kubernetes的dashboard界面部署
kubernetes这个名字起源于古希腊，是舵手的意思，所以它的Logo既像一张渔网，又像一个罗盘。谷歌采用这个名字的深意就是：既然Docker把自己定位为驮着集装箱在大海上自在遨游的鲸鱼，那么谷歌就是要以kubernetes掌舵大航海时代的话语权，"捕获"和"指引"这条鲸鱼按照"主人"设定的路线巡游，确保谷歌倾力打造的新一代容器世界的宏伟蓝图实现。kubernetes之所以叫k8s，是因为k和s之间有8个字母。
k8s的部署环境如下：
系统：CentOS7.6
docker版本：docker-ce-18.06.1
kubernetes版本：v1.19.0
主机IP：master（192.168.121.201）node1（192.168.121.202）node2（192.168.121.203）
下面采用kubeadm部署方式以master节点为例：
#master节点
#1.设置主机名
hostnamectl set-hostname master
#2.配置域名解析
echo '192.168.121.201 master' >>/etc/hosts
echo '192.168.121.202 node1' >>/etc/hosts
echo '192.168.121.203 node2' >>/etc/hosts
#3.配置selinux
sed -i 's/SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
setenforce 0
#4.配置防火墙
systemctl stop firewalld && systemctl disable firewalld
#5.配置时钟同步
yum -y install chrony
sed -i 's/^server/#&/g' /etc/chrony.conf
sed -i '2a server time.windows.com iburst' /etc/chrony.conf
#6.永久关闭交换分区
sed -i 's/.*centos-swap.*/#&/g' /etc/fstab
swapoff -a
#7.安装基础软件
yum -y install wget expect vim net-tools ntp bash-completion ipvsadm ipset jq iptables conntrack sysstat libseccomp
#8.安装docker的必备软件
yum -y install yum-utils device-mapper-persistent-data lvm2
#9.添加docker源，安装docker-ce-18.06.1版本
yum-config-manager --add-repo=https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum install -y docker-ce-18.06.1.ce-3.el7
#10.设置docker启动和开机启动
systemctl start docker && systemctl enable docker
#11.配置docker镜像加速器
cat >/etc/docker/daemon.json << EOF
{
"registry-mirrors": ["https://docker.mirrors.ustc.edu.cn/"]
}
EOF
#12.重新启动docker确保docker镜像加速器能启动
systemctl daemon-reload && systemctl restart docker
#13.加载IPVS模块
cat > /etc/sysconfig/modules/ipvs.modules <
ipvs_modules="ip_vs ip_vs_lc ip_vs_wlc ip_vs_rr ip_vs_wrr ip_vs_lblc ip_vs_lblcr ip_vs_dh ip_vs_sh ip_vs_fo ip_vs_nq ip_vs_sed ip_vs_ftp nf_conntrack"
for kernel_module in \${ipvs_modules}; do
/sbin/modinfo -F filename \${kernel_module} > /dev/null 2>&1
if [ $? -eq 0 ]; then
/sbin/modprobe \${kernel_module}
fi
done
EOF
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep ip_vs
#14.内核参数优化
cat > /etc/sysctl.d/k8s.conf << EOF
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
fs.may_detach_mounts = 1
vm.overcommit_memory=1
vm.panic_on_oom=0
fs.inotify.max_user_watches=89100
fs.file-max=52706963
fs.nr_open=52706963
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp.keepaliv.probes = 3
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp.max_tw_buckets = 36000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp.max_orphans = 327680
net.ipv4.tcp_orphan_retries = 3
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.ip_conntrack_max = 65536
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.top_timestamps = 0
net.core.somaxconn = 16384
EOF
#15.立即生效
sysctl --system
#16.配置Kubernetes源，安装k8s
cat > /etc/yum.repos.d/kubernetes.repo <
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
yum install -y kubelet-1.19.0-0 kubeadm-1.19.0-0 kubectl-1.19.0-0
#17.配置和启动kubelet
cat >/etc/sysconfig/kubelet << EOF
KUBELET_EXTRA_ARGS="--cgroup-driver=systemd"
