1. # Copyright 2017 The Kubernetes Authors.
    2. #
    3. # Licensed under the Apache License, Version 2.0 (the "License");
    4. # you may not use this file except in compliance with the License.
    5. # You may obtain a copy of the License at
    6. #
    7. #     http://www.apache.org/licenses/LICENSE-2.0
    8. #
    9. # Unless required by applicable law or agreed to in writing, software
    10. # distributed under the License is distributed on an "AS IS" BASIS,
    11. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12. # See the License for the specific language governing permissions and
    13. # limitations under the License.
    15. apiVersion: v1
    16. kind: Namespace
    17. metadata:
    18.   name: kubernetes-dashboard
    20. ---
    22. apiVersion: v1
    23. kind: ServiceAccount
    24. metadata:
    25.   labels:
    26.     k8s-app: kubernetes-dashboard
    27.   name: kubernetes-dashboard
    28.   namespace: kubernetes-dashboard
    30. ---
    32. kind: Service
    33. apiVersion: v1
    34. metadata:
    35.   labels:
    36.     k8s-app: kubernetes-dashboard
    37.   name: kubernetes-dashboard
    38.   namespace: kubernetes-dashboard
    39. spec:
    40.   type: NodePort
    41.   ports:
    42.     - port: 443
    43.       targetPort: 8443
    44.       nodePort: 31111
    45.   selector:
    46.     k8s-app: kubernetes-dashboard
    48. ---
    50. apiVersion: v1
    51. kind: Secret
    52. metadata:
    53.   labels:
    54.     k8s-app: kubernetes-dashboard
    55.   name: kubernetes-dashboard-certs
    56.   namespace: kubernetes-dashboard
    57. type: Opaque
    59. ---
    61. apiVersion: v1
    62. kind: Secret
    63. metadata:
    64.   labels:
    65.     k8s-app: kubernetes-dashboard
    66.   name: kubernetes-dashboard-csrf
    67.   namespace: kubernetes-dashboard
    68. type: Opaque
    69. data:
    70.   csrf: ""
    72. ---
    74. apiVersion: v1
    75. kind: Secret
    76. metadata:
    77.   labels:
    78.     k8s-app: kubernetes-dashboard
    79.   name: kubernetes-dashboard-key-holder
    80.   namespace: kubernetes-dashboard
    81. type: Opaque
    83. ---
    85. kind: ConfigMap
    86. apiVersion: v1
    87. metadata:
    88.   labels:
    89.     k8s-app: kubernetes-dashboard
    90.   name: kubernetes-dashboard-settings
    91.   namespace: kubernetes-dashboard
    93. ---
    95. kind: Role
    96. apiVersion: rbac.authorization.k8s.io/v1
    97. metadata:
    98.   labels:
    99.     k8s-app: kubernetes-dashboard
    100.   name: kubernetes-dashboard
    101.   namespace: kubernetes-dashboard
    102. rules:
    103.   # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
    104.   - apiGroups: [""]
    105.     resources: ["secrets"]
    106.     resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
    107.     verbs: ["get", "update", "delete"]
    108.     # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
    109.   - apiGroups: [""]
    110.     resources: ["configmaps"]
    111.     resourceNames: ["kubernetes-dashboard-settings"]
    112.     verbs: ["get", "update"]
    113.     # Allow Dashboard to get metrics.
    114.   - apiGroups: [""]
    115.     resources: ["services"]
    116.     resourceNames: ["heapster", "dashboard-metrics-scraper"]
    117.     verbs: ["proxy"]
    118.   - apiGroups: [""]
    119.     resources: ["services/proxy"]
    120.     resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
    121.     verbs: ["get"]
    123. ---
    125. kind: ClusterRole
    126. apiVersion: rbac.authorization.k8s.io/v1
    127. metadata:
    128.   labels:
    129.     k8s-app: kubernetes-dashboard
    130.   name: kubernetes-dashboard
    131. rules:
    132.   # Allow Metrics Scraper to get metrics from the Metrics server
    133.   - apiGroups: ["metrics.k8s.io"]
    134.     resources: ["pods", "nodes"]
    135.     verbs: ["get", "list", "watch"]
    137. ---
    139. apiVersion: rbac.authorization.k8s.io/v1
    140. kind: RoleBinding
    141. metadata:
    142.   labels:
    143.     k8s-app: kubernetes-dashboard
    144.   name: kubernetes-dashboard
    145.   namespace: kubernetes-dashboard
    146. roleRef:
    147.   apiGroup: rbac.authorization.k8s.io
    148.   kind: Role
    149.   name: kubernetes-dashboard
    150. subjects:
    151.   - kind: ServiceAccount
    152.     name: kubernetes-dashboard
    153.     namespace: kubernetes-dashboard
    155. ---
    157. apiVersion: rbac.authorization.k8s.io/v1
    158. kind: ClusterRoleBinding
    159. metadata:
    160.   name: kubernetes-dashboard
    161. roleRef:
    162.   apiGroup: rbac.authorization.k8s.io
    163.   kind: ClusterRole
    164.   name: kubernetes-dashboard
    165. subjects:
    166.   - kind: ServiceAccount
    167.     name: kubernetes-dashboard
    168.     namespace: kubernetes-dashboard
    170. ---
    172. kind: Deployment
    173. apiVersion: apps/v1
    174. metadata:
    175.   labels:
    176.     k8s-app: kubernetes-dashboard
    177.   name: kubernetes-dashboard
    178.   namespace: kubernetes-dashboard
    179. spec:
    180.   replicas: 1
    181.   revisionHistoryLimit: 10
    182.   selector:
    183.     matchLabels:
    184.       k8s-app: kubernetes-dashboard
    185.   template:
    186.     metadata:
    187.       labels:
    188.         k8s-app: kubernetes-dashboard
    189.     spec:
    190.       containers:
    191.         - name: kubernetes-dashboard
    192.           image: registry.cn-beijing.aliyuncs.com/qingfeng666/dashboard:v2.0.4
    193.           imagePullPolicy: Always
    194.           ports:
    195.             - containerPort: 8443
    196.               protocol: TCP
    197.           args:
    198.             - --auto-generate-certificates
    199.             - --namespace=kubernetes-dashboard
    200.             # Uncomment the following line to manually specify Kubernetes API server Host
    201.             # If not specified, Dashboard will attempt to auto discover the API server and connect
    202.             # to it. Uncomment only if the default does not work.
