Funky's NoteBook

Install K8S dashboard with ingress

字数统计: 1,479阅读时长: 8 min
2019/03/15 Share

安装 kubernetes dashboard(仪表盘)同时开启 ingress

Kubernetes Dashboard是Kubernetes集群的基于Web的通用UI。 它允许用户管理在群集中运行的应用程序并对其进行故障排除,以及管理群集本身。

Step1: 为 dashboard 创建 service account

我们创建一个命名空间在 kube-system 中, 名为 kubernetes-dashboard 的 Service Account:

1
2
3
4
5
apiVersion: v1
kind: ServiceAccount
metadata:
name: kubernetes-dashboard
namespace: kube-system

Step2: 为 dashboard设置 RBAC

我们创建一个 ClusterRoleBinding 用于关联我们创建好的 Service Account,并且给他赋予操纵整个集群的功能:

1
2
3
4
5
6
7
8
9
10
11
12
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: dashboard-crb
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kube-system

注意ClusterRoleBindingapiVersion 在不同的 kubernetes 版本可能略有不同,在 v1.8之前的集群他们的apiVersionrbac.authorization.k8s.io/v1beta1

如果你并不想给 dashboard 那么大的权限,你可以根据官方的 YAML 文件进行修改:k8s dashboard deploy yaml

Step3: 为 dashboard 生成 Secret

1
2
3
4
5
6
7
8
apiVersion: v1
kind: Secret
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-certs
namespace: kube-system
type: Opaque

Step4: 为 dashboard 编写 Deployment

  • 开启TLS认证(强烈推荐!非常安全!)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: kubernetes-dashboard
template:
metadata:
labels:
k8s-app: kubernetes-dashboard
spec:
containers:
- name: kubernetes-dashboard
image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
ports:
- containerPort: 8443
protocol: TCP
args:
- --auto-generate-certificates
# Uncomment the following line to manually specify Kubernetes API server Host
# If not specified, Dashboard will attempt to auto discover the API server and connect
# to it. Uncomment only if the default does not work.
# - --apiserver-host=http://my-address:port
volumeMounts:
- name: kubernetes-dashboard-certs
mountPath: /certs
# Create on-disk volume to store exec logs
- mountPath: /tmp
name: tmp-volume
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
- name: tmp-volume
emptyDir: {}
serviceAccountName: kubernetes-dashboard
# Comment the following tolerations if Dashboard must not be deployed on master

这里dashboard 网页默认开启TLS 认证,如果你不想使用TLS认证并且使其在内网使用,你需要像下面这样设置:

  • 关闭 TLS 与认证(不推荐)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: kubernetes-dashboard
template:
metadata:
labels:
k8s-app: kubernetes-dashboard
spec:
containers:
- name: kubernetes-dashboard
image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
ports:
- containerPort: 9090
protocol: TCP
# 关闭 TLS 认证 将端口设置为 9090 并且关闭自动生成的认证功能
# args:
# - --auto-generate-certificates
# Uncomment the following line to manually specify Kubernetes API server Host
# If not specified, Dashboard will attempt to auto discover the API server and connect
# to it. Uncomment only if the default does not work.
# - --apiserver-host=http://my-address:port
volumeMounts:
- name: kubernetes-dashboard-certs
mountPath: /certs
# Create on-disk volume to store exec logs
- mountPath: /tmp
name: tmp-volume
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
- name: tmp-volume
emptyDir: {}
serviceAccountName: kubernetes-dashboard
# Comment the following tolerations if Dashboard must not be deployed on master

如果这么设置你的 dashboard 将不会进行认证,请谨慎使用!

