17. dashboard

17. dashboard

dashboard的安装步骤：

1. wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta1/aio/deploy/recommended.yaml

2. 修改成可以外网访问：

[root@k8s-master ~]# kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kubernetes-dashboard

或者直接修改yaml资源文件，找到Service配置部分,修改service的type

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  type: NodePort   #在这个位子添加这一行
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard

1. kubectl apply -f recommended.yaml

2. 创建登录dashboard的serviceaccount
   
   [root@k8s-master manifests]# cat dashboard-sa.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard

[root@k8s-master manifests]# cat dashboard-clusterbinding.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

kubectl apply -f dashboard-sa.yaml
kubectl apply -f dashboard-clusterbinding.yaml

1. 查看分配的dashboard service对外访问的端口号

[root@k8s-master manifests]# kubectl get svc -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.107.174.193   <none>        8000/TCP        146m
kubernetes-dashboard        NodePort    10.108.37.234    <none>        443:31077/TCP   146m

可以看到分配的端口是31077

1. 通过火狐浏览器访问https://nodeip:31077
   
   https://10.250.0.89:31077

   注意： 这里我测试是必须要用火狐浏览器，当我使用360以及谷歌浏览器的时候就会在后面的使用token登录时候点击Sign in一直没反应的情况，目前还没查出来原因。

2. 使用token登录

找到secret中对应的admin-user，然后通过describe查看到对应的token值

[root@k8s-master manifests]# kubectl get secret -n kubernetes-dashboard
NAME                               TYPE                                  DATA   AGE
admin-user-token-pnszj             kubernetes.io/service-account-token   3      136m
default-token-ddt24                kubernetes.io/service-account-token   3      154m
kubernetes-dashboard-certs         Opaque                                0      154m
kubernetes-dashboard-csrf          Opaque                                1      154m
kubernetes-dashboard-key-holder    Opaque                                2      154m
kubernetes-dashboard-token-lnm2h   kubernetes.io/service-account-token   3      154m
[root@k8s-master manifests]# kubectl describe secret admin-user-token-pnszj   -n kubernetes-dashboard
Name:         admin-user-token-pnszj
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: admin-user
              kubernetes.io/service-account.uid: 7ea6f585-9a1b-11e9-bb28-000c299c8399

Type:  kubernetes.io/service-account-token

Data
====
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLXBuc3pqIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI3ZWE2ZjU4NS05YTFiLTExZTktYmIyOC0wMDBjMjk5YzgzOTkiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.QynjhkMhknnqfblzgE71on6ojdZg7a66nCpoOPhHKVBQ6ySjt4BO_Iw_EbM4qPdygLsMsnpUwA3RjoK0a0qtSX-jZDPPQXv6A5rKl5NrawDjlcO2dIUxtSuy79pWqH16li0oHcgHm5ye0qNq6XbOYYx2C84N6Eq6uv-1MTgKgfMb1HJYE5xHURpbSg7luxRcl2VIGaPZCTpLVCTbQN6xVZRwPbCNEFT2ft-ESSJr8u4kOJTPzqIDseNThKYIitHhOKxTIhf1kuCp3kdOmOSg42dA-DjRWywTCqbSZdzCCS673pIPymiWKFL0AkMCNOnjd0ocZRMz52p_oUxF_N0JAg
ca.crt:     1025 bytes
namespace:  20 bytes

1. 使用复制下来的token值登录dashboard

---

---

---

下面是通过proxy的方式配置外网访问dashboard,自己测试还有点问题，后续补充了

这里使用proxy方法：
[root@k8s-master ~]# kubectl proxy --address='0.0.0.0'  --accept-hosts='^*$'

--address='0.0.0.0'   指定监听的地址
--accept-hosts='^*$'   设置可以访问的ip的权限  如果没有这个授权会报错forbiden
然后通过下面的url访问：
http://10.250.0.89:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/.

[root@k8s-master ~]# kubectl create serviceaccount dashboard-admin -n kubernetes-dashboard
[root@k8s-master ~]# kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin

eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tcGRwbWIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMDAyNDg2YzAtOTlkOS0xMWU5LWJiMjgtMDAwYzI5OWM4Mzk5Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.au7S7c3mvf4LCeyauCCYV3pXY2WUCjx719bJ7X9SvMzHZeuz1rALm-sZ-Ate5tXZ1hLOwgTCBj4fNlKCgWR7M9io7M1PCQCHzWfXKYmZ9KI4N0EzSffXonoV9VDvpn2I42YtwypepDVvitxP5q-hHWkj43kvt_ObWTDmJETl3gcBSV1kYNhpHkC4N2uLPD2UXzukPMOH-Z_fIvdUT7BuaxwqTEa_l5NJPlhNsnCpBqvijXUyzNFPx_jH7WOMTS6ohSu85lGi5OLQcXDfxZlr4_p_xCt7DaQ9Uh6zWDOZQMCujhpP7SPRE90IilJUGLrkuSWu0VJCQTWk-8Yiz77bvQ

kubectl -n kubenetes-dashboard describe secret $(kubectl -n kubenetes-dashboard get secret | grep admin-user | awk '{print $1}')