K8s第八篇Kubernetes-Dashboard

Kubernetes-Dashboard Kubernetes Dashboard就是k8s集群的WEBUI，集合了所有命令行可以操作的所有命令。Kubernetes Dashboard功能：部署容器化的应用。监控应用的状态。执行故障排查任务。管理Kubernetes各种资源。监控集群节点的硬件资源状态。Github：https://github.com/kubernetes/...

IT运维民工

1623人浏览 · 2020-01-02 17:53:43

IT运维民工 · 2020-01-02 17:53:43 发布

Kubernetes-Dashboard

Kubernetes Dashboard就是k8s集群的WEBUI，集合了所有命令行可以操作的所有命令。

Kubernetes Dashboard功能：

部署容器化的应用。
监控应用的状态。
执行故障排查任务。
管理Kubernetes各种资源。
监控集群节点的硬件资源状态。

Github：https://github.com/kubernetes/dashboard

部署Kubernetes-Dashboard：

k8smatser：

[root@k8smaster kubernetes-dashboard]# wget  https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
--2020-01-02 14:39:49--  http://et/
Resolving et (et)... failed: Name or service not known.
wget: unable to resolve host address ‘et’
--2020-01-02 14:39:49--  https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.108.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4577 (4.5K) [text/plain]
Saving to: ‘kubernetes-dashboard.yaml’

100%[=================================================================================================>] 4,577       --.-K/s   in 0s      

2020-01-02 14:39:50 (65.7 MB/s) - ‘kubernetes-dashboard.yaml’ saved [4577/4577]

FINISHED --2020-01-02 14:39:50--
Total wall clock time: 1.3s
Downloaded: 1 files, 4.5K in 0s (65.7 MB/s)
[root@k8smaster kubernetes-dashboard]# ls
kubernetes-dashboard.yaml
[root@k8smaster kubernetes-dashboard]# ls
kubernetes-dashboard.yaml
[root@k8smaster kubernetes-dashboard]# kubectl apply -f kubernetes-dashboard.yaml 
secret/kubernetes-dashboard-certs created
serviceaccount/kubernetes-dashboard created
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
deployment.apps/kubernetes-dashboard created
service/kubernetes-dashboard created
[root@k8smaster kubernetes-dashboard]# kubectl patch svc kubernetes-dashboard -n kube-system -p '{"spec":{"type":"NodePort"}}' 
service/kubernetes-dashboard patched
[root@k8smaster kubernetes-dashboard]# kubectl get svc -n kube-system
NAME                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                  AGE
kube-dns                  ClusterIP   10.96.0.10       <none>        53/UDP,53/TCP,9153/TCP   65d
kubernetes-dashboard      NodePort    10.104.129.230   <none>        443:30152/TCP            2m13s
traefik-ingress-service   ClusterIP   10.102.130.108   <none>        80/TCP,8080/TCP          16d
traefik-web-ui            ClusterIP   10.98.71.71      <none>        80/TCP                   16d

#镜像下载失败，使用阿里云的镜像源。
[root@k8smaster kubernetes-dashboard]# docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
v1.10.1: Pulling from google_containers/kubernetes-dashboard-amd64
9518d8afb433: Pull complete 
Digest: sha256:0ae6b69432e78069c5ce2bcde0fe409c5c4d6f0f4d9cd50a17974fea38898747
Status: Downloaded newer image for registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
[root@k8smaster kubernetes-dashboard]# docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1  k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1

k8snode1：

[root@k8snode1 kubernetes-dashboard]# docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
v1.10.1: Pulling from google_containers/kubernetes-dashboard-amd64
9518d8afb433: Pull complete 
Digest: sha256:0ae6b69432e78069c5ce2bcde0fe409c5c4d6f0f4d9cd50a17974fea38898747
Status: Downloaded newer image for registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
[root@k8snode1 kubernetes-dashboard]# docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1  k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1

k8snode2：

[root@k8snode2 kubernetes-dashboard]# docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
v1.10.1: Pulling from google_containers/kubernetes-dashboard-amd64
9518d8afb433: Pull complete 
Digest: sha256:0ae6b69432e78069c5ce2bcde0fe409c5c4d6f0f4d9cd50a17974fea38898747
Status: Downloaded newer image for registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1
[root@k8snode2 kubernetes-dashboard]# docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.10.1  k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1

