码迷,mamicode.com
首页 > 其他好文 > 详细

k8s 部署dashboard

时间:2020-02-09 18:06:07      阅读:79      评论:0      收藏:0      [点我收藏+]

标签:bec   自签证书   ken   account   binding   new   oca   apply   fat   

1. 当前环境

kubernetes        v1.17
dashboard         v2.0.0-rc5

2. 部署dashboard

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc5/aio/deploy/recommended.yaml

修改service的为NodePort:30443,以便外网可以访问,以https访问网站时出现证书无效的错误。

3. 自签证书

  • 创建自签名CA
openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj "/C=CN/ST=CD/L=GX/O=WHYFATE/OU=WH/CN=CA"
  • 签发dashboard证书
openssl genrsa -out dashboard.key 2048
openssl req -new -sha256 -key dashboard.key -out dashboard.csr -subj "/C=CN/ST=CD/L=GX/O=WHYFATE/OU=WH/CN=192.168.0.200"
// ---配置dashboard.cnf ---
// vim dashboard.cnf
extensions = san
[san]
keyUsage = digitalSignature
extendedKeyUsage = clientAuth,serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
subjectAltName = IP:192.168.0.200,IP:127.0.0.1,DNS:192.168.0.200,DNS:localhost
// --- 签发证书 ---
openssl x509 -req -sha256 -days 3650 -in dashboard.csr -out dashboard.crt -CA ca.crt -CAkey ca.key -CAcreateserial -extfile dashboard.cnf

4. 更新部署dashboard

  • 删除 kubernetes-dashboard-certs
kubectl delete secret kubernetes-dashboard-certs -n kubernetes-dashboard
  • 根据文件生成secret
kubectl create secret generic kubernetes-dashboard-certs --from-file="tls/dashboard.crt,tls/dashboard.key" -n kubernetes-dashboard
  • 删除 dashboard pod 更新部署

    5. 导入CA

    拷贝ca.crt文件到要访问的机器上,导入证书。
    mac os 打开 钥匙串访问,把ca文件拖进去,信任 选择 始终信任,访问网站,出现192.168.0.200的登录证书,信任 选择 始终信任即可。

    6. 创建ServiceAccount以便登录dashboard

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard
  • 得到token
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')

拷贝token,登录选择token即可。

k8s 部署dashboard

标签:bec   自签证书   ken   account   binding   new   oca   apply   fat   

原文地址:https://www.cnblogs.com/wh-blog/p/12287788.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!