Kubernetes

1、部署准备工作

部署最小化 K8S 集群：master + node1 + node2

Ubuntu 是一款基于 Debian Linux 的以桌面应用为主的操作系统，内容涵盖文字处理、电子邮件、软件开发工具和 Web 服务等，可供用户免费下载、使用和分享。

  1. ➜ vgs
  2. Current machine states:
  3. master                    running (virtualbox)
  4. node1                     running (virtualbox)
  5. node2                     running (virtualbox)

1.1 基础环境信息

设置系统主机名以及 Host 文件各节点之间的相互解析

  • 使用这个的 Vagrantfile 启动的三节点服务已经配置好了
  • 以下使用 master 节点进行演示查看，其他节点操作均一致
  1. # hostnamectl
  2. vagrant@k8s-master:~$ hostnamectl
  3.    Static hostname: k8s-master
  5. # hosts
  6. vagrant@k8s-master:~$ cat /etc/hosts
  7. 127.0.0.1        localhost
  8. 127.0.1.1        vagrant.vm    vagrant
  9. 192.168.30.30    k8s-master
  10. 192.168.30.31    k8s-node1
  11. 192.168.30.32    k8s-node2
  13. # ping
  14. vagrant@k8s-master:~$ ping k8s-node1
  15. PING k8s-node1 (192.168.30.31) 56(84) bytes of data.
  16. 64 bytes from k8s-node1 (192.168.30.31): icmp_seq=1 ttl=64 time=0.689 ms

1.2 阿里源配置

配置 Ubuntu 的阿里源来加速安装速度

  • 阿里源镜像地址
  1. # 登录服务器
  2. ➜ vgssh master/node1/nod2
  3. Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-50-generic x86_64)
  5. # 设置阿里云Ubuntu镜像
  6. $ sudo cp /etc/apt/sources.list{,.bak}
  7. $ sudo vim /etc/apt/sources.list
  9. # 配置kubeadm的阿里云镜像源
  10. $ sudo vim /etc/apt/sources.list
  11. deb https://mirrors.aliyun.com/kubernetes/apt kubernetes-xenial main
  12. $ sudo gpg --keyserver keyserver.ubuntu.com --recv-keys BA07F4FB
  13. $ sudo gpg --export --armor BA07F4FB | sudo apt-key add -
  15. # 配置docker安装
  16. $ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
  17. $ sudo apt-key fingerprint 0EBFCD88
  18. $ sudo vim /etc/apt/sources.list
  19. deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
  21. # 更新仓库
  22. $ sudo apt update
  23. $ sudo apt dist-upgrade

1.3 基础工具安装

部署阶段的基础工具安装

  • 基础组件 docker
  • 部署工具 kubeadm
  • 路由规则 ipvsadm
  • 时间同步 ntp
  1. # 基础工具安装
  2. $ sudo apt install -y \
  3.     docker-ce docker-ce-cli containerd.io \
  4.     kubeadm ipvsadm \
  5.     ntp ntpdate \
  6.     nginx supervisor
  8. # 将当前普通用户加入docker组(需重新登录)
  9. $ sudo usermod -a -G docker $USER
  11. # 服务启用
  12. $ sudo systemctl enable docker.service
  13. $ sudo systemctl start docker.service
  14. $ sudo systemctl enable kubelet.service
  15. $ sudo systemctl start kubelet.service

1.4 操作系统配置

操作系统相关配置

  • 关闭缓存
  • 配置内核参数
  • 调整系统时区
  • 升级内核版本(默认为4.15.0的版本)
  1. # 关闭缓存
  2. $ sudo swapoff -a
  4. # 为K8S来调整内核参数
  5. $ sudo touch /etc/sysctl.d/kubernetes.conf
  6. $ sudo cat > /etc/sysctl.d/kubernetes.conf <<EOF
  7. net.bridge.bridge-nf-call-iptables = 1 # 开启网桥模式(必须)
  8. net.bridge.bridge-nf-call-ip6tables = 1 # 开启网桥模式(必须)
  9. net.ipv6.conf.all.disable_ipv6 = 1 # 关闭IPv6协议(必须)
  10. net.ipv4.ip_forward = 1 # 转发模式(默认开启)
  11. vm.panic_on_oom=0 # 开启OOM(默认开启)
  12. vm.swappiness = 0 # 禁止使用swap空间
  13. vm.overcommit_memory=1 # 不检查物理内存是否够用
  14. fs.inotify.max_user_instances=8192
  15. fs.inotify.max_user_watches=1048576
  16. fs.file-max = 52706963 # 设置文件句柄数量
  17. fs.nr_open = 52706963 # 设置文件的最大打开数量
  18. net.netfilter.nf_conntrack_max = 2310720
  19. EOF
  21. # 查看系统内核参数的方式
  22. $ sudo sysctl -a | grep xxx
  23. # 使内核参数配置文件生效
  24. $ sudo sysctl -p /etc/sysctl.d/kubernetes.conf
  25. # 设置系统时区为中国/上海
  26. $ sudo timedatectl set-timezone Asia/Shanghai
  28. # 将当前的UTC时间写入硬件时钟
  29. $ sudo timedatectl set-local-rtc 0

