kubernetes的dashboard登录方式

无密码登录

dashboard安装报错?下面介绍3种方式,无密码登录,token登录,dashboard客户端查看

# cat kubernetes-dashboard.yaml
# Copyright 2017 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the “License”);
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an “AS IS” BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Configuration to deploy release version of the Dashboard UI compatible with # Kubernetes 1.8. # # Example usage: kubectl create -f <this_file>

# ——————- Dashboard Service Account ——————- #

apiVersion: v1 kind: ServiceAccount metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system

— # ——————- Dashboard Role & Role Binding ——————- #

kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: kubernetes-dashboard-minimal namespace: kube-system rules: # Allow Dashboard to create ‘kubernetes-dashboard-key-holder’ secret. – apiGroups: [“”] resources: [“secrets”] verbs: [“create”] # Allow Dashboard to create ‘kubernetes-dashboard-settings’ config map. – apiGroups: [“”] resources: [“configmaps”] verbs: [“create”] # Allow Dashboard to get, update and delete Dashboard exclusive secrets. – apiGroups: [“”] resources: [“secrets”] resourceNames: [“kubernetes-dashboard-key-holder”] verbs: [“get”, “update”, “delete”] # Allow Dashboard to get and update ‘kubernetes-dashboard-settings’ config map. – apiGroups: [“”] resources: [“configmaps”] resourceNames: [“kubernetes-dashboard-settings”] verbs: [“get”, “update”] # Allow Dashboard to get metrics from heapster. – apiGroups: [“”] resources: [“services”] resourceNames: [“heapster”] verbs: [“proxy”] – apiGroups: [“”] resources: [“services/proxy”] resourceNames: [“heapster”, “http:heapster:”, “https:heapster:”] verbs: [“get”]

— apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: kubernetes-dashboard-minimal namespace: kube-system roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: kubernetes-dashboard-minimal subjects: – kind: ServiceAccount name: kubernetes-dashboard namespace: kube-system

— # ——————- Dashboard Deployment ——————- #

kind: Deployment apiVersion: apps/v1beta2 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system spec: replicas: 1 revisionHistoryLimit: 1 selector: matchLabels: k8s-app: kubernetes-dashboard template: metadata: labels: k8s-app: kubernetes-dashboard spec: containers: – name: kubernetes-dashboard imagePullPolicy: IfNotPresent image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3 ports: – containerPort: 9090 protocol: TCP args: # Uncomment the following line to manually specify Kubernetes API server Host # If not specified, Dashboard will attempt to auto discover the API server and connect # to it. Uncomment only if the default does not work. # – –apiserver-host=http://my-address:port volumeMounts: # Create on-disk volume to store exec logs – mountPath: /tmp name: tmp-volume livenessProbe: httpGet: path: / port: 9090 initialDelaySeconds: 30 timeoutSeconds: 30 volumes: – name: tmp-volume emptyDir: {} serviceAccountName: kubernetes-dashboard # Comment the following tolerations if Dashboard must not be deployed on master tolerations: – key: node-role.kubernetes.io/master effect: NoSchedule

— # ——————- Dashboard Service ——————- #

kind: Service apiVersion: v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system spec: #type: NodePort ports: – port: 9090 targetPort: 9090 #nodePort: 30088 selector: k8s-app: kubernetes-dashboard

# cat dashboard-admin.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
  labels:
    k8s-app: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
– kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system

kubectl创建完成后,加proxy

nohup kubectl proxy –address=’0.0.0.0′ –port=8888 –accept-hosts=’^*$’ &

浏览器访问http://master_IP:8888/ui

如果用NodePort模式,把上面type: NodePort 和 nodePort:30088 取消注释,访问30088端口即可

这个无密码登录有个问题:打开容器组的容器面板,右上角有”运行命令”,这里是不能执行的,另外菜单的”设置”不能使用,如果使用下面的token登录可以

token登录

# cat kubernetes-dashboard.yaml
# Copyright 2017 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the “License”);
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an “AS IS” BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Configuration to deploy release version of the Dashboard UI compatible with # Kubernetes 1.8. # # Example usage: kubectl create -f <this_file>

# ——————- Dashboard Secret ——————- #

apiVersion: v1 kind: Secret metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-certs namespace: kube-system type: Opaque

— # ——————- Dashboard Service Account ——————- #

apiVersion: v1 kind: ServiceAccount metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system

