{"id":1598,"date":"2020-04-09T16:09:52","date_gmt":"2020-04-09T08:09:52","guid":{"rendered":"http:\/\/www.puzi7.com\/?p=1598"},"modified":"2020-04-09T16:09:52","modified_gmt":"2020-04-09T08:09:52","slug":"kubernetes-dashboard-%e7%9a%84%e4%bd%bf%e7%94%a8%e8%af%b4%e6%98%8e","status":"publish","type":"post","link":"https:\/\/www.puzi7.net\/?p=1598","title":{"rendered":"Kubernetes dashboard \u7684\u5b89\u88c5\u4f7f\u7528\u8bf4\u660e"},"content":{"rendered":"

K8s\u7684dashboard \u53ef\u4ee5\u5e2e\u52a9\u7528\u6237\u67e5\u770b\u5404\u4e2a\u5e94\u7528\uff0c\u670d\u52a1\uff0c\u90e8\u7f72\u4ee5\u53ca\u8282\u70b9\u7684\u914d\u7f6e\u548c\u4f7f\u7528\u60c5\u51b5\u3002\u4ee5\u4e0b\u662f\u6211\u8fd9\u8fb9\u7b80\u5355\u7684\u4f7f\u7528\u548c\u90e8\u7f72\u6d41\u7a0b\uff0c\u4f9b\u5927\u5bb6\u53c2\u8003\u3002<\/p>\n

    \n
  1. \u83b7\u53d6dashboard\u7684YAML\u6587\u4ef6<\/li>\n<\/ol>\n

    wget https:\/\/raw.githubusercontent.com\/kubernetes\/dashboard\/v2.0.0-beta4\/aio\/deploy\/recommended.yaml -O kubernetes-dashboard.yaml<\/code><\/p>\n

    \u00a0 2. \u4fee\u6539kubernetes-dashboard.yaml, \u6dfb\u52a0<\/code>nodeport: 30001, and type: NodePort<\/p>\n

    kind: Service<\/code>
    \napiVersion: v1<\/code>
    \nmetadata:<\/code>
    \n labels:<\/code>
    \n k8s-app: kubernetes-dashboard<\/code>
    \n name: kubernetes-dashboard<\/code>
    \n namespace: kubernetes-dashboard<\/code>
    \nspec:<\/code>
    \n type: NodePort<\/span><\/code><\/span>
    \n ports:<\/code>
    \n - port: 443<\/code>
    \n targetPort: 8443<\/code>
    \n nodePort: 30001<\/span><\/code><\/span>
    \n selector:<\/code>
    \n k8s-app: kubernetes-dashboard\u00a0 \u00a0<\/code><\/p>\n

    3. \u5b89\u88c5dashboard\u670d\u52a1<\/p>\n

    kubectl apply -f\u00a0kubernetes-dashboard.yaml<\/code><\/p>\n

    4.\u00a0 \u68c0\u67e5\u5b89\u88c5<\/p>\n

    kubectl get service kubernetes-dashboard -n kubernetes-dashboard<\/code><\/p>\n

    NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE<\/code>
    \nkubernetes-dashboard NodePort 10.100.136.185 <none> 443:30001<\/span>\/TCP 3h22m<\/code><\/p>\n

    5. \u8bbf\u95ee\u670d\u52a1\u9875\u9762\u00a0 https:\/\/localhost:30001<\/p>\n

    \u51fa\u73b0\u670d\u52a1\u65e0\u6cd5\u670d\u52a1\uff0c\u8bf4\u660e\u6d4f\u89c8\u5668\u9700\u8981TLS\u7684\u8bc1\u4e66<\/p>\n

    6. \u521b\u5efa\u81ea\u7b7e\u540d\u7684\u8bc1\u4e66<\/p>\n

    mkdir\u00a0 tls && cd tls<\/p>\n

    \u521b\u5efaCA<\/p>\n

    openssl genrsa -out ca.key 2048<\/code><\/p>\n

    openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj \"\/C=CN\/ST=LN\/L=DL\/O=CMIR\/OU=CMIR\/CN=CA\"<\/code><\/p>\n

    openssl x509 -in ca.crt -noout -text<\/code><\/p>\n

    \u7b7e\u53d1\u8bc1\u4e66<\/p>\n

    openssl genrsa -out dashboard.key 2048<\/code><\/p>\n

    openssl req -new -sha256 -key dashboard.key -out dashboard.csr -subj \"\/C=CN\/ST=LN\/L=DL\/O=CMIR\/OU=CMIR\/CN=192.168.31.118\"<\/code><\/p>\n

