kubernetes-kubeadm

机器准备

阿里云,centos7.8,dpk1 2C8G,dpk2 dpk3 dpk4,4C16GB
dpk1 192.168.1.69 
dpk2 192.168.1.70
dpk3 192.168.1.72
dpk4 192.168.1.71

部署docker

首先在所有机器上安装Docker,参考 https://kubernetes.io/docs/setup/production-environment/container-runtimes/#docker
OR  http://as4k.top/containerization/xdocker

部署步骤

############################################ 1. 配置yum源 CentOS / RHEL / Fedora ########################################
cat << 'EOF' > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
EOF


############################################ 2. 安装kubectl kubeadm kubelet ########################################
yum install kubeadm-1.16.2-0.x86_64 kubectl-1.16.2-0.x86_64 kubelet-1.16.2-0.x86_64

==========================================================================================================
 Package                                Arch            Version                  Repository       Size
==========================================================================================================
Installing:
 kubeadm                                x86_64          1.16.2-0                 kubernetes      9.5 M
 kubectl                                x86_64          1.16.2-0                 kubernetes       10 M
 kubelet                                x86_64          1.16.2-0                 kubernetes       22 M
Installing for dependencies:
 conntrack-tools                        x86_64          1.4.4-7.el7              base            187 k
 cri-tools                              x86_64          1.13.0-0                 kubernetes      5.1 M
 kubernetes-cni                         x86_64          0.7.5-0                  kubernetes       10 M
 libnetfilter_cthelper                  x86_64          1.0.0-11.el7             base             18 k
 libnetfilter_cttimeout                 x86_64          1.0.0-7.el7              base             18 k
 libnetfilter_queue                     x86_64          1.0.2-2.el7_2            base             23 k
 socat                                  x86_64          1.7.3.2-2.el7            base            290 k
==========================================================================================================

############################################ 3. 启动和开机自启kubelet ############################################
systemctl enable kubelet && systemctl start kubelet

############################################ 4. 添加内核优化参数 ################################################ 
cat << 'EOF' >  /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sysctl --system
modprobe br_netfilter
lsmod | grep br_netfilter

############################################  5. 初始化kubernetes master节点 (set up the Kubernetes control plane) ############
cat << 'EOF' > kubeadm-init.sh
localip=`hostname -I | awk '{print $1}'`
kubeadm init  --apiserver-advertise-address $localip \
--apiserver-bind-port 6443 \
--control-plane-endpoint $localip \
--pod-network-cidr 10.88.1.0/24 \
--service-cidr 10.96.0.0/12 \
--image-repository registry.cn-hangzhou.aliyuncs.com/google_containers \
--kubernetes-version v1.16.2 \
--v=5
EOF

这个脚本执行完毕之后会有一段输出,需要记录下来备用,类似如下:

    Your Kubernetes control-plane has initialized successfully!

    To start using your cluster, you need to run the following as a regular user:

        mkdir -p $HOME/.kube
        sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
        sudo chown $(id -u):$(id -g) $HOME/.kube/config

    You should now deploy a pod network to the cluster.
    Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
        https://kubernetes.io/docs/concepts/cluster-administration/addons/

    You can now join any number of control-plane nodes by copying certificate authorities 
    and service account keys on each node and then running the following as root:

        kubeadm join 192.168.1.69:6443 --token 82mejo.u6ywdbsqzty8j2gx \
        --discovery-token-ca-cert-hash sha256:4006c47299eda847a248cf3702dc38211be9ae13054fcf428f17de1b26633fa0 \
        --control-plane 	  

    Then you can join any number of worker nodes by running the following on each as root:

    kubeadm join 192.168.1.69:6443 --token 82mejo.u6ywdbsqzty8j2gx \
        --discovery-token-ca-cert-hash sha256:4006c47299eda847a248cf3702dc38211be9ae13054fcf428f17de1b26633fa0 

############################################ 6. master节点kubectl访问 ##############################################
按照第5个步骤输出的提示操作 配置完成之后可以使用 kubectl version 检查

############################################## 7. 安装网络组件 #################################################
curl -sSL -o weave.yaml https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')
kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"

