前文我们了解了k8s的访问控制第三关准入控制相关插件的使用，回顾请参考：https://www.cnblogs.com/qiuhom-1874/p/14220402.html；今天我们来了解下k8s的web ui 组件的安装和用户授权相关话题；

k8s的webui是一个插件运行在k8s之上，以pod的方式提供服务；它能够给使用k8s用户提供一个web面板，我们可以基于这个web面板来管理k8s集群；比如创建pod，创建svc，部署应用等等；在部署之前，先说一下dashboard认证过程；dashboard是以pod的形式运行在k8s之上，它本身没有做访问权限认证相关的功能，它只是把用户的认证信息代理到k8s集群上，具体的认证授权还是由k8s的apiserver进行；所以我们登录dashboard必须是k8s上的用户；其次它是一个pod形式把我们的认证信息代理到apiserver上，所以我们登录dashboard的用户必须是一个sa用户，它不支持常规用户；简单讲dashboard就是一个代理服务；它把我们所有操作通过https协议代理到apiserver做相应的操作；dashboard是一个多用户的插件，它支持同时多个用户以不同身份登录到dashboard上做操作；对于dashboard本身来讲，它就是k8s上的一个web服务以pod形式运行，我们可以通过ingrss把它发布出来，也可以通过service把它发布出来；选择其中一种方式即可；

dashboard部署前准备

dashboard对外提供服务的是一个https服务，如果我们需要将其发布到集群外部供互联网访问，我们需要把对应域名的证书先用secret资源加载到k8s上，然后在部署dashboard时，引用对应的secret即可；

生成私钥，证书签署请求文件csr，然后发送给对应CA签署(如果对应域名的证书都申请好了，这一步直接跳过)

[root@master01 ~]# mkdir dashboard

[root@master01 ~]# cd dashboard

[root@master01 dashboard]# openssl genrsa -out dashboard.key 2048

Generating RSA private key, 2048 bit long modulus

................................................................................................+++

..................+++

e is 65537 (0x10001)

[root@master01 dashboard]# openssl req -new -key dashboard.key -out dashboard.csr -subj "/O=test/CN=webui.test.com"

[root@master01 dashboard]# ll

total 8

-rw-r--r-- 1 root root 920 Jan 2 14:00 dashboard.csr

-rw-r--r-- 1 root root 1679 Jan 2 13:59 dashboard.key

[root@master01 dashboard]#

使用某个ca签署对应的证书签署请求文件，我这里直接使用k8s上的CA签

[root@master01 dashboard]# openssl x509 -req -in dashboard.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out dashboard.crt -days 3650

Signature ok

subject=/O=test/CN=webui.test.com

Getting CA Private Key

[root@master01 dashboard]# ll

total 12

-rw-r--r-- 1 root root 1005 Jan 2 14:04 dashboard.crt

-rw-r--r-- 1 root root 920 Jan 2 14:00 dashboard.csr

-rw-r--r-- 1 root root 1679 Jan 2 13:59 dashboard.key

[root@master01 dashboard]#

提示：正常情况是找互联网上的ca签署，该证书只是用于使用对应域名在浏览器上能够通过https访问到dashboard；

下载部署清单，查看对应对应清单中的名称空间和对应secret的名称

[root@master01 dashboard]# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.1.0/aio/deploy/recommended.yaml

--2021-01-02 14:14:48-- https://raw.githubusercontent.com/kubernetes/dashboard/v2.1.0/aio/deploy/recommended.yaml

Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 199.232.28.133

Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|199.232.28.133|:443... connected.

