标签：stat pig 没有 none wget hub 开发环境 sts docker
Kubernetes Dashboard是Kubernetes集群的通用基于Web的UI。它允许用户管理在群集中运行的应用程序并对其进行故障排除，并管理群集本身。
curl -O https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/recommended/kubernetes-dashboard.yaml # https访问的 选这个
curl -O https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/alternative/kubernetes-dashboard.yaml # http方式访问> grep image kubernetes-dashboard.yaml
image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3 # 这个地址被墙，可以去docker-hub搜索此镜像上传至自己的镜像库中这里我们直接使用docker-hub上的镜像
镜像地址
> grep image kubernetes-dashboard.yaml
image: anjia0532/kubernetes-dashboard-amd64:v1.8.3
在deployment段加一个配置
- --heapster-host=http://heapster> kubectl apply -f kubernetes-dashboard.yaml
> kubectl get pods -n kube-system | grep dashboard
kubernetes-dashboard-bbc7b8b5-rj8hf 1/1 Running 0 10m
> kubectl get svc -n kube-system | grep dashboard
kubernetes-dashboard ClusterIP 10.254.61.253 <none> 80/TCP 43s要从本地工作站访问仪表板，您必须为您的Kubernetes集群创建一个安全通道。
运行以下命令：
kubectl proxy现在访问dashboard
http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/. # 可惜本地的服务器没有浏览器和GUI，可以使用elinks试下登录dashboard 的时候支持Kubeconfig 和token 两种认证方式，Kubeconfig 中也依赖token 字段，所以生成token 这一步是必不可少的。
我们创建一个admin用户并授予admin 角色绑定，使用下面的yaml文件创建admin用户并赋予他管理员权限，然后就可以通过token 登陆dashbaord，这种认证方式本质实际上是通过Service Account 的身份认证加上Bearer token请求 API server 的方式实现，参考 Kubernetes 中的认证
# cat k8s-dashboard-admin-rbac.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: admin
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: admin
namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin
namespace: kube-system
labels:
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile创建
kubectl apply -f k8s-dashboard-admin-rbac.yaml上面的admin用户创建完成后我们就可以获取到该用户对应的token了，如下命令：
> kubectl get secret -n kube-system|grep admin-token
admin-token-ph8sh kubernetes.io/service-account-token 3 11m
> kubectl get secret admin-token-ph8sh -o jsonpath={.data.token} -n kube-system |base64 -d
eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi10b2tlbi1waDhzaCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJhZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImYwYmM5ZjFmLTc2MDUtMTFlOC05YWQ1LTAwNTA1Njk4MDRmYyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTphZG1pbiJ9.TcGnYLj7008BNATdddz070f4Pu_FfXty0DjJdAey_TII9KTQnsfCpGDqDcMEl5XzeKrHRt7WH_3jP7LTv6ZDwU24cJB2MtAPWAOsLPasOyooIRAej53JzNcY_uP3NB0rF1xqBO28GtVHal-snzDPANcFTDtHHvvF2BCsa-dP__jCwG88vPHTa1h4TWVGHdsP2KcbH_56NTDdfeJg7CtXxs-KCWRS3K_3R4nwa1s1rSCSePot8OtbJ-SpVGZu9-G3-5XPNCqKk_TuCWMIPP2ZkWIJscudoPXwXX-8uC1_0WMpLuyvWnpQlVjGpVnhiOQHcNhSvsfZMeDXv4HoVskHgA 这个token有效期只针对于当前生命周期内的dashborad，如果删除后再创建，需要生成新的token
Heapster是容器集群监控和性能分析工具，天然的支持Kubernetes和CoreOS。Kubernetes有个出名的监控cAdvisor。在每个kubernetes Node上都会运行cAdvisor，它会收集本机以及容器的监控数据(cpu,memory,filesystem,network,uptime)。
在较新的版本中，K8S已经将cAdvisor功能集成到kubelet组件中。每个Node节点可以直接进行web访问。cAdvisor web界面访问： http://< Node-IP >:4194
cAdvisor也提供Restful API: https://github.com/google/cadvisor/blob/master/docs/api.md
到heapster release 页面下载最新版的heapster
> wget https://github.com/kubernetes/heapster/archive/v1.5.3.tar.gz
> tar -xf v1.5.3.tar.gz
# 相关文件
> cd heapster-1.5.3/deploy/kube-config/
> ls rbac/ && ls influxdb/
heapster-rbac.yaml
grafana.yaml heapster.yaml influxdb.yaml> grep image influxdb/*
influxdb/grafana.yaml: image: gcr.io/google_containers/heapster-grafana-amd64:v4.4.3
influxdb/heapster.yaml: image: gcr.io/google_containers/heapster-amd64:v1.5.3
influxdb/influxdb.yaml: image: gcr.io/google_containers/heapster-influxdb-amd64:v1.3.3> grep image influxdb/*
influxdb/grafana.yaml: image: anjia0532/heapster-grafana-amd64:v4.4.3
influxdb/heapster.yaml: image: anjia0532/heapster-amd64:v1.5.3
influxdb/influxdb.yaml: image: anjia0532/heapster-influxdb-amd64:v1.3.3> cp rbac/heapster-rbac.yaml influxdb/
