一、Kubernetes Dashboard 简介

Kubernetes Dashboard是k8s的管理工具，先引用官方的文档说明：

Dashboard is a web-based Kubernetes user interface. You can use Dashboard to deploy containerized applications to a Kubernetes cluster, troubleshoot your containerized application, and manage the cluster resources. You can use Dashboard to get an overview of applications running on your cluster, as well as for creating or modifying individual Kubernetes resources (such as Deployments, Jobs, DaemonSets, etc). For example, you can scale a Deployment, initiate a rolling update, restart a pod or deploy new applications using a deploy wizard.

大意就是：

Dashboard 是基于 Web 的 Kubernetes 用户界面。您可以使用 Dashboard 将容器化应用程序部署到 Kubernetes 群集、对容器化应用程序进行故障排除以及管理群集资源。您可以使用 Dashboard 获取群集上运行的应用程序的概述，以及创建或修改单个 Kubernetes 资源（如部署、作业、守护进程集等）。例如，您可以缩放部署、启动滚动更新、重新启动窗格或使用部署向导部署新应用程序。

仪表板还提供有关群集中 Kubernetes 资源的状态以及可能发生的任何错误的信息。

下面说说如何在Docker Desktop的Kubernetes中安装。

二、获取部署文件

先到下面的链接查看最新版的Kubernetes Dashboard：https://github.com/kubernetes/dashboard/releases/

然后找到部署的yaml文件，本人安装时是使用：https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.4/aio/deploy/recommended.yaml