1.5 开启 ipvs 服务

开启 ipvs 服务

  • kube-proxy 开启 ipvs 的前置条件
  1. # 载入指定的个别模块
  2. $ modprobe br_netfilter
  4. # 修改配置
  5. $ cat > /etc/sysconfig/modules/ipvs.modules <<EOF
  6. #!/bin/bash
  7. modprobe -- ip_vs
  8. modprobe -- ip_vs_rr
  9. modprobe -- ip_vs_wrr
  10. modprobe -- ip_vs_sh
  11. modprobe -- nf_conntrack_ipv
  12. EOF
  14. # 加载配置
  15. $ chmod 755 /etc/sysconfig/modules/ipvs.modules \
  16.     && bash /etc/sysconfig/modules/ipvs.modules \
  17.     && lsmod | grep -e ip_vs -e nf_conntrack_ipv

2、部署 Master 节点

节点最低配置: 2C+2G 内存；从节点资源尽量充足

kubeadm 工具的 init 命令，即可初始化以单节点部署的 master。为了避免翻墙，这里可以使用阿里云的谷歌源来代替。在执行 kubeadm 部署命令的时候，指定对应地址即可。当然，可以将其加入本地的镜像库之中，更易维护。

注意事项

  • 阿里云谷歌源地址
  • 使用 kubeadm 定制控制平面配置
  1. # 登录服务器
  2. ➜ vgssh master
  3. Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-50-generic x86_64)
  5. # 部署节点(命令行)
  6. # 注意pod和service的地址需要不同(否则会报错)
  7. $ sudo kubeadm init \
  8.     --kubernetes-version=1.20.2 \
  9.     --image-repository registry.aliyuncs.com/google_containers \
  10.     --apiserver-advertise-address=192.168.30.30 \
  11.     --pod-network-cidr=10.244.0.0/16 \
  12.     --service-cidr=10.245.0.0/16
  14. # 部署镜像配置(配置文件)
  15. $ sudo kubeadm init --config ./kubeadm-config.yaml
  16. Your Kubernetes control-plane has initialized successfully!
  18. # 查看IP段是否生效(iptable)
  19. $ ip route show
  20. 10.244.0.0/24 dev cni0 proto kernel scope link src 10.244.0.1
  21. 10.244.1.0/24 via 10.244.1.0 dev flannel.1 onlink
  22. 10.244.2.0/24 via 10.244.2.0 dev flannel.1 onlink
  24. # # 查看IP段是否生效(ipvs)
  25. $ ipvsadm -L -n
  26. IP Virtual Server version 1.2.1 (size=4096)
  27. Prot LocalAddress:Port Scheduler Flags
  28.   -> RemoteAddress:Port           Forward Weight ActiveConn InActConn

配置文件定义

  • 接口使用了 v1beta2 版本
  • 配置主节点 IP 地址为 192.168.30.30
  • 为 flannel 分配的是 10.244.0.0/16 网段
  • 选择的 kubernetes 是当前最新的 1.20.2 版本
  • 加入了 controllerManager 的水平扩容功能
  1. # kubeadm-config.yaml
  2. # sudo kubeadm config print init-defaults > kubeadm-config.yaml
  3. apiVersion: kubeadm.k8s.io/v1beta2
  4. imageRepository: registry.aliyuncs.com/google_containers
  5. kind: ClusterConfiguration
  6. kubernetesVersion: v1.20.2
  7. apiServer:
  8.   extraArgs:
  9.     advertise-address: 192.168.30.30
  10. networking:
  11.   podSubnet: 10.244.0.0/16
  12. controllerManager:
  13.   ExtraArgs:
  14.     horizontal-pod-autoscaler-use-rest-clients: "true"
  15.     horizontal-pod-autoscaler-sync-period: "10s"
  16.     node-monitor-grace-period: "10s"

执行成功之后会输出如下信息，需要安装如下步骤操作下

第一步 在 kubectl 默认控制和操作集群节点的时候，需要使用到 CA 的密钥，传输过程是通过 TLS 协议保障通讯的安全性。通过下面 3 行命令拷贝密钥信息到当前用户家目录下，这样 kubectl 执行时会首先访问 .kube 目录，使用这些授权信息访问集群。

第二步 之后添加 worker 节点时，要通过 token 才能保障安全性。因此，先把显示的这行命令保存下来，以备后续使用会用到。

  1. # master setting step one
  2. To start cluster, you need to run the following as a regular user:
  3.   mkdir -p $HOME/.kube
  4.   sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  5.   sudo chown $(id -u):$(id -g) $HOME/.kube/config
  7. Alternatively, if you are the root user, you can run:
  8.   export KUBECONFIG=/etc/kubernetes/admin.conf
  10. # master setting step two
  11. You should now deploy a pod network to the cluster.
  12. Run "kubectl apply -f [podnetwork].yaml" with one of the options listed:
  13.   https://kubernetes.io/docs/concepts/cluster-administration/addons/
  15. Join any number of worker nodes by running the following on each as root:
  16. kubeadm join 192.168.30.30:6443 \
  17.   --token lebbdi.p9lzoy2a16tmr6hq \
  18.   --discovery-token-ca-cert-hash \
  19.   sha256:6c79fd83825d7b2b0c3bed9e10c428acf8ffcd615a1d7b258e9b500848c20cae