HTTP request sent, awaiting response... 200 OK

Length: 7552 (7.4K) [text/plain]

Saving to: ‘recommended.yaml’

100%[=========================================================================>] 7,552 3.08KB/s in 2.4s

2021-01-02 14:14:52 (3.08 KB/s) - ‘recommended.yaml’ saved [7552/7552]

[root@master01 dashboard]# ls

dashboard.crt dashboard.csr dashboard.key recommended.yaml

[root@master01 dashboard]#

提示：上述是dashboard的部署清单中的secret资源名称和对应的名称空间，我们如果需要手动替换自己的证书，就必须提前把对应的证书做成和部署清单中相同名称空间相同类型和相同名称的secret资源；

创建kubenetes-dashboard名称空间，把dashboard.crt和dashboard.key映射为k8s上kubenetes-dashboard名称空间下的generic类型的secret资源

[root@master01 dashboard]# kubectl create ns kubernetes-dashboard

namespace/kubernetes-dashboard created

[root@master01 dashboard]# kubectl create secret generic kubernetes-dashboard-certs --from-file=dashboard.crt --from-file=dashboard.key -n kubernetes-dashboard

secret/kubernetes-dashboard-certs created

[root@master01 dashboard]# kubectl get secret -n kubernetes-dashboard

NAME TYPE DATA AGE

default-token-vcw5h kubernetes.io/service-account-token 3 2m31s

kubernetes-dashboard-certs Opaque 2 12s

[root@master01 dashboard]#

应用dashboard部署资源清单

[root@master01 dashboard]# kubectl apply -f recommended.yaml

Warning: resource namespaces/kubernetes-dashboard is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.

namespace/kubernetes-dashboard configured

serviceaccount/kubernetes-dashboard created

service/kubernetes-dashboard created

Warning: resource secrets/kubernetes-dashboard-certs is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.

secret/kubernetes-dashboard-certs configured

secret/kubernetes-dashboard-csrf created

secret/kubernetes-dashboard-key-holder created

configmap/kubernetes-dashboard-settings created

role.rbac.authorization.k8s.io/kubernetes-dashboard created

clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created

rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created

clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created

deployment.apps/kubernetes-dashboard created

service/dashboard-metrics-scraper created

deployment.apps/dashboard-metrics-scraper created

[root@master01 dashboard]#

在线编辑对应service的配置，将clusterip类型更改为nodeport类型

提示：更改为nodeport类型service，对应集群外部的客户端才可以正常访问；

查看对应名称空间下的pod是否启动起来？

[root@master01 ~]# kubectl get all -n kubernetes-dashboard

NAME READY STATUS RESTARTS AGE

pod/dashboard-metrics-scraper-79c5968bdc-tc79t 1/1 Running 0 6m56s

pod/kubernetes-dashboard-7448ffc97b-v98gk 1/1 Running 0 6m56s

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

service/dashboard-metrics-scraper ClusterIP 10.103.202.122 8000/TCP 6m56s

service/kubernetes-dashboard NodePort 10.108.57.122 443:31635/TCP 6m57s

NAME READY UP-TO-DATE AVAILABLE AGE

deployment.apps/dashboard-metrics-scraper 1/1 1 1 6m56s

deployment.apps/kubernetes-dashboard 1/1 1 1 6m56s

NAME DESIRED CURRENT READY AGE

replicaset.apps/dashboard-metrics-scraper-79c5968bdc 1 1 1 6m56s

replicaset.apps/kubernetes-dashboard-7448ffc97b 1 1 1 6m56s

[root@master01 ~]#

提示：可以看到对应资源都已经跑起来了，对应service暴露的端口是34635端口，我们可以访问k8s集群任意节点的31635端口就能访问到dashboard，如果使用域名访问，请注意对应域名要解析到对应k8s集群上的任意一个节点ip上；

访问dashboard

提示：这里要用https访问，因为对应服务是提供的https服务；这里提示我们证书不安全，是因为对应证书不是浏览器认可的ca颁发，所以我们需要自己手动信任下；

提示：能够看到上面的页面，说明dashboard就运行起来了，接下我们要创建一个账号来登录dashboard；

创建一个sa账号

[root@master01 ~]# kubectl create serviceaccount webui-cluster-admin -n kubernetes-dashboard

serviceaccount/webui-cluster-admin created

[root@master01 ~]# kubectl get sa -n kubernetes-dashboard

NAME SECRETS AGE

default 1 29m

kubernetes-dashboard 1 17m

webui-cluster-admin 1 11s

[root@master01 ~]# kubectl describe sa webui-cluster-admin -n kubernetes-dashboard

