安裝dashboard插件 · kubernetes完整攻略

# 安裝dashboard插件 > 注意：本文檔中安裝的是kubernetes dashboard v1.6.0，安裝新版的dashboard請參考[升級dashboard](dashboard-upgrade.md)。官方文件目錄：https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dashboard 我們使用的文件如下： ``` bash $ ls *.yaml dashboard-controller.yaml dashboard-service.yaml dashboard-rbac.yaml ``` 已經修改好的 yaml 文件見：[../manifests/dashboard](https://github.com/rootsongjc/kubernetes-handbook/blob/master/manifests/dashboard) 文件中的kubernetes-dashboard-amd64鏡像為本地鏡像地址需要修改為對應的鏡像地址和版本： kubernetes 1.7.11 可以使用此鏡像地址：`registry.cn-qingdao.aliyuncs.com/haitao/kubernetes-dashboard-amd64:v1.7.0` 替換 `dashboard-controller.yaml` 文件中的鏡像地址。由于 `kube-apiserver` 啟用了 `RBAC` 授權，而官方源碼目錄的 `dashboard-controller.yaml` 沒有定義授權的 ServiceAccount，所以后續訪問 API server 的 API 時會被拒絕，web中提示： ```bash Forbidden (403) User "system:serviceaccount:kube-system:default" cannot list jobs.batch in the namespace "default". (get jobs.batch) ``` 增加了一個`dashboard-rbac.yaml`文件，定義一個名為 dashboard 的 ServiceAccount，然后將它和 Cluster Role view 綁定，如下： ```yaml apiVersion: v1 kind: ServiceAccount metadata: name: dashboard namespace: kube-system --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: dashboard subjects: - kind: ServiceAccount name: dashboard namespace: kube-system roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io ``` 然后使用`kubectl apply -f dashboard-rbac.yaml`創建。 ## 配置dashboard-service ``` bash $ diff dashboard-service.yaml.orig dashboard-service.yaml 10a11 > type: NodePort ``` + 指定端口類型為 NodePort，這樣外界可以通過地址 `nodeIP:nodePort` 訪問 dashboard； ## 配置dashboard-controller ``` bash $ diff dashboard-controller.yaml.orig dashboard-controller.yaml 23c23 < image: gcr.io/google_containers/kubernetes-dashboard-amd64:v1.6.0 --- > image: harbor-001.jimmysong.io/library/kubernetes-dashboard-amd64:v1.6.0 ``` ## 執行所有定義文件 ``` bash $ pwd /root/kubernetes/cluster/addons/dashboard $ ls *.yaml dashboard-controller.yaml dashboard-service.yaml $ kubectl create -f . service "kubernetes-dashboard" created deployment "kubernetes-dashboard" created ``` ## 檢查執行結果查看分配的 NodePort ``` bash $ kubectl get services kubernetes-dashboard -n kube-system NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE kubernetes-dashboard 10.254.224.130 <nodes> 80:30312/TCP 25s ``` + NodePort 30312映射到 dashboard pod 80端口；檢查 controller ``` bash $ kubectl get deployment kubernetes-dashboard -n kube-system NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE kubernetes-dashboard 1 1 1 1 3m $ kubectl get pods -n kube-system | grep dashboard kubernetes-dashboard-1339745653-pmn6z 1/1 Running 0 4m ``` ## 訪問dashboard 有以下三種方式： - kubernetes-dashboard 服務暴露了 NodePort，可以使用 `http://NodeIP:nodePort` 地址訪問 dashboard - 通過 API server 訪問 dashboard（https 6443端口和http 8080端口方式） - 通過 kubectl proxy 訪問 dashboard ### 通過 kubectl proxy 訪問 dashboard 啟動代理 ``` bash $ kubectl proxy --address='172.20.0.113' --port=8086 --accept-hosts='^*$' Starting to serve on 172.20.0.113:8086 ``` + 需要指定 `--accept-hosts` 選項，否則瀏覽器訪問 dashboard 頁面時提示 “Unauthorized”；瀏覽器訪問 URL：http://172.20.0.113:8086/ui 自動跳轉到：http://172.20.0.113:8086/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard/#/workload?namespace=default ### 通過 API server 訪問dashboard 獲取集群服務地址列表 ``` bash $ kubectl cluster-info Kubernetes master is running at https://172.20.0.113:6443 KubeDNS is running at https://172.20.0.113:6443/api/v1/proxy/namespaces/kube-system/services/kube-dns kubernetes-dashboard is running at https://172.20.0.113:6443/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard ``` 瀏覽器訪問 URL：<https://172.20.0.113:6443/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard>（瀏覽器會提示證書驗證，因為通過加密通道，以改方式訪問的話，需要提前導入證書到你的計算機中）。這是我當時在這遇到的坑：[通過 kube-apiserver 訪問dashboard，提示User "system:anonymous" cannot proxy services in the namespace "kube-system". #5](https://github.com/opsnull/follow-me-install-kubernetes-cluster/issues/5)，已經解決。 **導入證書** 將生成的admin.pem證書轉換格式 ```bash openssl pkcs12 -export -in admin.pem -out admin.p12 -inkey admin-key.pem ``` 將生成的`admin.p12`證書導入的你的電腦，導出的時候記住你設置的密碼，導入的時候還要用到。