将子节点加入主节点中

  1. $ kubectl get nodes
  2. NAME         STATUS     ROLES                  AGE   VERSION
  3. k8s-master   NotReady   control-plane,master   62m   v1.20.2
  4. k8s-node1    NotReady   <none>                 82m   v1.20.2
  5. k8s-node2    NotReady   <none>                 82m   v1.20.2
  7. # 查看token令牌
  8. $ sudo kubeadm token list
  10. # 生成token令牌
  11. $ sudo kubeadm token create
  13. # 忘记sha编码
  14. $ openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt \
  15.     | openssl rsa -pubin -outform der 2>/dev/null \
  16.     | openssl dgst -sha256 -hex | sed 's/^.* //'
  17. # 生成一个新的 token 令牌(比上面的方便)
  18. $ kubeadm token generate
  20. # 直接生成 join 命令(比上面的方便)
  21. $ kubeadm token create <token_generate> --print-join-command --ttl=0

执行完成之后可以通过如下命令，查看主节点信息

默认生成四个命名空间

  • default、kube-system、kube-public、kube-node-lease

部署的核心服务有以下几个 (kube-system)

  • coredns、etcd
  • kube-apiserver、kube-scheduler
  • kube-controller-manager、kube-controller-manager

此时 master 并没有 ready 状态(需要安装网络插件)，下面安装 flannel 这个网络插件

  1. # 命名空间
  2. $ kubectl get namespace
  3. NAME              STATUS   AGE
  4. default           Active   19m
  5. kube-node-lease   Active   19m
  6. kube-public       Active   19m
  7. kube-system       Active   19m
  9. # 核心服务
  10. $ kubectl get pod -n kube-system
  11. NAME                                 READY   STATUS    RESTARTS   AGE
  12. coredns-7f89b7bc75-bh42f             1/1     Running   0          19m
  13. coredns-7f89b7bc75-dvzpl             1/1     Running   0          19m
  14. etcd-k8s-master                      1/1     Running   0          19m
  15. kube-apiserver-k8s-master            1/1     Running   0          19m
  16. kube-controller-manager-k8s-master   1/1     Running   0          19m
  17. kube-proxy-5rlpv                     1/1     Running   0          19m
  18. kube-scheduler-k8s-master            1/1     Running   0          19m

3、部署 flannel 网络

网络服务用于管理 K8S 集群中的服务网络

flannel 网络需要指定 IP 地址段，即上一步中通过编排文件设置的 10.244.0.0/16。其实可以通过 flannel 官方和 HELM 工具直接部署服务，但是原地址是需要搭梯子的。所以，可以将其内容保存在如下配置文件中，修改对应镜像地址。

部署 flannel 服务的官方下载地址

  1. # 部署flannel服务
  2. # 1.修改镜像地址(如果下载不了的话)
  3. # 2.修改Network为--pod-network-cidr的参数IP段
  4. $ kubectl apply -f ./kube-flannel.yml
  6. # 如果部署出现问题可通过如下命令查看日志
  7. $ kubectl logs kube-flannel-ds-6xxs5 --namespace=kube-system
  8. $ kubectl describe pod kube-flannel-ds-6xxs5 --namespace=kube-system

部署一个最小化的 Kubernetes 集群 - 图1

如果使用当中存在问题的，可以参考官方的问题手册

因为这里使用的是 Vagrant 虚拟出来的机器进行 K8S 的部署，但是在运行对应 yaml 配置的时候，会报错。通过查看日志发现是因为默认绑定的是虚拟机上面的 eth0 这块网卡，而这块网卡是 Vagrant 使用的，应该绑定的是 eth1 才对。

Vagrant 通常为所有 VM 分配两个接口，第一个为所有主机分配的 IP 地址为 10.0.2.15，用于获得 NAT 的外部流量。这样会导致 flannel 部署存在问题。通过官方问题说明，可以使用 —iface=eth1 这个参数选择第二个网卡。

对应的参数使用方式，可以参考 flannel use –iface=eth1 中的回答自行添加，而这里直接修改了启动的配置文件，在启动服务的时候通过 args 修改了，如下所示。

