Kubernetes监控：使用集群权限的用户登录Dashbaord 2.0.0

墨蓝 2023-07-03 06:02 16阅读 0赞

在前面的文章中，我们介绍了两种创建Dashboard服务的方法，但是两种方法登录之后都缺乏权限，因为官方推荐的设定文件中创建的service account的权限不足，这篇文章继续介绍如何绑定就有管理权限的用户登录Dashboard。

# 环境准备 #

使用如下方式进行Dashboard的环境准备：

*  自动证书生成方式：[https://liumiaocn.blog.csdn.net/article/details/104144132][https_liumiaocn.blog.csdn.net_article_details_104144132]
 *  外部证书指定方式：[https://liumiaocn.blog.csdn.net/article/details/104146361][https_liumiaocn.blog.csdn.net_article_details_104146361]

# 具有集群管理权限的用户 #

创建一个名为dashboard-admin的具有集群管理权限的用户，设定信息如下所示：

[root@host131 tmp]# cat dashboard-admin.yml 
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: dashboard-admin
      namespace: kubernetes-dashboard
      labels:
        kubernetes.io/cluster-service: "true"
        addonmanager.kubernetes.io/mode: Reconcile
    ...
    
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: dashboard-admin
      namespace: kubernetes-dashboard
      annotations:
        rbac.authorization.kubernetes.io/autoupdate: "true"
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-admin
    subjects:
    - kind: ServiceAccount
      name: dashboard-admin
      namespace: kubernetes-dashboard
    ...
    [root@host131 tmp]#

创建用户，执行示例日志如下所示

[root@host131 tmp]# kubectl apply -f dashboard-admin.yml 
    serviceaccount/dashboard-admin created
    clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
    [root@host131 tmp]#

# 获取token #

使用如下命令获取token：

> 执行命令：kubectl -n kubernetes-dashboard get secret -o jsonpath=’\{range .items\[?(@.metadata.annotations.kubernetes.io/service-account.name==“dashboard-admin”)\].data\}\{.token\}\{end\}’ | base64 -d

执行日志如下所示：

[root@host131 tmp]# kubectl -n kubernetes-dashboard get secret -o jsonpath='{range .items[?(@.metadata.annotations.kubernetes\.io/service-account\.name=="dashboard-admin")].data}{.token}{end}' | base64 -d
    eyJhbGciOiJSUzI1NiIsImtpZCI6Ikt5aFRwRXR6M1hMLU5GTjg0M0R1LTNfNTZLOVNhVUxZd1BSZW9HNGJrMVEifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkYXNoYm9hcmQtYWRtaW4tdG9rZW4ta3hkYjkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGFzaGJvYXJkLWFkbWluIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiYTRlZGNjZmYtYzY3My00ODkwLTk3MTctNjhkODIzYjI0YzA3Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmRhc2hib2FyZC1hZG1pbiJ9.ehELY1eO5Y-_6DQd2tbx4DZQF7TQV6LuBgInZ0IGhbMUbD5BZ7YP_VNj2SDIVLLgxxYPgewy3CVnDKgkbmVWM746lq6WOT69r7TQE_zBn7Jj8I1ouuRmulR8oKIBf62q9F1NP8fhNe4G97IZivWRBlFuuTKmFzqkrPknSlgwtg4qjyAmFzFjKCSO_KOEh8YrlFrRFmdOvqC3D1B9IwoYO5qmbrTiePbBVgrLBu5ed9GN8aDJle7Pf4GSzXHtlydsVBJgPvtIvioxueWCVJQoEOaNs1Fs0gatwe-22-3-D-BXdSOF260B5qVPMTjgd2zIsv4b8V-Jm2vITu00ycmZaw[root@host131 tmp]#

# 登录确认 #

使用token方式登录后，可看到如下信息：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9saXVtaWFvY24uYmxvZy5jc2RuLm5ldA_size_16_color_FFFFFF_t_70]  
确认全namespace的整体信息  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9saXVtaWFvY24uYmxvZy5jc2RuLm5ldA_size_16_color_FFFFFF_t_70 1]  
Pod的资源使用率仍然没有获取到，因为Metrics Server等尚未启动  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9saXVtaWFvY24uYmxvZy5jc2RuLm5ldA_size_16_color_FFFFFF_t_70 2]  
但是可以看到，具有权限的用户已经可以开始使用Dashboard进行整个集群的状态确认了

[https_liumiaocn.blog.csdn.net_article_details_104144132]: https://liumiaocn.blog.csdn.net/article/details/104144132
[https_liumiaocn.blog.csdn.net_article_details_104146361]: https://liumiaocn.blog.csdn.net/article/details/104146361
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9saXVtaWFvY24uYmxvZy5jc2RuLm5ldA_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200202211059762.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9saXVtaWFvY24uYmxvZy5jc2RuLm5ldA==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9saXVtaWFvY24uYmxvZy5jc2RuLm5ldA_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200202211149787.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9saXVtaWFvY24uYmxvZy5jc2RuLm5ldA==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9saXVtaWFvY24uYmxvZy5jc2RuLm5ldA_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/2020020221130611.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9saXVtaWFvY24uYmxvZy5jc2RuLm5ldA==,size_16,color_FFFFFF,t_70