Kubernetes1.13.1部署Kuberneted-dashboard v1.10.1版本

参考文档 

https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/#deploying-the-dashboard-ui
https://github.com/kubernetes/kubernetes/tree/7f23a743e8c23ac6489340bbb34fa6f1d392db9d/cluster/addons/dashboard
https://github.com/kubernetes/dashboard
https://blog.csdn.net/nklinsirui/article/details/80581286
https://github.com/kubernetes/dashboard/issues/3472

一、填坑

按照官网文档一条命令即可，但是国内显然不是这样，首先要填许多坑才行

坑一：Docker镜像

1、注册阿里云账户构建自己的镜像

可以关联github构建，这样就可以把国外镜像生成为阿里云镜像
https://github.com/minminmsn/k8s1.13/tree/master/kubernetes-dashboard-amd64/Dockerfile

2、下载docker镜像

docker pull registry.cn-beijing.aliyuncs.com/minminmsn/kubernetes-dashboard:v1.10.1

坑二：SSL证书

证书不对或者用auto创建的证书会报错，报错见https://github.com/kubernetes/dashboard/issues/3472

1、如果购买有的证书的话，把证书文件放在certs/目录下创建secret即可
[[email protected] /]# ls certs/
minminmsn.crt  minminmsn.csr  minminmsn.key

[[email protected] /]# kubectl create secret generic kubernetes-dashboard-certs --from-file=certs -n kube-system
secret/kubernetes-dashboard-certs created
2、如果没有购买的话需要自定义生成证书，步骤如下
[[email protected] /]# mkdir /certs
[[email protected] /]# openssl req -nodes -newkey rsa:2048 -keyout certs/dashboard.key -out certs/dashboard.csr -subj "/C=/ST=/L=/O=/OU=/CN=kubernetes-dashboard"
Generating a 2048 bit RSA private key
................+++
..............................................+++
writing new private key to ‘certs/dashboard.key‘
-----
No value provided for Subject Attribute C, skipped
No value provided for Subject Attribute ST, skipped
No value provided for Subject Attribute L, skipped
No value provided for Subject Attribute O, skipped
No value provided for Subject Attribute OU, skipped
[[email protected] /]# ls /certs
dashboard.csr  dashboard.key

[[email protected] /]# openssl x509 -req -sha256 -days 365 -in certs/dashboard.csr -signkey certs/dashboard.key -out certs/dashboard.crt
Signature ok
subject=/CN=kubernetes-dashboard
Getting Private key
[[email protected] /]# ls certs/
dashboard.crt  dashboard.csr  dashboard.key

[[email protected] /]# kubectl create secret generic kubernetes-dashboard-certs --from-file=certs -n kube-system
secret/kubernetes-dashboard-certs created

坑三：修改service配置，将type: ClusterIP改成NodePort,便于通过Node端口访问

[[email protected] /]# wget https://raw.githubusercontent.com/kubernetes/dashboard/master/aio/deploy/recommended/kubernetes-dashboard.yaml
[[email protected] /]# vim /k8s/yaml/kubernetes-dashboard.yaml
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kube-system
spec:
  type: NodePort
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard

二、部署Kubernetes-dashboard

修改镜像地址为registry.cn-beijing.aliyuncs.com/minminmsn/kubernetes-dashboard:v1.10.1即可部署

[[email protected] /]# vim /k8s/yaml/kubernetes-dashboard.yaml
    spec:
      containers:
      - name: kubernetes-dashboard
        image: registry.cn-beijing.aliyuncs.com/minminmsn/kubernetes-dashboard:v1.10.1

[[email protected] /]# kubectl create -f /k8s/yaml/kubernetes-dashboard.yaml
serviceaccount/kubernetes-dashboard created
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
deployment.apps/kubernetes-dashboard created
service/kubernetes-dashboard created
Error from server (AlreadyExists): error when creating "/k8s/yaml/kubernetes-dashboard.yaml": secrets "kubernetes-dashboard-certs" already exists

[[email protected] /]# kubectl get pods -n kube-system
NAME                                   READY   STATUS    RESTARTS   AGE
kubernetes-dashboard-cb55bd5bd-4jsh7   1/1     Running   0          21s
[[email protected] /]# kubectl get svc -n kube-system
NAME                   TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
kubernetes-dashboard   NodePort   10.254.140.115   <none>        443:41579/TCP   31s
[[email protected] /]# kubectl get pods -n kube-system -o wide
NAME                                   READY   STATUS    RESTARTS   AGE   IP            NODE        NOMINATED NODE   READINESS GATES
kubernetes-dashboard-cb55bd5bd-4jsh7   1/1     Running   0          40s   10.254.73.2   10.2.8.34   <none>           <none>