  1. $ kubectl get pods -n kube-system
  2. NAME                                 READY   STATUS    RESTARTS   AGE
  3. coredns-7f89b7bc75-bh42f             1/1     Running   0          61m
  4. coredns-7f89b7bc75-dvzpl             1/1     Running   0          61m
  5. etcd-k8s-master                      1/1     Running   0          62m
  6. kube-apiserver-k8s-master            1/1     Running   0          62m
  7. kube-controller-manager-k8s-master   1/1     Running   0          62m
  8. kube-flannel-ds-zl148                1/1     Running   0          44s
  9. kube-flannel-ds-ll523                1/1     Running   0          44s
  10. kube-flannel-ds-wpmhw                1/1     Running   0          44s
  11. kube-proxy-5rlpv                     1/1     Running   0          61m
  12. kube-scheduler-k8s-master            1/1     Running   0          62m

配置文件如下所示

  1. ---
  2. apiVersion: policy/v1beta1
  3. kind: PodSecurityPolicy
  4. metadata:
  5.   name: psp.flannel.unprivileged
  6.   annotations:
  7.     seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
  8.     seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
  9.     apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
  10.     apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
  11. spec:
  12.   privileged: false
  13.   volumes:
  14.     - configMap
  15.     - secret
  16.     - emptyDir
  17.     - hostPath
  18.   allowedHostPaths:
  19.     - pathPrefix: "/etc/cni/net.d"
  20.     - pathPrefix: "/etc/kube-flannel"
  21.     - pathPrefix: "/run/flannel"
  22.   readOnlyRootFilesystem: false
  23.   # Users and groups
  24.   runAsUser:
  25.     rule: RunAsAny
  26.   supplementalGroups:
  27.     rule: RunAsAny
  28.   fsGroup:
  29.     rule: RunAsAny
  30.   # Privilege Escalation
  31.   allowPrivilegeEscalation: false
  32.   defaultAllowPrivilegeEscalation: false
  33.   # Capabilities
  34.   allowedCapabilities: ["NET_ADMIN", "NET_RAW"]
  35.   defaultAddCapabilities: []
  36.   requiredDropCapabilities: []
  37.   # Host namespaces
  38.   hostPID: false
  39.   hostIPC: false
  40.   hostNetwork: true
  41.   hostPorts:
  42.     - min: 0
  43.       max: 65535
  44.   # SELinux
  45.   seLinux:
  46.     # SELinux is unused in CaaSP
  47.     rule: "RunAsAny"
  48. ---
  49. kind: ClusterRole
  50. apiVersion: rbac.authorization.k8s.io/v1
  51. metadata:
  52.   name: flannel
  53. rules:
  54.   - apiGroups: ["extensions"]
  55.     resources: ["podsecuritypolicies"]
  56.     verbs: ["use"]
  57.     resourceNames: ["psp.flannel.unprivileged"]
  58.   - apiGroups:
  59.       - ""
  60.     resources:
  61.       - pods
  62.     verbs:
  63.       - get
  64.   - apiGroups:
  65.       - ""
  66.     resources:
  67.       - nodes
  68.     verbs:
  69.       - list
  70.       - watch
  71.   - apiGroups:
  72.       - ""
  73.     resources:
  74.       - nodes/status
  75.     verbs:
  76.       - patch
  77. ---
  78. kind: ClusterRoleBinding
  79. apiVersion: rbac.authorization.k8s.io/v1
  80. metadata:
  81.   name: flannel
  82. roleRef:
  83.   apiGroup: rbac.authorization.k8s.io
  84.   kind: ClusterRole
  85.   name: flannel
  86. subjects:
  87.   - kind: ServiceAccount
  88.     name: flannel
  89.     namespace: kube-system
  90. ---
  91. apiVersion: v1
  92. kind: ServiceAccount
  93. metadata:
  94.   name: flannel
  95.   namespace: kube-system
  96. ---
  97. kind: ConfigMap
  98. apiVersion: v1
  99. metadata:
  100.   name: kube-flannel-cfg
  101.   namespace: kube-system
  102.   labels:
  103.     tier: node
  104.     app: flannel
  105. data:
  106.   cni-conf.json: |
  107.     {
  108.       "name": "cbr0",
  109.       "cniVersion": "0.3.1",
  110.       "plugins": [
  111.         {
  112.           "type": "flannel",
  113.           "delegate": {
  114.             "hairpinMode": true,
  115.             "isDefaultGateway": true
  116.           }
  117.         },
  118.         {
  119.           "type": "portmap",
  120.           "capabilities": {
  121.             "portMappings": true
  122.           }
  123.         }
  124.       ]
  125.     }
  126.   net-conf.json: |
  127.     {
  128.       "Network": "10.244.0.0/16",
  129.       "Backend": {
  130.         "Type": "vxlan"
  131.       }
  132.     }
  133. ---
  134. apiVersion: apps/v1
  135. kind: DaemonSet
  136. metadata:
  137.   name: kube-flannel-ds
  138.   namespace: kube-system
  139.   labels:
  140.     tier: node
  141.     app: flannel
  142. spec:
  143.   selector:
  144.     matchLabels:
  145.       app: flannel
  146.   template:
  147.     metadata:
  148.       labels:
  149.         tier: node
  150.         app: flannel
  151.     spec:
  152.       affinity:
  153.         nodeAffinity:
  154.           requiredDuringSchedulingIgnoredDuringExecution:
  155.             nodeSelectorTerms:
  156.               - matchExpressions:
  157.                   - key: kubernetes.io/os
  158.                     operator: In
  159.                     values:
  160.                       - linux
  161.       hostNetwork: true
  162.       priorityClassName: system-node-critical
  163.       tolerations:
  164.         - operator: Exists
  165.           effect: NoSchedule
  166.       serviceAccountName: flannel
  167.       initContainers:
  168.         - name: install-cni
  169.           image: quay.io/coreos/flannel:v0.13.1-rc1
  170.           command:
  171.             - cp
  172.           args:
  173.             - -f
  174.             - /etc/kube-flannel/cni-conf.json
  175.             - /etc/cni/net.d/10-flannel.conflist
  176.           volumeMounts:
  177.             - name: cni
  178.               mountPath: /etc/cni/net.d
  179.             - name: flannel-cfg
  180.               mountPath: /etc/kube-flannel/
  181.       containers:
  182.         - name: kube-flannel
  183.           image: quay.io/coreos/flannel:v0.13.1-rc1
  184.           command:
  185.             - /opt/bin/flanneld
  186.           args:
  187.             - --ip-masq
  188.             - --kube-subnet-mgr
  189.             - --iface=eth1
  190.           resources:
  191.             requests:
  192.               cpu: "100m"
  193.               memory: "50Mi"
  194.             limits:
  195.               cpu: "100m"
  196.               memory: "50Mi"
  197.           securityContext:
  198.             privileged: false
  199.             capabilities:
  200.               add: ["NET_ADMIN", "NET_RAW"]
  201.           env:
  202.             - name: POD_NAME
  203.               valueFrom:
  204.                 fieldRef:
  205.                   fieldPath: metadata.name
  206.             - name: POD_NAMESPACE
  207.               valueFrom:
  208.                 fieldRef:
  209.                   fieldPath: metadata.namespace
  210.           volumeMounts:
  211.             - name: run
  212.               mountPath: /run/flannel
  213.             - name: flannel-cfg
  214.               mountPath: /etc/kube-flannel/
  215.       volumes:
  216.         - name: run
  217.           hostPath:
  218.             path: /run/flannel
  219.         - name: cni
  220.           hostPath:
  221.             path: /etc/cni/net.d
  222.         - name: flannel-cfg
  223.           configMap:
  224.             name: kube-flannel-cfg