— # ——————- Dashboard Role & Role Binding ——————- #

kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: kubernetes-dashboard-minimal namespace: kube-system rules: # Allow Dashboard to create ‘kubernetes-dashboard-key-holder’ secret. – apiGroups: [“”] resources: [“secrets”] verbs: [“create”] # Allow Dashboard to create ‘kubernetes-dashboard-settings’ config map. – apiGroups: [“”] resources: [“configmaps”] verbs: [“create”] # Allow Dashboard to get, update and delete Dashboard exclusive secrets. – apiGroups: [“”] resources: [“secrets”] resourceNames: [“kubernetes-dashboard-key-holder”, “kubernetes-dashboard-certs”] verbs: [“get”, “update”, “delete”] # Allow Dashboard to get and update ‘kubernetes-dashboard-settings’ config map. – apiGroups: [“”] resources: [“configmaps”] resourceNames: [“kubernetes-dashboard-settings”] verbs: [“get”, “update”] # Allow Dashboard to get metrics from heapster. – apiGroups: [“”] resources: [“services”] resourceNames: [“heapster”] verbs: [“proxy”] – apiGroups: [“”] resources: [“services/proxy”] resourceNames: [“heapster”, “http:heapster:”, “https:heapster:”] verbs: [“get”]

— apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: kubernetes-dashboard-minimal namespace: kube-system roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: kubernetes-dashboard-minimal subjects: – kind: ServiceAccount name: kubernetes-dashboard namespace: kube-system

— # ——————- Dashboard Deployment ——————- #

kind: Deployment apiVersion: apps/v1beta2 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system spec: replicas: 1 revisionHistoryLimit: 1 selector: matchLabels: k8s-app: kubernetes-dashboard template: metadata: labels: k8s-app: kubernetes-dashboard spec: containers: – name: kubernetes-dashboard #image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3 image: harbor.iris-technologies.com.cn:50505/k8s/kubernetes-dashboard-amd64:v1.8.3 imagePullPolicy: IfNotPresent ports: – containerPort: 8443 protocol: TCP args: – –auto-generate-certificates # Uncomment the following line to manually specify Kubernetes API server Host # If not specified, Dashboard will attempt to auto discover the API server and connect # to it. Uncomment only if the default does not work. # – –apiserver-host=http://my-address:port volumeMounts: – name: kubernetes-dashboard-certs mountPath: /certs # Create on-disk volume to store exec logs – mountPath: /tmp name: tmp-volume livenessProbe: httpGet: scheme: HTTPS path: / port: 8443 initialDelaySeconds: 30 timeoutSeconds: 30 volumes: – name: kubernetes-dashboard-certs secret: secretName: kubernetes-dashboard-certs – name: tmp-volume emptyDir: {} serviceAccountName: kubernetes-dashboard # Comment the following tolerations if Dashboard must not be deployed on master tolerations: – key: node-role.kubernetes.io/master effect: NoSchedule

— # ——————- Dashboard Service ——————- #

kind: Service apiVersion: v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kube-system spec: # type: NodePort ports: – port: 9090 targetPort: 8443 selector: k8s-app: kubernetes-dashboard

获取dashboard token

kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep kubernetes-dashboard-token|awk ‘{print $1}’)|grep token:|awk ‘{print $2}’

登录:

https://192.168.0.238:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/login

{ “kind”: “Status”, “apiVersion”: “v1”, “metadata”: {

}, “status”: “Failure”, “message”: “services \”https:kubernetes-dashboard:\” is forbidden: User \”system:anonymous\” cannot get services/proxy in the namespace \”kube-system\””, “reason”: “Forbidden”, “details”: { “name”: “https:kubernetes-dashboard:”, “kind”: “services” }, “code”: 403 }

证书问题,添加证书
使用client-certificate-data和client-key-data生成一个p12文件

生成client-certificate-data

grep ‘client-certificate-data’ ~/.kube/config | head -n 1 | awk ‘{print $2}’ | base64 -d >> kubecfg.crt

生成client-key-data

grep ‘client-key-data’ ~/.kube/config | head -n 1 | awk ‘{print $2}’ | base64 -d >> kubecfg.key

生成p12

openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name “kubernetes-client”

kubecfg.p12就是生成的个人证书

下面是Chrome和Firefox浏览器导入证书

在Chrome或者Firefox添加 kubecfg.p12 个人证书,再次使用令牌访问,提示。。。等等一堆错误:

configmaps is forbidden: User “system:serviceaccount:kube-system:kubernetes-dashboard” cannot list configmaps in the namespace “default”

根据下面操作:

kubectl create serviceaccount dashboard -n default
kubectl create clusterrolebinding dashboard-admin -n default –clusterrole=cluster-admin  –serviceaccount=default:dashboard
kubectl get secret $(kubectl get serviceaccount dashboard -o jsonpath=”{.secrets[0].name}”) -o jsonpath=”{.data.token}” | base64 –decode

拿这个token登录dashboard界面即可

客户端查看

https://kubernetic.com/ 下载客户端

比如Windows电脑,Win+R打开运行,输入cmd,执行命令mkdir .kube

把master节点 .kube/config 放到 C:\Users\用户名.kube 目录下,打开kubernetic即可

未经允许不得转载:国外便宜VPS » kubernetes的dashboard登录方式

赞 (0)