上篇文章中，已經(jīng)完成了基于kubeadm安裝的kubernetes集群，本文將基于上述的集群環(huán)境，搭建dashboard組件。

安裝環(huán)境及版本
kubernetes版本及基礎(chǔ)組件版本可參考前一篇安裝集群環(huán)境的文章

dashboard組件：kubernetes-dashboard-v1.10.1

需準(zhǔn)備的鏡像：

k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1???????????
k8s.gcr.io/heapster-amd64:v1.5.4 ???????????????????????
k8s.gcr.io/heapster-influxdb-amd64:v1.5.2 ??????????????
k8s.gcr.io/heapster-grafana-amd64:v5.0.4

?

#!/bin/bash DASHDOARD_VERSION=v1.10.1 HEAPSTER_VERSION=v1.5.4 GRAFANA_VERSION=v5.0.4 INFLUXDB_VERSION=v1.5.2 username=registry.cn-hangzhou.aliyuncs.com/google_containers images=(kubernetes-dashboard-amd64:${DASHDOARD_VERSION}heapster-grafana-amd64:${GRAFANA_VERSION}heapster-amd64:${HEAPSTER_VERSION}heapster-influxdb-amd64:${INFLUXDB_VERSION}) for image in ${images[@]} do docker pull ${username}/${image} docker tag ${username}/${image} k8s.gcr.io/${image} docker rmi ${username}/${image} done

?

主節(jié)點(diǎn)與個(gè)node節(jié)點(diǎn)均需要以上鏡像：

k8s.gcr.io/kubernetes-dashboard-amd64 v1.10.1 f9aed6605b81 3 months ago 122MB k8s.gcr.io/heapster-amd64 v1.5.4 72d68eecf40c 8 months ago 75.3MB k8s.gcr.io/heapster-influxdb-amd64 v1.5.2 eb180058aee0 8 months ago 16.5MB k8s.gcr.io/heapster-grafana-amd64 v5.0.4 25e1da333f76 8 months ago 171MB

?? 在主節(jié)點(diǎn)上準(zhǔn)備部署所需的yaml文件：

dashboard項(xiàng)目官方地址：https://github.com/kubernetes/dashboard/releases

這是作者自己修改過(guò)的yaml文件： https://github.com/chopperchan/k8s-dashboard.git

包含有：

kubernetes-dashboard.yaml?

????

# Copyright 2017 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License.# Configuration to deploy release version of the Dashboard UI compatible with # Kubernetes 1.8. # # Example usage: kubectl create -f <this_file># ------------------- Dashboard Secret ------------------- #apiVersion: v1 kind: Secret metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboard-certsnamespace: kube-system type: Opaque--- # ------------------- Dashboard Service Account ------------------- #apiVersion: v1 kind: ServiceAccount metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kube-system--- # ------------------- Dashboard Role & Role Binding ------------------- #kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata:name: kubernetes-dashboard-minimalnamespace: kube-system rules:# Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret. - apiGroups: [""]resources: ["secrets"]verbs: ["create"]# Allow Dashboard to create 'kubernetes-dashboard-settings' config map. - apiGroups: [""]resources: ["configmaps"]verbs: ["create"]# Allow Dashboard to get, update and delete Dashboard exclusive secrets. - apiGroups: [""]resources: ["secrets"]resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]verbs: ["get", "update", "delete"]# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. - apiGroups: [""]resources: ["configmaps"]resourceNames: ["kubernetes-dashboard-settings"]verbs: ["get", "update"]# Allow Dashboard to get metrics from heapster. - apiGroups: [""]resources: ["services"]resourceNames: ["heapster"]verbs: ["proxy"] - apiGroups: [""]resources: ["services/proxy"]resourceNames: ["heapster", "http:heapster:", "https:heapster:"]verbs: ["get"]--- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata:name: kubernetes-dashboard-minimalnamespace: kube-system roleRef:apiGroup: rbac.authorization.k8s.iokind: Rolename: kubernetes-dashboard-minimal subjects: - kind: ServiceAccountname: kubernetes-dashboardnamespace: kube-system--- # ------------------- Dashboard Deployment ------------------- #kind: Deployment apiVersion: apps/v1beta2 metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kube-system spec:replicas: 1revisionHistoryLimit: 10selector:matchLabels:k8s-app: kubernetes-dashboardtemplate:metadata:labels:k8s-app: kubernetes-dashboardspec:containers:- name: kubernetes-dashboardimage: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1ports:- containerPort: 9090protocol: TCPargs:#- --auto-generate-certificates# Uncomment the following line to manually specify Kubernetes API server Host# If not specified, Dashboard will attempt to auto discover the API server and connect# to it. Uncomment only if the default does not work.#- --apiserver-host=http://10.0.1.168:8080 volumeMounts:- name: kubernetes-dashboard-certsmountPath: /certs# Create on-disk volume to store exec logs- mountPath: /tmpname: tmp-volumelivenessProbe:httpGet:scheme: HTTPpath: /port: 9090initialDelaySeconds: 30timeoutSeconds: 30volumes:- name: kubernetes-dashboard-certssecret:secretName: kubernetes-dashboard-certs- name: tmp-volumeemptyDir: {}serviceAccountName: kubernetes-dashboard-admin# Comment the following tolerations if Dashboard must not be deployed on mastertolerations:- key: node-role.kubernetes.io/mastereffect: NoSchedule--- # ------------------- Dashboard Service ------------------- #kind: Service apiVersion: v1 metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboardnamespace: kube-system spec:ports:- port: 9090targetPort: 9090selector:k8s-app: kubernetes-dashboard# ------------------------------------------------------------ kind: Service apiVersion: v1 metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboard-externalnamespace: kube-system spec:ports:- port: 9090targetPort: 9090nodePort: 31666type: NodePortselector:k8s-app: kubernetes-dashboard