至此集群部署成功！如果有参数错误需要修改，也可以在 reset 后重新 init 集群。

  1. $ kubectl get nodes
  2. NAME         STATUS   ROLES                  AGE   VERSION
  3. k8s-master   Ready    control-plane,master   62m   v1.20.2
  4. k8s-node1    Ready    control-plane,master   82m   v1.20.2
  5. k8s-node2    Ready    control-plane,master   82m   v1.20.2
  7. # 重启集群
  8. $ sudo kubeadm reset
  9. $ sudo kubeadm init

4、部署 dashboard 服务

以 WEB 页面的可视化 dashboard 来监控集群的状态

这个还是会遇到需要搭梯子下载启动配置文件的问题，下面是对应的下载地址，可以下载之后上传到服务器上面在进行部署。

部署 dashboard 服务的官方下载地址

  1. # 部署flannel服务
  2. $ kubectl apply -f ./kube-dashboard.yaml
  4. # 如果部署出现问题可通过如下命令查看日志
  5. $ kubectl logs \
  6.     kubernetes-dashboard-c9fb67ffc-nknpj \
  7.     --namespace=kubernetes-dashboard
  8. $ kubectl describe pod \
  9.     kubernetes-dashboard-c9fb67ffc-nknpj \
  10.     --namespace=kubernetes-dashboard
  12. $ kubectl get svc -n kubernetes-dashboard
  13. NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
  14. dashboard-metrics-scraper   ClusterIP   10.245.214.11    <none>        8000/TCP   26s
  15. kubernetes-dashboard        ClusterIP   10.245.161.146   <none>        443/TCP    26s

需要注意的是 dashboard 默认不允许外网访问，即使通过 kubectl proxy 允许外网访问。但 dashboard 又只允许 HTTPS 访问，这样 kubeadm init 时自签名的 CA 证书是不被浏览器承认的。

这里采用的方案是 Nginx 作为反向代理，使用 Lets Encrypt 提供的有效证书对外提供服务，再经由 proxy_pass 指令反向代理到 kubectl proxy 上，如下所示。此时，本地可经由 8888 访问到 dashboard 服务，再通过 Nginx 访问它。

  1. # 代理(可以使用supervisor)
  2. $ kubectl proxy --accept-hosts='^*$'
  3. $ kubectl proxy --port=8888 --accept-hosts='^*$'
  4. # 测试代理是否正常(默认监听在8001端口上)
  5. $ curl -X GET -L http://localhost:8001
  7. # 本地(可以使用nginx)
  8. proxy_pass http://localhost:8001;
  9. proxy_pass http://localhost:8888;
  11. # 外网访问如下URL地址
  12. https://mydomain/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/#/login