EOF
systemctl daemon-reload
systemctl restart kubelet && systemctl enable kubelet
#(node1和node2执行到此处)
#18.节点初始化
kubeadm init --kubernetes-version=1.19.0 --apiserver-advertise-address=192.168.121.201 --image-repository registry.aliyuncs.com/google_containers --service-cidr=10.1.0.0/16 --pod-network-cidr=10.244.0.0/16
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
node1和node2也执行成功后可将master节点初始化后显示的命令在node节点执行，然后master节点执行kube-flannel.yml文件。命令为：kubectl apply -f kube-flannel.yml
执行后等待数分钟master节点执行kubectl get node查看到如下所示：
接下来执行两个yml文件
kubectl create -f execute.yml
kubectl create -f kubernetes-dashboard.yml
删除旧证书创建新证书
kubectl delete secret kubernetes-dashboard-certs -n kubernetes-dashboard
kubectl create secret generic kubernetes-dashboard-certs --from-file=/etc/kubernetes/pki/apiserver.key --from-file=/etc/kubernetes/pki/apiserver.crt -n kubernetes-dashboard
然后在此处添加内容：
- --tls-key-file=apiserver.key
- --tls-cert-file=apiserver.crt
添加后执行此命令：kubectl apply -f kubernetes-dashboard.yml
最后执行：kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
上条命令执行后会生成一条长串的token值，将token值复制然后用浏览器访问master的IP加上端口号。登录选项选择token值登录，然后将复制的token值粘贴
注：配置文件里的端口号为30001
登录后的界面如下所示：
文章涉及的yml文件如下：
1 --- 2 apiVersion: policy/v1beta1 3 kind: PodSecurityPolicy 4 metadata: 5 name: psp.flannel.unprivileged 6 annotations: 7 seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default 8 seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default 9 apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default 10 apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default 11 spec: 12 privileged: false 13 volumes: 14 - configMap 15 - secret 16 - emptyDir 17 - hostPath 18 allowedHostPaths: 19 - pathPrefix: "/etc/cni/net.d" 20 - pathPrefix: "/etc/kube-flannel" 21 - pathPrefix: "/run/flannel" 22 readOnlyRootFilesystem: false 23 # Users and groups 24 runAsUser: 25 rule: RunAsAny 26 supplementalGroups: 27 rule: RunAsAny 28 fsGroup: 29 rule: RunAsAny 30 # Privilege Escalation 31 allowPrivilegeEscalation: false 32 defaultAllowPrivilegeEscalation: false 33 # Capabilities 34 allowedCapabilities: ['NET_ADMIN'] 35 defaultAddCapabilities: [] 36 requiredDropCapabilities: [] 37 # Host namespaces 38 hostPID: false 39 hostIPC: false 40 hostNetwork: true 41 hostPorts: 42 - min: 0 43 max: 65535 44 # SELinux 45 seLinux: 46 # SELinux is unused in CaaSP 47 rule: 'RunAsAny' 48 --- 49 kind: ClusterRole 50 apiVersion: rbac.authorization.k8s.io/v1 51 metadata: 52 name: flannel 53 rules: 54 - apiGroups: ['extensions'] 55 resources: ['podsecuritypolicies'] 56 verbs: ['use'] 57 resourceNames: ['psp.flannel.unprivileged'] 58 - apiGroups: 59 - "" 60 resources: 61 - pods 62 verbs: 63 - get 64 - apiGroups: 65 - "" 66 resources: 67 - nodes 68 verbs: 69 - list 70 - watch 71 - apiGroups: 72 - "" 73 resources: 74 - nodes/status 75 verbs: 76 - patch 77 --- 78 kind: ClusterRoleBinding 79 apiVersion: rbac.authorization.k8s.io/v1 80 metadata: 81 name: flannel 82 roleRef: 83 apiGroup: rbac.authorization.k8s.io 84 kind: ClusterRole 