创建Kubernetes仪表盘的安装和访问服务器服务

3 年 ago

清, 扬

3 minutes

首先

可以通过使用kubectl proxy或kubectl port-forward来访问Kubernetes仪表板，但执行这两个Kubectl命令都很麻烦。
因此，我们通过Service来实现访问。

环境

我正在使用Raspberry Pi 4安装Ubuntu 20.04，并在其上构建了一个Kubernetes环境，用于运行容器。前提条件是已经安装并创建了Metallb，并且已经建立了IP Pool。

Dashboard v2.0.4

安装 Dashboard v2

请注意，Dashboard v2中，命名空间从“kube-system”更改为“kubernetes-dashboard”。

此外，除了localhost之外的仪表盘将会通过https进行连接。
dashboard/README.md at master · kubernetes/dashboard – 登录不可用

在安装Dashboard时，请参考GitHub上的kubernetes/dashboard：用于Kubernetes集群的通用Web UI。

$ curl https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.4/aio/deploy/recommended.yaml -o dashboard.yaml
$ kubectl apply -f dashboard.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created
$ kubectl get pod -n kubernetes-dashboard    # 確認する
NAME                                         READY   STATUS    RESTARTS   AGE
dashboard-metrics-scraper-7b59f7d4df-bfgg7   1/1     Running   0          2m48s
kubernetes-dashboard-665f4c5ff-r8fcq         1/1     Running   0          2m48s

创建Dashboard账户。

请参考GitHub上的kubernetes/dashboard仓库中的dashboard/creating-sample-user.md文件，在其中创建ServiceAccount和ClusterRoleBinding。

$ vi dashboard-adminuser.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard
$ kubectl apply -f dashboard-adminuser.yaml
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user created
$ kubectl get serviceaccount/admin-user -n kubernetes-dashboard    # 確認する
NAME         SECRETS   AGE
admin-user   1         14s
$ kubectl get clusterrolebinding.rbac.authorization.k8s.io/admin-user -n kubernetes-dashboard    # 確認する
NAME         ROLE                        AGE
admin-user   ClusterRole/cluster-admin   29s

创建服务（负载均衡器）

前提是已经安装了Metallb并创建了IP Pool。
这是为了从IP Pool中获取Service的外部连接IP地址。
请注意，IP Pool中设定的范围为192.168.100.211～215。
有关Metallb的安装和配置，请参考LoadBalancer的安装说明。

$ vi dashboard_svc.yml
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: dashboard-service-lb # service(loadbalanser) の名前
  namespace: kubernetes-dashboard # namespace の名前
spec:
  type: LoadBalancer # minikube では未サポート
  ports:
    - name: dashboard-service-lb
      protocol: TCP
      port: 443 # serviceのIPでlistenするポート
      nodePort: 30085 # nodeのIPでlistenするポート（30000-32767）
      targetPort: 8443 # 転送先でlistenしているPort番号のポート
  selector: # service のselctorは、matchLabels になる
    k8s-app: kubernetes-dashboard # 転送先の pod のラベル
$ kubectl apply -f dashboard_svc.yml
service/dashboard-service-lb created
$ kubectl get svc -n kubernetes-dashboard    # 確認する
NAME                        TYPE           CLUSTER-IP       EXTERNAL-IP       PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP      10.102.76.63     <none>            8000/TCP        6m10s
dashboard-service-lb        LoadBalancer   10.106.221.180   192.168.100.212   443:30085/TCP   11s
kubernetes-dashboard        ClusterIP      10.98.194.70     <none>            443/TCP         6m11s

这是由dashboard-service-lb创建的服务。
EXTERNAL-IP（192.168.100.212）是在浏览器中连接的IP地址。
连接端口将使用dashboard_svc.yml文件中port的值（443）。

获得令牌

当你登录仪表盘时使用。

$ kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
Name:         admin-user-token-r8rvx
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: admin-user
              kubernetes.io/service-account.uid: ab2cbd16-4230-45be-8c80-415b529c3014

Type:  kubernetes.io/service-account-token

Data
====
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6ImczaFFpeTNzbVBIVzlad0EwUnJPdUFHOEY3THJvTzE3NVpIT2xfRFl2QVkifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLXI4cnZ4Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJhYjJjYmQxNi00MjMwLTQ1YmUtOGM4MC00MTViNTI5YzMwMTQiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.bSNGtb5xrUS_g-HEKdCakKd9WZqSi3D2YWkrLwgRvEWfFE6J6vkmPazPdwU28lPe4gL8q1xuNLshhBC9ENgPzzSqWnzGacnndCiA3AzhhAQ3XcHFXlw50S5vo3neACsbX3m5NfaSkUAHac8CXcVdnYkqghf3CqNW2dQPnhbvGAkGt9RpYC1wOyOkT8O7NgUCuLnPgGTi5bkCeu-Xann6UpLhHMSaN5reiXXeOhXNmqOQ0dfThtEiEUcJvWewCr4MuGuOe4-gnEulZjECkldzpWrjRwPhWafjPnrtP0DV4TMQEp4Ff2ZgVTz-ZNWmm1OA55B-eDB49ewLJzrFGCAcMg
ca.crt:     1066 bytes
namespace:  20 bytes

我会记录下token。