一、Dashboard简介

官网：https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/
 
Dashboard是基于web的Kubernetes用户界面。您可以使用指示板将容器化的应用程序部署到Kubernetes集群，对容器化的应用程序进行故障排除，并管理集群资源。您可以使用Dashboard来获得运行在集群上的应用程序的概览，以及创建或修改单独的Kubernetes资源(例如部署、作业、守护进程集等)。例如，您可以扩展部署、发起滚动更新、重新启动pod或使用部署向导部署新的应用程序。

---

二、k8s安装Dashboard

(1)下载Dashboard镜像（可选）

提前下载Dashboard镜像（可选）：

[root@m test]# docker pull mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.0

也可上传至私有仓库（可选）：

# 启动私有仓库
[root@m test]# docker start registry
# 给镜像打tag
[root@m test]# docker tag mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.0 192.168.116.170:5000/mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.0
# push镜像到私有仓库
[root@m test]# docker push 192.168.116.70:5000/mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.0

---

(2)根据yaml文件创建资源

[root@m test]# vi dashboard.yaml

内容（如果可能，注意修改其中的dashboard镜像地址（大约44行））:

apiVersion: v1
kind: ConfigMap
metadata:labels:k8s-app: kubernetes-dashboard# Allows editing resource and makes sure it is created first.addonmanager.kubernetes.io/mode: EnsureExistsname: kubernetes-dashboard-settingsnamespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:labels:k8s-app: kubernetes-dashboardaddonmanager.kubernetes.io/mode: Reconcilename: kubernetes-dashboardnamespace: kube-system
---
apiVersion: apps/v1
kind: Deployment
metadata:name: kubernetes-dashboardnamespace: kube-systemlabels:k8s-app: kubernetes-dashboardkubernetes.io/cluster-service: "true"addonmanager.kubernetes.io/mode: Reconcile
spec:selector:matchLabels:k8s-app: kubernetes-dashboardtemplate:metadata:labels:k8s-app: kubernetes-dashboardannotations:scheduler.alpha.kubernetes.io/critical-pod: ''seccomp.security.alpha.kubernetes.io/pod: 'docker/default'spec:priorityClassName: system-cluster-criticalcontainers:- name: kubernetes-dashboardimage: mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.0resources:limits:cpu: 100mmemory: 300Mirequests:cpu: 50mmemory: 100Miports:- containerPort: 8443protocol: TCPargs:# PLATFORM-SPECIFIC ARGS HERE- --auto-generate-certificatesvolumeMounts:- name: kubernetes-dashboard-certsmountPath: /certs- name: tmp-volumemountPath: /tmplivenessProbe:httpGet:scheme: HTTPSpath: /port: 8443initialDelaySeconds: 30timeoutSeconds: 30volumes:- name: kubernetes-dashboard-certssecret:secretName: kubernetes-dashboard-certs- name: tmp-volumeemptyDir: {}serviceAccountName: kubernetes-dashboardtolerations:- key: "CriticalAddonsOnly"operator: "Exists"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:labels:k8s-app: kubernetes-dashboardaddonmanager.kubernetes.io/mode: Reconcilename: kubernetes-dashboard-minimalnamespace: kube-system
rules:# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]resources: ["secrets"]resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]verbs: ["get", "update", "delete"]# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]resources: ["configmaps"]resourceNames: ["kubernetes-dashboard-settings"]verbs: ["get", "update"]# Allow Dashboard to get metrics from heapster.
- apiGroups: [""]resources: ["services"]resourceNames: ["heapster"]verbs: ["proxy"]
- apiGroups: [""]resources: ["services/proxy"]resourceNames: ["heapster", "http:heapster:", "https:heapster:"]verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:name: kubernetes-dashboard-minimalnamespace: kube-systemlabels:k8s-app: kubernetes-dashboardaddonmanager.kubernetes.io/mode: Reconcile
roleRef:apiGroup: rbac.authorization.k8s.iokind: Rolename: kubernetes-dashboard-minimal
subjects:
- kind: ServiceAccountname: kubernetes-dashboardnamespace: kube-system
---
apiVersion: v1
kind: Secret
metadata:labels:k8s-app: kubernetes-dashboard# Allows editing resource and makes sure it is created first.addonmanager.kubernetes.io/mode: EnsureExistsname: kubernetes-dashboard-certsnamespace: kube-system
type: Opaque
---
apiVersion: v1
kind: Secret
metadata:labels:k8s-app: kubernetes-dashboard# Allows editing resource and makes sure it is created first.addonmanager.kubernetes.io/mode: EnsureExistsname: kubernetes-dashboard-key-holdernamespace: kube-system
type: Opaque
---
apiVersion: v1
kind: Service
metadata:name: kubernetes-dashboardnamespace: kube-systemlabels:k8s-app: kubernetes-dashboardkubernetes.io/cluster-service: "true"addonmanager.kubernetes.io/mode: Reconcile
spec:selector:k8s-app: kubernetes-dashboardports:- port: 443targetPort: 8443nodePort: 30018type: NodePort

