开始部署

Gitlab 项目地址：https://github.com/kubernetes/dashboard


1) 创建证书：

mkdir dashboard-certs
cd dashboard-certs/
#创建命名空间
kubectl create namespace kubernetes-dashboard

# 创建key文件
openssl genrsa -out dashboard.key 2048
#证书请求
openssl req -new  -key dashboard.key -out dashboard.csr  -subj /CN=dashboard-cert
#自签证书，指定证书的有效期天数。
openssl x509 -req  -days 3650  -in dashboard.csr -signkey dashboard.key -out dashboard.crt

# 查看证书有效期
openssl x509  -noout -text -in dashboard.crt
#创建kubernetes-dashboard-certs对象

kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt -n kubernetes-dashboard

ubuntu18.04时生成CSR时报错 

Cant load /root/.rnd into RNG
140496635077056:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd

解决办法:

cd /root
openssl rand -writerand .rnd

2) 下载并修改​​recommended.yaml​​文件

wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta5/aio/deploy/recommended.yaml
#增加直接访问端口

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  type: NodePort #增加
  ports:
    - port: 443
      targetPort: 8443
      nodePort: 30008 #增加
  selector:
    k8s-app: kubernetes-dashboard

---

#因为自动生成的证书很多浏览器无法使用，所以我们在上面自己创建了，注释掉kubernetes-dashboard-certs对象声明

#apiVersion: v1
#kind: Secret
#metadata:
#  labels:
#    k8s-app: kubernetes-dashboard
#  name: kubernetes-dashboard-certs
#  namespace: kubernetes-dashboard
#type: Opaque

3) 安装​​Dashboard​​

#安装

kubectl apply -f  ~/recommended.yaml

#检查结果

kubectl get pods -A  -o wide
kubectl get service -n kubernetes-dashboard  -o wide

4) 创建​​Dashboard​​​管理员账号​​dashboard-admin.yaml​​​，并​​apply​​


自带的 serviceaccount 账号的权限有限，所以咱重新创建一个serviceaccount 账号，来登录dashboard。

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: dashboard-admin
  namespace: kubernetes-dashboard

5) 赋权​​dashboard-admin-bind-cluster-role.yaml​​，并​​apply​​

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin-bind-cluster-role
  labels:
    k8s-app: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: dashboard-admin
  namespace: kubernetes-dashboard

6) 复制​​token​​，并登录​​https://192.168.0.104:30008​​（换成你环境的ip即可）

kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep dashboard-admin | awk {print $1})