1.dashboard概述

• Dashboard是基于網頁的Kubernetes用戶界面。您可以使用Dashboard將容器應用部署到Kubernetes集群中，也可以對容器應用排錯，還能管理集群資源。您可以使用Dashboard獲取運行在集群中的應用的概覽信息，也可以創建或者修改Kubernetes資源( 如Deployment，Job,DaemonSet等等)
• Dashboard同時展示了Kubernetes集群中的資源狀態信息和所有報錯信息

官網：

https://github.com/kubernetes/dashboard

metrics插件：

kubernetes-sigs/metrics-server: Scalable and efficient source of container resource metrics for Kubernetes built-in autoscaling pipelines. (github.com)

dashboard資源文件

https://github.com/kubernetes/dashboard0

2.部署metrics-server

1)開啟apiserver聚合服務（中繼路由）

# 添加參數 ~]# vim /etc/kubernetes/manifests/kube-apiserver.yaml #apiserver啟動文件 # spec.containers.command 最下面手動添加如下一行(注意對對齊，否則所有查詢會報錯)- --enable-aggregator-routing=true ...... ~]# systemctl restart kubelet # 驗證 ~]# kubectl -n kube-system get pod kube-apiserver-master -o yaml |grep enable-aggregator-routing

2）證書的申請與簽發

linux的用戶k8s的用戶的用戶區別

linux用戶存儲在password

k8s用戶，證書的簽發機構，簽發證書可信（在k8s內只記錄一小時，一小時后刪除記錄，但是只要k8s簽發過的就可以在k8s內用），所以在k8s內有用戶的概念，但是不能查找用戶，只要用戶帶有簽發的證書就可以登錄k8s；所以node節點想要查詢就要有證書

metrics使用證書，為kubelet簽發證書

# 注：如果沒有證書是無法查看節點狀態的 # 在文件var/lib/kubelet/config.yaml的配置文件中添加 ~]# vim /var/lib/kubelet/config.yamlserverTLSBootstrap: true # 重啟kubelet服務，等待幾分鐘就能看到了;包括master在內的所有節點都需要做# 默認情況下是沒有開啟證書簽發的（在master操作） ~]# kubectl get csr No resources found # 申請證書示例（在所有節點操作） ~]# vim /var/lib/kubelet/config.yaml # 在文件的最后一行添加申請證書；注：改錯節點服務會起不來 serverTLSBootstrap: true # 重啟kubelet（在所有節點操作） ~]# systemctl restart kubelet # 查看（master操作） ~]# kubectl get csr NAME AGE SIGNERNAME REQUESTOR REQUESTEDDURATION CONDITION csr-6fbtl 91s kubernetes.io/kubelet-serving system:node:node1 <none> Pending csr-bctqw 11m kubernetes.io/kubelet-serving system:node:master <none> Pending csr-bz6hx 2m14s kubernetes.io/kube-apiserver-client-kubelet system:node:vm-0-114-centos <none> Pending csr-gk7tx 62s kubernetes.io/kubelet-serving system:node:vm-0-142-centos <none> Pending# ----------------簽發證書必須在 master 上執行 -------------------------# 看到Pending的狀態我們就可以簽發證書了（每臺都簽發一下） ~]# kubectl get csr | awk '{print $1}'| grep -v NAME| xargs -i kubectl certificate approve {}~]# kubectl get csr NAME AGE SIGNERNAME REQUESTOR REQUESTEDDURATION CONDITION csr-6fbtl 91s kubernetes.io/kubelet-serving system:node:node1 <none> Approved,Issued csr-bctqw 11m kubernetes.io/kubelet-serving system:node:master <none> Approved,Issued csr-bz6hx 2m14s kubernetes.io/kube-apiserver-client-kubelet system:node:vm-0-114-centos <none> Approved,Issued csr-gk7tx 62s kubernetes.io/kubelet-serving system:node:vm-0-142-centos <none> Approved,Issued# Approved,Issued則是簽發成功 # 申請的多余證書可以使用 （kubectl delete certificatesigningrequests 證書名稱） 刪除；如果誤刪了證書刪除也不需要再申請，因為已經有記錄了 2.安裝mertics插件 1）官網GitHub - kubernetes-sigs/metrics-server: Scalable and efficient source of container resource metrics for Kubernetes built-in autoscaling pipelines.2）下載鏡像和資源文件，并導入私有倉庫rbac.yaml 授權控制器pdb.yaml 中斷控制器deployment.yaml 主進程metrics（修改鏡像地址）service.yaml 后端metrics主進程服務apiservice.yaml 注冊集群API## 先導入鏡像然后操作（這里我找了一些資料暫時沒找到國內的鏡像，所以如果要安裝部署metrics的話要跨網） ~]# docker load -i metrisc-server.tar.gz ~]# docker tag gcr.io/k8s-staging-metrics-server/metrics-server:master 172.17.0.98:5000/metrics-server:master ~]# docker push 172.17.0.98:5000/metrics-server:master

