k8s部署dash-board

官方仓库
GitHub - kubernetes/dashboard: General-purpose web UI for Kubernetes clusters

dashboard官网介绍：

Deploy and Access the Kubernetes Dashboard | Kubernetes

选在对应kubelet版本的安装说明：

查看kubelet版本：

选择v1.21版本对应的dashboard版本为v2.2.0,如下图：

1.准备：

建议提前下载这两个镜像：（不然后面会出现3.2中遇到的问题），这个下载很慢~

docker pull kubernetesui/dashboard:v2.2.0
docker pull kubernetesui/metrics-scraper:v1.0.7

2.下载

wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.2.0/aio/deploy/recommended.yaml

也可以直接使用 url

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.2.0/aio/deploy/recommended.yaml

但是，因为后续需要修改，而且 raw.githubusercontent.com 域名不一定总能打开，所以，下载下来比较放心！

3.改用 NodePort 方式访问

3.1 vim recommended.yaml

找到 k8s-app: kubernetes-dashboard ，增加 type: NodePort 和 nodePort: 30001

---kind: ServiceapiVersion: v1metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kubernetes-dashboardspec:type: NodePort #使用 NodePort方式，方便外网访问ports:- port: 443targetPort: 8443nodePort: 30001 #映射到host的30001端口selector:k8s-app: kubernetes-dashboard---

执行：kubectl apply -f recommended.yaml

查看pod状态，若出现一场请查看后面3.2步骤

3.2异常排查

发现dashbaord状态异常，查看dashboard-metrics-scraper-c45b7869d-djq5m详细信息：

kubectl describe pod dashboard-metrics-scraper-c45b7869d-djq5m -n kubernetes-dashboard

问题分析：错误信息来看是拉取kubernetesui/metrics-scraper:v1.0.7失败导致的；

解决方法:使用docker pull单独拉取

查看pod状态，第一个dashbaord-metrics-scraper已经1/1 Running正常；

同样方式解决第二个kubernetes-dashboard-576cb95f94-c497w异常：

查看kubernetes-dashboard-576cb95f94-c497w详细信息：

kubectl describe pod kubernetes-dashboard-576cb95f94-c497w -n kubernetes-dashboard

问题分析：从错误打印发现拉取kubernetesui/dashboard:v2.4.0失败导致

问题解决：使用docker pull单独拉取

dockers pull kubernetesui/dashboard:v2.2.0

创建访问用户

官方仓库文档
Creating sample user

镜像仓库文档
Creating sample user
创建一个 adminuser（Creating a Service Account）
vim dashboard-adminuser.yaml
```
 apiVersion: v1kind: ServiceAccountmetadata:name: admin-usernamespace: kubernetes-dashboard
```
生成
kubectl apply -f dashboard-adminuser.yaml

创建一个ClusterRole（Creating a ClusterRoleBinding）
vim dashboard-ClusterRoleBinding.yaml

 apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:name: admin-userroleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: cluster-adminsubjects:- kind: ServiceAccountname: admin-usernamespace: kubernetes-dashboard

生成
kubectl apply -f dashboard-ClusterRoleBinding.yaml

获取访问令牌（Getting a Bearer Token）

从仓库文档中找到 Getting a Bearer Token 命令样本

 kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"

结果如下：

   eyJhbGciOiJSUzI1NiIsImtpZCI6IkhRVkxadFBlblNkbGYtZ05obUNDWmxkNzhEazFsbWoxOGNCSkRST25VY28ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLWpzc3BwIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI4NmJkZGQwZS1lODE0LTQ4MjItODAyYS0wZGVlZWU1YzQ2ZjAiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.OivIRkS11wQMNTztVeokL63qYSl3-Cb9UnHHa3yFhiVBuDz_92F7gy3C1etX2MEE1l-1zAFnmiAypum1T-PjCVSodvgvUKv_N3KTDSUdW0JIpDxymK_cIoU6H6aqL5F5FvYgodYNKc05wuKVH2Jc1udZthADoD5RRpo1S_ttwLfjJgiSOa-Bz-4A_jv4EzJqcBqVZtusacosT6x9JxcukoWq9bmuSZ8Lp99dVFzsCHgD1XicBYSm6RQ8tXAYioEHa0tk3SJrC6rLrLBa5_NIO9ZkwGWpumj35yC-SkD8uDjuwPFtn1DE7EmOEut8N1Rg5kZ9izV4_7oY9CK1nQDcb[root@c[root@centos7-189 working]# [root@centos7-[root@c[root@centos7-[root@centos7-[root@centos7-[root@c[root@centos7-

或者

这个指令样本忘记从哪里 cp 来的了

 kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"

返回结果样本：

eyJhbGciOiJSUzI1NiIsImtpZCI6IkhRVkxadFBlblNkbGYtZ05obUNDWmxkNzhEazFsbWoxOGNCSkRST25VY28ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLWpzc3BwIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI4NmJkZGQwZS1lODE0LTQ4MjItODAyYS0wZGVlZWU1YzQ2ZjAiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.OivIRkS11wQMNTztVeokL63qYSl3-Cb9UnHHa3yFhiVBuDz_92F7gy3C1etX2MEE1l-1zAFnmiAypum1T-PjCVSodvgvUKv_N3KTDSUdW0JIpDxymK_cIoU6H6aqL5F5FvYgodYNKc05wuKVH2Jc1udZthADoD5RRpo1S_ttwLfjJgiSOa-Bz-4A_jv4EzJqcBqVZtusacosT6x9JxcukoWq9bmuSZ8Lp99dVFzsCHgD1XicBYSm6RQ8tXAYioEHa0tk3SJrC6rLrLBa5_NIO9ZkwGWpumj35yC-SkD8uDjuwPFtn1DE7EmOEut8N1Rg5kZ9izV4_7oY9CK1nQDcbQ

5.打开Dashboard

浏览器打开 https://192.168.1.189:30001/#/login
使用前一步保存的 token 登录