首页 / K8S / k8s dashboard 安装和证书更新

k8s dashboard 安装和证书更新

内容导读

互联网集市收集整理的这篇技术教程文章主要介绍了k8s dashboard 安装和证书更新，小编现在分享给大家，供广大互联网技能从业者学习和参考。文章包含5804字，纯文字阅读大概需要9分钟。

内容图文

1、k8s 搭建   参见https://blog.51cto.com/lizhenliang/2325770

[root@VM_0_48_centos ~]# kubectl  get cs
NAME                 STATUS    MESSAGE              ERROR
scheduler            Healthy   ok                   
controller-manager   Healthy   ok                   
etcd-1               Healthy   {"health": "true"}   
etcd-0               Healthy   {"health": "true"}   
etcd-2               Healthy   {"health": "true"}

注意：博客中有个别修改的.

/opt/kubernetes/cfg/kube-apiserver  ：

需要由：--enable-admission-plugins=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota

改为：  --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,NodeRestriction   去掉：SecurityContextDeny

 

2、dashboard  下载地址： /opt/dashboard/    注意： admin-token.yaml 为手工创建

git clone  https://github.com/kubernetes/kubernetes.git 

[root@VM_0_48_centos dashboard]# ll *.yaml
-rw-r--r-- 1 root root  515 Aug  8 10:11 admin-token.yaml
-rw-r--r-- 1 root root  264 Aug  5 16:27 dashboard-configmap.yaml
-rw-r--r-- 1 root root 1835 Aug  8 09:14 dashboard-controller.yaml
-rw-r--r-- 1 root root 1353 Aug  5 16:27 dashboard-rbac.yaml
-rw-r--r-- 1 root root  551 Aug  5 16:27 dashboard-secret.yaml
-rw-r--r-- 1 root root  339 Aug  7 15:24 dashboard-service.yaml

3、修改dashboard-service.yaml  内容   

[root@VM_0_48_centos dashboard]# cat dashboard-service.yaml 
apiVersion: v1
kind: Service
metadata:
  name: kubernetes-dashboard
  namespace: kube-system
  labels:
    k8s-app: kubernetes-dashboard
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  type: NodePort   #添加Nodeport 以便访问
  selector:
    k8s-app: kubernetes-dashboard
  ports:
  - port: 443
    targetPort: 8443

 

4、 启动服务

kubectl  apply  -f dashboard-configmap.yaml 

 kubectl  apply  -f dashboard-secret.yaml 

kubectl  apply  -f dashboard-rbac.yaml 

kubectl apply -f dashboard-service.yaml 

kubectl  apply -f  dashboard-controller.yaml

 

5、修改/usr/lib/systemd/system/kubelet.service  参数：cluster-dns  cluster-domain 

 kubectl  describe pod kubernetes-dashboard-746dfd476-mdv5n  -n kube-system

b报错：kubelet does not have ClusterDNS IP configured and cannot create PodJ解决方案

[root@VM_0_48_centos dashboard]# cat /usr/lib/systemd/system/kubelet.service
[Unit]
Description=Kubernetes Kubelet
After=docker.service
Requires=docker.service

[Service]
EnvironmentFile=/opt/kubernetes/cfg/kubelet
ExecStart=/opt/kubernetes/bin/kubelet $KUBELET_OPTS
Restart=on-failure
KillMode=process

[Install]
WantedBy=multi-user.target
[root@VM_0_48_centos dashboard]# cat /opt/kubernetes/cfg/kubelet
KUBELET_OPTS="--logtostderr=true \
--v=4 \
--hostname-override=172.19.0.48 \
--cluster-dns=10.0.0.2 \             ### 配置dns
--cluster-domain=cluster.local \   ###配置域名
--kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \
--bootstrap-kubeconfig=/opt/kubernetes/cfg/bootstrap.kubeconfig \
--cert-dir=/opt/kubernetes/ssl \
--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0"

        修改完以后，重启服务发现正常
6、权限问题 发现官网yaml授权中只有默认的defalut ，需要重新绑定角色。

    
[root@VM_0_48_centos dashboard]# cat admin-token.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: admin
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  kind: ClusterRole
  name: cluster-admin   #词角色未系统搭建时候自动生成管理员角色
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: admin
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: kube-system
  labels:
    kubernetes.io/cluster-service: "true"

　　官网给的yaml:

[root@VM_0_48_centos dashboard]# cat dashboard-rbac.yaml 
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
    addonmanager.kubernetes.io/mode: Reconcile
  name: kubernetes-dashboard-minimal
  namespace: kube-system   #只能看到systemo 空间
rules:
  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
  verbs: ["get", "update", "delete"]
  # Allow Dashboard to get and update ‘kubernetes-dashboard-settings‘ config map.
- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["kubernetes-dashboard-settings"]
  verbs: ["get", "update"]
  # Allow Dashboard to get metrics from heapster.
- apiGroups: [""]
  resources: ["services"]
  resourceNames: ["heapster"]
  verbs: ["proxy"]
- apiGroups: [""]
  resources: ["services/proxy"]
  resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubernetes-dashboard-minimal
  namespace: kube-system
  labels:
    k8s-app: kubernetes-dashboard
    addonmanager.kubernetes.io/mode: Reconcile
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubernetes-dashboard-minimal
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system

更新以后获取登录token:

[root@VM_0_48_centos dashboard]# kubectl describe secret/$(kubectl get secret -nkube-system |grep admin|awk ‘{print $1}‘) -nkube-system  
Name:         admin-token-j8sjg
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: admin
              kubernetes.io/service-account.uid: d9e482cf-b981-11e9-9170-525400c318af

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1359 bytes
namespace:  11 bytes
token:      *****************************************************************##设计保密信息

 

        
            
7、更新https证书有效期，解决只能由火狐浏览器访问，其他浏览器无法访问问题。
产生证书：

    
mkdir key && cd key
openssl genrsa -out dashboard.key 2048 

openssl req -new -out dashboard.csr -key dashboard.key -subj ‘/CN=172.19.0.48‘

openssl x509 -req -in dashboard.csr -signkey dashboard.key -out dashboard.crt 

kubectl delete secret kubernetes-dashboard-certs -n kube-system

kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt -n kube-system  #新的证书

kubectl delete pod kubernetes-dashboard-746dfd476-b2r5f -n kube-system    #重启服务

 

        8、效果展示：
技术分享图片

 

原文：https://www.cnblogs.com/xiajq/p/11322568.html

内容总结

以上是互联网集市为您收集整理的k8s dashboard 安装和证书更新全部内容，希望文章能够帮你解决k8s dashboard 安装和证书更新所遇到的程序开发问题。 如果觉得互联网集市技术教程内容还不错，欢迎将互联网集市网站推荐给程序员好友。

内容备注

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 gblab@vip.qq.com 举报，一经查实，本站将立刻删除。

内容手机端

扫描二维码推送至手机访问。

本文链接：https://qyyshop.com/info/1286138.html

来源：【匿名】