85 name: flannel 86 subjects: 87 - kind: ServiceAccount 88 name: flannel 89 namespace: kube-system 90 --- 91 apiVersion: v1 92 kind: ServiceAccount 93 metadata: 94 name: flannel 95 namespace: kube-system 96 --- 97 kind: ConfigMap 98 apiVersion: v1 99 metadata: 100 name: kube-flannel-cfg 101 namespace: kube-system 102 labels: 103 tier: node 104 app: flannel 105 data: 106 cni-conf.json: | 107 { 108 "name": "cbr0", 109 "cniVersion": "0.3.1", 110 "plugins": [ 111 { 112 "type": "flannel", 113 "delegate": { 114 "hairpinMode": true, 115 "isDefaultGateway": true 116 } 117 }, 118 { 119 "type": "portmap", 120 "capabilities": { 121 "portMappings": true 122 } 123 } 124 ] 125 } 126 net-conf.json: | 127 { 128 "Network": "10.244.0.0/16", 129 "Backend": { 130 "Type": "vxlan" 131 } 132 } 133 --- 134 apiVersion: apps/v1 135 kind: DaemonSet 136 metadata: 137 name: kube-flannel-ds-amd64 138 namespace: kube-system 139 labels: 140 tier: node 141 app: flannel 142 spec: 143 selector: 144 matchLabels: 145 app: flannel 146 template: 147 metadata: 148 labels: 149 tier: node 150 app: flannel 151 spec: 152 affinity: 153 nodeAffinity: 154 requiredDuringSchedulingIgnoredDuringExecution: 155 nodeSelectorTerms: 156 - matchExpressions: 157 - key: beta.kubernetes.io/os 158 operator: In 159 values: 160 - linux 161 - key: beta.kubernetes.io/arch 162 operator: In 163 values: 164 - amd64 165 hostNetwork: true 166 tolerations: 167 - operator: Exists 168 effect: NoSchedule 169 serviceAccountName: flannel 170 initContainers: 171 - name: install-cni 172 image: quay.io/coreos/flannel:v0.12.0-amd64 173 command: 174 - cp 175 args: 176 - -f 177 - /etc/kube-flannel/cni-conf.json 178 - /etc/cni/net.d/10-flannel.conflist 179 volumeMounts: 180 - name: cni 181 mountPath: /etc/cni/net.d 182 - name: flannel-cfg 183 mountPath: /etc/kube-flannel/ 184 containers: 185 - name: kube-flannel 186 image: quay.io/coreos/flannel:v0.12.0-amd64 187 command: 188 - /opt/bin/flanneld 189 args: 190 - --ip-masq 191 - --kube-subnet-mgr 192 resources: 193 requests: 194 cpu: "100m" 195 memory: "50Mi" 196 limits: 197 cpu: "100m" 198 memory: "50Mi" 199 securityContext: 200 privileged: false 201 capabilities: 202 add: ["NET_ADMIN"] 203 env: 204 - name: POD_NAME 205 valueFrom: 206 fieldRef: 207 fieldPath: metadata.name 208 - name: POD_NAMESPACE 209 valueFrom: 210 fieldRef: 211 fieldPath: metadata.namespace 212 volumeMounts: 213 - name: run 214 mountPath: /run/flannel 215 - name: flannel-cfg 216 mountPath: /etc/kube-flannel/ 217 volumes: 218 - name: run 219 hostPath: 220 path: /run/flannel 221 - name: cni 222 hostPath: 223 path: /etc/cni/net.d 224 - name: flannel-cfg 225 configMap: 226 name: kube-flannel-cfg 227 --- 228 apiVersion: apps/v1 229 kind: DaemonSet 230 metadata: 231 name: kube-flannel-ds-arm64 232 namespace: kube-system 233 labels: 234 tier: node 235 app: flannel 236 spec: 237 selector: 238 matchLabels: 239 app: flannel 240 template: 241 metadata: 242 labels: 243 tier: node 244 app: flannel 245 spec: 246 affinity: 247 nodeAffinity: 