当然，我知道大家的网络都不是太好，于是将其下载到本地，方便大家复制。以下内容修改了Service部分，修改后的文件如下：

  1. # Copyright 2017 The Kubernetes Authors.
  2. #
  3. # Licensed under the Apache License, Version 2.0 (the "License");
  4. # you may not use this file except in compliance with the License.
  5. # You may obtain a copy of the License at
  6. #
  7. #     http://www.apache.org/licenses/LICENSE-2.0
  8. #
  9. # Unless required by applicable law or agreed to in writing, software
  10. # distributed under the License is distributed on an "AS IS" BASIS,
  11. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. # See the License for the specific language governing permissions and
  13. # limitations under the License.
  15. apiVersion: v1
  16. kind: Namespace
  17. metadata:
  18.   name: kubernetes-dashboard
  20. ---
  22. apiVersion: v1
  23. kind: ServiceAccount
  24. metadata:
  25.   labels:
  26.     k8s-app: kubernetes-dashboard
  27.   name: kubernetes-dashboard
  28.   namespace: kubernetes-dashboard
  30. ---
  32. kind: Service
  33. apiVersion: v1
  34. metadata:
  35.   labels:
  36.     k8s-app: kubernetes-dashboard
  37.   name: kubernetes-dashboard
  38.   namespace: kubernetes-dashboard
  39. spec:
  40.   ports:
  41.     - port: 443
  42.       targetPort: 8443
  43.       nodePort: 30443
  44.       name: kubernetes-dashboard
  45.   type: NodePort
  46.   selector:
  47.     k8s-app: kubernetes-dashboard
  49. ---
  51. apiVersion: v1
  52. kind: Secret
  53. metadata:
  54.   labels:
  55.     k8s-app: kubernetes-dashboard
  56.   name: kubernetes-dashboard-certs
  57.   namespace: kubernetes-dashboard
  58. type: Opaque
  60. ---
  62. apiVersion: v1
  63. kind: Secret
  64. metadata:
  65.   labels:
  66.     k8s-app: kubernetes-dashboard
  67.   name: kubernetes-dashboard-csrf
  68.   namespace: kubernetes-dashboard
  69. type: Opaque
  70. data:
  71.   csrf: ""
  73. ---
  75. apiVersion: v1
  76. kind: Secret
  77. metadata:
  78.   labels:
  79.     k8s-app: kubernetes-dashboard
  80.   name: kubernetes-dashboard-key-holder
  81.   namespace: kubernetes-dashboard
  82. type: Opaque
  84. ---
  86. kind: ConfigMap
  87. apiVersion: v1
  88. metadata:
  89.   labels:
  90.     k8s-app: kubernetes-dashboard
  91.   name: kubernetes-dashboard-settings
  92.   namespace: kubernetes-dashboard
  94. ---
  96. kind: Role
  97. apiVersion: rbac.authorization.k8s.io/v1
  98. metadata:
  99.   labels:
  100.     k8s-app: kubernetes-dashboard
  101.   name: kubernetes-dashboard
  102.   namespace: kubernetes-dashboard
  103. rules:
  104.   # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  105.   - apiGroups: [""]
  106.     resources: ["secrets"]
  107.     resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
  108.     verbs: ["get", "update", "delete"]
  109.     # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  110.   - apiGroups: [""]
  111.     resources: ["configmaps"]
  112.     resourceNames: ["kubernetes-dashboard-settings"]
  113.     verbs: ["get", "update"]
  114.     # Allow Dashboard to get metrics.
  115.   - apiGroups: [""]
  116.     resources: ["services"]
  117.     resourceNames: ["heapster", "dashboard-metrics-scraper"]
  118.     verbs: ["proxy"]
  119.   - apiGroups: [""]
  120.     resources: ["services/proxy"]
  121.     resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
  122.     verbs: ["get"]
  124. ---
  126. kind: ClusterRole
  127. apiVersion: rbac.authorization.k8s.io/v1
  128. metadata:
  129.   labels:
  130.     k8s-app: kubernetes-dashboard
  131.   name: kubernetes-dashboard
  132. rules:
  133.   # Allow Metrics Scraper to get metrics from the Metrics server
  134.   - apiGroups: ["metrics.k8s.io"]
  135.     resources: ["pods", "nodes"]
  136.     verbs: ["get", "list", "watch"]
  138. ---
  140. apiVersion: rbac.authorization.k8s.io/v1
  141. kind: RoleBinding
  142. metadata:
  143.   labels:
  144.     k8s-app: kubernetes-dashboard
  145.   name: kubernetes-dashboard
  146.   namespace: kubernetes-dashboard
  147. roleRef:
  148.   apiGroup: rbac.authorization.k8s.io
  149.   kind: Role
  150.   name: kubernetes-dashboard
  151. subjects:
  152.   - kind: ServiceAccount
  153.     name: kubernetes-dashboard
  154.     namespace: kubernetes-dashboard
  156. ---
  158. apiVersion: rbac.authorization.k8s.io/v1
  159. kind: ClusterRoleBinding
  160. metadata:
  161.   name: kubernetes-dashboard
  162. roleRef:
  163.   apiGroup: rbac.authorization.k8s.io
  164.   kind: ClusterRole
  165.   name: kubernetes-dashboard
  166. subjects:
  167.   - kind: ServiceAccount
  168.     name: kubernetes-dashboard
  169.     namespace: kubernetes-dashboard
