k8s 部署dashboard

Posted 2020-11-25 wh-blog

1. 当前环境

kubernetes        v1.17
dashboard         v2.0.0-rc5

2. 部署dashboard

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc5/aio/deploy/recommended.yaml

修改service的为NodePort:30443，以便外网可以访问，以https访问网站时出现证书无效的错误。

3. 自签证书

• 创建自签名CA

openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj "/C=CN/ST=CD/L=GX/O=WHYFATE/OU=WH/CN=CA"

• 签发dashboard证书

openssl genrsa -out dashboard.key 2048
openssl req -new -sha256 -key dashboard.key -out dashboard.csr -subj "/C=CN/ST=CD/L=GX/O=WHYFATE/OU=WH/CN=192.168.0.200"
// ---配置dashboard.cnf ---
// vim dashboard.cnf
extensions = san
[san]
keyUsage = digitalSignature
extendedKeyUsage = clientAuth,serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
subjectAltName = IP:192.168.0.200,IP:127.0.0.1,DNS:192.168.0.200,DNS:localhost
// --- 签发证书 ---
openssl x509 -req -sha256 -days 3650 -in dashboard.csr -out dashboard.crt -CA ca.crt -CAkey ca.key -CAcreateserial -extfile dashboard.cnf

4. 更新部署dashboard

• 删除 kubernetes-dashboard-certs

kubectl delete secret kubernetes-dashboard-certs -n kubernetes-dashboard

• 根据文件生成secret

kubectl create secret generic kubernetes-dashboard-certs --from-file="tls/dashboard.crt,tls/dashboard.key" -n kubernetes-dashboard

• 删除 dashboard pod 更新部署

  5. 导入CA

  拷贝ca.crt文件到要访问的机器上，导入证书。
  mac os 打开 钥匙串访问，把ca文件拖进去，信任 选择 始终信任，访问网站，出现192.168.0.200的登录证书，信任 选择 始终信任即可。

  6. 创建ServiceAccount以便登录dashboard

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

• 得到token

kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')

拷贝token，登录选择token即可。