使用RBAC授权用户登录DashBoard界面

官方文档

Dashboard是基于网页的Kubernetes用户界面。你可以使用Dashboard将容器应用部署到Kubernetes集群中，也可以对容器应用排错，还能管理集群资源。你可以使用Dashboard获取运行在集群中的应用的概览信息，也可以创建或者修改Kubernetes资源（如Deployment，Job，DaemonSet等等）。例如，你可以对Deployment实现弹性伸缩、发起滚动升级、重启 Pod 或者使用向导创建新的应用。

Dashboard同时展示了Kubernetes集群中的资源状态信息和所有报错信息。

部署 Dashboard UI

默认情况下不会部署Dashboard。可以通过以下命令部署：

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.2.0/aio/deploy/recommended.yaml

以上命令执行后会在k8s集群上创建出相应的pod和svc

root@k8s-master01:~# kubectl get svc -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
dashboard-metrics-scraper   ClusterIP   10.100.12.165   <none>        8000/TCP   65s
kubernetes-dashboard        ClusterIP   10.108.81.228   <none>        443/TCP    65s

# 此处的port为443需要验证证书。并且ip为ClusterIP无法直接访问

# 将其svc改为NodePort类型
root@k8s-master01:~# vim dashbord-svc.yaml
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  type: NodePort
  ports:
    - port: 443
      targetPort: 8443
      nodePort: 30090
  selector:
    k8s-app: kubernetes-dashboard

# 再次应用此配置文件
root@k8s-master01:~# kubectl apply -f dashbord-svc.yaml
service/kubernetes-dashboard configured

root@k8s-master01:~# kubectl get svc -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.100.12.165   <none>        8000/TCP        11m
kubernetes-dashboard        NodePort    10.108.81.228   <none>        443:30090/TCP   11m

在浏览器中访问

Dashboard UI登录账号

在K8S上有两类用户，人类用户和pod。人类用户的账号是在直接访问k8s的API Server时使用。而pod则是在应用于API Service交互时使用。

Dashboard的登录账号实际上是pod和API Server的交互，所以此处需要使用的登录账号为ServiceAccount的账号。

而dashboard的登录又分为token和kubeconfig

获取token登录dashboard

上一节授权中创建了一个dev-admin这个SA，并对其进行了授权，所以其拥有了管理dev名称空间下的所有资源的能力

# 获取其secrets
root@k8s-master01:~# kubectl get secrets -n dev
NAME                    TYPE                                  DATA   AGE
admin-token-6lrjw       kubernetes.io/service-account-token   3      5d2h
default-token-j5lt6     kubernetes.io/service-account-token   3      5d2h
dev-admin-token-kx8ng   kubernetes.io/service-account-token   3      38m     # 此为创建的dev-admin的secret

# 获取其token信息。
root@k8s-master01:~# kubectl get secrets -n dev dev-admin-token-kx8ng -o yaml | grep token: | awk '{print $2}' | base64 -d
eyJhbGciOiJSUzI1NiIsImtpZCI6Ijd4OE5hMTV1VU0tUDQzRk45UUwzNWNzUDVsbTdpc2tzMEZYRUtwa1lfdmMifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZXYiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoiZGV2LWFkbWluLXRva2VuLWt4OG5nIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImRldi1hZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjZkMTgxYjIxLTNiNmQtNDcyNC1iNTk0LTExZDkzYzI4ZTkzMiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZXY6ZGV2LWFkbWluIn0.LCObvAqa21bjAkvewywR0m8v8V7w5GdqLxYcp9TvdEu7Woogo9mVnuWrpPtQ8Qhj_ZNrIMkgFJOn-J3jIlB_QfuAy-4T-t4nTw9ypsFSPgvLae0R_ATFIlk4xs4jJL-RLEvIVyrnoEfeqmPef39H7q2vbbFPO663QkVAfZv39cCfYn6EYOx69tTqo0Y1qf_k0lzErRNOPqSPE9KCs8Z7ozsB77s_o1owHnOol7qIoGAJzIdZPZiLW5bp20waCJMsRNR6Gx3ZiVbdS6JYWV-guSpix2GvcN7tXjlClQOKJbxxBzpJMKjFNQTth338jgI_zJdeOQRi9_sha24YSCxmbw

