1.环境描述

其余细节环境和上一篇文章一样
https://blog.csdn.net/AtlanSI/article/details/87946010

主机名	IP	集群角色
C7-1	192.168.8.70	master
C7-2	192.168.8.71	node1
C7-3	192.168.8.72	node2

2.安装dashboard

访问dashboard项目官方地址：https://github.com/kubernetes/dashboard

2.1 在master上执行如下命令

[root@C7-1 ~]# kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml

查看一下pod的运行状况

[root@C7-1 ~]# kubectl get pods -n kube-system
NAME                                   READY   STATUS    RESTARTS   AGE
coredns-86c58d9df4-r7kp9               1/1     Running   196        15d
coredns-86c58d9df4-sfwmp               1/1     Running   199        15d
etcd-c7-1                              1/1     Running   13         15d
kube-apiserver-c7-1                    1/1     Running   16         15d
kube-controller-manager-c7-1           1/1     Running   16         15d
kube-flannel-ds-amd64-h7kmx            1/1     Running   19         15d
kube-flannel-ds-amd64-jxpdq            1/1     Running   13         15d
kube-flannel-ds-amd64-r2pm6            1/1     Running   16         15d
kube-proxy-7sh9j                       1/1     Running   12         15d
kube-proxy-qpb99                       1/1     Running   16         15d
kube-proxy-tt2c4                       1/1     Running   14         15d
kube-scheduler-c7-1                    1/1     Running   17         15d
kubernetes-dashboard-57df4db6b-bqj5p   1/1     Running   0          8s

查看一下dashboard的pod运行状况，为Running，即可开始后续操作。如显示ImagePullError，进入下方操作
在K8S集群的所有node节点上运行如下命令

[root@C7-2 ~]# docker pull mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1
[root@C7-2 ~]# docker tag mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1 k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1


[root@C7-3 ~]# docker pull mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1
[root@C7-3 ~]# docker tag mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1 k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1

2.2 配置Service

查看创建时的yaml文件发现，默认没有将端口发布出去
于是才用打补丁的方式，将dashboard的端口发布出去

[root@C7-1 ~]# kubectl get svc -n kube-system
NAME                   TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
kube-dns               ClusterIP   10.96.0.10       <none>        53/UDP,53/TCP   15d
kubernetes-dashboard   ClusterIP   10.106.249.245   <none>        443/TCP   10m


[root@C7-1 ~]# kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kube-system



[root@C7-1 ~]# kubectl get svc -n kube-system
NAME                   TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
kube-dns               ClusterIP   10.96.0.10       <none>        53/UDP,53/TCP   15d
kubernetes-dashboard   NodePort    10.106.249.245   <none>        443:30115/TCP   147m

2.3 测试访问

浏览器输入https://集群任意IP:端口号
注意是https
到了此步骤可以发现K8S dashboard一共有两种登陆方式，本文会介绍两种方式

3.认证配置

3.1 令牌方式

== 认证时的账号必须为ServiceAccount：被dashboard pod拿来由kubernetes进行认证==

3.1.1 集权全部权限

3.1.1.1 创建ServiceAccount

[root@C7-1 ~]# kubectl create serviceaccount dashboard-admin -n kube-system

3.1.1.2 绑定相关role

[root@C7-1 ~]# kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin

• –clusterrole:指定使用的集群角色,系统默认自带很多，
• –serviceaccount：指定认证使用的ServiceAccount,由第一步创建

3.1.1.3 获取ServiceAccount使用的Secret

[root@C7-1 ~]# kubectl describe sa dashboard-admin -n kube-system
Name:                dashboard-admin
Namespace:           kube-system
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   dashboard-admin-token-vfgqh
Tokens:              dashboard-admin-token-vfgqh
Events:              <none>

由此可知 dashboard-admin-token-vfgqh为使用的Secret

3.1.1.4 获取token

[root@C7-1 ~]# kubectl describe secret dashboard-admin-token-vfgqh  -n kube-system
Name:         dashboard-admin-token-vfgqh
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 3669b2a5-458d-11e9-aa4f-000c29724115