创建资源：

[root@m test]# kubectl apply -f dashboard.yaml
configmap/kubernetes-dashboard-settings created
serviceaccount/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-key-holder created
service/kubernetes-dashboard created
[root@m test]# 

---

(3)查看资源

[root@m test]# kubectl get pods -n kube-system
[root@m test]# kubectl get pods -n kube-system -o wide
[root@m test]# kubectl get svc -n kube-system
[root@m test]# kubectl get deploy kubernetes-dashboard -n kube-system# 查看pod创建详情：
[root@m test]# kubectl describe pod kubernetes-dashboard-7bdfc744fc-hmhh2 -n kube-system

---

(4)生成登录需要的token

# 创建service account
kubectl create sa dashboard-admin -n kube-systemkubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin# 查看dashboard-admin的secret名字
ADMIN_SECRET=$(kubectl get secrets -n kube-system | grep dashboard-admin | awk '{print $1}')
echo ADMIN_SECRET# 打印secret的token
kubectl describe secret -n kube-system ${ADMIN_SECRET} | grep -E '^token' | awk '{print $2}'

# (1)创建service account
[root@m test]# kubectl create sa dashboard-admin -n kube-system
serviceaccount/dashboard-admin created
[root@m test]# # (2)创建角色绑定关系
[root@m test]# kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
[root@m test]# # (3)查看dashboard-admin的secret名字
[root@m test]# ADMIN_SECRET=$(kubectl get secrets -n kube-system | grep dashboard-admin | awk '{print $1}')
[root@m test]# echo ADMIN_SECRET
ADMIN_SECRET
[root@m test]# # (4)打印secret的token（浏览器访问需要）
[root@m test]# kubectl describe secret -n kube-system ${ADMIN_SECRET} | grep -E '^token' | awk '{print $2}'
eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tdDVjbjQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMzdjMDFmZmQtNTY5MC0xMWViLThiNDQtMDA1MDU2Mjg0ZjMwIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRhc2hib2FyZC1hZG1pbiJ9.nafBF2TUqen-4LFLQHdOWZ8XZ08k1rzBMkR0vEvFov6c0DVTUUlwX4-Uxe_OCep8gQgOphlJ3SXUNwCkFvONzxzR5799JeiLr3ahUaVhuMB12m45KHRPE-95pRvgFzs7OpPKiIxEn1cUMtErKdDPRo1zNBB-PzE95-5RGFimrdw-maP2yMo1auAgMow-JjHXhGTLeujDacEdcBWm5YbgFbaD3AkUd_c9EjbokR4-yT4iMd99tD4TwZqjYpUI_Qm76rV54qqylyf5LaOssR2scoiwA2TVHGA4ElMMOng_HqRjJJzmHux9-unakNfM5z8wtTAbJow8r7XHM6IfhxfLSg
[root@m test]# 

注：以上密钥，浏览器访问时需要输入。

---

(5)使用火狐 / 搜狗浏览器访问（个人用的搜狗）

说明：谷歌浏览器配置安全问题太麻烦。

访问地址(输入密钥)：https://192.168.116.170:30018/