升级dashboard从v1.6.3到v1.7.1
Jimmy Song
parent
044256f691
commit
a578d8af03
|
|
@ -41,7 +41,7 @@
|
|||
- [3.3.1 管理集群中的TLS](guide/managing-tls-in-a-cluster.md)
|
||||
- [3.3.2 kubelet的认证授权](guide/kubelet-authentication-authorization.md)
|
||||
- [3.3.3 TLS bootstrap](guide/tls-bootstrapping.md)
|
||||
- [3.3.4 kubectl的用户认证授权](guide/kubectl-user-authentication-authorization.md)
|
||||
- [3.3.4 创建用户认证授权的kubeconfig文件](guide/kubectl-user-authentication-authorization.md)
|
||||
- [3.3.5 RBAC——基于角色的访问控制](guide/rbac.md)
|
||||
- [3.3.6 IP伪装代理](guide/ip-masq-agent.md)
|
||||
- [3.4 访问 Kubernetes 集群](guide/access-kubernetes-cluster.md)
|
||||
|
|
@ -80,7 +80,6 @@
|
|||
- [4.3.7 管理容器的计算资源](practice/manage-compute-resources-container.md)
|
||||
- [4.3.8 使用Prometheus监控kubernetes集群](practice/using-prometheus-to-monitor-kuberentes-cluster.md)
|
||||
- [4.3.9 使用Heapster获取集群和对象的metric数据](practice/using-heapster-to-get-object-metrics.md)
|
||||
- [4.3.10 手动集群升级](practice/manually-upgrade.md)
|
||||
- [4.4 存储管理](practice/storage.md)
|
||||
- [4.4.1 GlusterFS](practice/glusterfs.md)
|
||||
- [4.4.1.1 使用GlusterFS做持久化存储](practice/using-glusterfs-for-persistent-storage.md)
|
||||
|
|
@ -93,6 +92,9 @@
|
|||
- [4.6 持续集成与发布](practice/ci-cd.md)
|
||||
- [4.6.1 使用Jenkins进行持续集成与发布](practice/jenkins-ci-cd.md)
|
||||
- [4.6.2 使用Drone进行持续集成与发布](practice/drone-ci-cd.md)
|
||||
- [4.7 更新与升级](practice/update-and-upgrade.md)
|
||||
- [4.7.1 手动升级kubernetes集群](practice/manually-upgrade.md)
|
||||
- [4.7.2 升级dashboard](practice/dashboard-upgrade.md)
|
||||
- [5. 领域应用](usecases/index.md)
|
||||
- [5.1 微服务架构](usecases/microservices.md)
|
||||
- [5.1.1 微服务中的服务发现](usecases/service-discovery-in-microservices.md)
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# kubectl 的用户认证授权
|
||||
# 创建用户认证授权的kubeconfig文件
|
||||
|
||||
当我们安装好集群后，如果想要把 kubectl 命令交给用户使用，就不得不对用户的身份进行认证和对其权限做出限制。
|
||||
|
||||
|
|
|
|||
Binary file not shown.
|
After Width: | Height: | Size: 240 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 158 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 106 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 57 KiB |
|
|
@ -0,0 +1,163 @@
|
|||
# Copyright 2017 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
# Configuration to deploy release version of the Dashboard UI compatible with
|
||||
# Kubernetes 1.7.
|
||||
#
|
||||
# Example usage: kubectl create -f <this_file>
|
||||
|
||||
# ------------------- Dashboard Secret ------------------- #
|
||||
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard-certs
|
||||
namespace: kube-system
|
||||
type: Opaque
|
||||
|
||||
---
|
||||
# ------------------- Dashboard Service Account ------------------- #
|
||||
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
# ------------------- Dashboard Role & Role Binding ------------------- #
|
||||
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
metadata:
|
||||
name: kubernetes-dashboard-minimal
|
||||
namespace: kube-system
|
||||
rules:
