官方仓库
GitHub - kubernetes/dashboard: General-purpose web UI for Kubernetes clusters

dashboard官网介绍：

Deploy and Access the Kubernetes Dashboard | Kubernetes

选在对应kubelet版本的安装说明：

查看kubelet版本：

​

 选择v1.21版本对应的dashboard版本为v2.2.0,如下图：

​

1.准备：

建议提前下载这两个镜像：（不然后面会出现3.2中遇到的问题），这个下载很慢~

docker pull kubernetesui/dashboard:v2.2.0
docker pull kubernetesui/metrics-scraper:v1.0.7

2.下载

wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.2.0/aio/deploy/recommended.yaml

也可以直接使用 url

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.2.0/aio/deploy/recommended.yaml

但是，因为后续需要修改，而且 raw.githubusercontent.com 域名不一定总能打开，所以，下载下来比较放心！

3.改用 NodePort 方式访问

3.1 vim recommended.yaml

找到 k8s-app: kubernetes-dashboard ，增加 type: NodePort 和 nodePort: 30001

---
 kind: Service
 apiVersion: v1
 metadata:
   labels:
     k8s-app: kubernetes-dashboard
   name: kubernetes-dashboard
   namespace: kubernetes-dashboard
 spec:
   type: NodePort #使用 NodePort方式，方便外网访问
   ports:
     - port: 443
       targetPort: 8443
       nodePort: 30001 #映射到host的30001端口
   selector:
     k8s-app: kubernetes-dashboard
 
 ---

执行：kubectl apply -f recommended.yaml

​

查看pod状态，若出现一场请查看后面3.2步骤

​

​

3.2异常排查

发现dashbaord状态异常，查看dashboard-metrics-scraper-c45b7869d-djq5m详细信息：

kubectl describe pod dashboard-metrics-scraper-c45b7869d-djq5m -n kubernetes-dashboard

​

 问题分析：错误信息来看是拉取kubernetesui/metrics-scraper:v1.0.7失败导致的；

解决方法:使用docker pull单独拉取

​

 查看pod状态，第一个dashbaord-metrics-scraper已经1/1 Running正常；​

 同样方式解决第二个kubernetes-dashboard-576cb95f94-c497w异常：

查看kubernetes-dashboard-576cb95f94-c497w详细信息：

kubectl describe pod kubernetes-dashboard-576cb95f94-c497w -n kubernetes-dashboard

​

 问题分析：从错误打印发现拉取kubernetesui/dashboard:v2.4.0失败导致

问题解决：使用docker pull单独拉取

dockers pull kubernetesui/dashboard:v2.2.0

创建访问用户

1. 官方仓库文档
   Creating sample user

   镜像仓库文档
   Creating sample user

2. 创建一个 adminuser（Creating a Service Account）
   vim dashboard-adminuser.yaml

    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: admin-user
      namespace: kubernetes-dashboard
   

   生成
   kubectl apply -f dashboard-adminuser.yaml

3. 创建一个ClusterRole（Creating a ClusterRoleBinding）
   vim dashboard-ClusterRoleBinding.yaml

    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: admin-user
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-admin
    subjects:
    - kind: ServiceAccount
      name: admin-user
      namespace: kubernetes-dashboard
   

   生成
   kubectl apply -f dashboard-ClusterRoleBinding.yaml

4. 获取访问令牌（Getting a Bearer Token）

   从仓库文档中找到 Getting a Bearer Token 命令样本

    kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"
   

   结果如下：

   	eyJhbGciOiJSUzI1NiIsImtpZCI6IkhRVkxadFBlblNkbGYtZ05obUNDWmxkNzhEazFsbWoxOGNCSkRST25VY28ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLWpzc3BwIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI4NmJkZGQwZS1lODE0LTQ4MjItODAyYS0wZGVlZWU1YzQ2ZjAiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.OivIRkS11wQMNTztVeokL63qYSl3-Cb9UnHHa3yFhiVBuDz_92F7gy3C1etX2MEE1l-1zAFnmiAypum1T-PjCVSodvgvUKv_N3KTDSUdW0JIpDxymK_cIoU6H6aqL5F5FvYgodYNKc05wuKVH2Jc1udZthADoD5RRpo1S_ttwLfjJgiSOa-Bz-4A_jv4EzJqcBqVZtusacosT6x9JxcukoWq9bmuSZ8Lp99dVFzsCHgD1XicBYSm6RQ8tXAYioEHa0tk3SJrC6rLrLBa5_NIO9ZkwGWpumj35yC-SkD8uDjuwPFtn1DE7EmOEut8N1Rg5kZ9izV4_7oY9CK1nQDcb[root@c[root@centos7-189 working]# [root@centos7-[root@c[root@centos7-[root@centos7-[root@centos7-[root@c[root@centos7-
   

   或者

   这个指令样本忘记从哪里 cp 来的了

    kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"
   

   返回结果样本：

   eyJhbGciOiJSUzI1NiIsImtpZCI6IkhRVkxadFBlblNkbGYtZ05obUNDWmxkNzhEazFsbWoxOGNCSkRST25VY28ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLWpzc3BwIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI4NmJkZGQwZS1lODE0LTQ4MjItODAyYS0wZGVlZWU1YzQ2ZjAiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.OivIRkS11wQMNTztVeokL63qYSl3-Cb9UnHHa3yFhiVBuDz_92F7gy3C1etX2MEE1l-1zAFnmiAypum1T-PjCVSodvgvUKv_N3KTDSUdW0JIpDxymK_cIoU6H6aqL5F5FvYgodYNKc05wuKVH2Jc1udZthADoD5RRpo1S_ttwLfjJgiSOa-Bz-4A_jv4EzJqcBqVZtusacosT6x9JxcukoWq9bmuSZ8Lp99dVFzsCHgD1XicBYSm6RQ8tXAYioEHa0tk3SJrC6rLrLBa5_NIO9ZkwGWpumj35yC-SkD8uDjuwPFtn1DE7EmOEut8N1Rg5kZ9izV4_7oY9CK1nQDcbQ
   

5.打开Dashboard 

1. 浏览器打开 https://192.168.1.189:30001/#/login
2. 使用前一步保存的 token 登录