K8S——關于K8S控制臺的yaml文件編寫（基于上一章多節點K8S部署）

• 一、yaml文件編寫流程
• 二、證書自簽

一、yaml文件編寫流程

rbac.yaml---->secret.yaml---->configmap.yaml---->controller.yaml----->dashboard.yaml

#dashboard-rbac.yaml文件 vim dashboard-rbac.yaml kind: Role #角色 apiVersion: rbac.authorization.k8s.io/v1 #api版本號（有專門的版本號控制） metadata: #源信息labels:k8s-app: kubernetes-dashboardaddonmanager.kubernetes.io/mode: Reconcilename: kubernetes-dashboard-minimal #創建的資源名稱namespace: kube-system rules: #參數信息的傳入# Allow Dashboard to get, update and delete Dashboard exclusive secrets. - apiGroups: [""]resources: ["secrets"]resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]verbs: ["get", "update", "delete"]# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. - apiGroups: [""]resources: ["configmaps"]resourceNames: ["kubernetes-dashboard-settings"]verbs: ["get", "update"]# Allow Dashboard to get metrics from heapster. - apiGroups: [""]resources: ["services"]resourceNames: ["heapster"]verbs: ["proxy"] - apiGroups: [""]resources: ["services/proxy"]resourceNames: ["heapster", "http:heapster:", "https:heapster:"]verbs: ["get"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata:name: kubernetes-dashboard-minimalnamespace: kube-systemlabels:k8s-app: kubernetes-dashboardaddonmanager.kubernetes.io/mode: Reconcile roleRef:apiGroup: rbac.authorization.k8s.iokind: Rolename: kubernetes-dashboard-minimal subjects: - kind: ServiceAccountname: kubernetes-dashboardnamespace: kube-system #名稱空間的管理（默認為default）#創建dashboard-rbac.yaml資源 kubectl create -f dashboard-rbac.yaml #使用-n 查看Role角色kube-system名稱空間中的資源 kubectl get Role -n kube-system ------------------------------------------------------------------------ #dashboard-secret.yaml文件 vim dashboard-secret.yaml apiVersion: v1 kind: Secret #角色 metadata: #源信息labels:k8s-app: kubernetes-dashboard# Allows editing resource and makes sure it is created first.addonmanager.kubernetes.io/mode: EnsureExistsname: kubernetes-dashboard-certs #資源名稱namespace: kube-system #命名空間 type: Opaque --- #--- 分段 apiVersion: v1 kind: Secret metadata:labels:k8s-app: kubernetes-dashboard# Allows editing resource and makes sure it is created first.addonmanager.kubernetes.io/mode: EnsureExistsname: kubernetes-dashboard-key-holder #密鑰namespace: kube-system type: Opaque#創建dashboard-secret.yaml 資源 kubectl create -f dashboard-secret.yaml kubectl get Secret -n kube-system ------------------------------------------------------------------------ #dashboard-configmap.yaml 配置管理文件 vim dashboard-configmap.yaml apiVersion: v1 kind: ConfigMap metadata:labels:k8s-app: kubernetes-dashboard# Allows editing resource and makes sure it is created first.addonmanager.kubernetes.io/mode: EnsureExistsname: kubernetes-dashboard-settingsnamespace: kube-system#創建dashboard-configmap.yaml資源 kubectl create -f dashboard-configmap.yaml kubectl get Configmap -n kube-system ------------------------------------------------------------------------ #dashboard-controller.yaml 控制器文件 vim dashboard-controller.yaml apiVersion: v1 kind: ServiceAccount #控制器名稱（服務訪問） metadata:labels:k8s-app: kubernetes-dashboardaddonmanager.kubernetes.io/mode: Reconcilename: kubernetes-dashboardnamespace: kube-system --- apiVersion: apps/v1 kind: Deployment #控制器名稱 metadata:name: kubernetes-dashboardnamespace: kube-systemlabels:k8s-app: kubernetes-dashboardkubernetes.io/cluster-service: "true"addonmanager.kubernetes.io/mode: Reconcile spec:selector:matchLabels:k8s-app: kubernetes-dashboardtemplate:metadata:labels:k8s-app: kubernetes-dashboardannotations:scheduler.alpha.kubernetes.io/critical-pod: ''seccomp.security.alpha.kubernetes.io/pod: 'docker/default'spec:priorityClassName: system-cluster-critical containers: #資源指定的名稱、鏡像- name: kubernetes-dashboardimage: siriuszg/kubernetes-dashboard-amd64:v1.8.3resources: #設置了CPU和內存的上限limits:cpu: 100mmemory: 300Mirequests:cpu: 50mmemory: 100Miports:- containerPort: 8443 #8443提供對外的端口號（HTTPS協議）protocol: TCPargs:# PLATFORM-SPECIFIC ARGS HERE- --auto-generate-certificatesvolumeMounts: #容器卷- name: kubernetes-dashboard-certsmountPath: /certs- name: tmp-volumemountPath: /tmplivenessProbe:httpGet:scheme: HTTPSpath: /port: 8443initialDelaySeconds: 30timeoutSeconds: 30volumes:- name: kubernetes-dashboard-certssecret:secretName: kubernetes-dashboard-certs- name: tmp-volumeemptyDir: {}serviceAccountName: kubernetes-dashboardtolerations:- key: "CriticalAddonsOnly"operator: "Exists"#創建 dashboard-controller.yaml 資源 kubectl create -f dashboard-controller.yaml kubectl get ServiceAccount -n kube-system kubectl get deployment -n kube-system ------------------------------------------------------------------------ #dashboard-service.yaml 服務 vim dashboard-service.yaml apiVersion: v1 kind: Service #控制器名稱 metadata:name: kubernetes-dashboardnamespace: kube-systemlabels:k8s-app: kubernetes-dashboardkubernetes.io/cluster-service: "true"addonmanager.kubernetes.io/mode: Reconcile spec:type: NodePort #提供的形式（訪問node節點提供出來的端口，即nodeportselector:k8s-app: kubernetes-dashboardports:- port: 443 #內部提供targetPort: 8443 #Pod內部端口nodePort: 30001 #節點對外提供的端口（映射端口）#創建dashboard-service.yaml資源 kubectl create -f dashboard-service.yaml kubectl get service -n kube-system ------------------------------------------------------------------------ #查看pod資源 kubectl get pods,svc -n kube-system#查看資源分配的位置 kubectl get pods -n kube-system -o wide#查看此pod資源的日志 kubectl create clusterrolebinding cluster-system-anonymous --clusterrole=cluster-admin --user=system:anonymous clusterrolebinding.rbac.authorization.k8s.io/cluster-system-anonymous created kubectl logs kubernetes-dashboard-65f974f565-bh5zh -n kube-system

