学习K8S之路.5--- K8S集群安装部署(四)

本篇讲解 K8S核心插件-仪表盘

一：部署kubernetes-dashboard

　　1：在运维主机(192.168.6.96)上准备dashboard镜像

　　　　dashboard镜像官方地址：https://github.com/kubernetes/dashboard

[root@k8s-6-96 ~]# docker pull k8scn/kubernetes-dashboard-amd64:v1.8.3
v1.8.3: Pulling from k8scn/kubernetes-dashboard-amd64
a4026007c47e: Pull complete 
Digest: sha256:ebc993303f8a42c301592639770bd1944d80c88be8036e2d4d0aa116148264ff
Status: Downloaded newer image for k8scn/kubernetes-dashboard-amd64:v1.8.3
docker.io/k8scn/kubernetes-dashboard-amd64:v1.8.3

[root@k8s-6-96 ~]# docker images|grep dashboard
k8scn/kubernetes-dashboard-amd64   v1.8.3                     fcac9aa03fd6        18 months ago       102MB

[root@k8s-6-96 ~]# docker tag fcac9aa03fd6  harbor.auth.com/public/dashboard:v1.8.3
[root@k8s-6-96 ~]# docker push harbor.auth.com/public/dashboard:v1.8.3
The push refers to repository [harbor.auth.com/public/dashboard.auth.com]
23ddb8cbb75a: Pushed 
v1.8.3: digest: sha256:ebc993303f8a42c301592639770bd1944d80c88be8036e2d4d0aa116148264ff size: 529

　　2：在运维主机(192.168.6.96)上创建资源配置清单

　　　　官方资源配置清单参考地址：https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard

[root@k8s-6-96 ~]# mkdir -p /data/k8s-yaml/dashboard && cd /data/k8s-yaml/dashboard

[root@k8s-6-96 ~]# vi /data/k8s-yaml/dashboard/rbac.yaml 
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kubernetes-dashboard
    addonmanager.kubernetes.io/mode: Reconcile
  name: kubernetes-dashboard-admin
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard-admin
  namespace: kube-system
  labels:
    k8s-app: kubernetes-dashboard
    addonmanager.kubernetes.io/mode: Reconcile
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard-admin
  namespace: kube-system

[root@k8s-6-96 ~]# vi /data/k8s-yaml/dashboard/dp.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kubernetes-dashboard
  namespace: kube-system
  labels:
    k8s-app: kubernetes-dashboard
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  selector:
    matchLabels:
      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
      priorityClassName: system-cluster-critical
      containers:
      - name: kubernetes-dashboard
        image: harbor.auth.com/public/dashboard:v1.8.3
        resources:
          limits:
            cpu: 100m
            memory: 300Mi
          requests:
            cpu: 50m
            memory: 100Mi
        ports:
        - containerPort: 8443
          protocol: TCP
        args:
          # PLATFORM-SPECIFIC ARGS HERE
          - --auto-generate-certificates
        volumeMounts:
        - name: tmp-volume
          mountPath: /tmp
        livenessProbe:
          httpGet:
            scheme: HTTPS
            path: /
            port: 8443
          initialDelaySeconds: 30
          timeoutSeconds: 30
      volumes:
      - name: tmp-volume
        emptyDir: {}
      serviceAccountName: kubernetes-dashboard-admin
      tolerations:
      - key: "CriticalAddonsOnly"
        operator: "Exists"

[root@k8s-6-96 ~]# vi /data/k8s-yaml/dashboard/svc.yaml 
apiVersion: v1
kind: Service
metadata:
  name: kubernetes-dashboard
  namespace: kube-system
  labels:
    k8s-app: kubernetes-dashboard
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  selector:
    k8s-app: kubernetes-dashboard
  ports:
  - port: 443
    targetPort: 8443

[root@k8s-6-96 ~]# vi /data/k8s-yaml/dashboard/ingress.yaml 
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kubernetes-dashboard
  namespace: kube-system
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: dashboard.auth.com
    http:
      paths:
      - backend:
          serviceName: kubernetes-dashboard
          servicePort: 443

　　3：在任意一台运算节点上应用资源配置清单

[root@k8s-6-94 ~]# kubectl apply -f http://k8s-yaml.auth.com/dashboard/rbac.yaml
serviceaccount/kubernetes-dashboard-admin created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-admin created

[root@k8s-6-94 ~]# kubectl apply -f http://k8s-yaml.auth.com/dashboard/dp.yaml
deployment.apps/kubernetes-dashboard created

[root@k8s-6-94 ~]# kubectl apply -f http://k8s-yaml.auth.com/dashboard/svc.yaml
service/kubernetes-dashboard created