三、访问dashboard

1、注意有证书需要域名访问，如果有DNS可以配置域名解析，没有Host绑定即可
2、选择token访问，token获取方法如下
[[email protected] ~]# cat /k8s/yaml/admin-token.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: admin
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: admin
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: kube-system
  labels:
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
[[email protected] yaml]# kubectl create -f admin-token.yaml
clusterrolebinding.rbac.authorization.k8s.io/admin created
serviceaccount/admin created

[[email protected] yaml]#  kubectl describe secret/$(kubectl get secret -nkube-system |grep admin|awk ‘{print $1}‘) -nkube-system
Name:         admin-token-5j2vf
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: admin
              kubernetes.io/service-account.uid: 6b0b0c00-0b45-11e9-85fe-52540089b2b6

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1359 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi10b2tlbi01ajJ2ZiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJhZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjZiMGIwYzAwLTBiNDUtMTFlOS04NWZlLTUyNTQwMDg5YjJiNiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTphZG1pbiJ9.TkpDjrLRiulxgOjm6AWGeiCIRDHTeCUR87lme6cY4YnLFFyC1MTiw2JWvTYeksYvGcaEIlope97Don-zk5oNn5q1HYgwZeY844KXRyYSQ3vVlC1lg1xMvIZSrfLuK7ek-jHB_pAxE1S2KGfjg1srfdDRHBHgBEaOIMB6DrkJvVMI-hVHxtL5ctwCpZ1iIo1XVyu83SgMUz2HnVE1TST8NL-s0KtR0rnz-Ve4YvJZ1_Jj9hKvMblS_APWetcqT0Trsf-VuZgfKxuRcOmOkFFRKV-ZSwU7i9umQabIWhD6xZ7dTsvogGCx4o0kgBOLwrwj-pUbgAyu7pmbbAbjOJ06cQ

3、效果如下
https://k8s.minminmsn.com
输入token
eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi10b2tlbi01ajJ2ZiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJhZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjZiMGIwYzAwLTBiNDUtMTFlOS04NWZlLTUyNTQwMDg5YjJiNiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTphZG1pbiJ9.TkpDjrLRiulxgOjm6AWGeiCIRDHTeCUR87lme6cY4YnLFFyC1MTiw2JWvTYeksYvGcaEIlope97Don-zk5oNn5q1HYgwZeY844KXRyYSQ3vVlC1lg1xMvIZSrfLuK7ek-jHB_pAxE1S2KGfjg1srfdDRHBHgBEaOIMB6DrkJvVMI-hVHxtL5ctwCpZ1iIo1XVyu83SgMUz2HnVE1TST8NL-s0KtR0rnz-Ve4YvJZ1_Jj9hKvMblS_APWetcqT0Trsf-VuZgfKxuRcOmOkFFRKV-ZSwU7i9umQabIWhD6xZ7dTsvogGCx4o0kgBOLwrwj-pUbgAyu7pmbbAbjOJ06cQ

补充

Apiserver hosts绑定ip错误10.0.0.1应该是10.254.0.1，默认pods网端是10.254.0.0/16，其中10.254.0.1会用来kubenetes的clusterip
[[email protected] ~]# kubectl get svc --all-namespaces=true
NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
default kubernetes ClusterIP 10.254.0.1 <none> 443/TCP 6d1h

解决方法
×××文件重启apiserver服务即可（配置前多检查，否则后面会增加很多排错过程）

[[email protected] yaml]# kubectl logs kubernetes-dashboard-865b64d96f-g5f9t --namespace=kube-system
2018/12/29 07:49:44 Starting overwatch
2018/12/29 07:49:44 Using in-cluster config to connect to apiserver
2018/12/29 07:49:44 Using service account token for csrf signing
2018/12/29 07:49:44 Error while initializing connection to Kubernetes apiserver. This most likely means that the cluster is misconfigured (e.g., it has invalid apiserver certificates or service account‘s configuration) or the --apiserver-host param points to a server that does not exist. Reason: Get https://10.254.0.1:443/version: x509: certificate is valid for 10.0.0.1, 127.0.0.1, 10.2.8.44, 10.2.8.65, 10.2.8.34, not 10.254.0.1
Refer to our FAQ and wiki pages for more information: https://github.com/kubernetes/dashboard/wiki/FAQ

修改Hosts里10.0.0.1为10.254.0.1

[[email protected] ssl]# cat server-csr.json
{
    "CN": "kubernetes",
    "hosts": [
      "10.254.0.1",
      "127.0.0.1",
      "10.2.8.44",
      "10.2.8.65",
      "10.2.8.34",
      "kubernetes",
      "kubernetes.default",
      "kubernetes.default.svc",
      "kubernetes.default.svc.cluster",
      "kubernetes.default.svc.cluster.local"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O": "k8s",
            "OU": "System"
        }
    ]
}

同步证书并重启服务

[[email protected] ssl]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server
2018/12/29 15:57:02 [INFO] generate received request
2018/12/29 15:57:02 [INFO] received CSR
2018/12/29 15:57:02 [INFO] generating key: rsa-2048
2018/12/29 15:57:03 [INFO] encoded CSR
2018/12/29 15:57:03 [INFO] signed certificate with serial number 57756035754570455349189088480535470836534926573
2018/12/29 15:57:03 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").