3)安裝控制器

## 第一步安裝授權控制器 # 手動書寫文件或官方下載 ~]# vim rbac.yaml --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: system:aggregated-metrics-reader labels:rbac.authorization.k8s.io/aggregate-to-view: "true"rbac.authorization.k8s.io/aggregate-to-edit: "true"rbac.authorization.k8s.io/aggregate-to-admin: "true" rules: - apiGroups: ["metrics.k8s.io"]resources: ["pods", "nodes"]verbs: ["get", "list", "watch"] --- apiVersion: v1 kind: ServiceAccount metadata:name: metrics-servernamespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata:name: metrics-server-auth-readernamespace: kube-system roleRef:apiGroup: rbac.authorization.k8s.iokind: Rolename: extension-apiserver-authentication-reader subjects:- kind: ServiceAccountname: metrics-servernamespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata:name: metrics-server:system:auth-delegator roleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: system:auth-delegator subjects:- kind: ServiceAccountname: metrics-servernamespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata:name: system:metrics-server rules:- apiGroups:- ""resources:- pods- nodes- nodes/stats- namespaces- configmapsverbs:- get- list- watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata:name: system:metrics-server roleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: system:metrics-server subjects:- kind: ServiceAccountname: metrics-servernamespace: kube-system # 安裝授權控制器 ~]# kubectl apply -f rbac.yaml clusterrole.rbac.authorization.k8s.io/system:aggregated-metrics-reader created serviceaccount/metrics-server created rolebinding.rbac.authorization.k8s.io/metrics-server-auth-reader created clusterrolebinding.rbac.authorization.k8s.io/metrics-server:system:auth-delegator created clusterrole.rbac.authorization.k8s.io/system:metrics-server created clusterrolebinding.rbac.authorization.k8s.io/system:metrics-server created ## 第二步安裝中斷控制器 # 官方下載文件或手動書寫 ~]# vim pdb.yaml --- apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata:name: metrics-servernamespace: kube-systemlabels:k8s-app: metrics-server spec:minAvailable: 100%selector:matchLabels:k8s-app: metrics-server # 安裝中斷控制器 ~]# kubectl apply -f pdb.yaml Warning: policy/v1beta1 PodDisruptionBudget is deprecated in v1.21+, unavailable in v1.25+; use policy/v1 PodDisruptionBudget poddisruptionbudget.policy/metrics-server created ## 第三安裝主進程 # 官方下載文件或手動書寫 ~]# vim deployment.yaml --- apiVersion: apps/v1 kind: Deployment metadata:name: metrics-servernamespace: kube-systemlabels:k8s-app: metrics-server spec:selector:matchLabels:k8s-app: metrics-serverstrategy:rollingUpdate:maxUnavailable: 0template:metadata:name: metrics-serverlabels:k8s-app: metrics-serverspec:serviceAccountName: metrics-servervolumes:# mount in tmp so we can safely use