1. # Copyright 2017 The Kubernetes Authors.
    2. #
    3. # Licensed under the Apache License, Version 2.0 (the "License");
    4. # you may not use this file except in compliance with the License.
    5. # You may obtain a copy of the License at
    6. #
    7. #     http://www.apache.org/licenses/LICENSE-2.0
    8. #
    9. # Unless required by applicable law or agreed to in writing, software
    10. # distributed under the License is distributed on an "AS IS" BASIS,
    11. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12. # See the License for the specific language governing permissions and
    13. # limitations under the License.
    15. apiVersion: v1
    16. kind: Namespace
    17. metadata:
    18.   name: kubernetes-dashboard
    20. ---
    22. apiVersion: v1
    23. kind: ServiceAccount
    24. metadata:
    25.   labels:
    26.     k8s-app: kubernetes-dashboard
    27.   name: kubernetes-dashboard
    28.   namespace: kubernetes-dashboard
    30. ---
    32. kind: Service
    33. apiVersion: v1
    34. metadata:
    35.   labels:
    36.     k8s-app: kubernetes-dashboard
    37.   name: kubernetes-dashboard
    38.   namespace: kubernetes-dashboard
    39. spec:
    40.   ports:
    41.     - port: 443
    42.       targetPort: 8443
    43.   selector:
    44.     k8s-app: kubernetes-dashboard
    46. ---
    48. apiVersion: v1
    49. kind: Secret
    50. metadata:
    51.   labels:
    52.     k8s-app: kubernetes-dashboard
    53.   name: kubernetes-dashboard-certs
    54.   namespace: kubernetes-dashboard
    55. type: Opaque
    57. ---
    59. apiVersion: v1
    60. kind: Secret
    61. metadata:
    62.   labels:
    63.     k8s-app: kubernetes-dashboard
    64.   name: kubernetes-dashboard-csrf
    65.   namespace: kubernetes-dashboard
    66. type: Opaque
    67. data:
    68.   csrf: ""
    70. ---
    72. apiVersion: v1
    73. kind: Secret
    74. metadata:
    75.   labels:
    76.     k8s-app: kubernetes-dashboard
    77.   name: kubernetes-dashboard-key-holder
    78.   namespace: kubernetes-dashboard
    79. type: Opaque
    81. ---
    83. kind: ConfigMap
    84. apiVersion: v1
    85. metadata:
    86.   labels:
    87.     k8s-app: kubernetes-dashboard
    88.   name: kubernetes-dashboard-settings
    89.   namespace: kubernetes-dashboard
    91. ---
    93. kind: Role
    94. apiVersion: rbac.authorization.k8s.io/v1
    95. metadata:
    96.   labels:
    97.     k8s-app: kubernetes-dashboard
    98.   name: kubernetes-dashboard
    99.   namespace: kubernetes-dashboard
    100. rules:
    101.   # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
    102.   - apiGroups: [""]
    103.     resources: ["secrets"]
    104.     resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
    105.     verbs: ["get", "update", "delete"]
    106.     # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
    107.   - apiGroups: [""]
    108.     resources: ["configmaps"]
    109.     resourceNames: ["kubernetes-dashboard-settings"]
    110.     verbs: ["get", "update"]
    111.     # Allow Dashboard to get metrics.
    112.   - apiGroups: [""]
    113.     resources: ["services"]
    114.     resourceNames: ["heapster", "dashboard-metrics-scraper"]
    115.     verbs: ["proxy"]
    116.   - apiGroups: [""]
    117.     resources: ["services/proxy"]
    118.     resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
    119.     verbs: ["get"]
    121. ---
    123. kind: ClusterRole
    124. apiVersion: rbac.authorization.k8s.io/v1
    125. metadata:
    126.   labels:
    127.     k8s-app: kubernetes-dashboard
    128.   name: kubernetes-dashboard
    129. rules:
    130.   # Allow Metrics Scraper to get metrics from the Metrics server
    131.   - apiGroups: ["metrics.k8s.io"]
    132.     resources: ["pods", "nodes"]
    133.     verbs: ["get", "list", "watch"]
    135. ---
    137. apiVersion: rbac.authorization.k8s.io/v1
    138. kind: RoleBinding
    139. metadata:
    140.   labels:
    141.     k8s-app: kubernetes-dashboard
    142.   name: kubernetes-dashboard
    143.   namespace: kubernetes-dashboard
    144. roleRef:
    145.   apiGroup: rbac.authorization.k8s.io
    146.   kind: Role
    147.   name: kubernetes-dashboard
    148. subjects:
    149.   - kind: ServiceAccount
    150.     name: kubernetes-dashboard
    151.     namespace: kubernetes-dashboard
    153. ---
    155. apiVersion: rbac.authorization.k8s.io/v1
    156. kind: ClusterRoleBinding
    157. metadata:
    158.   name: kubernetes-dashboard
    159. roleRef:
    160.   apiGroup: rbac.authorization.k8s.io
    161.   kind: ClusterRole
    162.   name: kubernetes-dashboard
    163. subjects:
    164.   - kind: ServiceAccount
    165.     name: kubernetes-dashboard
    166.     namespace: kubernetes-dashboard
    168. ---
    170. kind: Deployment
    171. apiVersion: apps/v1
    172. metadata:
    173.   labels:
    174.     k8s-app: kubernetes-dashboard
    175.   name: kubernetes-dashboard
    176.   namespace: kubernetes-dashboard
    177. spec:
    178.   replicas: 1
    179.   revisionHistoryLimit: 10
    180.   selector:
    181.     matchLabels:
    182.       k8s-app: kubernetes-dashboard
    183.   template:
    184.     metadata:
    185.       labels:
    186.         k8s-app: kubernetes-dashboard
    187.     spec:
    188.       containers:
    189.         - name: kubernetes-dashboard
    190.           image: kubernetesui/dashboard:v2.4.0
    191.           imagePullPolicy: Always
    192.           ports:
    193.             - containerPort: 8443
    194.               protocol: TCP
    195.           args:
    196.             - --auto-generate-certificates
    197.             - --namespace=kubernetes-dashboard
    198.             # Uncomment the following line to manually specify Kubernetes API server Host
    199.             # If not specified, Dashboard will attempt to auto discover the API server and connect
    200.             # to it. Uncomment only if the default does not work.