配置文件整理

  • nginx
  • supervisor
  1. # k8s.conf
  3. client_max_body_size     80M;
  4. client_body_buffer_size  128k;
  5. proxy_connect_timeout    600;
  6. proxy_read_timeout       600;
  7. proxy_send_timeout       600;
  9. server {
  10.     listen       8080 ssl;
  11.     server_name  _;
  13.     ssl_certificate     /etc/kubernetes/pki/ca.crt;
  14.     ssl_certificate_key /etc/kubernetes/pki/ca.key;
  16.     access_log /var/log/nginx/k8s.access.log;
  17.     error_log  /var/log/nginx/k8s.error.log  error;
  19.     location / {
  20.         proxy_set_header   X-Forwarded-Proto $scheme;
  21.         proxy_set_header   Host              $http_host;
  22.         proxy_set_header   X-Real-IP         $remote_addr;
  23.         proxy_pass http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/;
  24.     }
  25. }
  27. # k8s.conf
  29. [program:k8s-master]
  30. command=kubectl proxy --accept-hosts='^*$'
  31. user=vagrant
  32. environment=KUBECONFIG="/home/vagrant/.kube/config"
  33. stopasgroup=true
  34. stopasgroup=true
  35. autostart=true
  36. autorestart=unexpected
  37. stdout_logfile_maxbytes=1MB
  38. stdout_logfile_backups=10
  39. stderr_logfile_maxbytes=1MB
  40. stderr_logfile_backups=10
  41. stderr_logfile=/var/log/supervisor/k8s-stderr.log
  42. stdout_logfile=/var/log/supervisor/k8s-stdout.log