    vim dashboard.cnf \u6dfb\u52a0\u4e0b\u8fb9\u7684\u5185\u5bb9<\/code><\/p>\n

    extensions = san<\/code>
    \n[san]<\/code>
    \nkeyUsage = digitalSignature<\/code>
    \nextendedKeyUsage = clientAuth,serverAuth<\/code>
    \nsubjectKeyIdentifier = hash<\/code>
    \nauthorityKeyIdentifier = keyid,issuer<\/code>
    \nsubjectAltName =IP:192.168.31.118,IP:127.0.0.1,DNS:192.168.31.1,DNS:localhost<\/code><\/p>\n

    openssl x509 -req -sha256 -days 3650 -in dashboard.csr -out dashboard.crt -CA ca.crt -CAkey ca.key -CAcreateserial -extfile dashboard.cnf<\/code><\/p>\n

    openssl x509 -in dashboard.crt -noout -text<\/code><\/p>\n

    \u6302\u8f7d\u8bc1\u4e66\u5230dashboard<\/p>\n

      \n
    1. kubectl delete -f kubernetes-dashboard.yaml<\/code><\/li>\n
    2. kubectl create secret generic kubernetes-dashboard-certs --from-file=\"tls\/dashboard.crt,tls\/dashboard.key\" -n kube-system<\/code><\/li>\n
    3. kubectl apply -f kubernetes-dashboard.yaml<\/code><\/li>\n<\/ol>\n

      7.\u00a0 \u00a0\u518d\u6b21\u8bbf\u95ee https:\/\/localhost:30001, \u5e94\u8be5\u51fa\u73b0\u767b\u5f55\u754c\u9762\uff0c\u53ef\u4ee5\u63d0\u4f9b\u914d\u7f6e\u6216\u8005\u4ee4\u724c\u767b\u5f55<\/p>\n

      <\/p>\n

      8. \u751f\u6210\u4ee4\u724c<\/p>\n

        \n
      1. kubectl create serviceaccount dashboard-admin -n kubernetes-dashboard<\/code><\/li>\n
      2. kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kubernetes-dashboard:dashboard-admin<\/code><\/li>\n
      3. kubectl describe secrets -n kubernetes-dashboard $(kubectl -n kubernetes-dashboard get secret | awk '\/dashboard-admin\/{print $1}')<\/code><\/li>\n
      4. \u83b7\u53d6dashard-admin\u7684token, \u590d\u5236\u7c98\u8d34\u5230\u767b\u5f55\u9875\u9762\u5373\u53ef\u767b\u5f55<\/li>\n<\/ol>\n

        9. \u8fdb\u5165dashboard\u7684\u754c\u9762\uff0c\u53ef\u4ee5\u67e5\u770bk8s\u90e8\u7f72\u7684\u5404\u79cd\u670d\u52a1\u4ee5\u53ca\u72b6\u6001<\/p>\n

        <\/p>\n

        \u5bf9\u4e8eChrome\u6d4f\u89c8\u5668\uff0c\u672c\u5730\u65e0\u6cd5\u8bbf\u95eehttps\u7684\u89e3\u51b3\u65b9\u5f0f\uff1achrome:\/\/flags\/#allow-insecure-localhost<\/a>\uff0c\u8bbe\u7f6e\u4e3aenable\u5373\u53ef\u672c\u5730\u8bbf\u95ee<\/p>\n

         <\/p>\n","protected":false},"excerpt":{"rendered":"

        K8s\u7684dashboard \u53ef\u4ee5\u5e2e\u52a9\u7528\u6237\u67e5\u770b\u5404\u4e2a\u5e94\u7528\uff0c\u670d\u52a1\uff0c\u90e8\u7f72\u4ee5\u53ca\u8282\u70b9\u7684\u914d\u7f6e\u548c\u4f7f\u7528\u60c5\u51b5\u3002…<\/span><\/p>\n

        Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22,23,32,9,12],"tags":[55,79],"class_list":["post-1598","post","type-post","status-publish","format-standard","hentry","category-java","category-kubernetes","category-32","category-9","category-blog","tag-dashboard","tag-k8s","zoom-theme-has-thumb"],"_links":{"self":[{"href":"https:\/\/www.puzi7.net\/index.php?rest_route=\/wp\/v2\/posts\/1598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.puzi7.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.puzi7.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.puzi7.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.puzi7.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1598"}],"version-history":[{"count":0,"href":"https:\/\/www.puzi7.net\/index.php?rest_route=\/wp\/v2\/posts\/1598\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.puzi7.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.puzi7.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1598"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.puzi7.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}