|
||||
# Allow Dashboard to create and watch for changes of 'kubernetes-dashboard-key-holder' secret.
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["create", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
# Allow Dashboard to get, update and delete 'kubernetes-dashboard-key-holder' secret.
|
||||
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
|
||||
verbs: ["get", "update", "delete"]
|
||||
# Allow Dashboard to get metrics from heapster.
|
||||
- apiGroups: [""]
|
||||
resources: ["services"]
|
||||
resourceNames: ["heapster"]
|
||||
verbs: ["proxy"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: kubernetes-dashboard-minimal
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: kubernetes-dashboard-minimal
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubernetes-dashboard
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
# ------------------- Dashboard Deployment ------------------- #
|
||||
|
||||
kind: Deployment
|
||||
apiVersion: extensions/v1beta1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: kube-system
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
spec:
|
||||
initContainers:
|
||||
- name: kubernetes-dashboard-init
|
||||
image: sz-pg-oam-docker-hub-001.tendcloud.com/library/kubernetes-dashboard-init-amd64:v1.0.1
|
||||
volumeMounts:
|
||||
- name: kubernetes-dashboard-certs
|
||||
mountPath: /certs
|
||||
containers:
|
||||
- name: kubernetes-dashboard
|
||||
image: sz-pg-oam-docker-hub-001.tendcloud.com/library/kubernetes-dashboard-amd64:v1.7.1
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
protocol: TCP
|
||||
args:
|
||||
- --tls-key-file=/certs/dashboard.key
|
||||
- --tls-cert-file=/certs/dashboard.crt
|
||||
# Uncomment the following line to manually specify Kubernetes API server Host
|
||||
# If not specified, Dashboard will attempt to auto discover the API server and connect
|
||||
# to it. Uncomment only if the default does not work.
|
||||
# - --apiserver-host=http://my-address:port
|
||||
volumeMounts:
|
||||
- name: kubernetes-dashboard-certs
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
# Create on-disk volume to store exec logs
|
||||
- mountPath: /tmp
|
||||
name: tmp-volume
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
scheme: HTTPS
|
||||
path: /
|
||||
port: 8443
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 30
|
||||
volumes:
|
||||
- name: kubernetes-dashboard-certs
|
||||
secret:
|
||||
secretName: kubernetes-dashboard-certs
|
||||
- name: tmp-volume
|
||||
emptyDir: {}
|
||||
serviceAccountName: kubernetes-dashboard
|
||||
# Comment the following tolerations if Dashboard must not be deployed on master
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
|
||||
---
|
||||
# ------------------- Dashboard Service ------------------- #
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: kube-system
|
||||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 8443
|
||||
selector:
|
||||
k8s-app: kubernetes-dashboard
|
||||
type: NodePort
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
官方文件目录：`kubernetes/cluster/addons/dashboard`
|
||||
|
||||
我们使用的文件
|
||||
我们使用的文件如下：
|
||||
|
||||
``` bash
|
||||
$ ls *.yaml
|
||||
|
|
@ -11,7 +11,7 @@ dashboard-controller.yaml dashboard-service.yaml dashboard-rbac.yaml
|
|||
|
||||
已经修改好的 yaml 文件见：[../manifests/dashboard](https://github.com/rootsongjc/kubernetes-handbook/blob/master/manifests/dashboard)
|
||||
