一、前言

上一篇文章介绍了从零开始搭建Kubernetes集群，本文将介绍一下如何搭建K8S的Dashboard。

简单的说，K8S Dashboard是官方的一个基于WEB的用户界面，专门用来管理K8S集群，并展示集群的状态。K8S集群安装好后默认没有包含Dashboard，我们需要额外创建它。

Dashboard设计的还不错，界面友好，功能也比较强大。如果你厌倦了命令行的操作，全程使用Dashboard也是可行的。

因为我们使用kubeadm搭建的集群会默认开启RABC（角色访问控制机制），所以我们必须要进行额外的设置。关于RABC的概念，网上资料很多，大家务必提前了解。

二、RBAC简介

RBAC（Role-Based Access Control ）基于角色的访问控制，不懂的可以百度看下
K8S 1.6引进，是让用户能够访问 k8S API 资源的授权方式【不授权就没有资格访问K8S的资源】

2.1、用户

K8S有两种用户：User和Service Account。其中，User给人用，Service Account给进程用，让进程有相关权限。如Dashboard就是一个进程，我们就可以创建一个Service Account给它

2.2、角色

Role是一系列权限的集合，例如一个Role可包含读取和列出 Pod的权限【 ClusterRole 和 Role 类似，其权限范围是整个集群】

2.3、角色绑定

RoleBinding把角色映射到用户，从而让这些用户拥有该角色的权限【ClusterRoleBinding 和RoleBinding 类似，可让用户拥有 ClusterRole 的权限】

2.4、Secret

Secret是一个包含少量敏感信息如密码，令牌，或秘钥的对象。把这些信息保存在 Secret对象中，可以在这些信息被使用时加以控制，并可以降低信息泄露的风险
如下图，灰色是“角色”，蓝色是“用户”，绿色是“角色绑定”，黄色是该角色拥有的权限。简言之 ，角色绑定将角色和用户进行挂钩：
【Kubernetes详解】（三）搭建Kubernetes Dashboard - 图1

三、安装Kubernetes-Dashboard

官方文档：Web UI (K8S Dashboard)