from-scratch images and/or read-only containers- name: tmp-diremptyDir: {}containers:- name: metrics-serverimage: gcr.io/k8s-staging-metrics-server/metrics-server:masterimagePullPolicy: IfNotPresentargs:- --cert-dir=/tmp- --secure-port=4443- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname- --kubelet-use-node-status-port# - --kubelet-insecure-tlsports:- name: main-portcontainerPort: 4443protocol: TCPreadinessProbe:httpGet:path: /healthzport: main-portscheme: HTTPSsecurityContext:readOnlyRootFilesystem: truerunAsNonRoot: truerunAsUser: 1000volumeMounts:- name: tmp-dirmountPath: /tmpnodeSelector:kubernetes.io/os: linux # 安裝主進程 ~]# kubectl apply -f deployment.yaml deployment.apps/metrics-server created ## 第四安裝service服務 # 官方下載文件或手動書寫 ~]# vim service.yaml --- apiVersion: v1 kind: Service metadata:name: metrics-servernamespace: kube-systemlabels:kubernetes.io/name: "Metrics-server"kubernetes.io/cluster-service: "true" spec:selector:k8s-app: metrics-serverports:- port: 443protocol: TCPtargetPort: main-port # 裝service服務 ~]# kubectl apply -f service.yaml service/metrics-server created ## 最后安裝集群api # 官方下載文件或手動書寫 ~]# vim apiservice.yaml --- apiVersion: apiregistration.k8s.io/v1beta1 kind: APIService metadata:name: v1beta1.metrics.k8s.io spec:service:name: metrics-servernamespace: kube-systemgroup: metrics.k8s.ioversion: v1beta1insecureSkipTLSVerify: truegroupPriorityMinimum: 100versionPriority: 100 # 安裝集群api ~]# kubectl apply -f apiservice.yaml apiservice.apiregistration.k8s.io/v1beta1.metrics.k8s.io created #-------------------------------- 查詢驗證 ---------------------------------------------- ~]# kubectl -n kube-system get pod NAME READY STATUS RESTARTS AGE metrics-server-78dfb54777-4dcjl 1/1 Running 0 116s~]# kubectl -n kube-system get apiservices | grep metrics NAME SERVICE AVAILABLE AGE v1beta1.metrics.k8s.io kube-system/metrics-server True 2m20s # 如果安裝成功了就可以查看節點資源了~]# kubectl top node NAME CPU(cores) CPU% MEMORY(bytes) MEMORY% master 95m 4% 840Mi 48% node-0001 24m 1% 266Mi 15% node-0002 24m 1% 270Mi 15% node-0003 26m 1% 280Mi 16% #CPU(cores)：毫核 1000分之95秒(把每個執行的周期分為1000，那么一個周期就是95毫秒) #CPU% CPU / 內核數：（兩內核就是2000） # HPA就是根據資源占用情況來做的## 監控容器的示例 # 安裝之前寫的myapache創建一個容器 ~]# kubectl apply -f myapache.yaml deployment.apps/myapache created # 查看pod容器的資源 ~]# kubectl top pod error: metrics not available yet # 等待大約 30 秒 ~]# kubectl top pod NAME CPU(cores) MEMORY(bytes) myapache-7d689bf8f-lfr5h 1m 6Mi # 設置訪問次數來實驗pod ~]# curl http://10.244.2.17/info.html?id=5000000 <pre> Array ([REMOTE_ADDR] => 10.244.0.0[REQUEST_METHOD] => GET[HTTP_USER_AGENT] => curl/7.29.0[REQUEST_URI] => /info.php?id=5000000[id] => 5000000 ) php_host: myapache-7d689bf8f-lfr5h ~]# kubectl top pod NAME CPU(cores) MEMORY(bytes) myapache-7d689bf8f-w4rtt 1000m 8Mi

