kubernetes-dashboard安装(2)

安装ingress-controller

部署在k8s中的服务默认只能在集群内部方法，如果需要集群外部访问可以通过:NodePort、LoadBalance和Ingress进行处理

nginx-ingress
工作流程：
1. The Ingress controller can then automatically program a frontend load balancer to enable Ingress configuration.
2. Users who need to provide external access to their Kubernetes services create an Ingress resource that defines rules, including the URI path, backing service name, and other information
原理：ingress在向ingress-controller注册的时候，会将服务信息注册到ingress-controller的nginx的配置中
1. ingress-controller：实质就是一个方向代理，不同的实现对ingress的配置规则不一样
2. ingress：实质就是定义代理的规则，如何进行跳转

下载deployment

 curl -O https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml

修改镜像和deployment的容器参数，并对Role中设置configmaps的添加update权限

  containers:
 - name: nginx-ingress-controller
   image: wistiaanders/nginx-ingress-controller:0.25.1
   args:
     - /nginx-ingress-controller
     - --configmap=$(POD_NAMESPACE)/nginx-configuration
     - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
     - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
     - --publish-service=$(POD_NAMESPACE)/ingress-nginx
     - --annotations-prefix=nginx.ingress.kubernetes.io
     - --ingress-class=k8s-nginx-ingress # 设置唯一表示，用于ingress resource的注册
     - --enable-ssl-passthrough          # 使用https时如果证书部署在server端这必须在启动参数设置--enable-ssl-passthrough

安装deployment
```
 kubectl apply -f mandatory.yaml
```

下载和部署service

 curl -O https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/cloud-generic.yaml
 # 安装
 kubectl apply -f cloud-generic.yaml

部署dashboard

kubernetes-dashboard必须通过https协议进行访问，所以先生成证书。

创建目录
```
 mkdir dashboard
```

生成密钥

 mkdir certs
 cd certs
 openssl genrsa -des3 -passout pass:x -out tls.pass.key 2048
 ...
 openssl rsa -passin pass:x -in tls.pass.key -out tls.key
 # Writing RSA key
 rm tls.pass.key
 openssl req -new -key tls.key -out tls.csr
 # 密码留空，提示设置域名填写  dashboard.tlh.com 也可以自行修改，其他信息更具自己的需求填写

 # 生成证书
 openssl x509 -req -sha256 -days 365 -in tls.csr -signkey tls.key -out tls.crt
 # 将生成的tls.crt证书安装到浏览器

创建namespace和secrets

 # 创建namespace
 kubectl create namespace kubernetes-dashboard
 # 创建secrets，from-file为上面生成的密钥文件的路径
 kubectl create secret generic kubernetes-dashboard-certs --from-file=certs -n kubernetes-dashboard
 # 查看密钥
 kubectl describe secret kubernetes-dashboard-certs -n kubernetes-dashboard

下载dashboard的部署文件

 curl -O https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta4/aio/deploy/recommended.yaml

修改部署文件，设置启动参数配置密钥文件

  containers:
 - name: kubernetes-dashboard
   image: kubernetesui/dashboard:v2.0.0-beta4
   imagePullPolicy: Always
   ports:
     - containerPort: 8443
       protocol: TCP
   args:
     - --namespace=kubernetes-dashboard
     - --tls-key-file=tls.key    # 配置密钥文件
     - --tls-cert-file=tls.crt

应用部署
```
 kubectl apply -f recommended.yaml
```

创建ingress

编写ingress文件

 apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   labels:
     k8s-app: kubernetes-dashboard
   annotations:
     kubernetes.io/ingress.class: "k8s-nginx-ingress" # 选择指定的ingress-controller
     nginx.ingress.kubernetes.io/ssl-redirect: "true" # 强制重定向到https
     nginx.ingress.kubernetes.io/ssl-passthrough: "true" # 配置不在nginx进行https的解密，强制转发到server端进行处理，需要在ingress-controller的deployment启动参数添加enable-ssl-passthrough才生效
   name: kubernetes-dashboard
   namespace: kubernetes-dashboard
 spec:
   rules:
   - host: dashboard.tlh.com     # 为在创建自签名密钥时填写的域名
     http:
       paths:
       - path: /
         backend:
           servicePort: 443
           serviceName: kubernetes-dashboard
   tls:
   - hosts:
     - dashboard.tlh.com
     secretName: kubernetes-dashboard-certs

应用
```
 kubectl apply -f ingress.yaml
```

查看ingress信息，将metallb分配的IP地址到本机的hosts文件中

 # 查看分配的IP地址
 kubectl describe ingress -n kubernetes-dashboard
 # 配置到宿主机的hosts文件
 查询到的IP  dashboard.tlh.com

通过浏览器访问
```
 https://dashboard.tlh.com
```

创建admin用户

创建dashboard-adminuser.yaml文件

 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: admin-user
   namespace: kubernetes-dashboard
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: admin-user
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cluster-admin
 subjects:
 - kind: ServiceAccount
   name: admin-user
   namespace: kubernetes-dashboard

创建用户

 kubectl apply -f dashboard-adminuser.yaml

获取登陆的token

kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')