Name: webui-cluster-admin

Namespace: kubernetes-dashboard

Labels:

Annotations:

Image pull secrets:

Mountable secrets: webui-cluster-admin-token-bxl2z

Tokens: webui-cluster-admin-token-bxl2z

Events:

[root@master01 ~]#

授权对应sa账号为cluster-admin角色

[root@master01 ~]# kubectl create clusterrolebinding webui-cluster-admin --clusterrole=cluster-admin --serviceaccount=kubernetes-dashboard:webui-cluster-admin

clusterrolebinding.rbac.authorization.k8s.io/webui-cluster-admin created

[root@master01 ~]# kubectl get clusterrolebinding |grep webui

webui-cluster-admin ClusterRole/cluster-admin 41s

[root@master01 ~]# kubectl describe clusterrolebinding webui-cluster-admin

Name: webui-cluster-admin

Labels:

Annotations:

Role:

Kind: ClusterRole

Name: cluster-admin

Subjects:

Kind Name Namespace

---- ---- ---------

ServiceAccount webui-cluster-admin kubernetes-dashboard

[root@master01 ~]#

提示：指定serviceaccount需要指定对应sa的名称空间加“：”对应sa的名称；

使用上面对应sa账号对应的secret中的token登录dashboard

登录dashboard

提示：默认登录到dashboard会是在default名称空间，我们可以选择上面的名称空间查看对应名称空间下的资源；

创建某个名称空间下的管理员

[root@master01 ~]# kubectl create serviceaccount myns-admin -n myns

serviceaccount/myns-admin created

[root@master01 ~]# kubectl create rolebinding myns-admin --clusterrole=admin --serviceaccount=myns:myns-admin -n myns

rolebinding.rbac.authorization.k8s.io/myns-admin created

[root@master01 ~]#

提示：rolebinding需要指定名称空间，否则不指定默认表示default名称空间；

查看对应账号的token

[root@master01 ~]# kubectl describe sa -n myns

Name: default

Namespace: myns

Labels:

Annotations:

Image pull secrets:

Mountable secrets: default-token-n6tg5

Tokens: default-token-n6tg5

Events:

Name: myns-admin

Namespace: myns

Labels:

Annotations:

Image pull secrets:

Mountable secrets: myns-admin-token-p6gh8

Tokens: myns-admin-token-p6gh8

Events:

[root@master01 ~]# kubectl describe secret myns-admin-token-p6gh8 -n myns

Name: myns-admin-token-p6gh8

Namespace: myns

Labels:

Annotations: kubernetes.io/service-account.name: myns-admin

kubernetes.io/service-account.uid: ebaed1a9-4631-42cb-8af9-a14fa35a7098

Type: kubernetes.io/service-account-token

Data

====

ca.crt: 1066 bytes

namespace: 4 bytes

token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjM4WnU0Z1Q1c0hBNmR5Q1V0ejRaMFk4d2J2WncwWjNiUTAxZk02SGN4OTgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJteW5zIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6Im15bnMtYWRtaW4tdG9rZW4tcDZnaDgiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoibXlucy1hZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImViYWVkMWE5LTQ2MzEtNDJjYi04YWY5LWExNGZhMzVhNzA5OCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpteW5zOm15bnMtYWRtaW4ifQ.JuZ9WsojEfJai-Z1uLH7AIS-kLyqqln9POzEEoV_RTBKGO4NbtDJwMOw3z4SVeLwdCSiBefh-pD03DCnHmZ-HunrUPXBix2iKRgD42fkQ2L8cZzl8LGEw88jK5mUpSOF2si0wibc1cn7Gtrc5LqMiVtOgLoBMhEXaX2_RDUXj0Q8FtNb_srIcjQe__gXsMGmXxhHuU629IVk7fM99FvHzlDOyLj4goaydMw7F9-JFpL3I-ll2lq46goKDEwB2pMEz_qvsVFHvILNzg318TilMSK4VeMpKUbje6eovvs2IYSMCfVRBtvlpsv3KixYONai1AvYRQz_iISwKzI5JWO4hw

