Kubernetes Dashboard

GitHub地址：https://github.com/kubernetes/dashboard

下载Dashboard

wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.5.1/aio/deploy/recommended.yaml

修改yaml文件

默认Dashboard只能集群内部访问，修改Service为NodePort类型，暴露到外部可以访问：

vim recommended.yaml

---

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  type: NodePort # 手动添加
  ports:
    - port: 443
      targetPort: 8443
      nodePort: 30000 # 手动添加，端口范围：30000-32767
  selector:
    k8s-app: kubernetes-dashboard
---

创建Dashboard

[root@administrator k8s]# kubectl apply -f recommended.yaml
namespace/kubernetes-dashboard unchanged
serviceaccount/kubernetes-dashboard unchanged
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs unchanged
secret/kubernetes-dashboard-csrf unchanged
secret/kubernetes-dashboard-key-holder unchanged
configmap/kubernetes-dashboard-settings unchanged
role.rbac.authorization.k8s.io/kubernetes-dashboard unchanged
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard unchanged
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard unchanged
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard unchanged
deployment.apps/kubernetes-dashboard unchanged
service/dashboard-metrics-scraper unchanged
deployment.apps/dashboard-metrics-scraper unchanged
[root@administrator k8s]# kubectl get pod,svc -n kubernetes-dashboard
NAME                                             READY   STATUS    RESTARTS   AGE
pod/dashboard-metrics-scraper-799d786dbf-fb5jp   1/1     Running   0          119s
pod/kubernetes-dashboard-fb8648fd9-xzjr9         1/1     Running   0          119s

NAME                                TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
service/dashboard-metrics-scraper   ClusterIP   10.99.247.23    <none>        8000/TCP        119s
service/kubernetes-dashboard        NodePort    10.107.183.31   <none>        443:30000/TCP   34s

访问Dashboard

注意：一定使用https协议访问

创建身份验证令牌

# 在kubernetes-dashboard命名空间中创建服务帐户dashboard-admin
kubectl create serviceaccount dashboard-admin -n kubernetes-dashboard

# 为kubernetes-dashboard命名空间中的服务帐户dashboard-admin授予cluster-admin角色权限
kubectl create clusterrolebinding dashboard-admin-rb --clusterrole=cluster-admin --serviceaccount=kubernetes-dashboard:dashboard-admin

获取Token，方式一：

# 获取kubernetes-dashboard命名空间中的与服务账号dashboard-admin相关的secret
[root@administrator k8s]# kubectl get secrets -n kubernetes-dashboard | grep dashboard-admin
dashboard-admin-token-rxq94        kubernetes.io/service-account-token   3      19s
# 查看secret中记录的账号token
[root@administrator k8s]# kubectl describe secrets dashboard-admin-token-rxq94   -n kubernetes-dashboard
Name:         dashboard-admin-token-rxq94
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 2f420c24-b8b4-48e5-885e-f78db9346cd4

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1111 bytes
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IlNtNXZMWkFqWi1HMnRUM21BSWdlTmRFWFF5czhBc0tYLWVMMVFkY1JyQk0ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tcnhxOTQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMmY0MjBjMjQtYjhiNC00OGU1LTg4NWUtZjc4ZGI5MzQ2Y2Q0Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.OytDQBDqBuKjXc-bxwuu1NkjqfMATKwfSrabLIlf9reZBDoshYDPd3K8ffCMJX-9HIOwslo_89dT0pTArYIOeCmIie-HtcnXdNoNTcUGIsCUuji-K1ZVkAI-T3xnt3LgSUBOx7N9UBDNZ-egaWcH1FdksPvMB4CS83sxtZthjih-0EykZ52UBlmb3ob5UsTA7oprVtDM1fXxNIhMV0JkHr2rR0WdajxA-o8CNknhbd2OKeg-8TZjsCr0FZBqTzu_w1f6VsaEukiX-Ee02HF1hmfKTKESG9ghOG3fkXWPebrbUK1oeqUAejE6HTxjbKMEPnWxQxgzS6Owget7M2s5DA

获取Token，方式二：

[root@administrator k8s]# kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/dashboard-admin -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"
eyJhbGciOiJSUzI1NiIsImtpZCI6IlNtNXZMWkFqWi1HMnRUM21BSWdlTmRFWFF5czhBc0tYLWVMMVFkY1JyQk0ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tcnhxOTQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMmY0MjBjMjQtYjhiNC00OGU1LTg4NWUtZjc4ZGI5MzQ2Y2Q0Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.OytDQBDqBuKjXc-bxwuu1NkjqfMATKwfSrabLIlf9reZBDoshYDPd3K8ffCMJX-9HIOwslo_89dT0pTArYIOeCmIie-HtcnXdNoNTcUGIsCUuji-K1ZVkAI-T3xnt3LgSUBOx7N9UBDNZ-egaWcH1FdksPvMB4CS83sxtZthjih-0EykZ52UBlmb3ob5UsTA7oprVtDM1fXxNIhMV0JkHr2rR0WdajxA-o8CNknhbd2OKeg-8TZjsCr0FZBqTzu_w1f6VsaEukiX-Ee02HF1hmfKTKESG9ghOG3fkXWPebrbUK1oeqUAejE6HTxjbKMEPnWxQxgzS6Owget7M2s5DA

删除账号与取消授权

kubectl -n kubernetes-dashboard delete serviceaccount dashboard-admin

kubectl -n kubernetes-dashboard delete clusterrolebinding dashboard-admin

使用Token登录