k8s筆記九（kubernetes中dashboard的安裝與使用）

 

       Kubernetes dashboard可用於在k8s集羣上部署容器化應用、應用排障、管理集羣本身及附加的資源等。安裝完dashboard訪問之前需要做好相應的認證憑證，目前支持的認證方式有承載令牌和kubeconfig兩種。

1、部署https通信的Dashboard

       部署Dashboard時會從Secrets對象中加載所需要的私鑰和證書文件，需要事先準備好相關的私鑰、證書和Secretes對象。

# 創建一套CA證書
]# (umask 077;openssl genrsa -out dashboard.key 2048)
]# openssl req -new -key dashboard.key -out dashboard.csr -subj "/O=dayi123/CN=dashboard"
]# openssl x509 -req -in dashboard.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out dashboard.crt -days 3650
# 創建secret對象
]# kubectl create secret generic kubernetes-dashboard-certs -n kube-system --from-file=dashboard.crt=./dashboard.crt --from-file=dashboard.key=./dashboard.key -n kube-system

       Secret對象創建完成後就可部署dashboard,由於dashboard資源定義清單中的地址爲” k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1,無法訪問，所以先需要修改鏡像地址或者提前拉取鏡像重新打標籤。

# 拉取dashboard資源定義清單文件
wget https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
# 修改dashboard鏡像地址
]# sed -i "s#k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1#mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1#g" kubernetes-dashboard.yaml
# 創建dashboard 
]# kubectl apply -f kubernetes-dashboard.yaml
# 修改kubernetes-dashboard的svc類型爲NodePort
]# kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kube-system
]# kubectl get svc kubernetes-dashboard -n kube-system
NAME                   TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
kubernetes-dashboard   NodePort   10.108.199.182   <none>        443:31967/TCP   7m13s

      kubernetes的dashboard創建完成後並修改svc類型爲NodePort後就可通過客戶主機瀏覽器去登陸，如果需要登陸該系統則需要認證，認證方式有token認證和kubeconfig認證兩種。

2、配置token認證

       配置token認證也就是爲dashboard創建相應的ServiceAccount並完成授權，並獲取該ServiceAccount的token信息完成認證。

# 創建用於登陸dashboard的ServiceAccount
]# kubectl create serviceaccount dashboard-admin -n kube-system
# 通過綁定clusterrole授權
]# kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
# 查看dashboard-admin的token
]# kubectl -n kube-system get secret|awk '/^dashboard-admin/{print $1}'
dashboard-admin-token-4b4wk
]# kubectl describe secrets dashboard-admin-token-4b4wk -n kube-system
Name:         dashboard-admin-token-4b4wk
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 861d069b-7b50-11e9-8957-000c29063a23

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tNGI0d2siLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiODYxZDA2OWItN2I1MC0xMWU5LTg5NTctMDAwYzI5MDYzYTIzIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.Tf0l8OU0Kbev0AZmSKjglznzx8i2zxjL4_QakW6DHs_pEtGRNvXcOfX4X39OL61S9vNkCXXVhkU-GMlNgy6c8EruBx1zXBsaW0i2DBz7teeEJu1KDNzKlP7M9XU6QuWZsUPosF-8Zbz3a2c9rfo5EkB8mYIf8F-x0LCDHj2nC0bkEPzdyqcE-0Fc3hEgnIsCRsW5Pg7RPufGROgyvV_u_S6ck17-pMIbtNoM09D29SLi0CH9A0PqaKUMcR-WBjZiciRU5NRQBk9GRCtzi-Tfh0_s-FNK9vBbSzZFhMHBB1vM-d-g3BDJiT_sAaBAkjAbiEmqaEJGBaiA09rFSH4A1A

3、配置kubeconfig認證

       Kubeconfig是認證信息的承載工具，它能夠存入私鑰和證書，或者認證令牌等作爲用戶的認證配置文件。通過kubeconfig認證也需要創建service account並綁定角色並設定context。

# 創建Service Account並綁定管理員角色
]# kubectl create serviceaccount def-ns-admin -n default
]# kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin
# 初始化集羣信息，提供API Server的URL，驗證API Server證書所用到的CA證書
]# kubectl config set-cluster kubernetes --embed-certs=true --server="https://192.168.16.196:6443" --certificate-authority=/etc/kubernetes/pki/ca.crt --kubeconfig=./def-ns-admin.conf
# 獲取def-ns-admin的token並將其作爲認證信息
]# DEFNS_ADMIN_SECRET=$(kubectl -n default get secret|awk '/^def-ns-admin/{print $1}')
]# DEFNS_ADMIN_TOKEN=$(kubectl -n default get secret ${DEFNS_ADMIN_SECRET} -o jsonpath={.data.token}|base64 -d)
]# kubectl config set-credentials def-ns-admin --token=${DEFNS_ADMIN_TOKEN} --kubeconfig=./def-ns-admin.conf
# 設置context列表，定義一個名爲defns-admin的context
]# kubectl config set-context def-ns-admin --cluster=kubernetes --user=def-ns-admin --kubeconfig=./def-ns-admin.conf
# 指定要使用的context
]# kubectl config use-context def-ns-admin@kubernetes --kubeconfig=./def-ns-admin.conf

       上述操作完成後，只需將def-ns-admin.conf文件下載至客戶端，在dashboard頁面登陸認證時將該文件傳至dashboard即可完成認證。