248 requiredDuringSchedulingIgnoredDuringExecution: 249 nodeSelectorTerms: 250 - matchExpressions: 251 - key: beta.kubernetes.io/os 252 operator: In 253 values: 254 - linux 255 - key: beta.kubernetes.io/arch 256 operator: In 257 values: 258 - arm64 259 hostNetwork: true 260 tolerations: 261 - operator: Exists 262 effect: NoSchedule 263 serviceAccountName: flannel 264 initContainers: 265 - name: install-cni 266 image: quay.io/coreos/flannel:v0.12.0-arm64 267 command: 268 - cp 269 args: 270 - -f 271 - /etc/kube-flannel/cni-conf.json 272 - /etc/cni/net.d/10-flannel.conflist 273 volumeMounts: 274 - name: cni 275 mountPath: /etc/cni/net.d 276 - name: flannel-cfg 277 mountPath: /etc/kube-flannel/ 278 containers: 279 - name: kube-flannel 280 image: quay.io/coreos/flannel:v0.12.0-arm64 281 command: 282 - /opt/bin/flanneld 283 args: 284 - --ip-masq 285 - --kube-subnet-mgr 286 resources: 287 requests: 288 cpu: "100m" 289 memory: "50Mi" 290 limits: 291 cpu: "100m" 292 memory: "50Mi" 293 securityContext: 294 privileged: false 295 capabilities: 296 add: ["NET_ADMIN"] 297 env: 298 - name: POD_NAME 299 valueFrom: 300 fieldRef: 301 fieldPath: metadata.name 302 - name: POD_NAMESPACE 303 valueFrom: 304 fieldRef: 305 fieldPath: metadata.namespace 306 volumeMounts: 307 - name: run 308 mountPath: /run/flannel 309 - name: flannel-cfg 310 mountPath: /etc/kube-flannel/ 311 volumes: 312 - name: run 313 hostPath: 314 path: /run/flannel 315 - name: cni 316 hostPath: 317 path: /etc/cni/net.d 318 - name: flannel-cfg 319 configMap: 320 name: kube-flannel-cfg 321 --- 322 apiVersion: apps/v1 323 kind: DaemonSet 324 metadata: 325 name: kube-flannel-ds-arm 326 namespace: kube-system 327 labels: 328 tier: node 329 app: flannel 330 spec: 331 selector: 332 matchLabels: 333 app: flannel 334 template: 335 metadata: 336 labels: 337 tier: node 338 app: flannel 339 spec: 340 affinity: 341 nodeAffinity: 342 requiredDuringSchedulingIgnoredDuringExecution: 343 nodeSelectorTerms: 344 - matchExpressions: 345 - key: beta.kubernetes.io/os 346 operator: In 347 values: 348 - linux 349 - key: beta.kubernetes.io/arch 350 operator: In 351 values: 352 - arm 353 hostNetwork: true 354 tolerations: 355 - operator: Exists 356 effect: NoSchedule 357 serviceAccountName: flannel 358 initContainers: 359 - name: install-cni 360 image: quay.io/coreos/flannel:v0.12.0-arm 361 command: 362 - cp 363 args: 364 - -f 365 - /etc/kube-flannel/cni-conf.json 366 - /etc/cni/net.d/10-flannel.conflist 367 volumeMounts: 368 - name: cni 369 mountPath: /etc/cni/net.d 370 - name: flannel-cfg 371 mountPath: /etc/kube-flannel/ 372 containers: 373 - name: kube-flannel 374 image: quay.io/coreos/flannel:v0.12.0-arm 375 command: 376 - /opt/bin/flanneld 377 args: 378 - --ip-masq 379 - --kube-subnet-mgr 380 resources: 381 requests: 382 cpu: "100m" 383 memory: "50Mi" 384 limits: 385 cpu: "100m" 386 memory: "50Mi" 387 securityContext: 388 privileged: false 389 capabilities: 390 add: ["NET_ADMIN"] 391 env: 392 - name: POD_NAME 393 valueFrom: 394 fieldRef: 