根據(jù)上一步教程安裝kubernetes-dashboard-amd64:v1.10.1 最后瀏覽器打開會(huì)提示簽名錯(cuò)誤灶壶。
使用kubectl logs kubernetes-dashboard-5f7b999d65-8j5n8 --namespace=kube-system查看到錯(cuò)誤日志
image
推測(cè)kubernetes-dashboard自帶簽名證書過期了（或者別的原因）侈沪，下面進(jìn)行自簽證書
- 切換到root用戶
sudo su -
- 創(chuàng)建自簽名證書
下面步驟可能會(huì)因?yàn)?code>/root/.rnd文件找不到報(bào)錯(cuò)，直接創(chuàng)建一個(gè)touch /root/.rnd
mkdir -p /data/tls && cd /data/tls
openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj "/C=CN/ST=HB/L=WH/O=DM/OU=YPT/CN=CA"
//生成私鑰
openssl genrsa -out dashboard.key 2048
//申請(qǐng)簽名請(qǐng)求
- 申請(qǐng)簽名請(qǐng)求
# ip為dashaboard訪問地址ip
export ip=192.168.160.100
openssl req -new -sha256 -key dashboard.key -out dashboard.csr -subj "/C=CN/ST=HB/L=WH/O=DM/OU=YPT/CN=$ip"
cat > dashboard.cnf <<EOF
extensions = san
[san]
keyUsage = digitalSignature
extendedKeyUsage = clientAuth,serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
subjectAltName = IP:$ip,IP:127.0.0.1,DNS:$ip,DNS:localhost
EOF
- 簽發(fā)證書
openssl x509 -req -sha256 -days 3650 -in dashboard.csr -out dashboard.crt -CA ca.crt -CAkey ca.key -CAcreateserial -extfile dashboard.cnf
至此锚赤，dashboard證書簽發(fā)完成，接著就要?jiǎng)h除舊的kubernetes-dashboard用新的證書來創(chuàng)建
- 刪除舊kubernetes-dashboard
// 方法一：（我用這個(gè)方法報(bào)錯(cuò)了狭郑，所以選了方法二）
kubectl delete -f kubernetes-dashboard.yaml
// 方法二：(需要手動(dòng)一條一條刪除)
kubectl delete deployment kubernetes-dashboard --namespace=kube-system
kubectl delete service kubernetes-dashboard --namespace=kube-system
kubectl delete role kubernetes-dashboard-minimal --namespace=kube-system
kubectl delete rolebinding kubernetes-dashboard-minimal --namespace=kube-system
kubectl delete sa kubernetes-dashboard --namespace=kube-system
kubectl delete secret kubernetes-dashboard-certs --namespace=kube-system
kubectl delete secret kubernetes-dashboard-csrf --namespace=kube-system
kubectl delete secret kubernetes-dashboard-key-holder --namespace=kube-system
- 創(chuàng)建 secret kubernetes-dashboard-certs
kubectl create secret generic kubernetes-dashboard-certs --from-file="/data/tls/dashboard.crt,/data/tls/dashboard.key" -n kube-system
- 修改kubernetes-dashboard.yaml 文件亚茬，注釋掉Dashboard Secret 使用自己的簽名
# ------------------- Dashboard Secret ------------------- #
#apiVersion: v1
#kind: Secret
#metadata:
# labels:
# k8s-app: kubernetes-dashboard
# name: kubernetes-dashboard-certs
# namespace: kube-system
#type: Opaque
- 部署dashboard
kubectl create -f kubernetes-dashboard.yaml
kubectl get po -n kube-system
-
至此，使用自建證書創(chuàng)建kubernetes-dashboard步驟已經(jīng)完成抢呆。如果上一步有用k8s-admin-token.yaml文件創(chuàng)建過admin token的可以直接跳過這一步煮嫌，直接獲取token打開瀏覽器進(jìn)行登錄
image - 沒有創(chuàng)建
admin token的需要進(jìn)行入下操作
創(chuàng)建k8s-admin-token.yaml文件, 內(nèi)容如下
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: admin
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: admin
namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin
namespace: kube-system
labels:
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
配置admin token
kubectl create -f k8s-admin-token.yaml
動(dòng)態(tài)獲取登錄token
kubectl describe secret/$(kubectl get secret -nkube-system |grep admin|awk '{print $1}') -nkube-system
在瀏覽器中打開打開地址: https://<你的ip>:32288使用token登錄,注意如果是使用的云服務(wù)器，需要去服務(wù)器的安全組策略中放開32288端口