3.1、部署

参考官方文档，在部署好了 k8s 集群环境的前提下，要安装 Kubernetes-Dashboard 只需要一条命令就可以搞定，如下：

  1. kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml

确实如此，但是要通过页面访问还需要进行其他操作

3.2、访问

要想通过页面访问，我们可以先大致看下 recommended.yaml，理解下其中的内容

3.2.1、recommended.yaml 内容

  1. # Copyright 2017 The Kubernetes Authors.
  2. #
  3. # Licensed under the Apache License, Version 2.0 (the "License");
  4. # you may not use this file except in compliance with the License.
  5. # You may obtain a copy of the License at
  6. #
  7. #     http://www.apache.org/licenses/LICENSE-2.0
  8. #
  9. # Unless required by applicable law or agreed to in writing, software
  10. # distributed under the License is distributed on an "AS IS" BASIS,
  11. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. # See the License for the specific language governing permissions and
  13. # limitations under the License.
  15. apiVersion: v1
  16. kind: Namespace
  17. metadata:
  18.   name: kubernetes-dashboard
  20. ---
  22. apiVersion: v1
  23. kind: ServiceAccount
  24. metadata:
  25.   labels:
  26.     k8s-app: kubernetes-dashboard
  27.   name: kubernetes-dashboard
  28.   namespace: kubernetes-dashboard
  30. ---
  32. kind: Service
  33. apiVersion: v1
  34. metadata:
  35.   labels:
  36.     k8s-app: kubernetes-dashboard
  37.   name: kubernetes-dashboard
  38.   namespace: kubernetes-dashboard
  39. spec:
  40.   ports:
  41.     - port: 443
  42.       targetPort: 8443
  43.   selector:
  44.     k8s-app: kubernetes-dashboard
  46. ---
  48. apiVersion: v1
  49. kind: Secret
  50. metadata:
  51.   labels:
  52.     k8s-app: kubernetes-dashboard
  53.   name: kubernetes-dashboard-certs
  54.   namespace: kubernetes-dashboard
  55. type: Opaque
  57. ---
  59. apiVersion: v1
  60. kind: Secret
  61. metadata:
  62.   labels:
  63.     k8s-app: kubernetes-dashboard
  64.   name: kubernetes-dashboard-csrf
  65.   namespace: kubernetes-dashboard
  66. type: Opaque
  67. data:
  68.   csrf: ""
  70. ---
  72. apiVersion: v1
  73. kind: Secret
  74. metadata:
  75.   labels:
  76.     k8s-app: kubernetes-dashboard
  77.   name: kubernetes-dashboard-key-holder
  78.   namespace: kubernetes-dashboard
  79. type: Opaque
  81. ---
  83. kind: ConfigMap
  84. apiVersion: v1
  85. metadata:
  86.   labels:
  87.     k8s-app: kubernetes-dashboard
  88.   name: kubernetes-dashboard-settings
  89.   namespace: kubernetes-dashboard
  91. ---
  93. kind: Role
  94. apiVersion: rbac.authorization.k8s.io/v1
  95. metadata:
  96.   labels:
  97.     k8s-app: kubernetes-dashboard
  98.   name: kubernetes-dashboard
  99.   namespace: kubernetes-dashboard
  100. rules:
  101.   # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  102.   - apiGroups: [""]
  103.     resources: ["secrets"]
  104.     resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
  105.     verbs: ["get", "update", "delete"]
  106.     # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  107.   - apiGroups: [""]
  108.     resources: ["configmaps"]
  109.     resourceNames: ["kubernetes-dashboard-settings"]
  110.     verbs: ["get", "update"]
  111.     # Allow Dashboard to get metrics.
  112.   - apiGroups: [""]
  113.     resources: ["services"]
  114.     resourceNames: ["heapster", "dashboard-metrics-scraper"]
  115.     verbs: ["proxy"]
  116.   - apiGroups: [""]
  117.     resources: ["services/proxy"]
  118.     resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
  119.     verbs: ["get"]
  121. ---
  123. kind: ClusterRole
  124. apiVersion: rbac.authorization.k8s.io/v1
  125. metadata:
  126.   labels:
  127.     k8s-app: kubernetes-dashboard
  128.   name: kubernetes-dashboard
  129. rules:
  130.   # Allow Metrics Scraper to get metrics from the Metrics server
  131.   - apiGroups: ["metrics.k8s.io"]
  132.     resources: ["pods", "nodes"]
  133.     verbs: ["get", "list", "watch"]
  135. ---
  137. apiVersion: rbac.authorization.k8s.io/v1
  138. kind: RoleBinding
  139. metadata:
  140.   labels:
  141.     k8s-app: kubernetes-dashboard
  142.   name: kubernetes-dashboard
  143.   namespace: kubernetes-dashboard
  144. roleRef:
  145.   apiGroup: rbac.authorization.k8s.io
  146.   kind: Role
  147.   name: kubernetes-dashboard
  148. subjects:
  149.   - kind: ServiceAccount
  150.     name: kubernetes-dashboard
  151.     namespace: kubernetes-dashboard
  153. ---
  155. apiVersion: rbac.authorization.k8s.io/v1
  156. kind: ClusterRoleBinding
  157. metadata:
  158.   name: kubernetes-dashboard
  159. roleRef:
  160.   apiGroup: rbac.authorization.k8s.io
  161.   kind: ClusterRole
  162.   name: kubernetes-dashboard
  163. subjects:
  164.   - kind: ServiceAccount