  171. ---
  173. kind: Deployment
  174. apiVersion: apps/v1
  175. metadata:
  176.   labels:
  177.     k8s-app: kubernetes-dashboard
  178.   name: kubernetes-dashboard
  179.   namespace: kubernetes-dashboard
  180. spec:
  181.   replicas: 1
  182.   revisionHistoryLimit: 10
  183.   selector:
  184.     matchLabels:
  185.       k8s-app: kubernetes-dashboard
  186.   template:
  187.     metadata:
  188.       labels:
  189.         k8s-app: kubernetes-dashboard
  190.     spec:
  191.       containers:
  192.         - name: kubernetes-dashboard
  193.           image: kubernetesui/dashboard:v2.0.4
  194.           imagePullPolicy: Always
  195.           ports:
  196.             - containerPort: 8443
  197.               protocol: TCP
  198.           args:
  199.             - --auto-generate-certificates
  200.             - --namespace=kubernetes-dashboard
  201.             # Uncomment the following line to manually specify Kubernetes API server Host
  202.             # If not specified, Dashboard will attempt to auto discover the API server and connect
  203.             # to it. Uncomment only if the default does not work.
  204.             # - --apiserver-host=http://my-address:port
  205.           volumeMounts:
  206.             - name: kubernetes-dashboard-certs
  207.               mountPath: /certs
  208.               # Create on-disk volume to store exec logs
  209.             - mountPath: /tmp
  210.               name: tmp-volume
  211.           livenessProbe:
  212.             httpGet:
  213.               scheme: HTTPS
  214.               path: /
  215.               port: 8443
  216.             initialDelaySeconds: 30
  217.             timeoutSeconds: 30
  218.           securityContext:
  219.             allowPrivilegeEscalation: false
  220.             readOnlyRootFilesystem: true
  221.             runAsUser: 1001
  222.             runAsGroup: 2001
  223.       volumes:
  224.         - name: kubernetes-dashboard-certs
  225.           secret:
  226.             secretName: kubernetes-dashboard-certs
  227.         - name: tmp-volume
  228.           emptyDir: {}
  229.       serviceAccountName: kubernetes-dashboard
  230.       nodeSelector:
  231.         "kubernetes.io/os": linux
  232.       # Comment the following tolerations if Dashboard must not be deployed on master
  233.       tolerations:
  234.         - key: node-role.kubernetes.io/master
  235.           effect: NoSchedule
  237. ---
  239. kind: Service
  240. apiVersion: v1
  241. metadata:
  242.   labels:
  243.     k8s-app: dashboard-metrics-scraper
  244.   name: dashboard-metrics-scraper
  245.   namespace: kubernetes-dashboard
  246. spec:
  247.   ports:
  248.     - port: 8000
  249.       targetPort: 8000
  250.   selector:
  251.     k8s-app: dashboard-metrics-scraper
  253. ---
  255. kind: Deployment
  256. apiVersion: apps/v1
  257. metadata:
  258.   labels:
  259.     k8s-app: dashboard-metrics-scraper
  260.   name: dashboard-metrics-scraper
  261.   namespace: kubernetes-dashboard
  262. spec:
  263.   replicas: 1
  264.   revisionHistoryLimit: 10
  265.   selector:
  266.     matchLabels:
  267.       k8s-app: dashboard-metrics-scraper
  268.   template:
  269.     metadata:
  270.       labels:
  271.         k8s-app: dashboard-metrics-scraper
  272.       annotations:
  273.         seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
  274.     spec:
  275.       containers:
  276.         - name: dashboard-metrics-scraper
  277.           image: kubernetesui/metrics-scraper:v1.0.4
  278.           ports:
  279.             - containerPort: 8000
  280.               protocol: TCP
  281.           livenessProbe:
  282.             httpGet:
  283.               scheme: HTTP
  284.               path: /
  285.               port: 8000
  286.             initialDelaySeconds: 30
  287.             timeoutSeconds: 30
  288.           volumeMounts:
  289.           - mountPath: /tmp
  290.             name: tmp-volume
  291.           securityContext:
  292.             allowPrivilegeEscalation: false
  293.             readOnlyRootFilesystem: true
  294.             runAsUser: 1001
  295.             runAsGroup: 2001
  296.       serviceAccountName: kubernetes-dashboard
  297.       nodeSelector:
  298.         "kubernetes.io/os": linux
  299.       # Comment the following tolerations if Dashboard must not be deployed on master
  300.       tolerations:
  301.         - key: node-role.kubernetes.io/master
  302.           effect: NoSchedule
  303.       volumes:
  304.         - name: tmp-volume
  305.           emptyDir: {}