[root@k8s-6-94 ~]# kubectl apply -f http://k8s-yaml.auth.com/dashboard/ingress.yaml
ingress.extensions/kubernetes-dashboard created

　　4：查看创建的资源

[root@k8s-6-94 ~]# kubectl get pods -n kube-system
NAME                                    READY   STATUS    RESTARTS   AGE
coredns-78544f475c-pz76k                1/1     Running   0          4d18h
kubernetes-dashboard-7ff945475d-qh4n7   1/1     Running   0          117m
traefik-ingress-4s8d4                   1/1     Running   0          2d
traefik-ingress-khzqc                   1/1     Running   2          2d

[root@k8s-6-94 ~]# kubectl get svc -n kube-system
NAME                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                  AGE
coredns                   ClusterIP   10.100.0.2       <none>        53/UDP,53/TCP,9153/TCP   4d18h
kubernetes-dashboard      ClusterIP   10.100.160.154   <none>        443/TCP                  117m
traefik-ingress-service   ClusterIP   10.100.1.245     <none>        80/TCP,8080/TCP          2d

[root@k8s-6-94 ~]# kubectl get ingress -n kube-system
NAME                   HOSTS                ADDRESS   PORTS   AGE
kubernetes-dashboard   dashboard.auth.com             80      118m
traefik-web-ui         traefik.auth.com               80      2d

　　5：在DNS服务器(192.168.6.92)上解析域名

[root@k8s-6-92 ~]# vi /var/named/auth.com.zone
# 添加一条A记录，并修改serial序列号，进行 + 1
dashboard           A    192.168.6.89
重启named服务，并验证
[root@k8s-6-92 ~]# systemctl restart named
[root@k8s-6-92 ~]# dig -t A dashboard.auth.com @192.168.6.92 +short
192.168.6.89

注意：生产上不建议直接restart named，建议rndc 来 reload

　　6：浏览器访问

 

 注意：dashboardv1.8.3直接可以跳过，需要升级更高版本，拿令牌登陆，需要https，上图也可以看到，现实不安全的连接

//令牌命令行获取方式：

[root@k8s-6-95 ~]# kubectl get secret -n kube-system
NAME                                     TYPE                                  DATA   AGE
coredns-token-dspsm                      kubernetes.io/service-account-token   3      4d18h
default-token-txvfn                      kubernetes.io/service-account-token   3      7d21h
kubernetes-dashboard-admin-token-jgp9f   kubernetes.io/service-account-token   3      125m
kubernetes-dashboard-key-holder          Opaque                                2      125m
traefik-ingress-controller-token-bt4k7   kubernetes.io/service-account-token   3      2d


[root@k8s-6-95 ~]# kubectl describe secret kubernetes-dashboard-admin-token-jgp9f -n kube-system
Name:         kubernetes-dashboard-admin-token-jgp9f
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: kubernetes-dashboard-admin
              kubernetes.io/service-account.uid: 1c50fc4a-add5-489d-bcb9-9c3b53f8dfc4

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1338 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9
zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVz
LWRhc2hib2FyZC1hZG1pbi10b2tlbi1qZ3A5ZiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRh
c2hib2FyZC1hZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjFjNTBmYzRhLWFkZDUtNDg5ZC1iY2I5LTljM2I1M2
Y4ZGZjNCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTprdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbiJ9.QDEWUWzAMTwr49eW1aVmy05vEl2
b0SNm96ynJIlXAZLTV_Ew7EzFK7dbtxamW__VU8gPgpxcfmUF1zhlLnEfOhUgoFjKz1-BoCuij1dUwiSOVYU7qMb5CTCsR8Ph7lag5yg0qXEgbAI53dfgmW5067hI9WqDe
JeQ-QWoxuSQjREll6gewmrQNTsdKZW58-Xh9VZmrxk9tOBy7NTfjkPjX9izsxD0L6JcZYoj0WNlyZy_mrkUWp0bODePuiRYhpKHbaLOFV6Dv4dI2XUdULYltUYUuWZ6q3S
hcAdpH8yKJX7vP_ir73l9acaqo-Q97JQ8eUlZpKTgASKbnoA_12QC2w