如果你不想使用**https**的話，可以直接訪問insecure port 8080端口：<http://172.20.0.113:8080/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard> ![kubernetes dashboard](https://box.kancloud.cn/289f7a5de0cc7ad406256b9d3ef0816e_3228x1852.jpg) 由于缺少 Heapster 插件，當前 dashboard 不能展示 Pod、Nodes 的 CPU、內存等 metric 圖形。 ### 更新 Kubernetes 1.6 版本的 dashboard 的鏡像已經到了 v1.6.3 版本，我們可以使用下面的方式更新。修改 `dashboard-controller.yaml` 文件中的鏡像的版本將 `v1.6.0` 更改為 `v1.6.3`。 ```yaml image: harbor-001.jimmysong.io/library/kubernetes-dashboard-amd64:v1.6.3 ``` 然后執行下面的命令： ```bash kubectl apply -f dashboard-controller.yaml ``` 即可在線更新 dashboard 的版本。監聽 dashboard Pod 的狀態可以看到： ```bash kubernetes-dashboard-215087767-2jsgd 0/1 Pending 0 0s kubernetes-dashboard-3966630548-0jj1j 1/1 Terminating 0 1d kubernetes-dashboard-215087767-2jsgd 0/1 Pending 0 0s kubernetes-dashboard-3966630548-0jj1j 1/1 Terminating 0 1d kubernetes-dashboard-215087767-2jsgd 0/1 ContainerCreating 0 0s kubernetes-dashboard-3966630548-0jj1j 0/1 Terminating 0 1d kubernetes-dashboard-3966630548-0jj1j 0/1 Terminating 0 1d kubernetes-dashboard-215087767-2jsgd 1/1 Running 0 6s kubernetes-dashboard-3966630548-0jj1j 0/1 Terminating 0 1d kubernetes-dashboard-3966630548-0jj1j 0/1 Terminating 0 1d kubernetes-dashboard-3966630548-0jj1j 0/1 Terminating 0 1d ``` 新的 Pod 的啟動了，舊的 Pod 被終結了。 Dashboard 的訪問地址不變，重新訪問 <http://172.20.0.113:8080/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard>，可以看到新版的界面： ![V1.6.3版本的dashboard界面](https://box.kancloud.cn/d5e8a0edae5a2e56b2f4d8f4eb337862_1664x971.jpg) 新版本中最大的變化是增加了進入容器內部的入口，可以在頁面上進入到容器內部操作，同時又增加了一個搜索框。關于如何將dashboard從1.6版本升級到1.7版本請參考[升級dashboard](dashboard-upgrade.md)。 ## 問題 ### 1. 按照教程安裝后，發現dashboard pod 無法啟動 **場景一** ``` kubectl -n kube-system describe pod dashboard-xxxxxxx ``` ![pod無法正常啟動](https://box.kancloud.cn/abfff373e978646a416fad2a5578c869_2824x526.png) 可以嘗試刪除所有相關“資源”再重試一次，如：secret、serviceaccount、service、pod、deployment **場景二** ```bash kubectl describe pod -n kube-system kubernetes-dashboard-7b7bf9bcbd-xxxxx Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 49s default-scheduler Successfully assigned kubernetes-dashboard-7b7bf9bcbd-625cb to 192.168.1.101 Normal SuccessfulMountVolume 49s kubelet, 192.168.1.101 MountVolume.SetUp succeeded for volume "tmp-volume" Warning FailedMount 17s (x7 over 49s) kubelet, 192.168.1.101 MountVolume.SetUp failed for volume "kubernetes-dashboard-certs" : secrets "kubernetes-dashboard-certs" is forbidden: User "system:node:192.168.1.233" cannot get secrets in the namespace "kube-system": no path found to object Warning FailedMount 17s (x7 over 49s) kubelet, 192.168.1.101 MountVolume.SetUp failed for volume "kubernetes-dashboard-token-27kdp" : secrets "kubernetes-dashboard-token-27kdp" is forbidden: User "system:node:192.168.1.233" cannot get secrets in the namespace "kube-system": no path found to object ``` 通過官方文檔：[RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions)。可以了解到，對于k8s1.8+版本，system:node不會進行默認綁定。因此對于分配到其他node的pod，會出現forbidden。需要手動bind各個node： ```bash kubectl create clusterrolebinding node233 --clusterrole=system:node --user=system:node:192.168.1.233 kubectl describe pod -n kube-system kubernetes-dashboard-7b7bf9bcbd-xxxxx Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 15s default-scheduler Successfully assigned kubernetes-dashboard-7b7bf9bcbd-pq6pk to 192.168.1.101 Normal SuccessfulMountVolume 15s kubelet, 192.168.1.101 MountVolume.SetUp succeeded for volume "tmp-volume" Normal SuccessfulMountVolume 15s kubelet, 192.168.1.101 MountVolume.SetUp succeeded for volume "kubernetes-dashboard-certs" Normal SuccessfulMountVolume 15s kubelet, 192.168.1.101 MountVolume.SetUp succeeded for volume "kubernetes-dashboard-token-8rj79" Normal Pulling 15s kubelet, 192.168.1.101 pulling image "registry.cn-hangzhou.aliyuncs.com/google_containers/kubernetes-dashboard-amd64:v1.8.3" ``` ### 2. 自定義dashboard啟動參數可以在dashboard的YAML文件中配置[啟動參數](https://github.com/kubernetes/dashboard/wiki/Dashboard-arguments)，比如設置token的默認過期時間、heapster地址、綁定的證書等。 ## 參考 - [WebUI(Dashboard) 文檔](https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/)