[[email protected] ssl]# scp server-csr.json server.csr server-key.pem server.pem 10.2.8.65:$PWD
[[email protected] ssl]# scp server-csr.json server.csr server-key.pem server.pem 10.2.8.34:$PWD
[[email protected] ssl]# systemctl restart kube-apiserver
[[email protected] ssl]# systemctl restart kube-scheduler
[[email protected] ssl]# systemctl restart kube-controller-manager

原文地址：http://blog.51cto.com/jerrymin/2337940

时间： 2024-08-04 02:33:13

Kubernetes1.13.1部署Kuberneted-dashboard v1.10.1版本的相关文章

jquery.min.js v1.10.3版本autocomplete方法会在text前添加搜索出多少项的文本信息 要去除

http://stackoverflow.com/questions/13011127/how-to-remove-change-jquery-ui-autocomplete-helper-text How to remove/change JQuery UI Autocomplete Helper text? It seems that this is a new feature in JQuery UI 1.9.0, because I used JQuery UI plenty of ti

kubernetes1.13.1部署ingress-nginx并配置https转发dashboard

参考 https://github.com/kubernetes/ingress-nginx https://www.jianshu.com/p/e30b06906b77 https://github.com/kubernetes/ingress-nginx/issues/2474 https://www.cnblogs.com/zhangeamon/p/7007076.html https://github.com/kubernetes/kubernetes/issues/45324 http

Kubernetes 生产环境安装部署 基于 Kubernetes v1.14.0 之 部署规划

1. 安装规划 1.1 部署节点说明 etcd集群规划 etcd 中心集群 192.168.2.247192.168.2.248192.168.2.249 etcd 事件集群 192.168.2.250192.168.2.251192.168.2.252 Kubernetes master节点集群规划 192.168.3.10192.168.3.11192.168.3.12192.168.3.13192.168.3.14 Kubernetes master vip 192.168.4.1192.

[转帖]Breeze部署kubernetes1.13.2高可用集群

Breeze部署kubernetes1.13.2高可用集群 2019年07月23日 10:51:41 willblog 阅读数 673 标签: kubernetes 更多 个人分类: kubernetes https://blog.csdn.net/networken/article/details/86550735 所知道的太少了.. 不过简单试了下 不是特别好用 国内公司做的系统.. 也可能跟我的虚拟机兼容性有关系.. breeze简介 项目地址:https://github.com/wis

kubernetes V1.10.4 集群部署 (手动生成证书)

说明:本文档涉及docker镜像,yaml文件下载地址 链接:https://pan.baidu.com/s/1QuVelCG43_VbHiOs04R3-Q 密码:70q2 本文只是作为一个安装记录 1. 环境 1.1 服务器信息 主机名 IP地址 os 版本 节点 k8s01 172.16.50.131 CentOS Linux release 7.4.1708 (Core) master k8s02 172.16.50.132 CentOS Linux release 7.4.1708 (C

Ubuntu16.04安装kubernetes1.13集群

Ubuntu16.04安装kubernetes1.13集群 最新的安装可以使用以下方式:https://www.cnrancher.com/docs/rancher/v2.x/cn/overview/quick-start-guide 方便,快捷! 以下为正文. 前言 Docker容器化,虚拟化技术上的又一个猛将,可以极高提高软件部署的速度.运行一个Docker容器,这个容器作为一个进程分配了计算资源,不同容器之间资源隔离,仿佛每个容器都是一台机器, 并且通过宿主机网桥,可以模拟一个局域网.可以

kubeadm安装Kubernetes V1.10集群详细文档

1:服务器信息以及节点介绍 系统信息:centos1708 minimal    只修改IP地址 主机名称 IP 备注 node01 192.168.150.181 master and etcd rode02 192.168.150.182 master and etcd node03 192.168.150.183 master and etcd node04 192.168.150.184 node VIP 192.168.150.186 软件版本: docker17.03.2-ce so

k8s实践19:kubernetes二进制部署集群v1.12升级v1.15

1.升级前的版本 [[email protected] ~]# kubectl version Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.4", GitCommit:"5ca598b4ba5abb89bb773071ce452e33fb66339d", GitTreeState:"clean", BuildDa

基于centos6的mysql5.7.13主从部署（三）

基于centos6的mysql5.7.13主从部署(三) 主从测试 登入(主)mysql1 [[email protected] ~]# mysql -uroot -p123456 mysql> unlock tables;  #解锁,对应上一章节的表的锁死 mysql> use shiyan; mysql> show tables; 删除其中一个表: mysql> drop table engine_cost; 登入(从)mysql2 [[email protected] ~]#