配置文件如下所示

  1. # Copyright 2017 The Kubernetes Authors.
  2. #
  3. # Licensed under the Apache License, Version 2.0 (the "License");
  4. # you may not use this file except in compliance with the License.
  5. # You may obtain a copy of the License at
  6. #
  7. #     http://www.apache.org/licenses/LICENSE-2.0
  8. #
  9. # Unless required by applicable law or agreed to in writing, software
  10. # distributed under the License is distributed on an "AS IS" BASIS,
  11. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. # See the License for the specific language governing permissions and
  13. # limitations under the License.
  15. apiVersion: v1
  16. kind: Namespace
  17. metadata:
  18.   name: kubernetes-dashboard
  20. ---
  21. apiVersion: v1
  22. kind: ServiceAccount
  23. metadata:
  24.   labels:
  25.     k8s-app: kubernetes-dashboard
  26.   name: kubernetes-dashboard
  27.   namespace: kubernetes-dashboard
  29. ---
  30. kind: Service
  31. apiVersion: v1
  32. metadata:
  33.   labels:
  34.     k8s-app: kubernetes-dashboard
  35.   name: kubernetes-dashboard
  36.   namespace: kubernetes-dashboard
  37. spec:
  38.   ports:
  39.     - port: 443
  40.       targetPort: 8443
  41.   selector:
  42.     k8s-app: kubernetes-dashboard
  44. ---
  45. apiVersion: v1
  46. kind: Secret
  47. metadata:
  48.   labels:
  49.     k8s-app: kubernetes-dashboard
  50.   name: kubernetes-dashboard-certs
  51.   namespace: kubernetes-dashboard
  52. type: Opaque
  54. ---
  55. apiVersion: v1
  56. kind: Secret
  57. metadata:
  58.   labels:
  59.     k8s-app: kubernetes-dashboard
  60.   name: kubernetes-dashboard-csrf
  61.   namespace: kubernetes-dashboard
  62. type: Opaque
  63. data:
  64.   csrf: ""
  66. ---
  67. apiVersion: v1
  68. kind: Secret
  69. metadata:
  70.   labels:
  71.     k8s-app: kubernetes-dashboard
  72.   name: kubernetes-dashboard-key-holder
  73.   namespace: kubernetes-dashboard
  74. type: Opaque
  76. ---
  77. kind: ConfigMap
  78. apiVersion: v1
  79. metadata:
  80.   labels:
  81.     k8s-app: kubernetes-dashboard
  82.   name: kubernetes-dashboard-settings
  83.   namespace: kubernetes-dashboard
  85. ---
  86. kind: Role
  87. apiVersion: rbac.authorization.k8s.io/v1
  88. metadata:
  89.   labels:
  90.     k8s-app: kubernetes-dashboard
  91.   name: kubernetes-dashboard
  92.   namespace: kubernetes-dashboard
  93. rules:
  94.   # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  95.   - apiGroups: [""]
  96.     resources: ["secrets"]
  97.     resourceNames:
  98.       [
  99.         "kubernetes-dashboard-key-holder",
  100.         "kubernetes-dashboard-certs",
  101.         "kubernetes-dashboard-csrf",
  102.       ]
  103.     verbs: ["get", "update", "delete"]
  104.     # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  105.   - apiGroups: [""]
  106.     resources: ["configmaps"]
  107.     resourceNames: ["kubernetes-dashboard-settings"]
  108.     verbs: ["get", "update"]
  109.     # Allow Dashboard to get metrics.
  110.   - apiGroups: [""]
  111.     resources: ["services"]
  112.     resourceNames: ["heapster", "dashboard-metrics-scraper"]
  113.     verbs: ["proxy"]
  114.   - apiGroups: [""]
  115.     resources: ["services/proxy"]
  116.     resourceNames:
  117.       [
  118.         "heapster",
  119.         "http:heapster:",
  120.         "https:heapster:",
  121.         "dashboard-metrics-scraper",
  122.         "http:dashboard-metrics-scraper",
  123.       ]
  124.     verbs: ["get"]
  126. ---
  127. kind: ClusterRole
  128. apiVersion: rbac.authorization.k8s.io/v1
  129. metadata:
  130.   labels:
  131.     k8s-app: kubernetes-dashboard
  132.   name: kubernetes-dashboard
  133. rules:
  134.   # Allow Metrics Scraper to get metrics from the Metrics server
  135.   - apiGroups: ["metrics.k8s.io"]
  136.     resources: ["pods", "nodes"]
  137.     verbs: ["get", "list", "watch"]
  139. ---
  140. apiVersion: rbac.authorization.k8s.io/v1
  141. kind: RoleBinding
  142. metadata:
  143.   labels:
  144.     k8s-app: kubernetes-dashboard
  145.   name: kubernetes-dashboard
  146.   namespace: kubernetes-dashboard
  147. roleRef:
  148.   apiGroup: rbac.authorization.k8s.io
  149.   kind: Role
  150.   name: kubernetes-dashboard
  151. subjects:
  152.   - kind: ServiceAccount
  153.     name: kubernetes-dashboard
  154.     namespace: kubernetes-dashboard
  156. ---
  157. apiVersion: rbac.authorization.k8s.io/v1
  158. kind: ClusterRoleBinding
  159. metadata:
  160.   name: kubernetes-dashboard
  161. roleRef:
  162.   apiGroup: rbac.authorization.k8s.io
  163.   kind: ClusterRole
  164.   name: kubernetes-dashboard
  165. subjects:
  166.   - kind: ServiceAccount
  167.     name: kubernetes-dashboard
  168.     namespace: kubernetes-dashboard
  170. ---
  171. kind: Deployment
  172. apiVersion: apps/v1
  173. metadata:
  174.   labels:
  175.     k8s-app: kubernetes-dashboard
  176.   name: kubernetes-dashboard
  177.   namespace: kubernetes-dashboard
  178. spec:
  179.   replicas: 1
  180.   revisionHistoryLimit: 10
  181.   selector:
  182.     matchLabels:
  183.       k8s-app: kubernetes-dashboard
  184.   template:
  185.     metadata:
  186.       labels:
  187.         k8s-app: kubernetes-dashboard
  188.     spec:
  189.       containers:
  190.         - name: kubernetes-dashboard
  191.           image: registry.cn-shanghai.aliyuncs.com/jieee/dashboard:v2.0.4
  192.           imagePullPolicy: Always
  193.           ports:
  194.             - containerPort: 8443
  195.               protocol: TCP
  196.           args:
  197.             - --auto-generate-certificates
  198.             - --namespace=kubernetes-dashboard
  199.             # Uncomment the following line to manually specify Kubernetes API server Host
  200.             # If not specified, Dashboard will attempt to auto discover the API server and connect
  201.             # to it. Uncomment only if the default does not work.
  202.             # - --apiserver-host=http://my-address:port
  203.           volumeMounts:
  204.             - name: kubernetes-dashboard-certs
  205.               mountPath: /certs
  206.               # Create on-disk volume to store exec logs
  207.             - mountPath: /tmp
  208.               name: tmp-volume
  209.           livenessProbe:
  210.             httpGet:
  211.               scheme: HTTPS
  212.               path: /
  213.               port: 8443
  214.             initialDelaySeconds: 30
  215.             timeoutSeconds: 30
  216.           securityContext:
  217.             allowPrivilegeEscalation: false
  218.             readOnlyRootFilesystem: true
  219.             runAsUser: 1001
  220.             runAsGroup: 2001
  221.       volumes:
  222.         - name: kubernetes-dashboard-certs
  223.           secret:
  224.             secretName: kubernetes-dashboard-certs
  225.         - name: tmp-volume
  226.           emptyDir: {}
  227.       serviceAccountName: kubernetes-dashboard
  228.       nodeSelector:
  229.         "kubernetes.io/os": linux
  230.       # Comment the following tolerations if Dashboard must not be deployed on master
  231.       tolerations:
  232.         - key: node-role.kubernetes.io/master
  233.           effect: NoSchedule
  235. ---
  236. kind: Service
  237. apiVersion: v1
  238. metadata:
  239.   labels:
  240.     k8s-app: dashboard-metrics-scraper
  241.   name: dashboard-metrics-scraper
  242.   namespace: kubernetes-dashboard
  243. spec:
  244.   ports:
  245.     - port: 8000
  246.       targetPort: 8000
  247.   selector:
  248.     k8s-app: dashboard-metrics-scraper
  250. ---
  251. kind: Deployment
  252. apiVersion: apps/v1
  253. metadata:
  254.   labels:
  255.     k8s-app: dashboard-metrics-scraper
  256.   name: dashboard-metrics-scraper
  257.   namespace: kubernetes-dashboard
  258. spec:
  259.   replicas: 1
  260.   revisionHistoryLimit: 10
  261.   selector:
  262.     matchLabels:
  263.       k8s-app: dashboard-metrics-scraper
  264.   template:
  265.     metadata:
  266.       labels:
  267.         k8s-app: dashboard-metrics-scraper
  268.       annotations:
  269.         seccomp.security.alpha.kubernetes.io/pod: "runtime/default"
  270.     spec:
  271.       containers:
  272.         - name: dashboard-metrics-scraper
  273.           image: registry.cn-shanghai.aliyuncs.com/jieee/metrics-scraper:v1.0.4
  274.           ports:
  275.             - containerPort: 8000
  276.               protocol: TCP
  277.           livenessProbe:
  278.             httpGet:
  279.               scheme: HTTP
  280.               path: /
  281.               port: 8000
  282.             initialDelaySeconds: 30
  283.             timeoutSeconds: 30
  284.           volumeMounts:
  285.             - mountPath: /tmp
  286.               name: tmp-volume
  287.           securityContext:
  288.             allowPrivilegeEscalation: false
  289.             readOnlyRootFilesystem: true
  290.             runAsUser: 1001
  291.             runAsGroup: 2001
  292.       serviceAccountName: kubernetes-dashboard
  293.       nodeSelector:
  294.         "kubernetes.io/os": linux
  295.       # Comment the following tolerations if Dashboard must not be deployed on master
  296.       tolerations:
  297.         - key: node-role.kubernetes.io/master
  298.           effect: NoSchedule
  299.       volumes:
  300.         - name: tmp-volume
  301.           emptyDir: {}