    201.             # - --apiserver-host=http://my-address:port
    202.           volumeMounts:
    203.             - name: kubernetes-dashboard-certs
    204.               mountPath: /certs
    205.               # Create on-disk volume to store exec logs
    206.             - mountPath: /tmp
    207.               name: tmp-volume
    208.           livenessProbe:
    209.             httpGet:
    210.               scheme: HTTPS
    211.               path: /
    212.               port: 8443
    213.             initialDelaySeconds: 30
    214.             timeoutSeconds: 30
    215.           securityContext:
    216.             allowPrivilegeEscalation: false
    217.             readOnlyRootFilesystem: true
    218.             runAsUser: 1001
    219.             runAsGroup: 2001
    220.       volumes:
    221.         - name: kubernetes-dashboard-certs
    222.           secret:
    223.             secretName: kubernetes-dashboard-certs
    224.         - name: tmp-volume
    225.           emptyDir: {}
    226.       serviceAccountName: kubernetes-dashboard
    227.       nodeSelector:
    228.         "kubernetes.io/os": linux
    229.       # Comment the following tolerations if Dashboard must not be deployed on master
    230.       tolerations:
    231.         - key: node-role.kubernetes.io/master
    232.           effect: NoSchedule
    234. ---
    236. kind: Service
    237. apiVersion: v1
    238. metadata:
    239.   labels:
    240.     k8s-app: dashboard-metrics-scraper
    241.   name: dashboard-metrics-scraper
    242.   namespace: kubernetes-dashboard
    243. spec:
    244.   ports:
    245.     - port: 8000
    246.       targetPort: 8000
    247.   selector:
    248.     k8s-app: dashboard-metrics-scraper
    250. ---
    252. kind: Deployment
    253. apiVersion: apps/v1
    254. metadata:
    255.   labels:
    256.     k8s-app: dashboard-metrics-scraper
    257.   name: dashboard-metrics-scraper
    258.   namespace: kubernetes-dashboard
    259. spec:
    260.   replicas: 1
    261.   revisionHistoryLimit: 10
    262.   selector:
    263.     matchLabels:
    264.       k8s-app: dashboard-metrics-scraper
    265.   template:
    266.     metadata:
    267.       labels:
    268.         k8s-app: dashboard-metrics-scraper
    269.     spec:
    270.       securityContext:
    271.         seccompProfile:
    272.           type: RuntimeDefault
    273.       containers:
    274.         - name: dashboard-metrics-scraper
    275.           image: kubernetesui/metrics-scraper:v1.0.7
    276.           ports:
    277.             - containerPort: 8000
    278.               protocol: TCP
    279.           livenessProbe:
    280.             httpGet:
    281.               scheme: HTTP
    282.               path: /
    283.               port: 8000
    284.             initialDelaySeconds: 30
    285.             timeoutSeconds: 30
    286.           volumeMounts:
    287.           - mountPath: /tmp
    288.             name: tmp-volume
    289.           securityContext:
    290.             allowPrivilegeEscalation: false
    291.             readOnlyRootFilesystem: true
    292.             runAsUser: 1001
    293.             runAsGroup: 2001
    294.       serviceAccountName: kubernetes-dashboard
    295.       nodeSelector:
    296.         "kubernetes.io/os": linux
    297.       # Comment the following tolerations if Dashboard must not be deployed on master
    298.       tolerations:
    299.         - key: node-role.kubernetes.io/master
    300.           effect: NoSchedule
    301.       volumes:
    302.         - name: tmp-volume
    303.           emptyDir: {}