> cd influxdb/
> ls
grafana.yaml heapster-rbac.yaml heapster.yaml influxdb.yaml
> kubectl create -f .> kubectl get svc -n kube-system -o wide
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
coredns ClusterIP 10.254.0.2 <none> 53/UDP,53/TCP 7d k8s-app=coredns
heapster ClusterIP 10.254.76.86 <none> 80/TCP 24s k8s-app=heapster
kubernetes-dashboard ClusterIP 10.254.61.253 <none> 80/TCP 1h k8s-app=kubernetes-dashboard
monitoring-grafana ClusterIP 10.254.234.193 <none> 80/TCP 24s k8s-app=grafana
monitoring-influxdb ClusterIP 10.254.83.156 <none> 8086/TCP 24s k8s-app=influxdb
> kubectl get pod -n kube-system -o wide
NAME READY STATUS RESTARTS AGE IP NODE
coredns-66c9f6f9f7-5k9fb 1/1 Running 1 3d 172.18.16.2 k8s-n2-16-239
heapster-d59d66579-gr8sf 1/1 Running 0 33s 172.18.29.3 k8s-n3-16-240
kubernetes-dashboard-bbc7b8b5-rj8hf 1/1 Running 0 1h 172.18.29.2 k8s-n3-16-240
monitoring-grafana-bff95c48c-7kfjm 1/1 Running 0 10m 172.18.16.3 k8s-n2-16-239
monitoring-influxdb-5d474bf6d5-56pxq 1/1 Running 0 34s 172.18.52.2 k8s-n1-16-238我们之前使用kubectl proxy就是只能loclahost访问
kubectl proxy --address='0.0.0.0' --accept-hosts='^*$'然后访问
http://<master-ip>:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/ # 也是半天没出来NodePort是将节点直接暴露在外网的一种方式，只建议在开发环境，单节点的安装方式中使用。
启用NodePort很简单，只需执行kubectl edit命令进行编辑：
kubectl -n kube-system edit service kubernetes-dashboard输出
apiVersion: v1
kind: Service
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"k8s-app":"kubernetes-dashboard"},"name":"kubernetes-dashboard","namespace":"kube-system"},"spec":{"ports":[{"port":443,"targetPort":8443}],"selector":{"k8s-app":"kubernetes-dashboard"}}}
creationTimestamp: 2018-06-22T09:56:05Z
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
resourceVersion: "1715288"
selfLink: /api/v1/namespaces/kube-system/services/kubernetes-dashboard
uid: 7abab091-7602-11e8-80c7-00505698f5d8
spec:
clusterIP: 10.254.61.253
ports:
- port: 443
protocol: TCP
targetPort: 8443
selector:
k8s-app: kubernetes-dashboard
sessionAffinity: None
type: ClusterIP
status:
loadBalancer: {}将上面的type: ClusterIP修改为type: NodePort，保存后使用kubectl get service命令来查看自动生产的端口：
> kubectl -n kube-system get service kubernetes-dashboard
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes-dashboard NodePort 10.254.61.253 <none> 443:30054/TCP 2hs
> kubectl -n kube-system get pod -o wide | grep dashboard
kubernetes-dashboard-9d85bdcb6-n5ngf 1/1 Running 0 14m 172.18.16.4 k8s-n2-16-239访问
https://192.168.16.239:30054/#!/login # 登录界面，输入之前的令牌就可以登录如果Kubernetes API服务器是公开的，并可以从外部访问，那我们可以直接使用API Server的方式来访问，也是比较推荐的方式。
Dashboard的访问地址为：
https://<master-ip>:<apiserver-port>/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/
https://api.kubernetes.master/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/返回结果
kind "Status"
apiVersion "v1"
metadata {}
status "Failure"
message "services \"https:kubernetes-dashboard:\" is forbidden: User \"system:anonymous\" cannot get services/proxy in the namespace \"kube-system\""
reason "Forbidden"
details
name "https:kubernetes-dashboard:"
kind "services"
code 403这是因为最新版的k8s默认启用了RBAC，并为未认证用户赋予了一个默认的身份：anonymous
对于API Server来说，它是使用证书进行认证的，我们需要先创建一个证书：
2.然后我们使用client-certificate-data和client-key-data生成一个p12文件，可使用下列命令：
# 生成client-certificate-data
grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt
# 生成client-key-data
grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key
# 生成p12
openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name "kubernetes-client"3.最后在浏览器导入上面生成的p12文件，重新打开浏览器
因为证书无法签证通过，还是无法访问到
使用开源的反向代理负载均衡软件(nginx,haproxy)与k8s集成，更为方便灵活的服务暴露方式，推荐使用这种，在下面的Ingress我们会将dashboard service使用traefik暴露出来进行访问的
[k8s集群系列-09]Kubernetes 组件 Dashboard
标签：stat pig 没有 none wget hub 开发环境 sts docker
原文地址：https://www.cnblogs.com/knmax/p/9215417.html