[root@master01 ~]#

使用对应的token登录dashboard

提示：这里默认登录进来是default名称空间，对应账号没有权限，所以它会提示我们没有权限查看当前名称空间下的资源；

切换到myns名称空间

提示：到此对应用户就能在myns名称空间下做响应的管理操作了；

制作kubeconfig文件登录dashboard

[root@master01 ~]# kubectl config set-cluster mykube --server="https://192.168.0.41:6443" --embed-certs --certificate-authority=/etc/kubernetes/pki/ca.crt --kubeconfig=/tmp/test-mykube.config

Cluster "mykube" set.

[root@master01 ~]# kubectl config set-credentials webui-admin --token=eyJhbGciOiJSUzI1NiIsImtpZCI6IjM4WnU0Z1Q1c0hBNmR5Q1V0ejRaMFk4d2J2WncwWjNiUTAxZk02SGN4OTgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJ3ZWJ1aS1jbHVzdGVyLWFkbWluLXRva2VuLWJ4bDJ6Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6IndlYnVpLWNsdXN0ZXItYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI2NDYwNWFhMi1kZmI1LTRlZjItYTQ3NC0yMzczOGUwZmNjZDgiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6d2VidWktY2x1c3Rlci1hZG1pbiJ9.lIEEMbIyYDlWXxG_xSWcY595Ai3yCYTAKEYQVwybysBfNTM9ksJOhqep9M9PF6bfUGIpbFr-Y75gvAmOprrYICv-W7RKUQxMq1s_9mIY7ATlWh3xiPOjYoT9K7JWXNpFOPsl9eEOY2j_VJE7hK_7mzMg7ASPTWEbQS1YkXvoBh3nG_SDBbKgqs-SiQ5_yhx0QFK-PSdFUiBhGRq_TvqbrmZeAi1lJ6tNODcUW7zikSwO53wQDJHgjdYiYHhqm0O3GysBYp6JzgkryXdmjLri6NXvWV9qTc201SL7xrF6S09vSFQaox479r5A5qat9DJn0qq4YEUFKXzweuyxjJfdwA --kubeconfig=/tmp/test-mykube.config

User "webui-admin" set.

[root@master01 ~]# kubectl config set-context webui-admin@mykube --cluster=mykube --user=webui-admin --kubeconfig=/tmp/test-mykube.config

Context "webui-admin@mykube" created.

[root@master01 ~]# kubectl config view --kubeconfig=/tmp/test-mykube.config

apiVersion: v1

clusters:

- cluster:

certificate-authority-data: DATA+OMITTED

server: https://192.168.0.41:6443

name: mykube

contexts:

- context:

cluster: mykube

user: webui-admin

name: webui-admin@mykube

current-context: ""

kind: Config

preferences: {}

users:

- name: webui-admin

user:

token: REDACTED

[root@master01 ~]# kubectl config use-context webui-admin@mykube --kubeconfig=/tmp/test-mykube.config

Switched to context "webui-admin@mykube".

[root@master01 ~]# kubectl config view --kubeconfig=/tmp/test-mykube.config

apiVersion: v1

clusters:

- cluster:

certificate-authority-data: DATA+OMITTED

server: https://192.168.0.41:6443

name: mykube

contexts:

- context:

cluster: mykube

user: webui-admin

name: webui-admin@mykube

current-context: webui-admin@mykube

kind: Config

preferences: {}

users:

- name: webui-admin

user:

token: REDACTED

[root@master01 ~]#

提示：在设置用户时，选择对应用户的token信息即可；

把对应配置文件导出，在浏览器上使用对应文件登录dashboard

提示：此时登录到dashboard用户就是对应配置文件中的token对应的sa用户；到此dashboard就搭建好了。。