1. 必要工具准备

1.1 下载部署dashboard 需要的yaml文件

wget https://github.com/kubernetes/dashboard/blob/v2.0.0/aio/deploy/recommended.yaml

也可以用这个文件：
recommended.yaml

1.2 制作证书

vim create_cert.sh
#!/bin/bash
if [ $# -ne 4 ];then
    echo "please user in: `basename $0` SECRET_NAME CERT_NAME DOMAIN NAMESPACE"
    exit 1
fi
SECRET_NAME=$1
CERT_NAME=$2
DOMAIN=$3
NAMESPACE=$4
# TLS Secrets 
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout ${CERT_NAME}.key -out ${CERT_NAME}.crt -subj "/CN=${DOMAIN}/O=${DOMAIN}"
# 创建 NAMESPACE
kubectl get namespace |grep ${NAMESPACE}
if [ $? -eq 0 ]; then
     echo "[INFO] ${NAMESPACE} is already exists"
else
     kubectl create namespace ${NAMESPACE}
     echo "[INFO] create ${NAMESPACE} success!"
fi
# 如果你使用--key --cert方式则创建的secret中data的默认2个文件名就是tls.key和tls.crt
kubectl create secret generic ${SECRET_NAME} --from-file=${CERT_NAME}.crt --from-file=${CERT_NAME}.key -n ${NAMESPACE}

运行上面文件

chmod 7 create_cert.sh
./create_cert.sh kubernetes-dashboard-certs dashboard dashboard.shiqi.cn kubernetes-dashboard
Generating a 2048 bit RSA private key
........+++
....................................................+++
writing new private key to 'dashboard.key'
-----
kubernetes-dashboard   Active   2m48s
[INFO] kubernetes-dashboard is already exists
secret/kubernetes-dashboard-certs created

1.3 修改配置文件

[root@m]# vim ./recommended.yaml
#将以下内容注释，因为要用我们自己生成的证书
# ---
#apiVersion: v1
#kind: Secret
#metadata:
#  labels:
#    k8s-app: kubernetes-dashboard
#  name: kubernetes-dashboard-certs
#  namespace: kubernetes-dashboard
#type: Opaque
...
# 修改启动参数，添加证书路径
...
kind: Deployment
apiVersion: apps/v1
metadata:
spec:
...
    spec:
      containers:
        - name: kubernetes-dashboard
          image: kubernetesui/dashboard:v2.0.3
          imagePullPolicy: Always
          ports:
            - containerPort: 8443
              protocol: TCP
          command:                              # 新增
            - /dashboard                        # 新增
          args:
            - --auto-generate-certificates
            - --namespace=kubernetes-dashboard
            - --token-ttl=3600                  # 新增
            - --bind-address=0.0.0.0            # 新增
            - --tls-cert-file=dashboard.crt     # 新增 
            - --tls-key-file=dashboard.key      # 新增

kubectl apply -f recommended.yaml

1.4 创建 ingress 文件

[root@uk8s-a ingress]# vim ingress-dashboard.yaml
[root@uk8s-a ingress]# cat ingress-dashboard.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-dashboard
  namespace: kubernetes-dashboard
  annotations:
    kubernetes.io/ingress.class: "nginx"
    # 开启use-regex，启用path的正则匹配
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  tls:
  - hosts:
    - dashboard.5179.top
    secretName: kubernetes-dashboard-certs
  rules:
  - host: dashboard.5179.top
    http:
      paths:
      - path: /
        backend:
          serviceName: kubernetes-dashboard
          servicePort: 443

1.5 创建用户

[root@m]# cat create-user.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard
[root@m]# kubectl apply -f create-user.yaml
serviceaccount/admin-user unchanged
clusterrolebinding.rbac.authorization.k8s.io/admin-user unchanged

1.6 获取token

[root@m]# cat get-user-token.sh
#!/bin/bash
USER=${1:-admin-user}
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep $USER | awk '{print $1}')
# 执行一下脚本
[root@uk8s-a web-ui]# bash get-user-token.sh
Name:         admin-user-token-dhx6r
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: admin-user
              kubernetes.io/service-account.uid: 84583c60-2c95-4118-9158-6341962d917f
Type:  kubernetes.io/service-account-token
Data
====
ca.crt:     1363 bytes
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6ImZlaXFTZERBdjhGLWwyZ0xLTzljaHdhSlJ1OWdfeTNDWU4wRzhuS3MyYTAifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLWRoeDZyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI4NDU4M2M2MC0yYzk1LTQxMTgtOTE1OC02MzQxOTYyZDkxN2YiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.tPgicyWaMDfN5GkLY8XX2S-jhS-pvNC6eNvZ1FCIgZi3quWQND_JASqUr4Y9nyzdFtt-Jog1QbBCRGOE1YMrc3CX27TZttsbJNgq_PqlSjJ8NpmQfUzL5EAaYEUk7bcTRsePrGpECLqih7OOMN1lXO3WYiMJLfeDvkSaUweuUQzSTGtdkzbjVmVY-DksejyXSO_DI_-DMa4lq8zTnegwywdNUkFu06J_DXTTZZIpyKBKvpKz0pny2JIS4x9rI6v4g4Ljw47U7GM30CkQeletagQ8tjXf8g2QTp7Puc9NIpK39u8H1SIqbEZCBtRTJEfLTibDXXnlNplZF5FQ5bms1g

1.7 宿主机上访问虚拟机

https://dashboard.shiqi.cn/#/persistentvolume?namespace=default

参见

安装 k8s-dashboard 并通过 ingress 暴露访问