############################################ 8. 安装kubernetes worker节点 ############################################ 
在worker机器上,执行上述1,2,3,4
之后按照第5步脚本输出内容提示,加入集群,成为worker节点

############################################  9. 让master也成为工作节点(该步骤可选) ############################################ 
[root@k8s001 ~]# kubectl taint nodes --all node-role.kubernetes.io/master-
node/k8s001 untainted

############################################ 10. 检查部署状态 ############################################ 
[root@dpk1 ~]# kubectl get nodes
NAME   STATUS   ROLES    AGE    VERSION
dpk1   Ready    master   16m    v1.16.2
dpk2   Ready    <none>   117s   v1.16.2
dpk3   Ready    <none>   114s   v1.16.2
dpk4   Ready    <none>   112s   v1.16.2

[root@dpk1 ~]# kubectl get pods --all-namespaces
NAMESPACE     NAME                           READY   STATUS    RESTARTS   AGE
kube-system   coredns-67c766df46-2ltns       1/1     Running   0          35m
kube-system   coredns-67c766df46-whcqh       1/1     Running   0          35m
kube-system   etcd-dpk1                      1/1     Running   0          34m
kube-system   kube-apiserver-dpk1            1/1     Running   0          34m
kube-system   kube-controller-manager-dpk1   1/1     Running   0          34m
kube-system   kube-proxy-kcdzw               1/1     Running   0          35m
kube-system   kube-proxy-qpdsx               1/1     Running   0          20m
kube-system   kube-proxy-tnrj9               1/1     Running   0          20m
kube-system   kube-proxy-v2hjp               1/1     Running   0          20m
kube-system   kube-scheduler-dpk1            1/1     Running   0          34m
kube-system   weave-net-f4h7z                2/2     Running   1          20m
kube-system   weave-net-kvcwt                2/2     Running   0          20m
kube-system   weave-net-ls7cn                2/2     Running   0          20m
kube-system   weave-net-rps7q                2/2     Running   0          24m

kubeadm config view

[root@dpk1 kubernetes]# kubectl cluster-info
Kubernetes master is running at https://192.168.1.69:6443
KubeDNS is running at https://192.168.1.69:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

使用私有镜像仓库创建应用

kubectl create secret docker-registry regcred --docker-server=registry.as4k.com --docker-username=as4k --docker-password=123456 --docker-email=xys4k@qq.com

约束调度-给node打上标签

[root@k8s001 ~]# 
[root@k8s001 ~]# kubectl get nodes -o wide
NAME     STATUS   ROLES    AGE    VERSION   INTERNAL-IP    EXTERNAL-IP   OS-IMAGE                KERNEL-VERSION               CONTAINER-RUNTIME
k8s001   Ready    master   6h2m   v1.16.2   192.168.1.15   <none>        CentOS Linux 7 (Core)   3.10.0-957.21.3.el7.x86_64   docker://18.6.3
k8s002   Ready    <none>   3h9m   v1.16.2   192.168.1.20   <none>        CentOS Linux 7 (Core)   3.10.0-957.21.3.el7.x86_64   docker://18.6.3
k8s003   Ready    <none>   3h9m   v1.16.2   192.168.1.14   <none>        CentOS Linux 7 (Core)   3.10.0-957.21.3.el7.x86_64   docker://18.6.3
[root@k8s001 ~]# 
[root@k8s001 ~]# kubectl label nodes k8s001 role=node1
node/k8s001 labeled
[root@k8s001 ~]# kubectl label nodes k8s002 role=node2
node/k8s002 labeled
[root@k8s001 ~]# kubectl label nodes k8s003 role=node3
node/k8s003 labeled
[root@k8s001 ~]# kubectl get nodes --show-labels
NAME     STATUS   ROLES    AGE     VERSION   LABELS
k8s001   Ready    master   6h7m    v1.16.2   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=k8s001,kubernetes.io/os=linux,node-role.kubernetes.io/master=,role=node1
k8s002   Ready    <none>   3h14m   v1.16.2   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=k8s002,kubernetes.io/os=linux,role=node2
k8s003   Ready    <none>   3h14m   v1.16.2   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=k8s003,kubernetes.io/os=linux,role=node3
[root@k8s001 ~]# 

