21.安装Dashboard

桃扇骨 2022-10-07 10:56 2阅读 0赞

### 21.安装Dashboard ###

Kubernetes Dashboard 是 k8s集群的一个 WEB UI管理工具，代码托管在 github 上  
地址：https://github.com/kubernetes/dashboard  
提前准备docker 镜像，版本参见下文image的配置

#### 一、资源配置清单  ####

##### 1. RBAC `rbac.yaml` 查看 #####

创建`ServiceAccount`用于启动容器时使用的帐号  
`Role`、`RoleBinding`创建角色赋予dashbord相关权限，再绑定该role到serviceAccount上  
`ClusterRole`、`ClusterRoleBinding`创建clusterRole赋予pods、nodes的查看权限，绑定该role到serviceAccount上

##### 2.Configmap `configmap.yaml` 查看 #####

##### 3.Deployment `dp.yaml` 查看 #####

##### 4.Service `svc.yaml` 查看 #####

#### 二、登录dashboard ####

##### 1.token登录 #####

创建admintoken，用于token方式登录dashbord

kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: admin
      annotations:
        rbac.authorization.kubernetes.io/autoupdate: "true"
    roleRef:
      kind: ClusterRole
      name: cluster-admin
      apiGroup: rbac.authorization.k8s.io
    subjects:
    - kind: ServiceAccount
      name: admin
      namespace: kube-system
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: admin
      namespace: kube-system
      labels:
        kubernetes.io/cluster-service: "true"
        addonmanager.kubernetes.io/mode: Reconcile

apply rbac 使用上面部署dashboard时RBAC创建的ServiceAccount：kubernetes-dashboard应该也可以，获取token的方式下方一样

[root@node21 ~]# kubectl get secret -n kube-system|grep admin-token
    admin-token-s5vcp                        kubernetes.io/service-account-token   3      <invalid>
    [root@node21 ~]# kubectl get secrets admin-token-s5vcp -o jsonpath={.data.token} -n kube-system | base64 -d
    eyJhbGciOiJSU........这就是token，dashbord token登录粘贴这部分内容就可以了

![在这里插入图片描述][20210617195819657.gif]

##### 2.token导出到kubeconfig #####

…

#### 三、部署heapster ####

kubernetes-dashboard(1.8.3)部署与踩坑：https://www.cnblogs.com/RainingNight/p/deploying-k8s-dashboard-ui.html  
https://github.com/kubernetes-retired/heapster/tree/master/deploy/kube-config

#### 1. 获取镜像，并上传库 ####

`docker pull mirrorgooglecontainers/heapster-amd64:v1.5.4`  
修改tag并push到仓库

#### 2. 配置 ####

*  rbac.yaml

apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: heapster
      namespace: kubernetes-dashboard
    ---
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: heapster
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: system:heapster
    subjects:
      - kind: ServiceAccount
        name: heapster
        namespace: kubernetes-dashboard

*  dp.yaml

apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: heapster
      namespace: kubernetes-dashboard
    spec:
      replicas: 1
      selector:
        matchLabels:
          k8s-app: heapster
      template:
        metadata:
          labels:
            task: monitoring
            k8s-app: heapster
        spec:
          serviceAccountName: heapster
          containers:
            - name: heapster
              image: mirrorgooglecontainers/heapster-amd64:v1.5.4
              command:
                - /heapster
                - --source=kubernetes:https://kubernetes.default

*  svc.yaml

kind: Service
    apiVersion: v1
    metadata:
      labels:
        task: monitoring
        k8s-app: heapster
        kubernetes.io/cluster-service: "true"
        kubernetes.io/name: Heapster
      name: heapster
      namespace: kubernetes-dashboard
    spec:
      ports:
        - port: 80
          targetPort: 8082
      selector:
        k8s-app: heapster

#### 附录 ####

*   rbac.yaml  
    back to config list

# namespace
    kind: Namespace
    apiVersion: v1
    metadata:
      name: kubernetes-dashboard
    ---
    # serbice account
    kind: ServiceAccount
    apiVersion: v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
      namespace: kubernetes-dashboard
    ---
    kind: Role
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
      namespace: kubernetes-dashboard
    rules:
      # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
      - apiGroups: [""]
        resources: ["secrets"]
        resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
        verbs: ["get", "update", "delete"]
        # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
      - apiGroups: [""]
        resources: ["configmaps"]
        resourceNames: ["kubernetes-dashboard-settings"]
        verbs: ["get", "update"]
        # Allow Dashboard to get metrics.
      - apiGroups: [""]
        resources: ["services"]
        resourceNames: ["heapster", "dashboard-metrics-scraper"]
        verbs: ["proxy"]
      - apiGroups: [""]
        resources: ["services/proxy"]
        resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
        verbs: ["get"]
    ---
    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
    rules:
      # Allow Metrics Scraper to get metrics from the Metrics server
      - apiGroups: ["metrics.k8s.io"]
        resources: ["pods", "nodes"]
        verbs: ["get", "list", "watch"]
    ---
    kind: RoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
      namespace: kubernetes-dashboard
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: kubernetes-dashboard
    subjects:
      - kind: ServiceAccount
        name: kubernetes-dashboard
        namespace: kubernetes-dashboard
    ---
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: kubernetes-dashboard
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: kubernetes-dashboard
    subjects:
      - kind: ServiceAccount
        name: kubernetes-dashboard
        namespace: kubernetes-dashboard

