通过k8s官网安装dashboard完成之后，结果通过Chrome无法打开k8s kubernetes dashboard，报错误：您的链接不是私密链接。查了一番资料，发现是dashboard证书无效，需要更新证书才可访问。一下是本人问题解决的过程，供大家参考。
- 第一步：通过官方yaml文档安装kubernetes dashboard
- 第二步：更新无效的secrete，通过自签证书重新创建secrete
- 通过官方文档安装其实很简单，直接通过官方的yaml文件创建dashboard即可
# 先使用官方默认配置创建dashboard
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml
# 如果获取yaml文件失败，可以先通过浏览器打开该yaml文件，然后复制所有内容再本地创建一个yaml文件
# kubectl apply -f 本地的.yaml文件
查看是否安装成功
» kubectl get svc -n kubernetes-dashboard
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
dashboard-metrics-scraper ClusterIP 10.103.214.52 <none> 8000/TCP 14d
kubernetes-dashboard ClusterIP 10.102.132.61 <none> 443/TCP 14d
# 拥有kubernetes-dashboard service则表示安装成功
- 更新无效的secrete，通过自签证书重新创建secrete
- 更改dashboard的service类型为Nodeport, 这样就可以直接将服务映射到本地, 通过端口访问
» kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard
1 # Please edit the object below. Lines beginning with a '#' will be ignored,
2 # and an empty file will abort the edit. If an error occurs while saving this file will be
3 # reopened with the relevant failures.
4 #
5 apiVersion: v1
6 kind: Service
7 metadata:
8 creationTimestamp: "2020-04-21T17:34:01Z"
9 labels:
10 k8s-app: kubernetes-dashboard
11 name: kubernetes-dashboard
12 namespace: kubernetes-dashboard
16 spec:
17 clusterIP: 10.105.195.26
18 ports:
19 - port: 443
20 protocol: TCP
21 targetPort: 8443
22 selector:
23 k8s-app: kubernetes-dashboard
24 sessionAffinity: None
25 type: ClusterIP # < ----- 改为 NodePort
验证svc是否修改成功
» kubectl get svc -n kubernetes-dashboard
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
dashboard-metrics-scraper ClusterIP 10.103.214.52 <none> 8000/TCP 14d
kubernetes-dashboard NodePort 10.102.132.61 <none> 443:30000/TCP 14d
# service 的类型变为NodePort, 表明修改成功
- 删除默认的secret：kubernetes-dashboard-certs
» kubectl delete secret -n kubernetes-dashboard kubernetes-dashboard-certs
- 自己签发证书（为访问的ip，以192.168.246.200为例）
» mkdir keys & cd keys
» openssl genrsa -out tls.key 2048
» openssl req -new -out tls.csr -key tls.key -subj '/CN=192.168.246.200'
» openssl x509 -req -in tls.csr -signkey tls.key -out tls.crt
» ls
tls.crt tls.csr tls.key
- 根据新的证书，创建secret
» cd keys # 如果本身就在keys文件夹下，则可以省略该步骤
» kubectl create secret generic kubernetes-dashboard-certs --from-file=./ -n kubernetes-dashboard
- 修改kubernetes-dashboard deployment,启用新的secret
» kubectl edit deploy kubernetes-dashboard -n kubernetes-dashboard
...
31 template:
32 metadata:
33 creationTimestamp: null
34 labels:
35 k8s-app: kubernetes-dashboard
36 spec:
37 containers:
38 - args:
41 - --auto-generate-certificates
42 - --namespace=kubernetes-dashboard
43 image: kubernetesui/dashboard:v2.0.0
44 imagePullPolicy: Always
...
# 在args中添加两行
containers:
- args:
- --tls-cert-file=/tls.crt
- --tls-key-file=/tls.key
# 添加之后
...
31 template:
32 metadata:
33 creationTimestamp: null
34 labels:
35 k8s-app: kubernetes-dashboard
36 spec:
37 containers:
38 - args:
39 - --tls-cert-file=/tls.crt < ----- 这里
40 - --tls-key-file=/tls.key < ----- 这里
41 - --auto-generate-certificates
42 - --namespace=kubernetes-dashboard
43 image: kubernetesui/dashboard:v2.0.0
44 imagePullPolicy: Always
...
- 查询出kubernetes-dashboard的service所映射的端口，通过ip+端口访问即可
» kubectl get svc -n kubernetes-dashboard
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
dashboard-metrics-scraper ClusterIP 10.103.214.52 <none> 8000/TCP 14d
kubernetes-dashboard NodePort 10.102.132.61 <none> 443:30000/TCP 14d
# kubernetes-dashboard service 映射到本地的端口为 3000
浏览器打开（以192.168.246.200为dashboard所在节点）https://192.168.246.200:30000/#/login
