云运维笔记(3) k8s 安装 dashboard 配置 ingress

# 下载 YAML 
wget -O dashboard.yaml https://raw.githubusercontent.com/kubernetes/dashboard/v20/aio/deploy/recommended.yaml

# YAML 里含有的镜像：
kubernetesui/dashboard:v20
kubernetesui/metrics-scraper:v17

# 创建目录
mkdir certs
# 进入目录，准备生成证书
cd certs
# req 生成证书签名请求
# -newkey 生成新的私钥文件
# -keyout 生成新的私钥文件
# -out 生成的CS文件
# -days 证书有效期，3650天，即10年
# -subj 生成CSR证书的参数
openssl req -newkey rsa:2048 -nodes -keyout dash.k8s.io.key -x509 -days 3650 -out dash.k8s.io.crt -subj "/C=CN/ST=Beijing/L=Beijing/O=Kubernetes/OU=K8S/CN=dash.k8s.io"

# X.509证书包含三个文件：key，csr，crt。
### key是服务器上的私钥文件，用于对发送给客户端数据的加密，以及对从客户端接收到数据的解密
### csr是证书签名请求文件，用于提交给证书颁发机构（CA）对证书签名
### crt是由证书颁发机构（CA）签名后的证书，或者是开发者自签名的证书，包含证书持有人的信息，持有人的公钥，以及签署者的签名等信息

# 查看 crt 证书信息
openssl x509 -noout -text -in dash.k8s.io.crt

# 创建命名空间
kubectl create ns kubernetes-dashboard

# 在 kubernetes-dashboard 空间下创建 secret 
## secret=kubernetes-dashboard-certs 固定的名称，请勿修改。
kubectl create secret tls kubernetes-dashboard-certs --cert=dash.k8s.io.crt --key=dash.k8s.io.key -n kubernetes-dashboard

vim dashboard.yaml

# 找到 Deployment name=kubernetes-dashboard

# 注释 kubernetes-dashboard-certs 名称，因为前面生成了自签名的 secret，注意名称必须与这个名称一致。

# apiVersion: v1
# kind: Secret
# metadata:
#   labels:
#     k8s-app: kubernetes-dashboard
#   name: kubernetes-dashboard-certs  # 替换成手动生成的 secret 文件
#   namespace: kubernetes-dashboard
# type: Opaque


# 修改第2处
kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
    spec:
      containers:
        - name: kubernetes-dashboard
          image: kubernetesui/dashboard:v20          
          imagePullPolicy: Always
          resources: {}
          ports:
            - containerPort: 8443
              protocol: TCP
          args:
            # - --auto-generate-certificates # 去掉自动生成的证书
            - --namespace=kubernetes-dashboard
            - --tls-key-file=tls.key  # 生成 Secret 时默认给的名称即：tls.key
            - --tls-cert-file=tls.crt # 生成 Secret 时默认给的名称即：tls.crt
            - --token-ttl=3600   # 设置 token 的超时时间

-> # k -n kubernetes-dashboard get secret kubernetes-dashboard-certs -o yaml

apiVersion: v1
data:
  tls.crt: xxx  # crt 名称
  tls.key: xxx  # key 名称
kind: Secret
metadata:
  name: kubernetes-dashboard-certs
  namespace: kubernetes-dashboard
type: kubernetes.io/tls

kubectl apply -f dashboard.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboardcrbinding
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

kubectl create clusterrolebinding dashboardcrbinding \
  --clusterrole=cluster-admin \
  --serviceaccount=kubernetes-dashboard:kubernetes-dashboard

# 创建 serviceAccount 帐号名称
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
# 将 clustrole 与 serviceAccount 进行绑定
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get serviceaccount admin-user -o jsonpath="{.secrets[0].name}")

######################## 创建指定命名空间下的 token #############################
apiVersion: v1
kind: ServiceAccount
metadata:
  name: general-user
  namespace: general # 权限限制的操作的命名空间
  annotations:
     remark: "创建一个 ServiceAccount 帐号" 
  
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: general # 权限限制的操作的命名空间
  name: role-general
  annotations:
     remark: "创建一个角色名称，即这个角色可以做什么" 
rules:
- apiGroups: [""]
  resources: ["pods"] # 可以操作的对象，如 pods
  verbs: ["get", "watch", "list"] # 如何操作，具有的权限
- apiGroups: ["extensions", "apps"] 
  resources: ["deployments", "configmaps", "services", "statefulsets", "ingresses"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: role-bind-cnych
  namespace: general # 权限限制的操作的命名空间
  annotations:
     remark: "将 ServiceAccount 与 Role 进行绑定在一起，给用户赋予角色操作权限" 
subjects:
- kind: ServiceAccount 
  name: general-user # serviceAccount 帐号名称
  namespace: general # 权限限制的操作的命名空间
roleRef:
  kind: Role
  name: role-general  # 绑定的角色
  apiGroup: rbac.authorization.k8s.io

kubectl -n general describe secret $(kubectl -n general get secret | grep general-user | awk '{print $1}')
# 或
kubectl -n general describe secret $(kubectl -n general get serviceaccount admin-user -o jsonpath="{.secrets[0].name}")

# 创建 serviceAccount 帐号名称
apiVersion: v1
kind: ServiceAccount
metadata:
  name: view-all-service-account
  namespace: namespace1
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: namespace1
  name: view-all-role
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log", "pods/exec"] # 可以操作的对象，如 pods
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # 如何操作，具有的权限
- apiGroups: ["extensions", "apps"] 
  resources: ["deployments", "configmaps", "services", "statefulsets", "ingresses"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: namespace2
  name: view-all-role
rules:
- apiGroups: ["*"] # "*" 表示所有 API 组
  resources: ["*"] # "*" 表示所有资源
  verbs: ["*"] # "*" 表示所有操作
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: view-all-binding
  namespace: namespace1
subjects:
- kind: ServiceAccount
  name: view-all-service-account
  namespace: namespace1
roleRef:
  kind: Role
  name: view-all-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: view-all-binding
  namespace: namespace2
subjects:
- kind: ServiceAccount
  name: view-all-service-account
  namespace: namespace1
roleRef:
  kind: Role
  name: view-all-role
  apiGroup: rbac.authorization.k8s.io
---
# 测试用例 
# k create ns namespace1
# k create ns namespace2
# kubectl -n namespace1 run test-nginx --image=nginx --restart=Always
# kubectl -n namespace2 run test-nginx --image=nginx --restart=Always

# 获取 token

# SECRET_NAME=$(kubectl get serviceaccount view-all-service-account -n namespace1 -o jsonpath="{.secrets[0].name}")
# kubectl get secret $SECRET_NAME -n namespace1 -o jsonpath="{.data.token}" | base64 --decode

# 获取 token
# kubectl -n namespace1 describe secret $(kubectl -n namespace1 get serviceaccount view-all-service-account -o jsonpath="{.secrets[0].name}")

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kube-ingress
  namespace: kubernetes-dashboard
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.kubernetes.io/ingress.class: "nginx"  # 指定 nginx
    # 默认为 true，启用 TLS 时，http请求会 308 重定向到https
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # 默认为 http，开启后端服务使用 proxy_pass https://协议
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  tls:
    - hosts:
        - dash.k8s.io
      secretName: kubernetes-dashboard-certs
  rules:
    - host: dash.k8s.io # 域名配置
      http:
        paths:
          - path: /
            backend:
              serviceName: kubernetes-dashboard
              servicePort: 443

proxy_pass http://upstream_balancer;

proxy_pass https://upstream_balancer;