k8s dashboard可视化操作界面的安装

一、官方安装方法

根据官网的安装配置可以选择如下安装：

bash 复制代码

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml

二、添加阿里云加速进行安装

bash 复制代码

#修改recommended.yaml拉取镜像的链接
vim recommended.yaml

          image: kubernetesui/dashboard:v2.0.0
          image: kubernetesui/metrics-scraper:v1.0.4
          #改为
          image: registry.cn-hangzhou.aliyuncs.com/google_containers/dashboard:v2.7.0
          image: registry.cn-hangzhou.aliyuncs.com/google_containers/metrics-scraper:v1.0.8

#拉取镜像
kubectl apply -f  recommended.yaml

查看阿里云进行加速地址的方法：

查看pod

三、访问dashboard

1、设置端口访问(把端口暴露到机器上方便外部访问)

（原理类似于docker -p）

bash 复制代码

#设置端口访问
kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard

2、验证端口设置是否成功

bash 复制代码

kubectl get svc -A | grep "kubernetes-dashboard"

3、设置成功后无法进行访问问题排查

bash 复制代码

[root@master k8s]# kubectl logs -f -n  kubernetes-dashboard   kubernetes-dashboard-5fddc4fcc-j5cw8
2024/12/24 10:37:31 Using namespace: kubernetes-dashboard
2024/12/24 10:37:31 Using in-cluster config to connect to apiserver
2024/12/24 10:37:31 Starting overwatch
2024/12/24 10:37:31 Using secret token for csrf signing
2024/12/24 10:37:31 Initializing csrf token from kubernetes-dashboard-csrf secret
panic: Get "https://10.96.0.1:443/api/v1/namespaces/kubernetes-dashboard/secrets/kubernetes-dashboard-csrf": dial tcp 10.96.0.1:443: i/o timeout

goroutine 1 [running]:
github.com/kubernetes/dashboard/src/app/backend/client/csrf.(*csrfTokenManager).init(0xc00056fae8)
        /home/runner/work/dashboard/dashboard/src/app/backend/client/csrf/manager.go:41 +0x30e
github.com/kubernetes/dashboard/src/app/backend/client/csrf.NewCsrfTokenManager(...)
        /home/runner/work/dashboard/dashboard/src/app/backend/client/csrf/manager.go:66
github.com/kubernetes/dashboard/src/app/backend/client.(*clientManager).initCSRFKey(0xc00019a080)
        /home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:527 +0x94
github.com/kubernetes/dashboard/src/app/backend/client.(*clientManager).init(0x19aba3a?)
        /home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:495 +0x32
github.com/kubernetes/dashboard/src/app/backend/client.NewClientManager(...)
        /home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:594
main.main()
        /home/runner/work/dashboard/dashboard/src/app/backend/dashboard.go:96 +0x1cf

安装kubernetes-dashboard时显示为CrashLoopBackOff或Error状态的经过上边日志分析出现了网络冲突，进一步排查发现是初始化时的--pod-network-cidr=参数设置成和本机同一网段导致访问出现异常，需要重新初始化k8s集群，再重新搭建。

解决方法参考大神博客：

安装kubernetes-dashboard时显示为CrashLoopBackOff或Error状态的可能原因 - 岁月已走远 - 博客园

4、创建访问账号；生成token令牌用于访问dashboard

bash 复制代码

#查看集群secret
[root@master k8s]# kubectl get secret -n kubernetes-dashboard

#查看token信息
NAME                               TYPE                                  DATA   AGE
default-token-cvk4b                kubernetes.io/service-account-token   3      44m
kubernetes-dashboard-certs         Opaque                                0      44m
kubernetes-dashboard-csrf          Opaque                                1      44m
kubernetes-dashboard-key-holder    Opaque                                2      44m
kubernetes-dashboard-token-bpgkb   kubernetes.io/service-account-token   3      44m

[root@master k8s]# kubectl describe secret kubernetes-dashboard-token-bpgkb -n kubernetes-dashboard



...

token:      eyJhbGciOiJSUzI1NiIsImtpZCI6Il95eExDMmIwYzQycHd5eG9mTTdwMEsxN0pqdVd4aGdxY2pRQzRXSEE5aWcifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC10b2tlbi1icGdrYiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImJjNDk0MWNhLWMyMmUtNDE0NS04YzIwLWQ3NjAzOGY4MmM4YiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDprdWJlcm5ldGVzLWRhc2hib2FyZCJ9.ODXZxeWbX-yC_ttv4pu9ut_VmTVrHrS8rGO2dSCezm2BBlgh6JsCztByrzbIu7jnxagDQpEzu9SL1eL4BXYJWkjEOpmF6LxdkpTi5M7OMbVAQh2F3fKmjm6xPR_ORpobTsOztDfxK18BQBg4SMZJRZLxg7_3lvJ8wKbT7O1UVEb9goVMsQStZPV_QeuNy4GXsiq8OCyEHk3JufP6gKCNirMAskuOVIL_NI4bDCG6ZyRW5eYQswe1I6etixZvIEPyFyfK7j5DWld5W-mosoznWwUImAjEWOb5-JUywNu36vyXPd_zDqamqL3kjWJ0btuk5BccFukdSnfLwFPJs4POzQ

5、API接口角色权限设置

k8s采用的是基于角色的访问控制策略，Role-Based Access Control, 即"RBAC"，使用"rbac.authorization.k8s.io" API Group实现授权决策，涉及到ServiceAccount，Role，ClusterRole，RoleBinding，ClusterRoleBinding，Secret等概念，执行如下命令解决：

bash 复制代码

kubectl create clusterrolebinding serviceaccount-cluster-admin --clusterrole=cluster-admin --user=system:serviceaccount:kubernetes-dashboard:kubernetes-dashboard

选择All-namespaces