{"id":2895,"date":"2024-11-17T21:43:32","date_gmt":"2024-11-17T13:43:32","guid":{"rendered":"https:\/\/www.chencuo.top\/?p=2895"},"modified":"2024-11-17T21:43:32","modified_gmt":"2024-11-17T13:43:32","slug":"k8s%e9%9b%86%e7%be%a4%e6%90%ad%e5%bb%ba","status":"publish","type":"post","link":"https:\/\/www.chencuo.top\/?p=2895","title":{"rendered":"k8s\u96c6\u7fa4\u642d\u5efa"},"content":{"rendered":"\n

\u865a\u62df\u673a\u51c6\u5907<\/h2>\n\n\n\n

\u64cd\u4f5c\u7cfb\u7edf<\/h3>\n\n\n\n
\u865a\u62df\u673a<\/td>centos 7.9.2009 x86_64<\/td><\/tr>
Docker<\/td>v24.0.6<\/td><\/tr>
k8s<\/td>v1.20.9<\/td><\/tr>
kubeadm<\/td>v1.20<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

\u8282\u70b9\u914d\u7f6e<\/h3>\n\n\n\n
\u4e3b\u673a<\/td>\u89d2\u8272<\/td>ip<\/td><\/tr>
node1<\/td>master<\/td>192.32.62.30<\/td><\/tr>
node2<\/td>node1<\/td>192.32.62.31<\/td><\/tr>
node3<\/td>node2<\/td>192.32.62.32<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

\u73af\u5883\u51c6\u5907<\/h3>\n\n\n\n

\u4ee5\u4e0b\u6240\u6709\u64cd\u4f5c\u5168\u8282\u70b9\u8fdb\u884c\uff0c\u8fd9\u91cc\u53ea\u5c55\u793a\u4e3b\u8282\u70b9<\/strong><\/p>\n\n\n\n

\u8bbe\u7f6e\u9759\u6001ip<\/h4>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u4e3b\u673aip\u6620\u5c04<\/h4>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u5206\u53d1\u7ed9\u5176\u4f59\u4e24\u53f0<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u914d\u7f6eSSH\u514d\u5bc6\u767b\u5f55<\/h4>\n\n\n\n

\u521b\u5efa\u516c\u94a5<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u5206\u53d1<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u5173\u95edSwap\u5206\u533a<\/h4>\n\n\n\n

kubelet\u8981\u6c42\u5fc5\u987b\u7981\u7528\u4ea4\u6362\u5206\u533a\uff0c\u6240\u4ee5kubeadm\u521d\u59cb\u5316\u65f6\u56de\u68c0\u6d4bswap\u662f\u5426\u5173\u95ed\uff0c\u5982\u679c\u6ca1\u6709\u5173\u95ed\u4f1a\u62a5\u9519\uff0c\u5982\u679c\u4e0d\u60f3\u5173\u95ed\u5b89\u88c5\u65f6kubelet\u547d\u4ee4\u9700\u8981\u6dfb\u52a0–fail-swap-on=false<\/p>\n\n\n\n

