为kubenetes集群，创建dashboard

上篇文章中介绍了如何安装kubenetes v1.18.1
部署Kubernetes集群 - v1.18.1
现给它安装个dashboard。

准备yaml文件

https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc7/aio/deploy/recommended.yaml

链接：https://pan.baidu.com/s/1XPaZ0on83UOJTxu3hJ2g6w
提取码：fry2
将其中dashboard-service修改成如下：

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kube-dashboard
spec:
  type: NodePort
  ports:
    - port: 443
      targetPort: 8443
      nodePort: 30000
  selector:
    k8s-app: kubernetes-dashboard

修改这个service，加上type为NodePort，ports下加一行nodePort: 30000

[root@dev-learn-77 dashboard]#  kubectl create -f dashboard.yml
namespace/kube-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created

查看pod和service

[root@dev-learn-77 dashboard]# kubectl get pod -o wide -n kube-dashboard
NAME                                        READY   STATUS    RESTARTS   AGE   IP              NODE           NOMINATED NODE   READINESS GATES
dashboard-metrics-scraper-dc6947fbf-tqc98   1/1     Running   0          26m   10.244.218.67   dev-learn-79   <none>           <none>
kubernetes-dashboard-7b9b9c94f7-9jrmc       1/1     Running   0          26m   10.244.224.8    dev-learn-78   <none>           <none>
[root@dev-learn-77 dashboard]# 
[root@dev-learn-77 dashboard]# kubectl get service -o wide -n kube-dashboard
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE   SELECTOR
dashboard-metrics-scraper   ClusterIP   10.111.218.20   <none>        8000/TCP        27m   k8s-app=dashboard-metrics-scraper
kubernetes-dashboard        NodePort    10.110.139.83   <none>        443:30000/TCP   27m   k8s-app=kubernetes-dashboard
[root@dev-learn-77 dashboard]# 

在浏览器中输入地址：https://172.22.21.77:30000，即可看到dashboard的登录详情，

查看token：

[root@dev-learn-77 dashboard]# kubectl get secret -o wide -n kube-dashboard
NAME                               TYPE                                  DATA   AGE
default-token-bh96r                kubernetes.io/service-account-token   3      28m
kubernetes-dashboard-certs         Opaque                                0      28m
kubernetes-dashboard-csrf          Opaque                                1      28m
kubernetes-dashboard-key-holder    Opaque                                2      28m
kubernetes-dashboard-token-hvq4g   kubernetes.io/service-account-token   3      28m
[root@dev-learn-77 dashboard]# 
[root@dev-learn-77 dashboard]# kubectl describe secret kubernetes-dashboard-token-hvq4g -n kube-dashboard
Name:         kubernetes-dashboard-token-hvq4g
Namespace:    kube-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: kubernetes-dashboard
              kubernetes.io/service-account.uid: 7425b2ff-a410-4082-adc4-0661cd005ccc

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  14 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IndjNlpPc0wtWTQxejd0VFJvX3hpQ2tzVkdMQTNGcF9xU0p1MVJQVElPVVUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2kkb2FyZC10b2tlbi1odnE0ZyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6Ijc0MjViMmZmLWE0MTAtNDA4Mi1hZGM0LTA2NjFjZDAwNWNjYyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLWRhc2hib2FyZDprdWJlcm5ldGVzLWRhc2hib2FyZCJ9.OhXrLIDNwetwXEepdE2ss_DGuIykIyVeFSyghlkn-d7tgIPWUN6Wnr-cM7UR1oz_DI5EyKIciNkuoRUjpICLvL9-AW16WpeZ1gP2JSkjUWzavOTTh3At8qO0aX1K9e2AfvpbqC0atXodrRa6Cj-jqsBHF1Dos2-2UcnifjmvQVRL30EXhsYxAfiOPRxB-WCABMRSfCtIN7LVYt_dLS1RxYw2qy52dVpXaToNn5OcM9Sk5NQ44SFNBFGO1Rel06XjvAgwdKwtSC0dWTYNE0_Z7Agd-mgNJKK_AB0IrjUSG_DJWGHldJOEer-VAYIiqM7C_I_ScTfFdB_CTmTDZJrgzg
[root@dev-learn-77 dashboard]# 

即可通过此token登录dashboard。

若遇到登录后什么都看不到的情况，应该是权限不够

Non-critical error occurred during resource retrieval: pods is forbidden: User "system:serviceaccount:kube-dashboard:kubernetes-dashboard" cannot list resource "pods" in API group "" in the namespace "kube-dashboard"

创建一个如下的yaml文件：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: dashboard-admin
  namespace: kube-dashboard
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: dashboard-admin
subjects:
  - kind: ServiceAccount
    name: dashboard-admin
    namespace: kube-dashboard
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

kubectl create -f k8s-admin.yaml

然后拿到这个新的secret的token即可

[root@dev-learn-77 dashboard]# kubectl describe secret dashboard-admin-token-7lfh7 -n kube-dashboard
Name:         dashboard-admin-token-7lfh7
Namespace:    kube-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 5886d511-ecbc-4da1-a567-b1d03391ca2d

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  14 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IndjNlpPc0wtWTQxejd0VFJvX3hpQ2tzVkdMQTNGcF9xU0p1MVJQVElPVVUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4tN2xmaDciLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5q8y9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNTg4NmQ1MTEtZWNiYy00ZGExLWE1NjctYjFkMDMzOTFjYTJkIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.BdStPGxT2vgmPWMtBobK9gL5VnuamWamLpIR0eEPcYiyzXm08JA1506NIYHgh7ZZTjZk6SZBLCdjltDbavp0kL3so62wlR1Bbe881937cWShuiztsuv1xEi8qIetCEU2mhRI3qtdGAAEWBsMQMQfydPXuNTMb6bERL48r-5gGKX0hUSAo92KZFI0DIXXzkMIdQf--TuDvDkWA-Hw83FjJpMDSzDiE-c3KMVeVdx50Sywok9cZhHBmeMzXmNVLGcdyRSoEMP7SCjssJQJiQyngKleUIO_v8KcNBtzyCHVF2HGvMG5NQXlowcaFca353vbo-9cwxEArLOou2QxIv39xQ
[root@dev-learn-77 dashboard]#