二、證書自簽

vim dashboard-cert.sh cat > dashboard-csr.json <<EOF #創建json格式的csr簽名文件 {"CN": "Dashboard","hosts": [],"key": {"algo": "rsa","size": 2048},"names": [{"C": "CN","L": "BeiJing","ST": "BeiJing"}] } EOFK8S_CA=$1 #以下產生CA證書 cfssl gencert -ca=$K8S_CA/ca.pem -ca-key=$K8S_CA/ca-key.pem -config=$K8S_CA/ca-config.json -profile=kubernetes dashboard-csr.json | cfssljson -bare dashboard#刪除原本的證書憑據 kubectl delete secret kubernetes-dashboard-certs -n kube-system #重新創建一個證書憑據 kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kube-system ------》wq#生成證書 bash dashboard-cert.sh /root/k8s/k8s-cert/#編輯dashboard-controller.yaml，指向證書位置，完成證書自簽 vim dashboard-controller.yaml ----47行左右添加/修改args:# PLATFORM-SPECIFIC ARGS HERE- --auto-generate-certificates- --tls-key-file=dashboard-key.pem- --tls-cert-file=dashboard.pem#重新部署 kubectl apply -f dashboard-controller.yaml#需要注意一個問題，在重新部署的時候，資源可能會分配到其他節點，再次查看pod資源位置 kubectl get pods -n kube-system -o wide#生成令牌 k8s-admin.yaml vim k8s-admin.yaml apiVersion: v1 kind: ServiceAccount metadata:name: dashboard-admin #創建dashboard-admin的資源，相當于一個管理員賬戶namespace: kube-system --- kind: ClusterRoleBinding #綁定群集用戶角色 apiVersion: rbac.authorization.k8s.io/v1beta1 metadata:name: dashboard-admin #群集用戶角色其實就是管理員的身份 subjects:- kind: ServiceAccountname: dashboard-adminnamespace: kube-system roleRef:kind: ClusterRolename: cluster-adminapiGroup: rbac.authorization.k8s.io#先查看secret(安全角色)的命名空間中的資源 kubectl get secret -n kube-system#生成令牌 kubectl create -f k8s-admin.yaml #再次查看secret資源 kubectl get secret -n kube-system#詳細查看令牌信息 kubectl describe secret dashboard-admin-token-dpjdk -n kube-system （最下方為token令牌，進行復制，登錄web控制臺需要使用）

總結

以上是生活随笔為你收集整理的K8S——关于K8S控制台的yaml文件编写（基于上一章多节点K8S部署）的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。