自建证书（默认的证书有问题，气死了！！！）

k8smatser：

[root@k8smaster kubernetes-dashboard]# mkdir tls
[root@k8smaster kubernetes-dashboard]# cd tls/
[root@k8smaster tls]# openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
...............................+++
....................................................+++
e is 65537 (0x10001)
[root@k8smaster tls]# openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj "/C=CN/ST=HB/L=WH/O=DM/OU=YPT/CN=CA"
[root@k8smaster tls]# openssl x509 -in ca.crt -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            88:42:bb:1b:0e:f9:2d:a4
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=HB, L=WH, O=DM, OU=YPT, CN=CA
        Validity
            Not Before: Jan  2 07:13:02 2020 GMT
            Not After : Dec 30 07:13:02 2029 GMT
        Subject: C=CN, ST=HB, L=WH, O=DM, OU=YPT, CN=CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b3:d7:15:32:f9:b0:3e:36:89:a9:70:a2:aa:ae:
                    12:5c:6a:6c:3f:12:6f:1d:9c:dc:18:cf:c2:40:c3:
                    81:8c:86:0c:fd:bb:24:e6:6c:aa:c1:b3:d4:45:52:
                    57:f5:88:ef:aa:74:af:a1:d1:a6:c4:fa:06:63:df:
                    78:41:69:a8:77:ae:a8:58:d0:11:e9:48:30:ea:a3:
                    6f:ac:e6:06:a6:75:fa:f0:48:9a:c4:96:ab:90:bd:
                    d6:eb:0c:7a:a1:4e:6b:c6:bd:0b:93:74:f6:3f:d2:
                    94:22:87:df:a2:dc:65:0f:aa:b1:45:e3:31:e3:14:
                    98:9a:b3:39:91:dd:83:05:7e:61:cd:ec:28:27:00:
                    46:78:1b:cc:df:69:ee:9f:7f:3d:42:4a:65:b2:e3:
                    b3:e5:f2:20:47:f0:88:06:6b:57:3d:2d:f1:93:12:
                    8a:17:a5:be:75:bf:73:2f:98:c4:83:02:7f:28:56:
                    0d:63:18:b0:eb:74:7b:33:e2:03:15:bf:51:74:0d:
                    2b:2f:3c:09:47:d6:cf:6b:3b:3d:08:d7:1e:a5:8d:
                    1a:79:f8:49:14:e6:69:7c:67:f3:a8:a4:3d:9f:e2:
                    6b:4f:cc:95:d5:98:f7:65:e8:cb:94:d3:18:3f:c7:
                    5d:59:a8:ac:c4:9f:84:ce:40:2b:c6:81:05:f6:82:
                    b2:b5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                15:A7:E8:46:43:30:3C:43:02:75:13:98:67:CA:4F:02:53:44:89:4C
            X509v3 Authority Key Identifier: 
                keyid:15:A7:E8:46:43:30:3C:43:02:75:13:98:67:CA:4F:02:53:44:89:4C