部署dashboard

1 下载并部署 recommended-v2.0.1.yaml (这个文件对内容参考后文)

kubectl create -f recommended-v2.0.1.yaml

部署完毕之后 netstat -lntup | grep 30000 ,可以看到宿主机已经监听了30000端口,后面通过这个端口在浏览器访问Dashboard

2 启用火狐浏览器(Firefox Version 77.0.1)访问 https://xtest.as4k.top:30000 ,使用其它浏览器(如谷歌),坑贼多,相关截图如下

Firefox Version 70.0 Google Chrome Version 83.0.4103.97 Firefox Version 77.0.1 Firefox Version 77.0.1

3 使用默认token登陆,该用户的权限不高

[root@dpk1 ~]# kubectl describe secrets -n kubernetes-dashboard `kubectl get secrets -n kubernetes-dashboard | grep "kubernetes-dashboard-token" | awk '{print $1}'`
Name:         kubernetes-dashboard-token-n242w
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: kubernetes-dashboard
              kubernetes.io/service-account.uid: a50a2adc-e401-42a7-a2d2-0b00bb6c6dcd
Type:  kubernetes.io/service-account-token
Data
====
ca.crt:     1025 bytes
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6ImJTZC1qMHBIS1R5VW9lZzJ1bnRqQ2h6M3lMTXdGcVQ2V1dFQWVxdENPeTAifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC10b2tlbi1uMjQydyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImE1MGEyYWRjLWU0MDEtNDJhNy1hMmQyLTBiMDBiYjZjNmRjZCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDprdWJlcm5ldGVzLWRhc2hib2FyZCJ9.aW0ms8UrAyKq0xF9E6c0mFA47oXfpI56FYbrp2X0bXPTbtaF3X567AD_Ooixn4YUefyVkvvvPAvOQ1NYN-0yCMBk-v-fK6ol-GsbipWYYyN206KX3do9tAV1aT0n2cEIGhiurM10-gt5TJXyPegGBzhjrG6IVX7LF_Q1zBV8qToJUpnPvu-u9lCow1xM5ZEBrb8EVSXYB6xLKS30Y1k5HHrOLpob_fEvMOaIEdNu4chl6kHwDfmqMuuSM8xGZQqbAJEQgZ015VBY64gVN_UFf5qNTuYBgDLRG-_ynfhdguk1IF19UPfFRJTb9Rrt9wQRPQBabjLnz3SvKKF6XFOV4w

4 使用YAML文件创建一个超级管理员用户

################################# 4.1 文件内容 ################################
[root@k8s-master01 manifests]# cat dashboard-admin.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding 
metadata: 
  name: admin-user
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system

################################# 4.1 创建超级管理员用户 ################################
kubectl create -f  dashboard-admin.yaml

################################# 4.3 拿到超级管理员用户对应多Token ######################
[root@dpk1 kubernetes]# kubectl describe secrets -n kube-system `kubectl get secrets --all-namespaces | grep admin-user | awk '{print $2}'`
Name:         admin-user-token-7mj5j
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: admin-user
              kubernetes.io/service-account.uid: 29496143-34c5-4984-aca6-22b33860840e
Type:  kubernetes.io/service-account-token
Data
====
ca.crt:     1025 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6ImJTZC1qMHBIS1R5VW9lZzJ1bnRqQ2h6M3lMTXdGcVQ2V1dFQWVxdENPeTAifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLTdtajVqIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIyOTQ5NjE0My0zNGM1LTQ5ODQtYWNhNi0yMmIzMzg2MDg0MGUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.QSHb3cW_dEOl7-wEt7UDqC-jRUyxJqMn6txsxt6aZfY3LuMQwInGBi0oivEpsUmQRve2IdmqazASiesZuFHsJ16NI8VLfQZ_T9WiraKZ8L47bBifLtd3NA57bh46daE4n4E6o5KW6VOX1xFiAuP6VDFnTGOjRSrZ6-SFBFvQlok8NYjc6PxfqCvhO7QUaQxeY1lw3kg0OiFECtpTt9eXcaduKnJG4CRsLJ3C1zwnRihjR2NRG7viXqvtrR1iW5srRpowVAoYymPYpTOWHKXF6ciRtzHeJF4l8z4K7-BiNY6yu5APcvphX3pmER7hvMGsFPjbPNQlSSplqVmDmIU_LQ