Step5: 为 dashboard 创建 Service

  • 开启TLS 认证情况:
1
2
3
4
5
6
7
8
9
10
11
12
13
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
ports:
- port: 80
targetPort: 8443
selector:
k8s-app: kubernetes-dashboard
  • 关闭 TLS 认证情况(不推荐):
1
2
3
4
5
6
7
8
9
10
11
12
13
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
ports:
- port: 80
targetPort: 9090
selector:
k8s-app: kubernetes-dashboard

Step6: 为 dashboard 创建 ingress

6.1 生成证书:

这里我推荐使用 Free SSL 提供的免费 TLS 证书,直接通过 DNS 解析获取证书,而且各种浏览器都是小绿锁。

6.2 上传证书到集群:

在证书的文件夹里存在 full_chain.pem, private.key 两个文件,一个是公钥,一个是私钥

6.3 为创建 TLS 类型的 Secret:

在终端中执行:

1
$ kubectl create secret -n kube-system tls dashboard-tls --key private.key --cert full_chain.pem

6.4 创建 Ingress

  • 开启 TLS 情况:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: dashboard-ingress
namespace: kube-system
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /
#nginx.ingress.kubernetes.io/secure-backends: "true" 该注释在0.18.0中被弃用,并在0.20.0发布后被删除,使用下面
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
tls:
- hosts:
- dashboard.example.top
secretName: dashboard-tls
rules:
- host: dashboard.example.top
http:
paths:
- backend:
serviceName: kubernetes-dashboard
servicePort: 80

这里我的 ingress-controller 使用的是 ingress-nginx,由于 dashboard 暴露的 8443 端口本身就开启了TLS,因此需要设置以下 ingress-nginx 参数用于重定向 TLS,不然容易导致 Pod 无法对外部提供服务的问题:

1
2
3
4
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /
nginx.ingress.kubernetes.io/secure-backends: "true"
  • 关闭 TLS 情况(不推荐):
1
2
3
4
5
6
7
8
9
10
11
12
13
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: dashboard-ingress
namespace: kube-system
spec:
rules:
- host: dashboard.example.top
http:
paths:
- backend:
serviceName: kubernetes-dashboard
servicePort: 80

Step7: 查找 dashboard 登录 Token

在终端中输入:

1
$ kubectl get secret -n kube-system | grep kubernetes-dashboard

你会看见如下输出:

1
2
3
kubernetes-dashboard-certs                       Opaque                                0      34h
kubernetes-dashboard-key-holder Opaque 2 37h
kubernetes-dashboard-token-xxxxxx kubernetes.io/service-account-token 3 34h

获取 Token:

1
$ kubectl -n kube-system describe secret kubernetes-dashboard-token-xxxxx

你会看见如下输出:

1
2
3
4
5
6
7
8
9
10
11
12
13
Name:         kubernetes-dashboard-token-qnwp5
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: kubernetes-dashboard
kubernetes.io/service-account.uid: c106fd9e-4614-11e9-81b0-525400ea5ba6

Type: kubernetes.io/service-account-token

Data
====
namespace: 11 bytes
token: asdasdasdasdasdasdasdasd
ca.crt: 1025 bytes

那么 token 对应的就是你登录 dashboard 需要的 token

或者直接通过下面的命令实现token获取:

1
$ kubectl -n kube-system describe secrets kubernetes-dashboard-token |awk -F'token:      '  'NR==13  { print $2  }'

至此,dashboard 搭建完毕!

本文代码地址:https://github.com/Mr-Linus/k8s-example/tree/master/dashboard

CATALOG
  1. 1. 安装 kubernetes dashboard(仪表盘)同时开启 ingress
    1. 1.1. Step1: 为 dashboard 创建 service account
    2. 1.2. Step2: 为 dashboard设置 RBAC
    3. 1.3. Step3: 为 dashboard 生成 Secret
    4. 1.4. Step4: 为 dashboard 编写 Deployment
    5. 1.5. Step5: 为 dashboard 创建 Service
    6. 1.6. Step6: 为 dashboard 创建 ingress
      1. 1.6.1. 6.1 生成证书:
      2. 1.6.2. 6.2 上传证书到集群:
      3. 1.6.3. 6.3 为创建 TLS 类型的 Secret:
      4. 1.6.4. 6.4 创建 Ingress
      5. 1.6.5. Step7: 查找 dashboard 登录 Token