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tdmZncWgiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMzY2OWIyYTUtNDU4ZC0xMWU5LWFhNGYtMDAwYzI5NzI0MTE1Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.Gzu_tcSftPD5i8n_cQGeDn46HIAS75CfzbBcp3LVh2hpDwayVr7VdWVt_F3sLYAkOCfAzuGurC7Dby_4dTw18x1AuRJL1PGR5oklvzqTj5kmiF0ek6jDb6tl6OkMVSka5xFZMbaLkX48fs8M5SQbi1GtshAC1AKKY6vzirHccB0Rjzpb_qRqii83-azjXFmsR-V5mlMxaI9z1YhCXX95-IAvoVVVHOzQ1b4MP88oVOJ8Z34vj2x1hu4mUWaQbBFvZNQzJdkdB7Ez9F2OeV-HPrpzF0McQW34jrgFSToiH06t_zK3NANLN-f7z2Sqs-VgXCta91l_pfmSkle6YPpZWA

上方命令输出的最后一行，即是认证token，全部复制到登陆页面即可登陆

3.1.1.5 验证

3.1.2 部分权限

此处使用RBAC中rolebinding的特性

3.1.2.1 创建ServiceAccount

[root@C7-1 ~]# kubectl create serviceaccount def-ns-admin

3.1.2.2 绑定相关role

[root@C7-1 ~]# kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin

3.1.2.3 获取ServiceAccount使用的Secret

[root@C7-1 ~]# kubectl get sa
NAME           SECRETS   AGE
admin          1         3d7h
def-ns-admin   1         20m
default        1         15d
[root@C7-1 ~]# kubectl describe sa def-ns-admin
Name:                def-ns-admin
Namespace:           default
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   def-ns-admin-token-c2d99
Tokens:              def-ns-admin-token-c2d99
Events:              <none>

由此可知 def-ns-admin-token-c2d99 为使用的Secret

3.1.2.4 获取token

[root@C7-1 ~]# kubectl describe secret def-ns-admin-token-c2d99
Name:         def-ns-admin-token-c2d99
Namespace:    default
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: def-ns-admin
              kubernetes.io/service-account.uid: 60f41626-458e-11e9-aa4f-000c29724115

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  7 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi1jMmQ5OSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI2MGY0MTYyNi00NThlLTExZTktYWE0Zi0wMDBjMjk3MjQxMTUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.hOdcw0vu8oqE4ACXVwSEXWGe6ZS_lKUUeiWbRBZGM_Us0cY_6eriL-T0ru6kbEpUe3vnynBylaf9cIGroG99Jn8dycaYF_HIxOeCyMntUWJAnOa5ab1qUENrihi2sbCt7VmKNzBWCSYHvycpWwSD-4quDE3FRRxdCXwLjJQNI3w7S_S7MZOS0haRWaS6ax9Opkrh7eUaqA--iSdiZ421F7_GiM44oJbCEkT9MxwLwwegE22tl022qpkAzpngDtxV11ZvjCimKFGFSwJrtNLxLhzwgX24dCUw47iuLcAm97eNDMjO-C3MuM05kYU2gOm7A1mBTIBaKd-Hlc4v2-_LEA

上方命令输出的最后一行，即是认证token，全部复制到登陆页面即可登陆

3.1.2.5 验证

3.2 kubeconfig认证方式

此认证方式相对麻烦，此处才用RBAC中的特性set-credentials
如果不适用上述方式，则需要使用k8s的ca对新用户进行签证，Secret中使用签发的证书
此处才用上方部分权限中的token
为了省事，此处直接才用上方的SeriveAccount
如不想使用，请重复上方 创建ServiceAccount 绑定相关role 获取ServiceAccount使用的Secret

3.2.1 获取解码后的token

[root@C7-1 ~]#  DEF_NS_ADMIN_SECRET=$(kubectl get secret def-ns-admin-token-c2d99 -o jsonpath={.data.token} | base64 -d )

3.2.2 生成配置文件

 [root@C7-1 ~]#  kubectl config set-cluster kubernetes --kubeconfig=/root/def-ns-admin.conf
 #设置集群 保存到文件
 [root@C7-1 ~]#  kubectl config set-credentials def-ns-admin --token=$DEF_NS_ADMIN_SECRET --kubeconfig=/root/def-ns-admin.conf
 #设置用户，credentials 保存到文件
 [root@C7-1 ~]#  kubectl config set-context def-ns-admin@kubernetes --cluster=kubernetes --user=def-ns-admin --kubeconfig=/root/def-ns-admin.conf
 #设置用户和集群的关系 保存到文件
 [root@C7-1 ~]#  kubectl config use-context def-ns-admin@kubernetes --kubeconfig=/root/def-ns-admin.conf
 #设置使用那个用户 保存到文件

将文件复制出来

3.2.3 验证