4.5 使用上面得到的超级管理员Token登陆,此时Kubernetes Dashboard即可拥有最高权限

5 重新部署

如果操作步骤有误,需要重新部署Dashboard,可以如下操作

kubectl delete -f recommended-v2.0.1.yaml
kubectl create -f recommended-v2.0.1.yaml

使用正版公网证书nginx反向代理Dashboard

kubeadm默认安装用的自签名证书使用非火狐浏览器无法打开,用火狐浏览器打开也是各种安全警告,而如果我们配置正版公网证书,这些问题一概没有

配置K8S Dashboard证书参考
[root@dpk1 conf.d]# cat /etc/nginx/conf.d/k8s.as4k.com.conf 

server {
    listen 443    ssl;                       
    server_name   k8s.as4k.com;
    root          html;
    index         index.html index.htm;
    
    ssl_certificate                /etc/nginx/cert/as4k.com.crt;  
    ssl_certificate_key            /etc/nginx/cert/as4k.com.key;  
    ssl_session_timeout            5m;
    ssl_ciphers                    ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; 
    ssl_protocols                  TLSv1 TLSv1.1 TLSv1.2;  
    ssl_prefer_server_ciphers      on;

    location / {
        proxy_pass                 https://127.0.0.1:30000;
        proxy_set_header Host      $host;
        proxy_connect_timeout      3600;
        proxy_send_timeout         3600;
        proxy_read_timeout         3600;
        proxy_set_header           X-Real-IP $remote_addr;
        proxy_buffering            off;
        proxy_request_buffering    off;
        proxy_set_header           X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header           X-Forwarded-Proto http;
    }
}

server {
    listen          80;
    server_name     k8s.as4k.com;
    rewrite ^(.*)$  https://$host$1 permanent;
}
# cat recommended-v2.0.1.yaml 
# https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.1/aio/deploy/recommended.yaml
# https:xtest.as4k.top:30000
# 这里的内容和官方提供的YAML有修改,替换NodePort成为对主机端口对直接映射

# Copyright 2017 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Namespace
metadata:
  name: kubernetes-dashboard

---

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard

---

# kind: Service
# apiVersion: v1
# metadata:
#   labels:
#     k8s-app: kubernetes-dashboard
#   name: kubernetes-dashboard
#   namespace: kubernetes-dashboard
# spec:
#   ports:
#     - port: 443
#       targetPort: 8443
#   selector:
#     k8s-app: kubernetes-dashboard

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 443
      targetPort: 8443
      nodePort: 30000
  selector:
    k8s-app: kubernetes-dashboard
  type: NodePort

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-certs
  namespace: kubernetes-dashboard
type: Opaque

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-csrf
  namespace: kubernetes-dashboard
type: Opaque
data:
  csrf: ""

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-key-holder
  namespace: kubernetes-dashboard
type: Opaque

---

kind: ConfigMap
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-settings
  namespace: kubernetes-dashboard

---

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
rules:
  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
    verbs: ["get", "update", "delete"]
    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["kubernetes-dashboard-settings"]
    verbs: ["get", "update"]
    # Allow Dashboard to get metrics.
  - apiGroups: [""]
    resources: ["services"]
    resourceNames: ["heapster", "dashboard-metrics-scraper"]
    verbs: ["proxy"]
  - apiGroups: [""]
    resources: ["services/proxy"]
    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
    verbs: ["get"]

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
rules:
  # Allow Metrics Scraper to get metrics from the Metrics server
  - apiGroups: ["metrics.k8s.io"]
    resources: ["pods", "nodes"]
    verbs: ["get", "list", "watch"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubernetes-dashboard
subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: kubernetes-dashboard

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubernetes-dashboard
subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: kubernetes-dashboard