　　7：在运维主机(192.168.6.96)上使用cfssl进行自签证书

setp1：找一个json文件然后修改域名
[root@k8s-6-96 ~]# cd /opt/certs/
[root@k8s-6-96 certs]# cp client-csr.json  auth.com-csr.json
[root@k8s-6-96 certs]# vi auth.com-csr.json
{
    "CN": "*.auth.com",
    "hosts": [
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "beijing",
            "L": "beijing",
            "O": "od",
            "OU": "ops"
        }
    ]
}
setp2：签发
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server auth.com-csr.json|cfssl-json -bare auth.com

setp3：查看生成的证书
[root@k8s-6-96 certs]# ls -l
-rw-r--r-- 1 root root  993 Nov 30 14:02 auth.com.csr
-rw-r--r-- 1 root root  280 Nov 30 13:58 auth.com-csr.json
-rw------- 1 root root 1679 Nov 30 14:02 auth.com-key.pem
-rw-r--r-- 1 root root 1363 Nov 30 14:02 auth.com.pem

　　8：在代理节点(192.168.6.92和192.168.6.93)上Nginx配置证书服务，

setp1:创建目录，拷贝证书
[root@k8s-6-92 ~]# mkdir /usr/local/nginx/conf/keys
[root@k8s-6-92 ~]# cd /usr/local/nginx/conf/keys

[root@k8s-6-92 keys]# scp 192.168.6.96:/opt/certs/auth.com-key.pem .
[root@k8s-6-92 keys]# scp 192.168.6.96:/opt/certs/auth.com.pem .

[root@k8s-6-92 keys]# ll
-rw------- 1 root root 1679 5月  11 16:29 auth.com-key.pem
-rw-r--r-- 1 root root 1350 5月  11 16:29 auth.com.pem

setp2:配置Nginx
[root@k8s-6-92 ~]# cd /usr/local/nginx/conf/vhosts
[root@k8s-6-92 vhosts]# vi dashboard.auth.com.conf 
server {
    listen       80;
    server_name  dashboard.auth.com;

    rewrite ^(.*)$ https://${server_name}$1 permanent;
}

server {
    listen       443 ssl;
    server_name  dashboard.auth.com;

    ssl_certificate /usr/local/nginx/conf/keys/auth.com.pem;
    ssl_certificate_key /usr/local/nginx/conf/keys/auth.com-key.pem;
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://default_backend_traefik;
        proxy_set_header Host       $http_host;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
    }
}

setp3：检查Nginx
[root@k8s-6-92 vhosts]# /usr/local/nginx/sbin/nginx -t
[root@k8s-6-92 vhosts]# /usr/local/nginx/sbin/nginx -s reload

　　9：浏览器测试访问：https://dashboard.auth.com/

　　10：找一个令牌进行测试

[root@k8s-6-95 ~]# kubectl get secret -n kube-system
NAME                                     TYPE                                  DATA   AGE
coredns-token-dspsm                      kubernetes.io/service-account-token   3      4d19h
default-token-txvfn                      kubernetes.io/service-account-token   3      7d22h
kubernetes-dashboard-admin-token-jgp9f   kubernetes.io/service-account-token   3      147m
kubernetes-dashboard-key-holder          Opaque                                2      147m
traefik-ingress-controller-token-bt4k7   kubernetes.io/service-account-token   3      2d1h
[root@k8s-6-95 ~]# 
[root@k8s-6-95 ~]# kubectl describe secret kubernetes-dashboard-admin-token-jgp9f -n kube-system
Name:         kubernetes-dashboard-admin-token-jgp9f
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: kubernetes-dashboard-admin
              kubernetes.io/service-account.uid: 1c50fc4a-add5-489d-bcb9-9c3b53f8dfc4

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1338 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3Vud
C9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbi
10b2tlbi1qZ3A5ZiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbiIsImt1
YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjFjNTBmYzRhLWFkZDUtNDg5ZC1iY2I5LTljM2I1M2Y4ZGZjNCIsInN1YiI6InN5c3
RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTprdWJlcm5ldGVzLWRhc2hib2FyZC1hZG1pbiJ9.QDEWUWzAMTwr49eW1aVmy05vEl2b0SNm96ynJIlXAZLTV_Ew7Ez
FK7dbtxamW__VU8gPgpxcfmUF1zhlLnEfOhUgoFjKz1-BoCuij1dUwiSOVYU7qMb5CTCsR8Ph7lag5yg0qXEgbAI53dfgmW5067hI9WqDeJeQ-QWoxuSQjREll6gewmrQN
TsdKZW58-Xh9VZmrxk9tOBy7NTfjkPjX9izsxD0L6JcZYoj0WNlyZy_mrkUWp0bODePuiRYhpKHbaLOFV6Dv4dI2XUdULYltUYUuWZ6q3ShcAdpH8yKJX7vP_ir73l9ac
aqo-Q97JQ8eUlZpKTgASKbnoA_12QC2w

　　粘贴token登陆