# 使用此token进行登录

制作kubeconfig登录

获取到ServiceAccount的token

# 获取到dev-admin的token信息
root@k8s-master01:~# kubectl get secrets -n dev dev-admin-token-kx8ng -o yaml | grep token: | awk '{print $2}' | base64 -d
eyJhbGciOiJSUzI1NiIsImtpZCI6Ijd4OE5hMTV1VU0tUDQzRk45UUwzNWNzUDVsbTdpc2tzMEZYRUtwa1lfdmMifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZXYiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoiZGV2LWFkbWluLXRva2VuLWt4OG5nIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImRldi1hZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjZkMTgxYjIxLTNiNmQtNDcyNC1iNTk0LTExZDkzYzI4ZTkzMiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZXY6ZGV2LWFkbWluIn0.LCObvAqa21bjAkvewywR0m8v8V7w5GdqLxYcp9TvdEu7Woogo9mVnuWrpPtQ8Qhj_ZNrIMkgFJOn-J3jIlB_QfuAy-4T-t4nTw9ypsFSPgvLae0R_ATFIlk4xs4jJL-RLEvIVyrnoEfeqmPef39H7q2vbbFPO663QkVAfZv39cCfYn6EYOx69tTqo0Y1qf_k0lzErRNOPqSPE9KCs8Z7ozsB77s_o1owHnOol7qIoGAJzIdZPZiLW5bp20waCJMsRNR6Gx3ZiVbdS6JYWV-guSpix2GvcN7tXjlClQOKJbxxBzpJMKjFNQTth338jgI_zJdeOQRi9_sha24YSCxmbw

制作kubeconfig文件

# 使用token添加用户信息
root@k8s-master01:~# kubectl config set-credentials dev-admin --token=eyJhbGciOiJSUzI1NiIsImtpZCI6Ijd4OE5hMTV1VU0tUDQzRk45UUwzNWNzUDVsbTdpc2tzMEZYRUtwa1lfdmMifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZXYiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoiZGV2LWFkbWluLXRva2VuLWt4OG5nIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImRldi1hZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjZkMTgxYjIxLTNiNmQtNDcyNC1iNTk0LTExZDkzYzI4ZTkzMiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZXY6ZGV2LWFkbWluIn0.LCObvAqa21bjAkvewywR0m8v8V7w5GdqLxYcp9TvdEu7Woogo9mVnuWrpPtQ8Qhj_ZNrIMkgFJOn-J3jIlB_QfuAy-4T-t4nTw9ypsFSPgvLae0R_ATFIlk4xs4jJL-RLEvIVyrnoEfeqmPef39H7q2vbbFPO663QkVAfZv39cCfYn6EYOx69tTqo0Y1qf_k0lzErRNOPqSPE9KCs8Z7ozsB77s_o1owHnOol7qIoGAJzIdZPZiLW5bp20waCJMsRNR6Gx3ZiVbdS6JYWV-guSpix2GvcN7tXjlClQOKJbxxBzpJMKjFNQTth338jgI_zJdeOQRi9_sha24YSCxmbw --kubeconfig=/tmp/dev-admin.conf
User "dev-admin" set.

# 添加集群信息
root@k8s-master01:~# kubectl config set-cluster kubernetes --server=https://kube-api:6443 --embed-certs --certificate-authority=/etc/kubernetes/pki/ca.crt --kubeconfig=/tmp/dev-admin.conf
Cluster "kubernetes" set.

# 添加用户和集群关联关系
root@k8s-master01:~# kubectl config set-context dev-admin@kubernetes --user=dev-admin --cluster=kubernetes --kubeconfig=/tmp/dev-admin.conf
Context "dev-admin@kubernetes" created.

# 添加当前使用的账号信息
root@k8s-master01:~# kubectl config use-context dev-admin@kubernetes --kubeconfig=/tmp/dev-admin.conf
Switched to context "dev-admin@kubernetes".