            X509v3 Basic Constraints: 
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
        a4:87:5b:55:67:b5:6a:a6:b6:6a:ae:07:b1:36:85:9c:be:ec:
        08:53:74:15:56:9b:a0:5a:99:73:ee:6a:ff:10:b1:11:ff:c7:
        e0:9c:15:a5:f8:fb:3e:23:45:e9:de:c6:8f:f2:20:8c:56:21:
        a4:0e:51:c9:61:80:35:9a:39:54:81:b2:48:ae:11:70:e8:85:
        0c:fc:8f:0e:67:99:22:76:f3:65:3c:30:c4:b6:b4:79:da:99:
        0b:0d:54:b2:eb:1f:c3:89:b0:e7:80:36:fc:01:57:87:7b:d9:
        7d:4c:85:24:3c:53:38:d0:62:9c:68:c6:12:7d:0a:97:23:ea:
        ba:dc:a2:11:d0:54:28:81:83:c7:55:f8:91:cf:eb:43:41:f3:
        d3:de:19:0f:55:8d:18:91:2d:5f:ab:44:66:83:08:78:db:04:
        46:55:17:96:a1:2b:f0:39:e8:48:4b:88:2a:09:b8:62:fc:50:
        13:d1:27:46:0a:de:b3:2d:c4:58:c2:0c:45:cf:8d:3b:69:32:
        a5:d8:fd:97:7e:cb:f4:1d:00:ed:bb:24:40:eb:ec:7f:09:6f:
        06:eb:db:52:f1:70:88:8b:ad:4f:0e:af:bb:a4:56:29:e7:bd:
        42:e4:f0:a7:31:df:6b:2c:bd:8b:30:96:22:b0:56:76:fa:20:
        a7:ff:4b:22
[root@k8smaster tls]# openssl genrsa -out dashboard.key 2048
Generating RSA private key, 2048 bit long modulus
.....................................................................+++
.....................................................................................    ................................................................................................................+++
e is 65537 (0x10001)
[root@k8smaster tls]# cat >  dashboard.cnf  <<EOF
> extensions = san
> [san]
> keyUsage = digitalSignature
> extendedKeyUsage = clientAuth,serverAuth
> subjectKeyIdentifier = hash
> authorityKeyIdentifier = keyid,issuer
> subjectAltName = IP:$ip,IP:127.0.0.1,DNS:$ip,DNS:localhost
> EOF
[root@k8smaster tls]# openssl x509 -req -sha256 -days 3650 -in dashboard.csr -out dashboard.crt -CA ca.crt -CAkey ca.key -CAcreateserial -extfile dashboard.cnf
Signature ok
subject=/C=CN/ST=HB/L=WH/O=DM/OU=YPT/CN=192.168.43.136
Getting CA Private Key
[root@k8smaster tls]# cd ../
[root@k8smaster kubernetes-dashboard]# kubectl create secret generic     kubernetes-dashboard-certs --from-file="tls/dashboard.crt,tls/dashboard.key" -n kube-system 
[root@k8smaster kubernetes-dashboard]# kubectl delete -f kubernetes-dashboard.yaml 
secret "kubernetes-dashboard-certs" deleted
serviceaccount "kubernetes-dashboard" deleted
role.rbac.authorization.k8s.io "kubernetes-dashboard-minimal" deleted
rolebinding.rbac.authorization.k8s.io "kubernetes-dashboard-minimal" deleted
deployment.apps "kubernetes-dashboard" deleted
service "kubernetes-dashboard" deleted
[root@k8smaster kubernetes-dashboard]# kubectl create secret generic kubernetes-dashboard-certs --from-file="tls/dashboard.crt,tls/dashboard.key" -n kube-system 
secret/kubernetes-dashboard-certs created
[root@k8smaster kubernetes-dashboard]# kubectl apply -f kubernetes-dashboard.yaml 
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
secret/kubernetes-dashboard-certs configured
serviceaccount/kubernetes-dashboard created
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
deployment.apps/kubernetes-dashboard created
service/kubernetes-dashboard created
[root@k8smaster kubernetes-dashboard]# kubectl patch svc kubernetes-dashboard -n kube-system -p '{"spec":{"type":"NodePort"}}' 
service/kubernetes-dashboard patched
[root@k8smaster kubernetes-dashboard]# kubectl get svc -n kube-system
NAME                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                  AGE
kube-dns                  ClusterIP   10.96.0.10       <none>        53/UDP,53/TCP,9153/TCP   65d
kubernetes-dashboard      NodePort    10.107.167.69    <none>        443:31733/TCP            63s
traefik-ingress-service   ClusterIP   10.102.130.108   <none>        80/TCP,8080/TCP          16d
traefik-web-ui            ClusterIP   10.98.71.71      <none>        80/TCP                   16d

认证：

token：通过集群中认证的ServiceAccount的Token值来进行认证。
- 创建ServiceAccount，根据其管理目标，使用rolebinding或clusterrolebinding绑定到合理的role或者clusterrole。
- 获取到此ServiceAccount的secret，查看secret的Token值。
kubeconfig：
- 创建ServiceAccount，根据其管理目标，使用rolebinding或clusterrolebinding绑定到合理的role或者clusterrole。
- 通过“DEF_NS_ADMIN_TOKEN=$(kubectl get secret SERVICEACCOUNT_SECRET_NAME -o jsonpath={.data.token} | base64 -d) ”这条命令定义DEF_NS_ADMIN_TOKEN变量为ServiceAccount的secret的Token值。
- 生成kubeconfig文件。
  - kubectl config set-credentials def-ns-admin --token=$DEF_NS_ADMIN_TOKEN --kubeconfig=/root/def-ns-admin.conf
  - kubectl config set-context def-ns-admin@kubernetes --cluster=kubernetes --user=def-ns-admin --kubeconfig=/root/def-ns-admin.conf
  - kubectl config use-context def-ns-admin@kubernetes --kubeconfig=/root/def-ns-admin.conf

