dashboard 可以从微软中国提供的 gcr.io ：http://mirror.azure.cn/help/gcr-proxy-cache.html免费代理下载被墙的镜像 docker pull gcr.azk8s.cn/google_containers/<imagename>:<version> 1. 下载文件 下载三个文件：https://github.com/gjmzj/kubeasz/tree/master/manifests/dashboard [root@hs-k8s-master01 dashboard]# pwd /data/k8s/dashboard [root@hs-k8s-master01 dashboard]# ll 总用量 32 -rw-r--r-- 1 root root 843 2月 5 15:31 admin-user-sa-rbac.yaml -rw-r--r-- 1 root root 8026 2月 5 15:38 kubernetes-dashboard.yaml -rw-r--r-- 1 root root 3084 2月 5 15:33 read-user-sa-rbac.yaml 2. 部署dashboard主yaml配置文件 #修改镜像下载地址 [root@hs-k8s-master01 dashboard]# cat kubernetes-dashboard.yaml |grep image image: registry.cn-hangzhou.aliyuncs.com/google_containers/dashboard:v2.0.0-rc3 image: registry.cn-hangzhou.aliyuncs.com/google_containers/metrics-scraper:v1.0.3 [root@hs-k8s-master01 dashboard]# kubectl apply -f kubernetes-dashboard.yaml secret/kubernetes-dashboard-certs created serviceaccount/kubernetes-dashboard created role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created deployment.apps/kubernetes-dashboard created service/kubernetes-dashboard created 3. 创建可读可写admin Service Account [root@hs-k8s-master01 dashboard]# kubectl apply -f admin-user-sa-rbac.yaml serviceaccount/admin-user created clusterrolebinding.rbac.authorization.k8s.io/admin-user created 4. 创建只读 read Service Account [root@hs-k8s-master01 dashboard]# kubectl apply -f read-user-sa-rbac.yaml serviceaccount/dashboard-read-user created clusterrolebinding.rbac.authorization.k8s.io/dashboard-read-binding created clusterrole.rbac.authorization.k8s.io/dashboard-read-clusterrole created 5. 查看 #查看pod运行状态 [root@hs-k8s-master01 dashboard]# kubectl get pod -n kube-system | grep dashboard dashboard-metrics-scraper-6b66849c9-8lvqd 1/1 Running 0 23m kubernetes-dashboard-6dc6c4f59-84526 1/1 Running 0 23m #查看dashboard service [root@hs-k8s-master01 dashboard]# kubectl get svc -n kube-system|grep dashboard dashboard-metrics-scraper ClusterIP 10.107.131.160 <none> 8000/TCP 23m kubernetes-dashboard NodePort 10.99.144.160 <none> 443:31110/TCP 23m #查看集群服务 [root@hs-k8s-master01 dashboard]# kubectl cluster-info Kubernetes master is running at https://20.0.0.250:8443 KubeDNS is running at https://20.0.0.250:8443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy kubernetes-dashboard is running at https://20.0.0.250:8443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. #查看pod运行日志 [root@hs-k8s-master01 dashboard]# kubectl logs kubernetes-dashboard-6dc6c4f59-84526 -n kube-system 6. 生成证书 供本地google浏览器使用 #生成client-certificate-data [root@k8s-master01 dashboard]# grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt #生成client-key-data [root@k8s-master01 dashboard]# grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key #生成p12 [root@k8s-master01 dashboard]# openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name "kubernetes-client" Enter Export Password: 1 Verifying - Enter Export Password: 1 [root@hs-k8s-master01 dashboard]# ll 总用量 28 -rw-r--r-- 1 root root 843 2月 5 15:31 admin-user-sa-rbac.yaml -rw-r--r-- 1 root root 1082 2月 5 15:41 kubecfg.crt -rw-r--r-- 1 root root 1679 2月 5 15:41 kubecfg.key -rw-r--r-- 1 root root 2464 2月 5 15:43 kubecfg.p12 -rw-r--r-- 1 root root 8026 2月 5 15:38 kubernetes-dashboard.yaml -rw-r--r-- 1 root root 3084 2月 5 15:33 read-user-sa-rbac.yaml [root@k8s-master01 dashboard]# sz kubecfg.p12 谷歌浏览器导入证书： 备注把上一步骤的kubecfg.p12 文件导入证书后需要重启浏览器： 7. 导出令牌 [root@hs-k8s-master01 dashboard]# kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}') Name: admin-user-token-4d2r4 Namespace: kube-system Labels: <none> Annotations: kubernetes.io/service-account.name: admin-user kubernetes.io/service-account.uid: cf8638e0-1434-4f61-aded-262f213dd803 Type: kubernetes.io/service-account-token Data ==== ca.crt: 1025 bytes namespace: 11 bytes token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjZaOTZ5MmR5MEs3eUVnclJ4R0MtOTNmVDlTTGlteGdzQ1RJc1ZZT2xvT00ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLTRkMnI0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJjZjg2MzhlMC0xNDM0LTRmNjEtYWRlZC0yNjJmMjEzZGQ4MDMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.HXlI_vXP4b9VVP6_jptMFjp99u1NLlmgC26ITfA7cHRPIyjxW6vKv97GjAOxF3Ne691cTZLcOAh_b1dNXExLkmUqKoWY8Cg_ys5hvQ2rcC_CEpS7S4shKWEb_DeLUUgr4UjjIDQKCH_tczX3nNpfsqiooMsMYkac-MlwgCHVvxgkqKmfrkub6ifP02yuaWBLhvuYvJc6DX_NvHQzy9w8FFbB2d4gpthzt_sinSR4x84MzgKHdOsj9CHXqwHMdCMwu0A-FM-bg7yr1fHZLKORrSrHz9OZ1pJeU-82VYRSOEntW7o6X3b0zOi2nB6yIpDmVDzzk5g30sI32vivmrNEJg #导出令牌 [root@k8s-master01 dashboard]# vim /root/.kube/config 加 token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjZaOTZ5MmR5MEs3eUVnclJ4R0MtOTNmVDlTTGlteGdzQ1RJc1ZZT2xvT00ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLTRkMnI0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJjZjg2MzhlMC0xNDM0LTRmNjEtYWRlZC0yNjJmMjEzZGQ4MDMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.HXlI_vXP4b9VVP6_jptMFjp99u1NLlmgC26ITfA7cHRPIyjxW6vKv97GjAOxF3Ne691cTZLcOAh_b1dNXExLkmUqKoWY8Cg_ys5hvQ2rcC_CEpS7S4shKWEb_DeLUUgr4UjjIDQKCH_tczX3nNpfsqiooMsMYkac-MlwgCHVvxgkqKmfrkub6ifP02yuaWBLhvuYvJc6DX_NvHQzy9w8FFbB2d4gpthzt_sinSR4x84MzgKHdOsj9CHXqwHMdCMwu0A-FM-bg7yr1fHZLKORrSrHz9OZ1pJeU-82VYRSOEntW7o6X3b0zOi2nB6yIpDmVDzzk5g30sI32vivmrNEJg [root@k8s-master01 dashboard]# cp /root/.kube/config /data/k8s/tmp/k8s-dashboard.kubeconfig [root@k8s-master01 dashboard]# sz /data/k8s/tmp/k8s-dashboard.kubeconfig