395 fieldPath: metadata.name 396 - name: POD_NAMESPACE 397 valueFrom: 398 fieldRef: 399 fieldPath: metadata.namespace 400 volumeMounts: 401 - name: run 402 mountPath: /run/flannel 403 - name: flannel-cfg 404 mountPath: /etc/kube-flannel/ 405 volumes: 406 - name: run 407 hostPath: 408 path: /run/flannel 409 - name: cni 410 hostPath: 411 path: /etc/cni/net.d 412 - name: flannel-cfg 413 configMap: 414 name: kube-flannel-cfg 415 --- 416 apiVersion: apps/v1 417 kind: DaemonSet 418 metadata: 419 name: kube-flannel-ds-ppc64le 420 namespace: kube-system 421 labels: 422 tier: node 423 app: flannel 424 spec: 425 selector: 426 matchLabels: 427 app: flannel 428 template: 429 metadata: 430 labels: 431 tier: node 432 app: flannel 433 spec: 434 affinity: 435 nodeAffinity: 436 requiredDuringSchedulingIgnoredDuringExecution: 437 nodeSelectorTerms: 438 - matchExpressions: 439 - key: beta.kubernetes.io/os 440 operator: In 441 values: 442 - linux 443 - key: beta.kubernetes.io/arch 444 operator: In 445 values: 446 - ppc64le 447 hostNetwork: true 448 tolerations: 449 - operator: Exists 450 effect: NoSchedule 451 serviceAccountName: flannel 452 initContainers: 453 - name: install-cni 454 image: quay.io/coreos/flannel:v0.12.0-ppc64le 455 command: 456 - cp 457 args: 458 - -f 459 - /etc/kube-flannel/cni-conf.json 460 - /etc/cni/net.d/10-flannel.conflist 461 volumeMounts: 462 - name: cni 463 mountPath: /etc/cni/net.d 464 - name: flannel-cfg 465 mountPath: /etc/kube-flannel/ 466 containers: 467 - name: kube-flannel 468 image: quay.io/coreos/flannel:v0.12.0-ppc64le 469 command: 470 - /opt/bin/flanneld 471 args: 472 - --ip-masq 473 - --kube-subnet-mgr 474 resources: 475 requests: 476 cpu: "100m" 477 memory: "50Mi" 478 limits: 479 cpu: "100m" 480 memory: "50Mi" 481 securityContext: 482 privileged: false 483 capabilities: 484 add: ["NET_ADMIN"] 485 env: 486 - name: POD_NAME 487 valueFrom: 488 fieldRef: 489 fieldPath: metadata.name 490 - name: POD_NAMESPACE 491 valueFrom: 492 fieldRef: 493 fieldPath: metadata.namespace 494 volumeMounts: 495 - name: run 496 mountPath: /run/flannel 497 - name: flannel-cfg 498 mountPath: /etc/kube-flannel/ 499 volumes: 500 - name: run 501 hostPath: 502 path: /run/flannel 503 - name: cni 504 hostPath: 505 path: /etc/cni/net.d 506 - name: flannel-cfg 507 configMap: 508 name: kube-flannel-cfg 509 --- 510 apiVersion: apps/v1 511 kind: DaemonSet 512 metadata: 513 name: kube-flannel-ds-s390x 514 namespace: kube-system 515 labels: 516 tier: node 517 app: flannel 518 spec: 519 selector: 520 matchLabels: 521 app: flannel 522 template: 523 metadata: 524 labels: 525 tier: node 526 app: flannel 527 spec: 528 affinity: 529 nodeAffinity: 530 requiredDuringSchedulingIgnoredDuringExecution: 531 nodeSelectorTerms: 532 - matchExpressions: 533 - key: beta.kubernetes.io/os 534 operator: In 535 values: 536 - linux 537 - key: beta.kubernetes.io/arch 538 operator: In 539 values: 540 - s390x 541 hostNetwork: true 542 tolerations: 543 - operator: Exists 544 effect: NoSchedule 545 