3.搭建dashboard

1）搭建并訪問dashboard

# 書寫資源文件或者官網下載（下載只要改鏡像就可以了） ~]# docker pull kubernetesui/dashboard:v2.0.0 ~]# docker tag kubernetesui/dashboard:v2.0.0 172.17.0.98:5000/dashboard:v2.0.0 ~]# vim recommended.yaml # Copyright 2017 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License.apiVersion: v1 kind: Namespace metadata:name: kubernetes-dashboard---apiVersion: v1 kind: ServiceAccount metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kubernetes-dashboard---kind: Service apiVersion: v1 metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kubernetes-dashboard spec:ports:- port: 443targetPort: 8443selector:k8s-app: kubernetes-dashboard---apiVersion: v1 kind: Secret metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboard-certsnamespace: kubernetes-dashboard type: Opaque---apiVersion: v1 kind: Secret metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboard-csrfnamespace: kubernetes-dashboard type: Opaque data:csrf: ""---apiVersion: v1 kind: Secret metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboard-key-holdernamespace: kubernetes-dashboard type: Opaque---kind: ConfigMap apiVersion: v1 metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboard-settingsnamespace: kubernetes-dashboard---kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kubernetes-dashboard rules:# Allow Dashboard to get, update and delete Dashboard exclusive secrets.- apiGroups: [""]resources: ["secrets"]resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]verbs: ["get", "update", "delete"]# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.- apiGroups: [""]resources: ["configmaps"]resourceNames: ["kubernetes-dashboard-settings"]verbs: ["get", "update"]# Allow Dashboard to get metrics.- apiGroups: [""]resources: ["services"]resourceNames: ["heapster", "dashboard-metrics-scraper"]verbs: ["proxy"]- apiGroups: [""]resources: ["services/proxy"]resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]verbs: ["get"]---kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboard rules:# Allow Metrics Scraper to get metrics from the Metrics server- apiGroups: ["metrics.k8s.io"]resources: ["pods", "nodes"]verbs: ["get", "list", "watch"]---apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kubernetes-dashboard roleRef:apiGroup: rbac.authorization.k8s.iokind: Rolename: kubernetes-dashboard subjects:- kind: ServiceAccountname: kubernetes-dashboardnamespace: kubernetes-dashboard---apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata:name: kubernetes-dashboard roleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: kubernetes-dashboard subjects:- kind: ServiceAccountname: kubernetes-dashboardnamespace: kubernetes-dashboard---kind: Deployment apiVersion: apps/v1 metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kubernetes-dashboard spec:replicas: 1revisionHistoryLimit: 10selector:matchLabels:k8s-app: kubernetes-dashboardtemplate:metadata:labels:k8s-app: kubernetes-dashboardspec:containers:- name: kubernetes-dashboardimage: 172.17.0.98：5000/dashboard:v2.0.0 # 改這為私有倉庫名imagePullPolicy: Alwaysports:- containerPort: 8443protocol: TCPargs:- --auto-generate-certificates- --namespace=kubernetes-dashboard# Uncomment the following line to manually specify Kubernetes API server Host# If not specified, Dashboard will attempt to auto discover the API server and connect# to it. Uncomment only if the default does not work.# - --apiserver-host=http://my-address:portvolumeMounts:- name: kubernetes-dashboard-certsmountPath: /certs# Create on-disk volume to store exec logs- mountPath: /tmpname: tmp-volumelivenessProbe:httpGet:scheme: HTTPSpath: /port: 8443initialDelaySeconds: 30timeoutSeconds: 30securityContext:allowPrivilegeEscalation: falsereadOnlyRootFilesystem: truerunAsUser: 1001runAsGroup: 2001volumes:- name: kubernetes-dashboard-certssecret:secretName: kubernetes-dashboard-certs- name: tmp-volumeemptyDir: {}serviceAccountName: kubernetes-dashboardnodeSelector:"kubernetes.io/os": linux# Comment the following tolerations if Dashboard must not be deployed on mastertolerations:- key: node-role.kubernetes.io/mastereffect: NoSchedule---kind: Service apiVersion: v1 metadata:labels:k8s-app: dashboard-metrics-scrapername: dashboard-metrics-scrapernamespace: kubernetes-dashboard spec:ports:- port: 8000targetPort: 8000selector:k8s-app: dashboard-metrics-scraper---kind: Deployment apiVersion: apps/v1 metadata:labels:k8s-app: dashboard-metrics-scrapername: dashboard-metrics-scrapernamespace: kubernetes-dashboard spec:replicas: 1revisionHistoryLimit: 10selector:matchLabels:k8s-app: dashboard-metrics-scrapertemplate:metadata:labels:k8s-app: dashboard-metrics-scraperannotations:seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'spec:containers:- name: dashboard-metrics-scraperimage: 172.17.0.98/metrics-scraper:v1.0.4 # 改這ports:- containerPort: 8000protocol: TCPlivenessProbe:httpGet:scheme: HTTPpath: /port: 8000initialDelaySeconds: 30timeoutSeconds: 30volumeMounts:- mountPath: /tmpname: tmp-volumesecurityContext:allowPrivilegeEscalation: falsereadOnlyRootFilesystem: truerunAsUser: 1001runAsGroup: 2001serviceAccountName: kubernetes-dashboardnodeSelector:"kubernetes.io/os": linux# Comment the following tolerations if Dashboard must not be deployed on mastertolerations:- key: node-role.kubernetes.io/mastereffect: NoSchedulevolumes:- name: tmp-volumeemptyDir: {} # 創建容器 ~]# kubectl apply -f recommended.yaml ~]# kubectl -n kubernetes-dashboard get service NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) dashboard-metrics-scraper ClusterIP 10.254.76.85 <none> 8000/TCP kubernetes-dashboard ClusterIP 10.254.211.125 <none> 443/TCP ~]# kubectl -n kubernetes-dashboard get pod NAME READY STATUS RESTARTS AGE dashboard-metrics-scraper-57bf85fcc9-vsz74 1/1 Running 0 52s kubernetes-dashboard-7b7f78bcf9-5k8vq 1/1 Running 0 52s