|
||||
由于 `kube-apiserver` 启用了 `RBAC` 授权，而官方源码目录的 `dashboard-controller.yaml` 没有定义授权的 ServiceAccount，所以后续访问 `kube-apiserver` 的 API 时会被拒绝，web中提示：
|
||||
由于 `kube-apiserver` 启用了 `RBAC` 授权，而官方源码目录的 `dashboard-controller.yaml` 没有定义授权的 ServiceAccount，所以后续访问 API server 的 API 时会被拒绝，web中提示：
|
||||
|
||||
```
|
||||
Forbidden (403)
|
||||
|
|
@ -79,9 +79,9 @@ kubernetes-dashboard-1339745653-pmn6z 1/1 Running 0 4m
|
|||
|
||||
有以下三种方式：
|
||||
|
||||
- kubernetes-dashboard 服务暴露了 NodePort，可以使用 `http://NodeIP:nodePort` 地址访问 dashboard；
|
||||
- 通过 kube-apiserver 访问 dashboard（https 6443端口和http 8080端口方式）；
|
||||
- 通过 kubectl proxy 访问 dashboard：
|
||||
- kubernetes-dashboard 服务暴露了 NodePort，可以使用 `http://NodeIP:nodePort` 地址访问 dashboard
|
||||
- 通过 API server 访问 dashboard（https 6443端口和http 8080端口方式）
|
||||
- 通过 kubectl proxy 访问 dashboard
|
||||
|
||||
### 通过 kubectl proxy 访问 dashboard
|
||||
|
||||
|
|
@ -94,10 +94,10 @@ Starting to serve on 172.20.0.113:8086
|
|||
|
||||
+ 需要指定 `--accept-hosts` 选项，否则浏览器访问 dashboard 页面时提示 “Unauthorized”；
|
||||
|
||||
浏览器访问 URL：`http://172.20.0.113:8086/ui`
|
||||
自动跳转到：`http://172.20.0.113:8086/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard/#/workload?namespace=default`
|
||||
浏览器访问 URL：http://172.20.0.113:8086/ui
|
||||
自动跳转到：http://172.20.0.113:8086/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard/#/workload?namespace=default
|
||||
|
||||
### 通过 kube-apiserver 访问dashboard
|
||||
### 通过 API server 访问dashboard
|
||||
|
||||
获取集群服务地址列表
|
||||
|
||||
|
|
@ -108,7 +108,7 @@ KubeDNS is running at https://172.20.0.113:6443/api/v1/proxy/namespaces/kube-sys
|
|||
kubernetes-dashboard is running at https://172.20.0.113:6443/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard
|
||||
```
|
||||
|
||||
浏览器访问 URL：`https://172.20.0.113:6443/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard`（浏览器会提示证书验证，因为通过加密通道，以改方式访问的话，需要提前导入证书到你的计算机中）。这是我当时在这遇到的坑：[通过 kube-apiserver 访问dashboard，提示User "system:anonymous" cannot proxy services in the namespace "kube-system". #5](https://github.com/opsnull/follow-me-install-kubernetes-cluster/issues/5)，已经解决。
|
||||
浏览器访问 URL：https://172.20.0.113:6443/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard（浏览器会提示证书验证，因为通过加密通道，以改方式访问的话，需要提前导入证书到你的计算机中）。这是我当时在这遇到的坑：[通过 kube-apiserver 访问dashboard，提示User "system:anonymous" cannot proxy services in the namespace "kube-system". #5](https://github.com/opsnull/follow-me-install-kubernetes-cluster/issues/5)，已经解决。
|
||||
|
||||
**导入证书**
|
||||
|
||||
|
|
@ -126,7 +126,7 @@ openssl pkcs12 -export -in admin.pem -out admin.p12 -inkey admin-key.pem
|
|||
|
||||
由于缺少 Heapster 插件，当前 dashboard 不能展示 Pod、Nodes 的 CPU、内存等 metric 图形。
|
||||
|
||||
**更新**
|
||||
### 更新
|
||||
|
||||
Kubernetes 1.6 版本的 dashboard 的镜像已经到了 v1.6.3 版本，我们可以使用下面的方式更新。
|
||||
|
||||
|
|
@ -168,6 +168,8 @@ Dashboard 的访问地址不变，重新访问 <http://172.20.0.113:8080/api/v1/
|
|||
|
||||
新版本中最大的变化是增加了进入容器内部的入口，可以在页面上进入到容器内部操作，同时又增加了一个搜索框。
|
||||
|
||||
关于如何将dashboard从1.6版本升级到1.7版本请参考[升级dashboard](dashboard-upgrade.md)。
|
||||
|
||||
## 参考
|
||||
|
||||
[WebUI(Dashboard) 文档](https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/)
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
# 升级Dashboard
|
||||
|
||||
我们在kubernetes1.6的时候同时安装了dashboard插件，该插件也是基于kubernetes1.6版本开发的。如今kubernetes1.8版本业已发布，如何升级dashboard以获取新版中功能呢？
|
||||
|
||||
Dashboard的升级比较简单，因为它仅仅是一个前端应用，用来展现集群信息和与后端API交互，理论上只需要更新原先dashboard的yaml配置文件中的镜像就可以了，但是为了使用dashboard1.7版本中的用户登陆功能，还需要做一些额外的操作。