serviceAccountName: flannel 546 initContainers: 547 - name: install-cni 548 image: quay.io/coreos/flannel:v0.12.0-s390x 549 command: 550 - cp 551 args: 552 - -f 553 - /etc/kube-flannel/cni-conf.json 554 - /etc/cni/net.d/10-flannel.conflist 555 volumeMounts: 556 - name: cni 557 mountPath: /etc/cni/net.d 558 - name: flannel-cfg 559 mountPath: /etc/kube-flannel/ 560 containers: 561 - name: kube-flannel 562 image: quay.io/coreos/flannel:v0.12.0-s390x 563 command: 564 - /opt/bin/flanneld 565 args: 566 - --ip-masq 567 - --kube-subnet-mgr 568 resources: 569 requests: 570 cpu: "100m" 571 memory: "50Mi" 572 limits: 573 cpu: "100m" 574 memory: "50Mi" 575 securityContext: 576 privileged: false 577 capabilities: 578 add: ["NET_ADMIN"] 579 env: 580 - name: POD_NAME 581 valueFrom: 582 fieldRef: 583 fieldPath: metadata.name 584 - name: POD_NAMESPACE 585 valueFrom: 586 fieldRef: 587 fieldPath: metadata.namespace 588 volumeMounts: 589 - name: run 590 mountPath: /run/flannel 591 - name: flannel-cfg 592 mountPath: /etc/kube-flannel/ 593 volumes: 594 - name: run 595 hostPath: 596 path: /run/flannel 597 - name: cni 598 hostPath: 599 path: /etc/cni/net.d 600 - name: flannel-cfg 601 configMap: 602 name: kube-flannel-cfgkube-flannel.yml
1 # Copyright 2017 The Kubernetes Authors. 2 # 3 # Licensed under the Apache License, Version 2.0 (the "License"); 4 # you may not use this file except in compliance with the License. 5 # You may obtain a copy of the License at 6 # 7 # http://www.apache.org/licenses/LICENSE-2.0 8 # 9 # Unless required by applicable law or agreed to in writing, software 10 # distributed under the License is distributed on an "AS IS" BASIS, 11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 # See the License for the specific language governing permissions and 13 # limitations under the License. 14 15 apiVersion: v1 16 kind: Namespace 17 metadata: 18 name: kubernetes-dashboard 19 20 --- 21 22 apiVersion: v1 23 kind: ServiceAccount 24 metadata: 25 labels: 26 k8s-app: kubernetes-dashboard 27 name: kubernetes-dashboard 28 namespace: kubernetes-dashboard 29 30 --- 31 32 kind: Service 33 apiVersion: v1 34 metadata: 35 labels: 36 k8s-app: kubernetes-dashboard 37 name: kubernetes-dashboard 38 namespace: kubernetes-dashboard 39 spec: 40 type: NodePort 41 ports: 42 - port: 443 43 targetPort: 8443 44 nodePort: 30001 45 selector: 46 k8s-app: kubernetes-dashboard 47 48 --- 49 50 apiVersion: v1 51 kind: Secret 52 metadata: 53 labels: 54 k8s-app: kubernetes-dashboard 55 name: kubernetes-dashboard-certs 56 namespace: kubernetes-dashboard 57 type: Opaque 58 59 --- 60 61 apiVersion: v1 62 kind: Secret 63 metadata: 64 labels: 65 k8s-app: kubernetes-dashboard 66 name: kubernetes-dashboard-csrf 67 namespace: kubernetes-dashboard 68 type: Opaque 69 data: 70 csrf: "" 71 72 --- 73 74 apiVersion: v1 75 kind: Secret 76 metadata: 77 labels: 78 k8s-app: kubernetes-dashboard 79 name: kubernetes-dashboard-key-holder 80 namespace: kubernetes-dashboard 81 type: Opaque 82 83 --- 84 85 kind: ConfigMap 86 apiVersion: v1 87 metadata: 88 labels: 89 k8s-app: kubernetes-dashboard 90 name: kubernetes-dashboard-settings 91 namespace: kubernetes-dashboard 92 93 --- 94 95 kind: Role 96 apiVersion: rbac.authorization.k8s.io/v1 97 metadata: 98 labels: 99 k8s-app: kubernetes-dashboard 100 name: kubernetes-dashboard 101 namespace: kubernetes-dashboard 102 rules: 103 # Allow Dashboard to get, update and delete Dashboard exclusive secrets. 