注：測試只能在集群內訪問（ClusterIP），這時需要創建service實現外部訪問

# 該資源文件可以當上面的（recommended.yaml）文件中復制 ~]# vim service.yaml --- kind: Service apiVersion: v1 metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kubernetes-dashboard spec:ports:- port: 443nodePort: 30443 # 新添加targetPort: 8443selector:k8s-app: kubernetes-dashboardtype: NodePort # 新添加~]# kubectl apply -f service.yaml ~]# kubectl -n kubernetes-dashboard get service NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE dashboard-metrics-scraper ClusterIP 10.254.66.25 <none> 8000/TCP 2m6s kubernetes-dashboard NodePort 10.254.165.155 <none> 443:30443/TCP 2m6s

公網訪問只要在云上為 node 節點綁定彈性公網IP [ https://彈性公網IP:30443/ ]

登錄

此時需要授權才能用

2）權限查詢

role： 名稱空間的系統權限

clusterrole：全局權限

系統權限

# 查詢某一個名稱空間內的所有系統權限 ~]# kubectl -n kube-system get role NAME CREATED AT extension-apiserver-authentication-reader 2022-01-22T08:33:50Z kube-proxy 2022-01-22T08:33:52Z kubeadm:kubelet-config-1.23 2022-01-22T08:33:51Z kubeadm:nodes-kubeadm-config 2022-01-22T08:33:51Z system::leader-locking-kube-controller-manager 2022-01-22T08:33:50Z system::leader-locking-kube-scheduler 2022-01-22T08:33:50Z system:controller:bootstrap-signer 2022-01-22T08:33:50Z system:controller:cloud-provider 2022-01-22T08:33:50Z system:controller:token-cleaner 2022-01-22T08:33:50Z # 查詢名稱空間內的系統權限的詳細信息 ~]# kubectl -n kube-system describe role kube-proxy Name: kube-proxy Labels: <none> Annotations: <none> PolicyRule:Resources Non-Resource URLs Resource Names Verbs--------- ----------------- -------------- -----configmaps [] [kube-proxy] [get]

全局權限

# 查看所有全局權限 ~]# kubectl -n kube-system get clusterrole # 指定查看某一個權限的詳細信息 ~]# kubectl -n kube-system describe clusterrole admin

3）token認證登錄

# 書寫權限資源 ~]# vim admin-token.yaml --- apiVersion: v1 kind: ServiceAccount metadata:name: admin-usernamespace: kubernetes-dashboard --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata:name: admin-user roleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: cluster-admin subjects: - kind: ServiceAccountname: admin-usernamespace: kubernetes-dashboard~]# kubectl apply -f admin-token.yaml ~]# kubectl -n kubernetes-dashboard get secrets NAME TYPE DATA AGE admin-user-token-bxjlz kubernetes.io/service-account-token 3 23s ~]# kubectl -n kubernetes-dashboard describe secrets admin-user-token-bxjlz Name: admin-user-token-bxjlz ... ... ca.crt: 1025 bytes namespace: 20 bytes token: ..... # 這里這個很長的字符串就是你要找的認證 token

把密碼粘貼并點擊登錄

?

4）使用dashboard

# 創建一個錯誤的apache容器 ~]# vim myapache.yaml --- kind: Deployment apiVersion: apps/v1 metadata:name: myapacheannotations:kubernetes.io/change-cause: httpd.v1 spec:selector:matchLabels:myapp: httpd replicas: 2template:metadata:labels:myapp: httpdspec:containers:- name: webclusterimage: 172.17.0.98:5000/myos:http # 故意把鏡像改錯stdin: falsetty: falseports:- protocol: TCPcontainerPort: 80restartPolicy: Always ~]# kubectl apply -f myapache.yaml ~]# kubectl get pods NAME READY STATUS RESTARTS AGE myapache-7c4546fdd-b76d7 0/1 ImagePullBackOff 0 45s myapache-7c4546fdd-nkv4b 0/1 ContainerCreating 0 45s

登錄查看

查看報錯

修改錯誤（修改時修改資源控制器）

查看

修改副本數

總結

以上是生活随笔為你收集整理的k8s部署dashboard的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。