|
||||
|
||||
[dashboard](https://github.com/kubernetes/dashboard)的更新日志请见[release note](https://github.com/kubernetes/dashboard/releases)，当前的最新版本为v1.7.1，下面将介绍将dashboard从v1.6.3升级到v1.7.1并开启用户登陆认证的详细步骤。
|
||||
|
||||
## 升级步骤
|
||||
|
||||
**删除原来的版本**
|
||||
|
||||
首先删除原来的dashboard资源：
|
||||
|
||||
```bash
|
||||
kubectl delete -f dashboard/
|
||||
```
|
||||
|
||||
将`dashboard`目录下的所有yaml文件中的资源全部删除，包括Deployment、service和角色绑定等。
|
||||
|
||||
**部署新版本**
|
||||
|
||||
我们使用官方的配置文件来安装，首先下载官方配置：
|
||||
|
||||
```bash
|
||||
wget https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/recommended/kubernetes-dashboard.yaml
|
||||
```
|
||||
|
||||
修改其中的两个镜像地址为我们的私有地址。
|
||||
|
||||
- gcr.io/google_containers/kubernetes-dashboard-init-amd64:v1.0.1
|
||||
- gcr.io/google_containers/kubernetes-dashboard-amd64:v1.7.1
|
||||
|
||||
这个两个镜像可以同时从**时速云**上获取：
|
||||
|
||||
- index.tenxcloud.com/jimmy/kubernetes-dashboard-amd64:v1.7.1
|
||||
- index.tenxcloud.com/jimmy/kubernetes-dashboard-init-amd64:v1.0.1
|
||||
|
||||
将service type设置为`NodePort`，修改后的yaml文件见[kubernetes-dashboard.yaml](https://github.com/rootsongjc/kubernetes-handbook/tree/master/manifests/dashboard-1.7.1/kubernetes-dashboard.yaml)，然后就可以部署新版本的dashboard了。
|
||||
|
||||
```bash
|
||||
kubectl create -f kubernetes-dashboard.yaml
|
||||
```
|
||||
|
||||
获取dashboard的外网访问端口：
|
||||
|
||||
```bash
|
||||
kubectl -n kube-system get svc kubernetes-dashboard
|
||||
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
|
||||
kubernetes-dashboard 10.254.177.181 <nodes> 443:32324/TCP 49m
|
||||
```
|
||||
|
||||
访问集群中的任何一个节点，即可打开dashboard登陆页面，如https://172.20.0.113:32324/（请使用https访问）：
|
||||
|
||||
|
||||
|
||||
选择本地的`kubeconfig`文件以登陆集群，`kubeconfig`文件中包括登陆的用户名、证书和token信息。
|
||||
|
||||
登陆之后首先看到的界面是这样的：
|
||||
|
||||
|
||||
|
||||
这是因为该用户没有对`default`命名空间的访问权限。
|
||||
|
||||
修改URL地址中的`namespace`字段为该用户有权限访问的命名空间如brand：<https://172.20.0.113:32324/#!/overview?namespace=brand>：
|
||||
|
||||
|
||||
|
||||
### 登陆凭证
|
||||
|
||||
登陆dashboard的时候可以指定`kubeconfig`文件来认证用户权限，如何生成登陆dashboard时指定的`kubeconfig`文件请参考[创建用户认证授权的kubeconfig文件](../guide/kubectl-user-authentication-authorization.md)。
|
||||
|
||||
另外还需要生成用户token，例如为brand用户生成token：
|
||||
|
||||
```bash
|
||||
$ head -c 16 /dev/urandom | od -An -t x| tr -d ' '
|
||||
a09bb459d67d876cf1829b4047394a5a
|
||||
```
|
||||
|
||||
将该用户的token追加到kuberentes API启动参数中指定的`token`文件中，我们安装时指定的是`/etc/kubernetes/token.csv`。
|
||||
|
||||
```bash
|
||||
a09bb459d67d876cf1829b4047394a5a,brand,10002,"brand"
|
||||
```
|
||||
|
||||
注意：此处Namespace和ServiceAccount相同，都是`brand`。
|
||||
|
||||
重启API server也加载最新的配置。
|
||||
|
||||
然后在上面生成的`kubeconfig`文件中追加一行`token`的配置，如下所示：
|
||||
|
||||
|
||||
|
||||
这样就可以使用`brand.kubeconfig`文件来登陆dashboard了，而且只能访问和操作`brand`命名空间下的对象。
|
||||
|
||||
## 参考
|
||||
|
||||
[Dashboard log in mechanism #2093](https://github.com/kubernetes/dashboard/issues/2093)
|
||||
|
||||
[Accessing Dashboard 1.7.X and above](https://github.com/kubernetes/dashboard/wiki/Accessing-Dashboard---1.7.X-and-above)
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 手动升级集群
|
||||
# 手动升级kubernetes集群
|
||||
|
||||
目前kubernetes的官方文档上并没有详细的手动安装的集群如何升级的参考资料，只有两篇关于kubernetes集群升级的文档。
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
# 更新与升级
|
||||
|
||||
Kubernetes到目前为止基本保持三个月发行一个新版本的节奏，更新节奏可以说非常快，这一部分将主要跟踪kubernetes及其相关组件的更新与升级。
|
||||
Loading…
Reference in New Issue