104 - apiGroups: [""] 105 resources: ["secrets"] 106 resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"] 107 verbs: ["get", "update", "delete"] 108 # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. 109 - apiGroups: [""] 110 resources: ["configmaps"] 111 resourceNames: ["kubernetes-dashboard-settings"] 112 verbs: ["get", "update"] 113 # Allow Dashboard to get metrics. 114 - apiGroups: [""] 115 resources: ["services"] 116 resourceNames: ["heapster", "dashboard-metrics-scraper"] 117 verbs: ["proxy"] 118 - apiGroups: [""] 119 resources: ["services/proxy"] 120 resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"] 121 verbs: ["get"] 122 123 --- 124 125 kind: ClusterRole 126 apiVersion: rbac.authorization.k8s.io/v1 127 metadata: 128 labels: 129 k8s-app: kubernetes-dashboard 130 name: kubernetes-dashboard 131 rules: 132 # Allow Metrics Scraper to get metrics from the Metrics server 133 - apiGroups: ["metrics.k8s.io"] 134 resources: ["pods", "nodes"] 135 verbs: ["get", "list", "watch"] 136 137 --- 138 139 apiVersion: rbac.authorization.k8s.io/v1 140 kind: RoleBinding 141 metadata: 142 labels: 143 k8s-app: kubernetes-dashboard 144 name: kubernetes-dashboard 145 namespace: kubernetes-dashboard 146 roleRef: 147 apiGroup: rbac.authorization.k8s.io 148 kind: Role 149 name: kubernetes-dashboard 150 subjects: 151 - kind: ServiceAccount 152 name: kubernetes-dashboard 153 namespace: kubernetes-dashboard 154 155 --- 156 157 apiVersion: rbac.authorization.k8s.io/v1 158 kind: ClusterRoleBinding 159 metadata: 160 name: kubernetes-dashboard 161 roleRef: 162 apiGroup: rbac.authorization.k8s.io 163 kind: ClusterRole 164 name: kubernetes-dashboard 165 subjects: 166 - kind: ServiceAccount 167 name: kubernetes-dashboard 168 namespace: kubernetes-dashboard 169 170 --- 171 172 kind: Deployment 173 apiVersion: apps/v1 174 metadata: 175 labels: 176 k8s-app: kubernetes-dashboard 177 name: kubernetes-dashboard 178 namespace: kubernetes-dashboard 179 spec: 180 replicas: 1 181 revisionHistoryLimit: 10 182 selector: 183 matchLabels: 184 k8s-app: kubernetes-dashboard 185 template: 186 metadata: 187 labels: 188 k8s-app: kubernetes-dashboard 189 spec: 190 containers: 191 - name: kubernetes-dashboard 192 image: kubernetesui/dashboard:v2.0.0-beta8 193 imagePullPolicy: Always 194 ports: 195 - containerPort: 8443 196 protocol: TCP 197 args: 198 - --auto-generate-certificates 199 - --namespace=kubernetes-dashboard 200 # Uncomment the following line to manually specify Kubernetes API server Host 201 # If not specified, Dashboard will attempt to auto discover the API server and