---

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
    spec:
      containers:
        - name: kubernetes-dashboard
          image: kubernetesui/dashboard:v2.0.1
          imagePullPolicy: Always
          ports:
            - containerPort: 8443
              protocol: TCP
          args:
            - --auto-generate-certificates
            - --namespace=kubernetes-dashboard
            # Uncomment the following line to manually specify Kubernetes API server Host
            # If not specified, Dashboard will attempt to auto discover the API server and connect
            # to it. Uncomment only if the default does not work.
            # - --apiserver-host=http://my-address:port
          volumeMounts:
            - name: kubernetes-dashboard-certs
              mountPath: /certs
              # Create on-disk volume to store exec logs
            - mountPath: /tmp
              name: tmp-volume
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /
              port: 8443
            initialDelaySeconds: 30
            timeoutSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      volumes:
        - name: kubernetes-dashboard-certs
          secret:
            secretName: kubernetes-dashboard-certs
        - name: tmp-volume
          emptyDir: {}
      serviceAccountName: kubernetes-dashboard
      nodeSelector:
        "kubernetes.io/os": linux
      # Comment the following tolerations if Dashboard must not be deployed on master
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule

---

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: dashboard-metrics-scraper
  name: dashboard-metrics-scraper
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 8000
      targetPort: 8000
  selector:
    k8s-app: dashboard-metrics-scraper

---

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: dashboard-metrics-scraper
  name: dashboard-metrics-scraper
  namespace: kubernetes-dashboard
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: dashboard-metrics-scraper
  template:
    metadata:
      labels:
        k8s-app: dashboard-metrics-scraper
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
    spec:
      containers:
        - name: dashboard-metrics-scraper
          image: kubernetesui/metrics-scraper:v1.0.4
          ports:
            - containerPort: 8000
              protocol: TCP
          livenessProbe:
            httpGet:
              scheme: HTTP
              path: /
              port: 8000
            initialDelaySeconds: 30
            timeoutSeconds: 30
          volumeMounts:
          - mountPath: /tmp
            name: tmp-volume
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      serviceAccountName: kubernetes-dashboard
      nodeSelector:
        "kubernetes.io/os": linux
      # Comment the following tolerations if Dashboard must not be deployed on master
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
      volumes:
        - name: tmp-volume
          emptyDir: {}

访问方式 kube-proxy

http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/

http://k8s001:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/

kubectl proxy --port=8001 --address=0.0.0.0 --disable-filter=true

[root@k8s001 ~]# kubectl cluster-info
Kubernetes master is running at https://192.168.1.12:6443
KubeDNS is running at https://192.168.1.12:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

http://k8s001:8001/api/v1/namespaces/kubernetes-dashboard/services/http:kubernetes-dashboard:/proxy/
http://192.168.1.105:8001/api/v1/namespaces/kubernetes-dashboard/services/http:kubernetes-dashboard:/proxy/

清空K8S部署环境

在master和node上执行
kubeadm reset

参考链接

https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/README.md
https://github.com/kubernetes/dashboard

Kubernetes的几种主流部署方式02-kubeadm部署高可用集群
https://segmentfault.com/a/1190000018741112?utm_source=tag-newest

使用 kubeadm 安装 kubernetes v1.16
https://www.kubernetes.org.cn/5846.html

kubernetes v1.14.0高可用master集群部署(使用kubeadm,离线安装)
https://www.kubernetes.org.cn/5273.html

https://github.com/kubernetes/dashboard

dashboard 证书生成
https://www.jianshu.com/p/f7ebd54ed0d1

https://github.com/kubernetes/kubernetes
http://docs.kubernetes.org.cn/

Kubernetes从零开始搭建自定义集群
http://docs.kubernetes.org.cn/774.html

kubernetes1.13.1+etcd3.3.10+flanneld0.10集群部署
https://www.kubernetes.org.cn/5025.html

随笔分类 - kubernetes
https://www.cnblogs.com/yuezhimi/category/1340864.html

Kubernetes 的证书认证
https://www.kubernetes.org.cn/2540.html

Centos7 单节点上安装kubernetes-dashboard过程
https://www.58jb.com/html/152.html

CoreDNS Manual
https://coredns.io/manual/toc/#installation

遇到的错误

docker不能安装在软链接目录里