rbac.yaml dashboard-service.yaml
dashboard-controller.yaml dashboard-secret.yaml k8s-admin.yaml
您在 /var/spool/mail/root 中有郵件
2.創建所需文件,按一下順序
//配置授權訪問api,角色控制,訪問控制
[root@localhost dashboard]# kubectl create -f dashboard-rbac.yaml
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
//配置進行加密,安全設定
[root@localhost dashboard]# kubectl create -f dashboard-secret.yaml
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created
//配置網站應用
[root@localhost dashboard]# kubectl create -f dashboard-configmap.yaml
configmap/kubernetes-dashboard-settings created
//配置控制器
[root@localhost dashboard]# kubectl create -f dashboard-controller.yaml
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
//配置發佈出去服務,給別人進行訪問
[root@localhost dashboard]# kubectl create -f dashboard-service.yaml
service/kubernetes-dashboard created
//完成後查看創建在指定的kube-system命名空間下
[root@localhost dashboard]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
kubernetes-dashboard-65f974f565-9svdg 0/1 ContainerCreating 0 13s
//查看如何訪問
[root@localhost dashboard]# kubectl get pods,svc -n kube-system
NAME READY STATUS RESTARTS AGE
pod/kubernetes-dashboard-65f974f565-9svdg 1/1 Running 0 2m18s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes-dashboard NodePort 10.0.0.247 <none> 443:30001/TCP 2m12s
3.訪問nodeIP就可以訪問
出現如下錯誤:
4.產生上述錯誤是因爲沒有令牌,我們需要自行生成令牌
//製作證書腳本
[root@localhost dashboard]# vim dashboard-cert.sh
cat > dashboard-csr.json <<EOF
{
"CN": "Dashboard",
"hosts": [],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "BeiJing",
"ST": "BeiJing"
}
]
}
EOF
K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | cfssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system
//執行腳本
[root@localhost dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/
//在控制器yaml文件中添加證書(47行處,不可以tab,用空格)
[root@localhost dashboard]# vim dashboard-controller.yaml
\- --auto-generate-certificates
\- --tls-key-file=dashboard-key.pem
\- --tls-cert-file=dashboard.pem
//重新部署
[root@localhost dashboard]# kubectl apply -f dashboard-controller.yaml
5.生成登陸token
//生成令牌
[root@localhost dashboard]# kubectl create -f k8s-admin.yaml
serviceaccount/dashboard-admin created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
//保存令牌
[root@localhost dashboard]# kubectl get secret -n kube-system
NAME TYPE DATA AGE
dashboard-admin-token-7bm26 kubernetes.io/service-account-token 3 57s
default-token-8fmt5 kubernetes.io/service-account-token 3 4d17h
kubernetes-dashboard-certs Opaque 11 7m28s
kubernetes-dashboard-key-holder Opaque 2 16m
kubernetes-dashboard-token-cpcmn kubernetes.io/service-account-token 3 16m
//查看令牌
[root@localhost dashboard]# kubectl describe secret dashboard-admin-token-7bm26 -n kube-system
Name: dashboard-admin-token-7bm26
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: 8d3a76f9-929f-11ea-96fd-000c297c1b9b
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1359 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tN2JtMjYiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiOGQzYTc2ZjktOTI5Zi0xMWVhLTk2ZmQtMDAwYzI5N2MxYjliIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.EPvr9wEsCmYU4O1Jr7panpbPJISheqfFjSgwuKbNqmi8aJ2dpuE7TUhOgePaDFElVItyNrORVA61Gt13EMRIFulblHYp2iQ0kPrcJrCgoK2W6Ld7R1PHnNGcb6rsPid0ffNUdtANQhmtdA_PEvd0foMFvkzajS-5gJyQo_03p1Mu8_dTtZaHpowQbVL8EOpTGFAqVTd1zvx_5waj21KZhMKftCPLEm3dzPkHanDrUACSBHDgLnbVGin6r-jfvG8eZDk4-EvdKYp8mMKzklLhAUrwFOz73So0fMI4A27zL-IZ5c5t17APP5WNPRXBBTiuZHngakpACfhE_qK7Ek84FQ
6.登陸dashbord(如果node1地址訪問不了,可以嘗試用node2地址,因爲apply之後,地址可能會重新獲取)