第一种：登录 dashboard 的方式(配置文件)

  • 采用 token 方式
  • 采用秘钥文件方式

部署一个最小化的 Kubernetes 集群 - 图2

  1. # 创建管理员帐户(dashboard)
  2. $ cat <<EOF | kubectl apply -f -
  3. apiVersion: v1
  4. kind: ServiceAccount
  5. metadata:
  6.   name: admin-user
  7.   namespace: kubernetes-dashboard
  8. EOF
  10. # 将用户绑定已经存在的集群管理员角色
  11. $ cat <<EOF | kubectl apply -f -
  12. apiVersion: rbac.authorization.k8s.io/v1
  13. kind: ClusterRoleBinding
  14. metadata:
  15.   name: admin-user
  16. roleRef:
  17.   apiGroup: rbac.authorization.k8s.io
  18.   kind: ClusterRole
  19.   name: cluster-admin
  20. subjects:
  21. - kind: ServiceAccount
  22.   name: admin-user
  23.   namespace: kubernetes-dashboard
  24. EOF
  26. # 获取可用户于访问的token令牌
  27. $ kubectl -n kubernetes-dashboard describe secret \
  28.     $(kubectl -n kubernetes-dashboard get secret \
  29.     | grep admin-user | awk '{print $1}')

针对 Chrome 浏览器，在空白处点击然后输入：thisisunsafe
针对 Firefox 浏览器，遇到证书过期，添加例外访问

第二种：授权 dashboard 权限(不适用配置文件)

  • 如果登录之后提示权限问题的话，可以执行如下操作
  • 把 serviceaccount 绑定在 clusteradmin
  • 授权 serviceaccount 用户具有整个集群的访问管理权限
  1. # 创建serviceaccount
  2. $ kubectl create serviceaccount dashboard-admin -n kube-system
  4. # 把serviceaccount绑定在clusteradmin
  5. # 授权serviceaccount用户具有整个集群的访问管理权限
  6. $ kubectl create clusterrolebinding \
  7.     dashboard-cluster-admin --clusterrole=cluster-admin \
  8.     --serviceaccount=kube-system:dashboard-admin
  10. # 获取serviceaccount的secret信息，可得到token令牌的信息
  11. $ kubectl get secret -n kube-system
  13. # 通过上边命令获取到dashboard-admin-token-slfcr信息
  14. $ kubectl describe secret <dashboard-admin-token-slfcr> -n kube-system
  16. # 浏览器访问登录并把token粘贴进去登录即可
  17. https://192.168.30.30:8080/
  19. # 快捷查看token的命令
  20. $ kubectl describe secrets -n kube-system \
  21.     $(kubectl -n kube-system get secret | awk '/admin/{print $1}')