仪表板是基于Web的Kubernetes用户界面。您可以使用仪表板将容器化应用程序部署到Kubernetes集群，对容器化应用程序进行故障排除，以及管理集群资源。您可以使用仪表板来概述群集上运行的应用程序，以及创建或修改单个Kubernetes资源（例如部署，作业，守护进程等）。例如，您可以使用部署向导扩展部署，启动滚动更新，重新启动Pod或部署新应用程序。
仪表板还提供有关群集中Kubernetes资源状态以及可能发生的任何错误的信息。
安装
1. 制作证书
1openssl genrsa -des3 -passout pass:x -out dashboard.pass.key 2048 2openssl rsa -passin pass:x -in dashboard.pass.key -out dashboard.key 3rm dashboard.pass.key 4＃编写RSA密钥 5openssl req -new -key dashboard.key -out dashboard.csr -subj "/C=CN/ST=GuangDong/L=ShenZhen/O=Sin/OU=IT/CN=192.168.1.101"
生成三个证书
1root@scott-Lenovo:/etc/kubernetes/pki# ll dashboard.* 2-rw-rw-r-- 1 root root 1034 1月 26 12:04 dashboard.crt 3-rw-rw-r-- 1 root root 920 1月 26 12:04 dashboard.csr 4-rw-rw-r-- 1 root root 1675 1月 26 12:04 dashboard.key
2. 用自定义证书创建secret
kubectl -n kube-system create secret generic kubernetes-dashboard-certs --from-file=dashboard.key --from-file=dashboard.crt
2. 从官网下载yaml文件
wegt https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
yaml文件需要修改三个地方
镜像地址：
image: mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1
部署方式：
kind: Service
apiVersion: v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
type: NodePort
ports:
- port: 443
nodePort: 30000
targetPort: 8443
selector:
k8s-app: kubernetes-dashboard
注释掉自动生成证书，否则无法用google和IE浏览器访问。
# ------------------- Dashboard Secret ------------------- #
#apiVersion: v1
#kind: Secret
#metadata:
# labels:
# k8s-app: kubernetes-dashboard
# name: kubernetes-dashboard-certs
# namespace: kube-system
#type: Opaque
2. 创建服务
kubectl apply -f kubernetes-dashboard.yaml
3. 查看NodePod，并访问服务
1[root@master yaml]# kubectl get service -n kube-system 2NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE 3kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP 2d16h 4kubernetes-dashboard NodePort 10.111.126.84 <none> 443:31943/TCP 5m10s
添加例外访问。
在k8s中 dashboard可以有两种访问方式：kubeconfig（HTTPS）和token（http）
1、token认证
1scott@scott-Lenovo:/etc/kubernetes/pki$ sudo kubectl create serviceaccount def-ns-admin -n default 2serviceaccount/def-ns-admin created 3scott@scott-Lenovo:/etc/kubernetes/pki$ sudo kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin 4rolebinding.rbac.authorization.k8s.io/def-ns-admin created 5scott@scott-Lenovo:/etc/kubernetes/pki$ sudo kubectl describe secret 6Name: def-ns-admin-token-4qm8p 7Namespace: default 8Labels: <none> 9Annotations: kubernetes.io/service-account.name: def-ns-admin 10 kubernetes.io/service-account.uid: d7b60993-2120-11e9-acd0-646e69e2bebb 11 12Type: kubernetes.io/service-account-token 13 14Data 15==== 16ca.crt: 1025 bytes 17namespace: 7 bytes 18token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZi1ucy1hZG1pbi10b2tlbi00cW04cCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWYtbnMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJkN2I2MDk5My0yMTIwLTExZTktYWNkMC02NDZlNjllMmJlYmIiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpkZWYtbnMtYWRtaW4ifQ.Y55NP3aDJNzvhia2yLZNcr4Y0i0NWv3YJPuGdikMIspVXxiQGWKM9kubpvUzjkwP9eL6cehyX3J7isunqJ0aI27rbuFgfszjEEl4nognOcLO6iqQAyvDoydjCOafxoT8Zua3ewASnuv6Lmqqaxs0aBj_iNWWyBClm4u8rm_EgGDMZfq8Z2-r-cmvm5gMTvzlgcz0gi5J7kR-NNpjW2o-2hl8-iLlBfaR9Dtcu-4Aksrf7dO_I6f8IictldNj-j6ly0PQMADDi594CODLL5Yti26FBaTO4dR0ykxvGkgVoYmy4r8i9OzQqY0jcN3vcZTQBTf9--XlQEEgpPgxioVBDA 19 20 21Name: default-token-lq7ct 22Namespace: default 23Labels: <none> 24Annotations: kubernetes.io/service-account.name: default 25 kubernetes.io/service-account.uid: 578bc521-20b3-11e9-acd0-646e69e2bebb 26 27Type: kubernetes.io/service-account-token 28 29Data 30==== 31ca.crt: 1025 bytes 32namespace: 7 bytes 33token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZmF1bHQtdG9rZW4tbHE3Y3QiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVmYXVsdCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjU3OGJjNTIxLTIwYjMtMTFlOS1hY2QwLTY0NmU2OWUyYmViYiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZmF1bHQifQ.X9O3i041VXqASe8fJvRsXecec6m0vv9u-ksyEkJgNfoFXsyiATZZOBdXaWhPTbmI5fUsciAjvjI5VTavB2-hsp2XGbZfcMSqqOhtiB626xEPi9UWsNhnbFJbye2ighzwjeAO2DW4YhVXkzCFihSEhvynTWuux14a-R3GWiNPuBFPqddE8NcROnCZC5scp3HsFHgRM_kuwazc84cvpyJu8AExuFeiEGLDvztQpWCeYN7WUTtOqWr-SiauDiEgolEqrjffKCOgBMWhpK77Sz6RUHJY-uOKLFfUghjSuP1_Ma4HZOOTlBc-uiPED28Y0jIwbJ56gVaJ8rNnDzG8SGY9mA
我们复制名字为def-ns-admin-token-4qm8p的token至浏览器，即可登陆。