创建ServiceAccount（提供token认证）：

#创建一个ServiceAccount，绑定到cluster-admin，让它具有对整个k8s集群的控制权限
[root@k8smaster kubernetes-dashboard]# kubectl create serviceaccount dashboard-admin -n kube-system
serviceaccount/dashboard-admin created
[root@k8smaster kubernetes-dashboard]# kubectl create clusterrolebinding dashboard-cluster-admin  --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
clusterrolebinding.rbac.authorization.k8s.io/dashboard-cluster-admin created
[root@k8smaster kubernetes-dashboard]# kubectl describe secret dashboard-admin-token-txf8r  -n kube-system
Name:         dashboard-admin-token-txf8r
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 9f4cd171-7eba-4df8-9bcf-c80c92067769

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tdHhmOHIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiOWY0Y2QxNzEtN2ViYS00ZGY4LTliY2YtYzgwYzkyMDY3NzY5Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.rzA3VSSEwcSljh-33jk0bJ7WbHJwi7q2FQnEavhi21GQ_aezI0Bmww1T9R02tlIHALFhHbbAXAyDxmGmbMR6IZyrgAFrUc4ici-KCkh0_u9XSRIH-GhJPBbjyHohMsJFSeLaM4IEI6MaxYVIMujJwe-yizyyO59ou3VmVtORQKMB3BIodY_uVx7mLruppdlmybiMwi3uDKhIPCJZvLN8Nbu4bAHw-8LWWpbN0kzqCoYR12QD4Mtx47HxbEqp_Jv79oOaqfBJlYxKxijZE39t0wGN7WGRaqpRHM7nYMWg9WSNN6FOWlhQGcp5q-auIlx4GzNjeDENj1qAAiTOPwXSrg

复制dashboard-admin-token-txf8r的Token，粘贴到此处：

创建一个认证文件：

#创建一个serviceaccount，并把它绑定到admin，只具有default名称空间的管理权限。
[root@k8smaster kubernetes-dashboard]# kubectl create serviceaccount def-ns-admin -n default 
serviceaccount/def-ns-admin created
[root@k8smaster kubernetes-dashboard]# kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin
rolebinding.rbac.authorization.k8s.io/def-ns-admin created
[root@k8smaster kubernetes-dashboard]# kubectl get secret 
NAME                       TYPE                                  DATA   AGE
admin-token-bs7sd          kubernetes.io/service-account-token   3      47h
def-ns-admin-token-flw6j   kubernetes.io/service-account-token   3      2m4s
default-token-kk2fq        kubernetes.io/service-account-token   3      65d
mysql-root-password        Opaque                                1      12d
[root@k8smaster kubernetes-dashboard]# DEF_NS_ADMIN_TOKEN=$(kubectl get secret def-ns-admin-token-flw6j -o jsonpath={.data.token} | base64 -d) 
[root@k8smaster kubernetes-dashboard]# kubectl config set-cluster kubernetes --certificate-authority=./tls/ca.crt --server="https://192.168.43.45:6443" --embed-certs=true --kubeconfig=/root/def-ns-admin.conf
Cluster "kubernetes" set.
[root@k8smaster kubernetes-dashboard]# kubectl config view --kubeconfig=/root/def-ns-admin.conf
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://192.168.43.45:6443
  name: kubernetes
contexts: []
current-context: ""
kind: Config
preferences: {}
users: []
[root@k8smaster kubernetes-dashboard]# kubectl config set-credentials def-ns-admin --token=$DEF_NS_ADMIN_TOKEN --kubeconfig=/root/def-ns-admin.conf
User "def-ns-admin" set.
[root@k8smaster kubernetes-dashboard]# kubectl config view --kubeconfig=/root/def-ns-admin.conf
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://192.168.43.45:6443
  name: kubernetes
contexts: []
current-context: ""
kind: Config
preferences: {}
users:
- name: def-ns-admin
  user:
    token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi1mbHc2aiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJkNjk1Yzc5OC1jYTU3LTQ0OGItYjY2My1kNGIyZTcxNzFjN2MiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.FAUUbzFpcYaRVtJSdP8ehJf8DQi6wHHcJZjjffGuKeW0IlNEvD20FMm-5W5nXprll4Fbk238mtnnER0IUSchaTH2dj64WDwyLqtlecKI4UzIyZkDWV2JQM8iDGtL7m53XCF9Syw5ajp6RHaPU5U1GDU3ULp79oPZgXKcibY0JA7qSQpVitDiJM80GidT2TiarwXu6tToW5Y9iV0Xt-FrwKvJIcnpGgn3EFycLiA7Pwn-oty7Xi-mGIQW3JGsXC0_rBIBNy578a7ak4tIIEJT-qJE1nnmjNNSUqxqXFPb2aXnoDTST7Y-N_ZCzy_OzxpPvQqKPcr0JY3jpCwmLfMAkw
[root@k8smaster kubernetes-dashboard]# kubectl config set-context def-ns-admin@kubernetes --cluster=kubernetes --user=def-ns-admin --kubeconfig=/root/def-ns-admin.conf
Context "def-ns-admin@kubernetes" created.
[root@k8smaster kubernetes-dashboard]# kubectl config use-context def-ns-admin@kubernetes --kubeconfig=/root/def-ns-admin.conf
Switched to context "def-ns-admin@kubernetes".
[root@k8smaster kubernetes-dashboard]# kubectl config view --kubeconfig=/root/def-ns-admin.conf
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://192.168.43.45:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: def-ns-admin
  name: def-ns-admin@kubernetes
current-context: def-ns-admin@kubernetes
kind: Config
preferences: {}
users:
- name: def-ns-admin
  user:
    token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi1mbHc2aiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJkNjk1Yzc5OC1jYTU3LTQ0OGItYjY2My1kNGIyZTcxNzFjN2MiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.FAUUbzFpcYaRVtJSdP8ehJf8DQi6wHHcJZjjffGuKeW0IlNEvD20FMm-5W5nXprll4Fbk238mtnnER0IUSchaTH2dj64WDwyLqtlecKI4UzIyZkDWV2JQM8iDGtL7m53XCF9Syw5ajp6RHaPU5U1GDU3ULp79oPZgXKcibY0JA7qSQpVitDiJM80GidT2TiarwXu6tToW5Y9iV0Xt-FrwKvJIcnpGgn3EFycLiA7Pwn-oty7Xi-mGIQW3JGsXC0_rBIBNy578a7ak4tIIEJT-qJE1nnmjNNSUqxqXFPb2aXnoDTST7Y-N_ZCzy_OzxpPvQqKPcr0JY3jpCwmLfMAkw