*   configmap.yaml  
    back to config list

---
    apiVersion: v1
    kind: Secret
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard-certs
      namespace: kubernetes-dashboard
    type: Opaque
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard-csrf
      namespace: kubernetes-dashboard
    type: Opaque
    data:
      csrf: ""
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard-key-holder
      namespace: kubernetes-dashboard
    type: Opaque
    ---
    kind: ConfigMap
    apiVersion: v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard-settings
      namespace: kubernetes-dashboard

*   dp.yaml  
    back to config list

kind: Deployment
    apiVersion: apps/v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
      namespace: kubernetes-dashboard
    spec:
      replicas: 1
      # 允许保留RS历史的数量(历史RS可以用于回滚)
      revisionHistoryLimit: 10
      selector:
        matchLabels:
          k8s-app: kubernetes-dashboard
      template:
        metadata:
          labels:
            k8s-app: kubernetes-dashboard
        spec:
          containers:
            - name: kubernetes-dashboard
              image: kubernetesui/dashboard:v2.2.0
              imagePullPolicy: Always
              resources:
                # 资源最大限制，容器使用资源超限会OOM
                limits:
                  cpu: 100m
                  memory: 300Mi
                # 最少请求资源量，不配值默认和limits一致
                requests:
                  cpu: 50m
                  memory: 100Mi
              ports:
                - containerPort: 8443
                  protocol: TCP
              args:
                # 自动生成证书
                - --auto-generate-certificates
                - --namespace=kubernetes-dashboard
                # Uncomment the following line to manually specify Kubernetes API server Host
                # If not specified, Dashboard will attempt to auto discover the API server and connect
                # to it. Uncomment only if the default does not work.
                # - --apiserver-host=http://my-address:port
              # 容器的存活探针(一旦检测不通过，会停止该pod提供服务，重启pod)
              livenessProbe:
                httpGet:
                  scheme: HTTPS
                  path: /
                  port: 8443
                # 容器启动30s后启动检测
                initialDelaySeconds: 30
                # 探针执行间隔
                timeoutSeconds: 30
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                runAsUser: 1001
                runAsGroup: 2001
              volumeMounts:
                - name: kubernetes-dashboard-certs
                  mountPath: /certs
                  # Create on-disk volume to store exec logs
                - mountPath: /tmp
                  name: tmp-volume
          volumes:
            - name: kubernetes-dashboard-certs
              secret:
                secretName: kubernetes-dashboard-certs
            - name: tmp-volume
              emptyDir: {
        }
          serviceAccountName: kubernetes-dashboard
          nodeSelector:
            "kubernetes.io/os": linux
          # Comment the following tolerations if Dashboard must not be deployed on master
          tolerations:
            - key: node-role.kubernetes.io/master
              effect: NoSchedule
    ---
    kind: Deployment
    apiVersion: apps/v1
    metadata:
      labels:
        k8s-app: dashboard-metrics-scraper
      name: dashboard-metrics-scraper
      namespace: kubernetes-dashboard
    spec:
      replicas: 1
      revisionHistoryLimit: 10
      selector:
        matchLabels:
          k8s-app: dashboard-metrics-scraper
      template:
        metadata:
          labels:
            k8s-app: dashboard-metrics-scraper
          annotations:
            seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
        spec:
          containers:
            - name: dashboard-metrics-scraper
              image: kubernetesui/metrics-scraper:v1.0.6
              ports:
                - containerPort: 8000
                  protocol: TCP
              livenessProbe:
                httpGet:
                  scheme: HTTP
                  path: /
                  port: 8000
                initialDelaySeconds: 30
                timeoutSeconds: 30
              volumeMounts:
              - mountPath: /tmp
                name: tmp-volume
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                runAsUser: 1001
                runAsGroup: 2001
          serviceAccountName: kubernetes-dashboard
          nodeSelector:
            "kubernetes.io/os": linux
          # Comment the following tolerations if Dashboard must not be deployed on master
          tolerations:
            - key: node-role.kubernetes.io/master
              effect: NoSchedule
          volumes:
            - name: tmp-volume
              emptyDir: {
        }

*   svc.yaml  
    back to config list

---
    kind: Service
    apiVersion: v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
      namespace: kubernetes-dashboard
    spec:
      ports:
        - port: 443
          targetPort: 8443
      selector:
        k8s-app: kubernetes-dashboard
    ---
    kind: Service
    apiVersion: v1
    metadata:
      labels:
        k8s-app: dashboard-metrics-scraper
      name: dashboard-metrics-scraper
      namespace: kubernetes-dashboard
    spec:
      ports:
        - port: 8000
          targetPort: 8000
      selector:
        k8s-app: dashboard-metrics-scraper
    ---
    # 临时暴露nodePort服务用于验证，可以通过ingressRoute去暴露dashbord服务
    apiVersion: v1
    kind: Service
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard-nodeport
      namespace: kubernetes-dashboard
    spec:
      ports:
      - port: 8443
        protocol: TCP
        targetPort: 8443
        nodePort: 8001
      selector:
        k8s-app: kubernetes-dashboard
      type: NodePort

[20210617195819657.gif]: /images/20221005/2ab5dde65bdd4837b1c33f2051f4a719.png