connect 202 # to it. Uncomment only if the default does not work. 203 # - --apiserver-host=http://my-address:port 204 volumeMounts: 205 - name: kubernetes-dashboard-certs 206 mountPath: /certs 207 # Create on-disk volume to store exec logs 208 - mountPath: /tmp 209 name: tmp-volume 210 livenessProbe: 211 httpGet: 212 scheme: HTTPS 213 path: / 214 port: 8443 215 initialDelaySeconds: 30 216 timeoutSeconds: 30 217 securityContext: 218 allowPrivilegeEscalation: false 219 readOnlyRootFilesystem: true 220 runAsUser: 1001 221 runAsGroup: 2001 222 volumes: 223 - name: kubernetes-dashboard-certs 224 secret: 225 secretName: kubernetes-dashboard-certs 226 - name: tmp-volume 227 emptyDir: {} 228 serviceAccountName: kubernetes-dashboard 229 nodeSelector: 230 "beta.kubernetes.io/os": linux 231 # Comment the following tolerations if Dashboard must not be deployed on master 232 tolerations: 233 - key: node-role.kubernetes.io/master 234 effect: NoSchedule 235 236 --- 237 238 kind: Service 239 apiVersion: v1 240 metadata: 241 labels: 242 k8s-app: dashboard-metrics-scraper 243 name: dashboard-metrics-scraper 244 namespace: kubernetes-dashboard 245 spec: 246 ports: 247 - port: 8000 248 targetPort: 8000 249 selector: 250 k8s-app: dashboard-metrics-scraper 251 252 --- 253 254 kind: Deployment 255 apiVersion: apps/v1 256 metadata: 257 labels: 258 k8s-app: dashboard-metrics-scraper 259 name: dashboard-metrics-scraper 260 namespace: kubernetes-dashboard 261 spec: 262 replicas: 1 263 revisionHistoryLimit: 10 264 selector: 265 matchLabels: 266 k8s-app: dashboard-metrics-scraper 267 template: 268 metadata: 269 labels: 270 k8s-app: dashboard-metrics-scraper 271 annotations: 272 seccomp.security.alpha.kubernetes.io/pod: 'runtime/default' 273 spec: 274 containers: 275 - name: dashboard-metrics-scraper 276 image: kubernetesui/metrics-scraper:v1.0.1 277 ports: 278 - containerPort: 8000 279 protocol: TCP 280 livenessProbe: 281 httpGet: 282 scheme: HTTP 283 path: / 284 port: 8000 285 initialDelaySeconds: 30 286 timeoutSeconds: 30 287 volumeMounts: 288 - mountPath: /tmp 289 name: tmp-volume 290 securityContext: 291 allowPrivilegeEscalation: false 292 readOnlyRootFilesystem: true 293 runAsUser: 1001 294 runAsGroup: 2001 295 serviceAccountName: kubernetes-dashboard 296 nodeSelector: 297 "beta.kubernetes.io/os": linux 298 # Comment the following tolerations if Dashboard must not be deployed on master 299 tolerations: 300 - key: node-role.kubernetes.io/master 301 effect: NoSchedule 302 volumes: 303 - name: tmp-volume 304 emptyDir: {}kubernetes-dashboard.yml
1 # Create Service Account 2 apiVersion: v1 3 kind: ServiceAccount 4 metadata: 5 name: admin-user 6 namespace: kube-system 7 --- 8 # Create ClusterRoleBinding 9 apiVersion: rbac.authorization.k8s.io/v1 10 kind: ClusterRoleBinding 11 metadata: 12 name: admin-user 13 roleRef: 14 apiGroup: rbac.authorization.k8s.io 15 kind: ClusterRole 16 name: cluster-admin 17 subjects: 18 - kind: ServiceAccount 19 name: admin-user 20 namespace: kube-systemexecute.yml