把/root/def-ns-admin.conf这个文件复制到宿主机中：

Dashboard界面结构分为三个大的区域：

顶部操作区：在这里用户可以搜索集群中的资源、创建资源或退出。
左边导航菜单：通过导航菜单可以查看和管理集群中的各种资源。菜单项按照资源的层级分为两类：Cluster 级别的资源，Namespace 级别的资源，默认显示的是 default Namespace，可以进行切换。
中间主体区：在导航菜单中点击了某类资源，中间主体区就会显示该资源所有实例，比如点击 Pods。

Cloudpods

开源、云原生的融合云平台

更多推荐

面向未来的 IT 基础设施管理架构——融合云（Unified IaaS）

随着数字化时代的到来，IT系统已成为人类社会正常运转不可或缺的组成部分。不远的未来，智能制造，5G和人工智能等技术将成为推动生产力发展的重要引擎，人类社会将面临前所未有的全面彻底的数字化浪潮。IT基础设施作为IT系统运行的平台和载体，是实现数字化的基石。在这场数字化浪潮中，企业必须积极拥抱云计算技术，采用符合技术发展趋势、面向未来的IT基础构架，才能在未来的竞争中赢得先机。一、云计算历经十余年

Cloudpods

Cloudpods负载均衡的功能介绍

作者:周有松今天的内容会从以下几个方面展开：负载均衡产品简介。主要介绍负载均衡作为一个云上产品，它的功能模型是怎样的，日常使用中会遇到的业务词汇负载均衡的功能与典型应用场景。这部分主要结合业务词汇，对负载均衡服务中常见的一些功能选项进行介绍，并举例介绍一些典型的应用场景最后，我们做一下总结，讨论一下负载均衡产品相比传统方式的优点一、产品简介 1. 以NGINX为例提到负载均衡，我们以

Cloudpods

使用Linux vfio将Nvidia GPU透传给QEMU虚拟机

Linux 上虚拟机 GPU 透传需要使用 vfio 的方式。主要是因为在 vfio 方式下对虚拟设备的权限和 DMA 隔离上做的更好。但是这么做也有个缺点，这个物理设备在主机和其他虚拟机都不能使用了。 qemu 直接使用物理设备本身命令行是很简单的，关键在于事先在主机上对系统、内核和物理设备的一些配置。单纯从 qemu 的命令行来看，其实和普通虚拟机启动就差了最后那个-device的选项。这