?

kubernetes-dashboard-admin.rbac.yaml

--- apiVersion: v1 kind: ServiceAccount metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboard-adminnamespace: kube-system--- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRoleBinding metadata:name: kubernetes-dashboard-adminlabels:k8s-app: kubernetes-dashboard roleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: cluster-admin subjects: - kind: ServiceAccountname: kubernetes-dashboard-adminnamespace: kube-system

?

heapster.yaml

apiVersion: v1 kind: ServiceAccount metadata:name: heapsternamespace: kube-system --- apiVersion: extensions/v1beta1 kind: Deployment metadata:name: heapsternamespace: kube-system spec:replicas: 1template:metadata:labels:task: monitoringk8s-app: heapsterspec:serviceAccountName: heapstercontainers:- name: heapsterimage: k8s.gcr.io/heapster-amd64:v1.5.4imagePullPolicy: IfNotPresentcommand:- /heapster- --source=kubernetes:https://kubernetes.default- --sink=influxdb:http://monitoring-influxdb.kube-system.svc:8086 --- apiVersion: v1 kind: Service metadata:labels:task: monitoring# For use as a Cluster add-on (https://github.com/kubernetes/kubernetes/tree/master/cluster/addons)# If you are NOT using this as an addon, you should comment out this line.kubernetes.io/cluster-service: 'true'kubernetes.io/name: Heapstername: heapsternamespace: kube-system spec:ports:- port: 80targetPort: 8082selector:k8s-app: heapster

?

heapster-rbac.yaml

kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata:name: heapster roleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: system:heapster subjects: - kind: ServiceAccountname: heapsternamespace: kube-system

?

官方的文件中只包含了kubernetes-dashboard.yaml，且kubernetes在1.6版本以后啟用了RBAC訪問(wèn)控制策略，直接使用官方版會(huì)出現(xiàn)訪問(wèn)權(quán)限不足的報(bào)錯(cuò)

?此問(wèn)題可使用kubectl或Kubernetes API進(jìn)行配置。使用RBAC可以直接授權(quán)給用戶，讓用戶擁有授權(quán)管理的權(quán)限，這樣就不再需要直接觸碰Master Node。

相關(guān)修改為：

kubernetes-dashboard.yaml 中修改 serviceAccountName，外部訪問(wèn)dashboard的方式（本文為token訪問(wèn)）

kubernetes-dashboard-admin（默認(rèn)為kubernetes-dashboard）

kind: Service apiVersion: v1 metadata:labels:k8s-app: kubernetes-dashboardname: kubernetes-dashboard-externalnamespace: kube-system spec:ports:- port: 9090targetPort: 9090nodePort: 31666type: NodePortselector:k8s-app: kubernetes-dashboard

?

在kubernetes-dashboard-admin.rbac.yaml中則是執(zhí)行了創(chuàng)建kubernetes-dashboard-admin用戶并賦予所有權(quán)限的命令

PS：yaml中涉及的image版本請(qǐng)根據(jù)自己實(shí)際情況調(diào)整

?

安裝dashboard及相關(guān)組件

ll #以下內(nèi)容其中g(shù)rafana和influxdb是作者自己增加的，讀者可不用部署 -rw-r--r-- 1 root root 2314 4月 3 10:02 grafana.yaml -rw-r--r-- 1 root root 264 11月 23 15:19 heapster-rbac.yaml -rw-r--r-- 1 root root 1100 4月 3 09:52 heapster.yaml -rw-r--r-- 1 root root 998 4月 3 10:02 influxdb.yaml -rw-r--r-- 1 root root 504 4月 3 10:13 kubernetes-dashboard-admin.rbac.yaml -rw-r--r-- 1 root root 5132 4月 3 12:40 kubernetes-dashboard.yaml#執(zhí)行安裝 kubectl apply -n kube-system -f .#執(zhí)行完成后查看pod是否正常運(yùn)行 kubectl get pod -n kube-system |grep kubernetes-dashboardkubernetes-dashboard-6cfdc589c7-krfmk 1/1 Running 0 164m#查看服務(wù)暴露的端口號(hào) kubectl get service -n kube-system |grep kubernetes-dashboard kubernetes-dashboard-external NodePort 10.98.178.105 <none> 9090:31666/TCP 168m

?

Running狀態(tài)說(shuō)明運(yùn)行正常，直接可通過(guò)masterip:端口號(hào)訪問(wèn)ui界面。

讀者可根據(jù)需要修改nodePort參數(shù)來(lái)修改訪問(wèn)端口。

可能會(huì)遇到的問(wèn)題
訪問(wèn)時(shí)出現(xiàn)權(quán)限不足

?

解決方法：

執(zhí)行本文中的kubernetes-dashboard-admin.rbac.yaml，或讀者自行創(chuàng)建serviceAccount，并修改kubernetes-dashboard.yml中serviceAccount參數(shù)為你創(chuàng)建的用戶名稱(chēng)

?

轉(zhuǎn)載于:https://www.cnblogs.com/ling-yu-amen/p/10955094.html

總結(jié)

以上是生活随笔為你收集整理的Kubernetes-基于k8s-v1.14.2安装dashboard-1.10.1的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。