提示：dashboard v2版本默认没有创建具有管理员权限的账户，可如下操作创建。
[root@master01 dashboard]# cat <<EOF > dashboard-admin.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin
namespace: kubernetes-dashboard
EOF
[root@master01 dashboard]# kubectl apply -f dashboard-admin.yaml
ingress暴露dashboard
创建ingress tls
[root@master01 dashboard]# kubectl -n kubernetes-dashboard create secret tls kubernetes-dashboard-tls --cert=http://www.likecs.com/root/dashboard/certs/tls.crt --key=http://www.likecs.com/root/dashboard/certs/tls.key
[root@master01 dashboard]# kubectl -n kubernetes-dashboard describe secrets kubernetes-dashboard-tls
创建ingress策略
[root@master01 dashboard]# cat <<EOF > dashboard-ingress.yaml
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: kubernetes-dashboard-ingress
namespace: kubernetes-dashboard
annotations:
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/use-regex: "true"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
nginx.ingress.kubernetes.io/rewrite-target: /
nginx.ingress.kubernetes.io/ssl-redirect: "true"
#nginx.ingress.kubernetes.io/secure-backends: "true"
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/proxy-connect-timeout: "600"
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
nginx.ingress.kubernetes.io/configuration-snippet: |
proxy_ssl_session_reuse off;
spec:
rules:
- host: web.odocker.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: kubernetes-dashboard
port:
number: 443
tls:
- hosts:
- web.odocker.com
secretName: kubernetes-dashboard-tls
EOF
[root@master01 dashboard]# kubectl apply -f dashboard-ingress.yaml
[root@master01 dashboard]# kubectl -n kubernetes-dashboard get ingress
访问dashboard
创建kubeconfig文件
使用token相对复杂，可将token添加至kubeconfig文件中，使用KubeConfig文件访问dashboard。
[root@master01 dashboard]# ADMIN_SECRET=$(kubectl -n kubernetes-dashboard get secret | grep admin | awk '{print $1}')
[root@master01 dashboard]# DASHBOARD_LOGIN_TOKEN=$(kubectl describe secret -n kubernetes-dashboard ${ADMIN_SECRET} | grep -E '^token' | awk '{print $2}')
[root@master01 dashboard]# kubectl config set-cluster kubernetes \
--certificate-authority=http://www.likecs.com/etc/kubernetes/pki/ca.crt \
--embed-certs=true \
--server=172.24.8.100:16443 \
--kubeconfig=local-ngkeconk8s-1-21-admin.kubeconfig # 设置集群参数
[root@master01 dashboard]# kubectl config set-credentials dashboard_user \
--token=${DASHBOARD_LOGIN_TOKEN} \
--kubeconfig=local-ngkeconk8s-1-21-admin.kubeconfig
# 设置客户端认证参数，使用上面创建的 Token
[root@master01 dashboard]# kubectl config set-context default \
--cluster=kubernetes \
--user=dashboard_user \
--kubeconfig=local-ngkeconk8s-1-21-admin.kubeconfig
# 设置上下文参数
[root@master01 dashboard]# kubectl config use-context default --kubeconfig=local-ngkeconk8s-1-21-admin.kubeconfig
# 设置默认上下文
将web.odocker.com.crt证书文件导入，以便于浏览器使用该文件登录。
导入证书
将web.odocker.com证书导入浏览器，并设置为信任，导入操作略。
测试访问dashboard