  165.     name: kubernetes-dashboard
  166.     namespace: kubernetes-dashboard
  168. ---
  170. kind: Deployment
  171. apiVersion: apps/v1
  172. metadata:
  173.   labels:
  174.     k8s-app: kubernetes-dashboard
  175.   name: kubernetes-dashboard
  176.   namespace: kubernetes-dashboard
  177. spec:
  178.   replicas: 1
  179.   revisionHistoryLimit: 10
  180.   selector:
  181.     matchLabels:
  182.       k8s-app: kubernetes-dashboard
  183.   template:
  184.     metadata:
  185.       labels:
  186.         k8s-app: kubernetes-dashboard
  187.     spec:
  188.       containers:
  189.         - name: kubernetes-dashboard
  190.           image: kubernetesui/dashboard:v2.0.0
  191.           imagePullPolicy: Always
  192.           ports:
  193.             - containerPort: 8443
  194.               protocol: TCP
  195.           args:
  196.             - --auto-generate-certificates
  197.             - --namespace=kubernetes-dashboard
  198.             # Uncomment the following line to manually specify Kubernetes API server Host
  199.             # If not specified, Dashboard will attempt to auto discover the API server and connect
  200.             # to it. Uncomment only if the default does not work.
  201.             # - --apiserver-host=http://my-address:port
  202.           volumeMounts:
  203.             - name: kubernetes-dashboard-certs
  204.               mountPath: /certs
  205.               # Create on-disk volume to store exec logs
  206.             - mountPath: /tmp
  207.               name: tmp-volume
  208.           livenessProbe:
  209.             httpGet:
  210.               scheme: HTTPS
  211.               path: /
  212.               port: 8443
  213.             initialDelaySeconds: 30
  214.             timeoutSeconds: 30
  215.           securityContext:
  216.             allowPrivilegeEscalation: false
  217.             readOnlyRootFilesystem: true
  218.             runAsUser: 1001
  219.             runAsGroup: 2001
  220.       volumes:
  221.         - name: kubernetes-dashboard-certs
  222.           secret:
  223.             secretName: kubernetes-dashboard-certs
  224.         - name: tmp-volume
  225.           emptyDir: {}
  226.       serviceAccountName: kubernetes-dashboard
  227.       nodeSelector:
  228.         "kubernetes.io/os": linux
  229.       # Comment the following tolerations if Dashboard must not be deployed on master
  230.       tolerations:
  231.         - key: node-role.kubernetes.io/master
  232.           effect: NoSchedule
  234. ---
  236. kind: Service
  237. apiVersion: v1
  238. metadata:
  239.   labels:
  240.     k8s-app: dashboard-metrics-scraper
  241.   name: dashboard-metrics-scraper
  242.   namespace: kubernetes-dashboard
  243. spec:
  244.   ports:
  245.     - port: 8000
  246.       targetPort: 8000
  247.   selector:
  248.     k8s-app: dashboard-metrics-scraper
  250. ---
  252. kind: Deployment
  253. apiVersion: apps/v1
  254. metadata:
  255.   labels:
  256.     k8s-app: dashboard-metrics-scraper
  257.   name: dashboard-metrics-scraper
  258.   namespace: kubernetes-dashboard
  259. spec:
  260.   replicas: 1
  261.   revisionHistoryLimit: 10
  262.   selector:
  263.     matchLabels:
  264.       k8s-app: dashboard-metrics-scraper
  265.   template:
  266.     metadata:
  267.       labels:
  268.         k8s-app: dashboard-metrics-scraper
  269.       annotations:
  270.         seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
  271.     spec:
  272.       containers:
  273.         - name: dashboard-metrics-scraper
  274.           image: kubernetesui/metrics-scraper:v1.0.4
  275.           ports:
  276.             - containerPort: 8000
  277.               protocol: TCP
  278.           livenessProbe:
  279.             httpGet:
  280.               scheme: HTTP
  281.               path: /
  282.               port: 8000
  283.             initialDelaySeconds: 30
  284.             timeoutSeconds: 30
  285.           volumeMounts:
  286.           - mountPath: /tmp
  287.             name: tmp-volume
  288.           securityContext:
  289.             allowPrivilegeEscalation: false
  290.             readOnlyRootFilesystem: true
  291.             runAsUser: 1001
  292.             runAsGroup: 2001
  293.       serviceAccountName: kubernetes-dashboard
  294.       nodeSelector:
  295.         "kubernetes.io/os": linux
  296.       # Comment the following tolerations if Dashboard must not be deployed on master
  297.       tolerations:
  298.         - key: node-role.kubernetes.io/master
  299.           effect: NoSchedule
  300.       volumes:
  301.         - name: tmp-volume
  302.           emptyDir: {}

