如何部署k8s

62次阅读

共计 4093 个字符，预计需要花费 11 分钟才能阅读完成。

如何部署 k8s-dashborad-Token 登录方式，很多新手对此不是很清楚，为了帮助大家解决这个难题，下面丸趣 TV 小编将为大家详细讲解，有这方面需求的人可以来学习下，希望你能有所收获。

1 部署 dashboard

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml

2 修改 dashborad 以 nodeport 方式访问

kubectl patch svc kubernetes-dashboard -p  {spec :{ type : NodePort}}  -n kube-system

3 创建属于 dashboard 的 serviceaccount

kubectl create serviceaccount dashboard-admin -n kube-system
查看 serviceaccount
kubectl get serviceaccount -n kube-system | grep dashboard-admin

4 创建 clusterrolebinding

创建 clusterrolebinding 绑定 clusterrole 使用 serviceaccount 认证

kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
我们使用 clusterrolebinding  绑定了 clusterrole 基本上拥有了跟个集群资源的所有权限, 如果细化授权需要使用 rolebinding 绑定 clusterrole 指定命名空间即可

5 查看生成的 token

 查看生成的 token
# kubectl get secret -n kube-system | grep dashboard-admin* 
dashboard-admin-token-97wz7 kubernetes.io/service-account-token 3 19h

6 查看令牌

kubectl describe secret dashboard-admin-token-97wz7 -n kube-system
Name: dashboard-admin-token-97wz7
Namespace: kube-system
Labels:  none 
Annotations: kubernetes.io/service-account.name: dashboard-admin
 kubernetes.io/service-account.uid: 7e681606-684b-11e9-b76a-000c29980aee
Type: kubernetes.io/service-account-token
ca.crt: 1025 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9yZC1hZG1pbi10b2tlbi05N3d6NyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkYXNoYm9yZC1hZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjdlNjgxNjA2LTY4NGItMTFlOS1iNzZhLTAwMGMyOTk4MGFlZSIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTpkYXNoYm9yZC1hZG1pbiJ9.b67GEYZEK_KZC9decv6KeXGhp9PFCrew9xQTWQ_HkGaerjlEkSX2JE3OVRpPGF84hcbYgfBjvCrAIVNmJmjprMIZCsLeCx3-EXJ93zka4tv1huFaywWDsi4wF3TF9tfYfculHSRuZyAKFenN4UiLPVGK954zUZpM_Rpq3SBpiaw8-HM2CRz0ws8ELpRk5UGRRCAboRB_2hkHbtv36p6qyYbrdSG7gjj-xdw_ncAq6H-Vvdx2j3A6q7cgt9erYvGXwnPdfXePcxPr7BfVwFxm4w2tkb4k-fNxWfQYe6wiJiV907tMpwooX_nx_WQ-dIGtiDEDVJU0sOP85Fy1XI4yxw

6 查看 nodeport 端口

kubectl get svc -n kube-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kube-dns ClusterIP 10.96.0.10  none  53/UDP,53/TCP,9153/TCP 10d
kubernetes-dashboard NodePort 10.98.179.47  none  443:31559/TCP 19h

7 使用令牌登录 dashboard

https://10.10.25.150:31559

8 如果只给 default 命名空间的权限呢?

1)  创建一个 default 的 serviceaccount
kubectl create serviceaccount default-admin
2) 使用 rolebinding 绑定 clusterrole
kubectl create rolebinding default-admin --clusterrole=admin --serviceaccount=default:default-admin
3) 获取 secret 
kubectl get secret | grep default-admin*
NAME TYPE DATA AGE
default-admin-token-476jp kubernetes.io/service-account-token 3 3m2s
4) 查看 token 值
kubectl describe secret default-admin-token-476jp
Name: default-admin-token-476jp
Namespace: default
Labels:  none 
Annotations: kubernetes.io/service-account.name: default-admin
 kubernetes.io/service-account.uid: 609fe45a-68da-11e9-b76a-000c29980aee
Type: kubernetes.io/service-account-token
ca.crt: 1025 bytes
namespace: 7 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZmF1bHQtYWRtaW4tdG9rZW4tNDc2anAiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVmYXVsdC1hZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjYwOWZlNDVhLTY4ZGEtMTFlOS1iNzZhLTAwMGMyOTk4MGFlZSIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZmF1bHQtYWRtaW4ifQ.D-0fw1cqEsp1xu98hBMv9fNyuF_lu2BGMWEUhvcEiC55po55Kml0p8D92tCe88RMeuh8no_a-WN2hX44DWibMUioxUFIEtiSVztGBlhDMWEQkFjQDkLtRX5_AefYXkVTk6vS-3KyUCieExPtmNKH87oScIOKmVmulK0qT3gZ1mNsuiwPo_w6muZ4n90PUT1oK-QhH7gms1J5kwU5y0TYVzcqTcck9OSVMcD5CQ3QhfrK_gU_vEYk7P1G5oqaYYKMZMlxg3aH-Q15mfMzyvLDTnNepGIJHXlZv7IZDScmAJgfbT3w5var86LimNXQ92cMemBmbRAywSMm8Gimizd6Jg
5) 使用 token 登录即可

看完上述内容是否对您有帮助呢？如果还想对相关知识有进一步的了解或阅读更多相关文章，请关注丸趣 TV 行业资讯频道，感谢您对丸趣 TV 的支持。

正文完