三、部署Kubernetes Dashboard

修改完成后，使用此文件进行部署：

  1. $ kubectl apply -f kubernetes-dashboard.yaml
  2. namespace/kubernetes-dashboard created
  3. serviceaccount/dashboard created
  4. clusterrolebinding.rbac.authorization.k8s.io/dashboard created
  5. service/kubernetes-dashboard created
  6. secret/kubernetes-dashboard-certs created
  7. secret/kubernetes-dashboard-csrf created
  8. secret/kubernetes-dashboard-key-holder created
  9. configmap/kubernetes-dashboard-settings created
  10. role.rbac.authorization.k8s.io/kubernetes-dashboard created
  11. clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
  12. rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
  13. clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
  14. deployment.apps/kubernetes-dashboard created
  15. service/dashboard-metrics-scraper created
  16. deployment.apps/dashboard-metrics-scraper created

当然，如果客官网络方便的话，可以直接使用：

  1. kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.4/aio/deploy/recommended.yaml

不过相关的Service还是得重写后部署，暴露端口以提供宿主机访问：

  1. kind: Service
  2. apiVersion: v1
  3. metadata:
  4.   labels:
  5.     k8s-app: kubernetes-dashboard
  6.   name: kubernetes-dashboard
  7.   namespace: kubernetes-dashboard
  8. spec:
  9.   ports:
  10.     - port: 443
  11.       targetPort: 8443
  12.       nodePort: 30443
  13.       name: kubernetes-dashboard
  14.   type: NodePort
  15.   selector:
  16.     k8s-app: kubernetes-dashboard

部署完毕后，查看其token：

  1. $ kubectl -n kubernetes-dashboard describe secret kubernetes-dashboard      
  2. Name:         kubernetes-dashboard-certs
  3. Namespace:    kubernetes-dashboard
  4. Labels:       k8s-app=kubernetes-dashboard
  5. Annotations:
  6. Type:         Opaque
  8. Data
  9. ====
  11. Name:         kubernetes-dashboard-csrf
  12. Namespace:    kubernetes-dashboard
  13. Labels:       k8s-app=kubernetes-dashboard
  14. Annotations:
  15. Type:         Opaque
  17. Data
  18. ====
  19. csrf:  256 bytes
  21. Name:         kubernetes-dashboard-key-holder
  22. Namespace:    kubernetes-dashboard
  23. Labels:       <none>
  24. Annotations:  <none>
  26. Type:  Opaque
  28. Data
  29. ====
  30. priv:  1679 bytes
  31. pub:   459 bytes
  33. Name:         kubernetes-dashboard-token-qbqfb
  34. Namespace:    kubernetes-dashboard
  35. Labels:       <none>
  36. Annotations:  kubernetes.io/service-account.name: kubernetes-dashboard
  37.               kubernetes.io/service-account.uid: 7d7d2c68-ea5a-4ec4-9571-6651bb57553b
  39. Type:  kubernetes.io/service-account-token
  41. Data
  42. ====
  43. ca.crt:     1025 bytes
  44. namespace:  20 bytes
  45. token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IkZMOVFkTXlLZnpQSmZxOThCT0NRdUVfa182bl9qZnA5MDVHelRILXpVSTAifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC10b2tlbi1xYnFmYiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjdkN2QyYzY4LWVhNWEtNGVjNC05NTcxLTY2NTFiYjU3NTUzYiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDprdWJlcm5ldGVzLWRhc2hib2FyZCJ9.O-FSx2r7mLFcOxYrQu8Y5yzK9FIdGtWX3tMVgMib-O2xx3XVOKx91pCHsZZH-4k8UF4yg6YVt9iT5F9MWoHoZS0gjIqRaY0q2BVgioNuPoaT5Dbnm2Y9J9OpqZ3vWqGyX_skNlFBxzpoobz3fKjRB2MrSFWZ8WCPifapv-vLivW46TtQrzeRMkLsOCjd1sPZ9VxLg8PnB0SZsYHppZkWpnTme267aBEg2_iI62sykH8-NM_5rzapQx1MSf3fd7mA7l_lZbmgPUZXk5fejaG7ji5ltzhQSZYXUUm9L9PkKT5ksXvfEY_BjbVvahRTJDVBZPxFpZt9M-tOcsN6Fh-3SQ

看到最底下就是token了。

四、使用token登录

打开浏览器，输入：https://localhost:30443/ ，首次打开会提示SSL证书错误：
📃 部署Kubernetes Dashboard - 图1
点击继续，输入获取到的token：
📃 部署Kubernetes Dashboard - 图2
就进入到了管理界面：
📃 部署Kubernetes Dashboard - 图3

五、使用kubeconfig登录

打开 ~/.kube/config 文件，将token粘到user节点下：
image.png
使用此文件登录即可：
image.png

参考资料