    203.             # - --apiserver-host=http://my-address:port
    204.           volumeMounts:
    205.             - name: kubernetes-dashboard-certs
    206.               mountPath: /certs
    207.               # Create on-disk volume to store exec logs
    208.             - mountPath: /tmp
    209.               name: tmp-volume
    210.           livenessProbe:
    211.             httpGet:
    212.               scheme: HTTPS
    213.               path: /
    214.               port: 8443
    215.             initialDelaySeconds: 30
    216.             timeoutSeconds: 30
    217.           securityContext:
    218.             allowPrivilegeEscalation: false
    219.             readOnlyRootFilesystem: true
    220.             runAsUser: 1001
    221.             runAsGroup: 2001
    222.       volumes:
    223.         - name: kubernetes-dashboard-certs
    224.           secret:
    225.             secretName: kubernetes-dashboard-certs
    226.         - name: tmp-volume
    227.           emptyDir: {}
    228.       serviceAccountName: kubernetes-dashboard
    229.       nodeSelector:
    230.         "kubernetes.io/os": linux
    231.       # Comment the following tolerations if Dashboard must not be deployed on master
    232.       tolerations:
    233.         - key: node-role.kubernetes.io/master
    234.           effect: NoSchedule
    236. ---
    238. kind: Service
    239. apiVersion: v1
    240. metadata:
    241.   labels:
    242.     k8s-app: dashboard-metrics-scraper
    243.   name: dashboard-metrics-scraper
    244.   namespace: kubernetes-dashboard
    245. spec:
    246.   ports:
    247.     - port: 8000
    248.       targetPort: 8000
    249.   selector:
    250.     k8s-app: dashboard-metrics-scraper
    252. ---
    254. kind: Deployment
    255. apiVersion: apps/v1
    256. metadata:
    257.   labels:
    258.     k8s-app: dashboard-metrics-scraper
    259.   name: dashboard-metrics-scraper
    260.   namespace: kubernetes-dashboard
    261. spec:
    262.   replicas: 1
    263.   revisionHistoryLimit: 10
    264.   selector:
    265.     matchLabels:
    266.       k8s-app: dashboard-metrics-scraper
    267.   template:
    268.     metadata:
    269.       labels:
    270.         k8s-app: dashboard-metrics-scraper
    271.       annotations:
    272.         seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
    273.     spec:
    274.       containers:
    275.         - name: dashboard-metrics-scraper
    276.           image: registry.cn-beijing.aliyuncs.com/qingfeng666/metrics-scraper:v1.0.4
    277.           ports:
    278.             - containerPort: 8000
    279.               protocol: TCP
    280.           livenessProbe:
    281.             httpGet:
    282.               scheme: HTTP
    283.               path: /
    284.               port: 8000
    285.             initialDelaySeconds: 30
    286.             timeoutSeconds: 30
    287.           volumeMounts:
    288.           - mountPath: /tmp
    289.             name: tmp-volume
    290.           securityContext:
    291.             allowPrivilegeEscalation: false
    292.             readOnlyRootFilesystem: true
    293.             runAsUser: 1001
    294.             runAsGroup: 2001
    295.       serviceAccountName: kubernetes-dashboard
    296.       nodeSelector:
    297.         "kubernetes.io/os": linux
    298.       # Comment the following tolerations if Dashboard must not be deployed on master
    299.       tolerations:
    300.         - key: node-role.kubernetes.io/master
    301.           effect: NoSchedule
    302.       volumes:
    303.         - name: tmp-volume
    304.           emptyDir: {}