3.2.1.1、recommended中包括了下面几个组件

  • Dashboard Service
  • Dashboard Deployment
  • Dashboard Role
  • RoleBinding
  • Dashboard Service Account
  • Dashboard Secret

Dashboard Service

  1. kind: Service
  2. ...
  3. k8s-app: kubernetes-dashboard
  4. ...
  5. spec:
  6.   type: NodePort
  7.   ports:
  8.     - port: 443 
  9.       targetPort: 8443
  10.       nodePort: 30000

Dashboard 对外提供服务设置，也指定了nodePort，这样我们可以通过物理机上的30000端口进行访问

Dashboard Deployment

  1. kind: Deployment
  2. ...
  3. k8s-app: kubernetes-dashboard
  4. ....

Dashboard的Deployment指定了其使用的ServiceAccount是kubernetes-dashboard。并且还将Secret kubernetes-dashboard-certs通过volumes挂在到pod内部的/certs路径。为何要挂载Secret ？原因是创建Secret 时会自动生成token。请注意参数—auto-generate-certificates，其表示Dashboard会自动生成证书。

Dashboard Role

  1. kind: Role
  2. apiVersion: rbac.authorization.k8s.io/v1
  3. metadata:
  4.   labels:
  5.     k8s-app: kubernetes-dashboard
  6.   name: kubernetes-dashboard
  7.   namespace: kubernetes-dashboard
  8. rules:
  9. ...

如上定义了Dashboard 的角色，其角色名称为 kubernetes-dashboard，rules中清晰的列出了其拥有的多个权限。

RoleBinding

  1. apiVersion: rbac.authorization.k8s.io/v1
  2. kind: RoleBinding
  3. metadata:
  4.   labels:
  5.     k8s-app: kubernetes-dashboard
  6.   name: kubernetes-dashboard
  7.   namespace: kubernetes-dashboard
  8. roleRef:
  9.   apiGroup: rbac.authorization.k8s.io
  10.   kind: Role
  11.   name: kubernetes-dashboard
  12. subjects:
  13.   - kind: ServiceAccount
  14.     name: kubernetes-dashboard
  15.     namespace: kubernetes-dashboard

Dashboard的角色绑定，其名称为 kubernetes-dashboard，roleRef 中为被绑定的角色，subjects中为绑定的用户：kubernetes-dashboard

Dashboard Service Account

  1. apiVersion: v1
  2. kind: ServiceAccount
  3. metadata:
  4.   labels:
  5.     k8s-app: kubernetes-dashboard
  6.   name: kubernetes-dashboard
  7.   namespace: kubernetes-dashboard

如上定义了Dashboard的用户，其类型为ServiceAccount，名称为kubernetes-dashboard

Dashboard Secret

  1. apiVersion: v1
  2. kind: Secret
  3. ...

3.3.2、web 页面

通过暴露的NodePort: 30000 访问 dashboard，页面如图(我这里通过 firefox 才能访问，chrome 都不行)：https://localhost:30000/
【Kubernetes详解】（三）搭建Kubernetes Dashboard - 图2
这里有两种登录方式：

  • Token
  • Kubeconfig

我们使用 Token 的方式登录，获取 Token 方式如下：

  1. kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep kubernetes-dashboard | awk '{print $1}')

【Kubernetes详解】（三）搭建Kubernetes Dashboard - 图3
复制token，点击登录即可

3.3、到这里还没有完

通过3.2的步骤会出现下面问题：
【Kubernetes详解】（三）搭建Kubernetes Dashboard - 图4
出现上述问题的原因是因为，kubernetes-dashboard 这个账户的角色权限不够
解决：

3.3.3、创建dashboard-adminuser.yaml

  1. cat > dashboard-adminuser.yaml << EOF
  2. apiVersion: v1
  3. kind: ServiceAccount
  4. metadata:
  5.   name: admin-user
  6.   namespace: kubernetes-dashboard
  8. ---
  9. apiVersion: rbac.authorization.k8s.io/v1
  10. kind: ClusterRoleBinding
  11. metadata:
  12.   name: admin-user
  13. roleRef:
  14.   apiGroup: rbac.authorization.k8s.io
  15.   kind: ClusterRole
  16.   name: cluster-admin
  17. subjects:
  18. - kind: ServiceAccount
  19.   name: admin-user
  20.   namespace: kubernetes-dashboard  
  21. EOF

3.3.2、创建登录用户

  1. kubectl apply -f dashboard-adminuser.yaml

说明：上面创建了一个叫 admin-user 的服务账号，并放在kubernetes-dashboard 命名空间下，并将 cluster-admin 角色绑定到admin-user账户，这样admin-user账户就有了管理员的权限。默认情况下，kubeadm创建集群时已经创建了cluster-admin角色，我们直接绑定即可。

3.3.3、查看admin-user账户的token

  1. kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')

重新登录即可
【Kubernetes详解】（三）搭建Kubernetes Dashboard - 图5

四、一些命令

  1. # 查看dashboard的角色(Role)
  2. kubectl get role -n kubernetes-dashboard
  3. # 查看dashboard的账户
  4. kubectl get ServiceAccount -n kubernetes-dashboard
  5. # 查看secret
  6. kubectl get secret -n kuberntes-dashboard
  7. # 查看集群的角色(ClusterRole)
  8. kubectl get ClusterRole -n kubernetes-dashboard