下载配置文件并生效
[root@k8s001 soft]# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta4/aio/deploy/recommended.yaml
[root@k8s001 soft]# kubectl apply -f recommended.yaml
查看pod状态
[root@k8s001 soft]# kubectl get pods --all-namespaces | grep dashboard
kubernetes-dashboard dashboard-metrics-scraper-665b55f67d-mbxw2 1/1 Running 0 52s
kubernetes-dashboard kubernetes-dashboard-5b5bd8dd4c-jb6nf 1/1 Running 0 52s
创建用户
[root@k8s001 soft]# vi dashboard-adminuser.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kube-system
[root@k8s001 soft]# kubectl apply -f dashboard-adminuser.yaml
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user created
生成证书
[root@k8s001 soft]# grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt
[root@k8s001 soft]# grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key
[root@k8s001 soft]# openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name "kubernetes-client"
Enter Export Password:
Verifying - Enter Export Password:
# 提示密码直接按回车跳过
[root@k8s001 soft]# ll |grep kubecfg
-rw-r--r-- 1 root root 1147 May 11 11:31 kubecfg.crt
-rw-r--r-- 1 root root 1675 May 11 11:31 kubecfg.key
-rw-r--r-- 1 root root 2512 May 11 11:31 kubecfg.p12
# kubecfg.p12即需要导入客户端机器的证书. 将证书拷贝到本机, 导入即可
登录界面
访问地址：https://<公网ip>:6443/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/#/login，选择对应证书即可
image.png
获取token
[root@k8s001 soft]# kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
Name: admin-user-token-xhc7v
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: admin-user
kubernetes.io/service-account.uid: 81bbba91-f394-427f-9ec8-468719a08573
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1066 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6Im4zTHBXMl9oVVczcHlXOXFUazlPYzN1bUItV1ZjckhoYnJ5azk5MlJRejAifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLXhoYzd2Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI4MWJiYmE5MS1mMzk0LTQyN2YtOWVjOC00Njg3MTlhMDg1NzMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.4fTwag3cKWr7ukrW3mOFQYG2bj_-7UaRw9MuEgcnEXCbkr68IhqgT1XXHvrVsZRSd3uxVTFf7P2NFjFJ6uLtl9B4HeCB22JwDJhLTvF3m-Ewqqo_mZeiRHN-rX7jOaFjHEAyySykH-LVTmx83S9q5U0gvCmC2jxDMkem9No8Qb17i3n1BRZp5eRhY2DTa58VpPDnnrXYMecCnx5A7XWiqdz7Nmrtpn0vQ1IVVFFqPsu6Q5RBAeuyftiYys3-VMUICfvUZsP-W-gtz2yQS5ISThFa1mVxwhHDaumTRA4WcyE2EClBunkEhQCxT9jTU6OY3EUUteED4l5lT0W-wIr_Rg
将对应token填入，即可登录页面
image.png
