kubernetes---web页面

dashboard界面安装所需的配置文件可在官方下载：https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard

部署web界面
在master1上部署

///创建dashboard工作目录
[root@localhost k8s]# mkdir dashboard
///将下载的文件拷贝多该目录下
[root@localhost dashboard]# ls
dashboard-configmap.yaml   dashboard-rbac.yaml    dashboard-service.yaml
dashboard-controller.yaml  dashboard-secret.yaml  k8s-admin.yaml    ///k8s-admin.yaml  需要自己创建
///安装文件顺序创建pod资源
[root@localhost dashboard]# kubectl create -f dashboard-rbac.yaml   //创建角色
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal createdrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
//创建安全验证
[root@localhost dashboard]#kubectl create -f dashboard-secret.yaml
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created
//创建配置
[root@localhost dashboard]# kubectl create -f dashboard-configmap.yaml
configmap/kubernetes-dashboard-settings created
//
[root@localhost dashboard]# kubectl create -f dashboard-controller.yaml
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
root@localhost dashboard]# kubectl create -f dashboard-service.yaml 

//查看创建在指定的kube-system名称空间下的pod
[root@promote ~]# kubectl get pods -n kube-system
NAME                                    READY   STATUS    RESTARTS   AGE
kubernetes-dashboard-7dffbccd68-6t66z   1/1     Running   1          49m
//查看如何访问（server可以简写svc）
[root@promote ~]# kubectl get pods,service -n kube-system
NAME                                        READY   STATUS    RESTARTS   AGE
pod/kubernetes-dashboard-7dffbccd68-6t66z   1/1     Running   1          51m
NAME                           TYPE       CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE
service/kubernetes-dashboard   NodePort   10.0.0.210   <none>        443:30001/TCP   83m
///查看pod被分配到那个节点上
NAME                                    READY   STATUS    RESTARTS   AGE   IP            NODE             NOMINATED NODE
kubernetes-dashboard-7dffbccd68-6t66z   1/1     Running   1          57m   172.17.15.2   192.168.175.91   <none>

我们可使用谷歌浏览器访问https://192.168.175.91:30001/
会发现需要证书

制作浏览器证书

[root@localhost dashboard]# vim dashboard-cert.sh
cat > dashboard-csr.json <<EOF
{
   "CN": "Dashboard",
   "hosts": [],
   "key": {
       "algo": "rsa",
       "size": 2048
},
   "names": [
       {
           "C": "CN",
           "L": "BeiJing",
           "ST": "BeiJing"
       }
   ]
}
EOF
K8S_CA=$1
cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | cfssljson -bare dashboard
kubectl delete secret kubernetes-dashboard-certs -n kube-system
kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system

/生成两个证书：dashboard-key.pem、dashboard.pem
[root@localhost dashboard]# bash dashboard-cert.sh /root/k8s/k8s-cert/
[root@localhost dashboard]# vim dashboard-controller.yaml
///增加证书两行
# PLATFORM-SPECIFIC ARGS HERE
- --auto-generate-certificates
- --tls-key-file=dashboard-key.pem
- --tls-cert-file=dashboard.pem 

//重新部署
[root@localhost dashboard]# kubectl apply -f dashboard-controller.yaml 

生成令牌

[root@localhost dashboard]# kubectl create -f k8s-admin.yaml
//保存
[root@localhost dashboard]# kubectl get secret -n kube-system

NAME                               TYPE                                  DATA   AGE
dashboard-admin-token-825ww        kubernetes.io/service-account-token   3      69m
default-token-r8426                kubernetes.io/service-account-token   3      2d
kubernetes-dashboard-certs         Opaque                                11     76m
kubernetes-dashboard-key-holder    Opaque                                2      118m
kubernetes-dashboard-token-j4wxg   kubernetes.io/service-account-token   3      110m
//查看令牌
[root@promote dashboard]# kubectl describe secret dashboard-admin-token-825ww -n kube-system
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tODI1d3ciLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiZTBkMWUyMmUtOTBjZi0xMWVhLWEyNjctMDAwYzI5MTY3ZTk4Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.YKJOjdvsbdHvPej7jFgK21sRP_t6dmlvAHwtJnsZz9_g6VDjFk_G4i_9_JVTc1W3kTRAyOfjEsnLcSQHHFHFawB8IKLyK5qfuAZI2GsOoyo1xd3Qm_IdssIpcbbMujXNNvYwNn-oDMErhxN3zr705VMKe5E1gku9JbwSJWh8UMHeJoJcDO9pc1EXlkTa-ZYQ4x485rOlUqqT986TuIOr2AHE2XY5zd4UFqt9G028yYpBEODDanhDBczStPmfUizYuLLyjJKbSLDYSwJguc13aO2X_Yi7clK2cQzCBN6uZuO616gELgvomwPs50KKCnMxZS1-OOq0yhiGz26We67S2A

将令牌输入进入界面