\u4e34\u65f6\u5173\u95ed\uff0c\u91cd\u542f\u6062\u590d<\/p>\n\n\n\n

swapoff -a<\/code><\/pre>\n\n\n\n
\u6c38\u4e45\u5173\u95ed<\/p>\n\n\n\n
vi \/etc\/fstab\n\n#\/dev\/mapper\/centos-swap swap                    swap    defaults        0 0    ##\u6ce8\u91ca\u6b64\u884c\n<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5173\u95ed\u9632\u706b\u5899<\/h4>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5173\u95edselinux<\/h4>\n\n\n\n
\u91cd\u542f<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4fee\u6539\u5185\u6838\u53c2\u6570<\/h4>\n\n\n\n
modprobe br_netfilter     ##\u52a0\u8f7d\u5185\u6838\u6a21\u5757\n\necho \"modprobe br_netfilter\" >> \/etc\/profile     ##\u5bfc\u5165\u73af\u5883\u914d\u7f6e\u6587\u4ef6\n\ntee \/etc\/sysctl.d\/k8s.conf << EOF                     ##\u5141\u8bb8\u7aef\u53e3\u8f6c\u53d1\nnet.bridge.bridge-nf-call-ip6tables = 1\nnet.bridge.bridge-nf-call-iptables = 1\nEOF\n<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u65f6\u95f4\u540c\u6b65<\/h4>\n\n\n\n
node1\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u670d\u52a1\u5f00\u542f\u4ee5\u53ca\u9a8c\u8bc1<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
node2\uff0cnode3\uff0c\u586b\u5199node1\u8282\u70b9\u6765\u65f6\u95f4\u540c\u6b65<\/p>\n\n\n\n
\u6b64\u5904\u53ea\u5c55\u793anode2<\/strong><\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u914d\u7f6eyum\u6e90<\/h4>\n\n\n\n
\u57fa\u7840\u6e90<\/p>\n\n\n\n
\u53c2\u8003\uff1acentos7\u6e90\u914d\u7f6e \u2013 cuo\u7684\u5c0f\u7a9d<\/a><\/p>\n\n\n\n
docker\u6e90<\/p>\n\n\n\n
\u53c2\u8003\uff1acentos7\u6e90\u914d\u7f6e \u2013 cuo\u7684\u5c0f\u7a9d<\/a><\/p>\n\n\n\n
k8s\u6e90<\/p>\n\n\n\n
\u53c2\u8003\uff1acentos7\u6e90\u914d\u7f6e \u2013 cuo\u7684\u5c0f\u7a9d<\/a><\/a><\/a><\/p>\n\n\n\n
docker\u5b89\u88c5<\/h2>\n\n\n\n
\u4e09\u53f0\u8282\u70b9\u90fd\u9700\u8981\u90e8\u7f72<\/p>\n\n\n\n
\u79fb\u6b65: docker\u90e8\u7f72 \u2013 cuo\u7684\u5c0f\u7a9d<\/a><\/p>\n\n\n\n
\u5b89\u88c5K8S\u96c6\u7fa4<\/h2>\n\n\n\n
\u5b89\u88c5\u4e09\u5927\u7ec4\u4ef6-kubeadm\u3001kubelet\u3001kubectl<\/h3>\n\n\n\n
\u4e09\u53f0\u8282\u70b9\u90fd\u9700\u8981<\/p>\n\n\n\n
    \n
  • kubeadm\uff1a\u7528\u6765\u521d\u59cb\u5316k8s\u96c6\u7fa4\u7684\u6307\u4ee4\u3002<\/li>\n\n\n\n
  • kubelet\uff1a\u5728\u96c6\u7fa4\u7684\u6bcf\u4e2a\u8282\u70b9\u4e0a\u7528\u6765\u542f\u52a8 Pod \u548c\u5bb9\u5668\u7b49\u3002<\/li>\n\n\n\n
  • kubectl\uff1a\u7528\u6765\u4e0ek8s\u96c6\u7fa4\u901a\u4fe1\u7684\u547d\u4ee4\u884c\u5de5\u5177\uff0c\u67e5\u770b\u3001\u521b\u5efa\u3001\u66f4\u65b0\u548c\u5220\u9664\u5404\u79cd\u8d44\u6e90\u3002<\/li>\n<\/ul>\n\n\n\n
    \u5b89\u88c5<\/h3>\n\n\n\n
    yum install -y kubelet-1.20.9 kubeadm-1.20.9 kubectl-1.20.9<\/code><\/pre>\n\n\n\n
    \u5c55\u793anode1<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6240\u6709\u8bbe\u7f6e\u5f00\u673a\u81ea\u542f<\/p>\n\n\n\n
    systemctl enable kubelet<\/code><\/pre>\n\n\n\n
    \u521d\u59cb\u5316k8s\u96c6\u7fa4<\/h3>\n\n\n\n
    apiserver-advertise-address\uff1aapiserver\u76d1\u542c\u5730\u5740
    control-plane-endpoint\uff1a\u63a7\u5236\u5e73\u9762\u7684IP\u5730\u5740\u6216DNS\u540d\u79f0
    image-repository\uff1a\u955c\u50cf\u4ed3\u5e93\uff0c\u6b64\u5904\u4e3a\u56fd\u5185\u963f\u91cc\u4e91\u955c\u50cf\u4ed3\u5e93\u52a0\u901f\u4e0b\u8f7d
    service-cidr\uff1a\u4e3aService\u5206\u914d\u7684IP\u5730\u5740\u6bb5
    pod-network-cidr\uff1a\u4e3apod\u5206\u914d\u7684IP\u5730\u5740\u6bb5
    <\/p>\n\n\n\n
    ##\u6240\u6709\u8282\u70b9\u6dfb\u52a0\necho \"192.32.62.30  cluster-endpoint\" >> \/etc\/hosts           ##master\uff0c\u6211\u8fd9\u91cc\u662fnode1\n# \u53ea\u5728\u4e3b\u8282\u70b9\u6267\u884c\nkubeadm init \\\n--apiserver-advertise-address=192.32.62.30 \\\n--control-plane-endpoint=cluster-endpoint \\\n--image-repository  registry.cn-hangzhou.aliyuncs.com\/google_containers \\\n--kubernetes-version v1.20.9 \\\n--service-cidr=10.96.0.0\/12 \\\n--pod-network-cidr=172.20.0.0\/16<\/code><\/pre>\n\n\n\n
    \u6210\u529f<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u4f7f\u7528\u975eroot\u7528\u6237\u8fd0\u884ckubectl<\/p>\n\n\n\n
      mkdir -p $HOME\/.kube\n  sudo cp -i \/etc\/kubernetes\/admin.conf $HOME\/.kube\/config\n  sudo chown $(id -u):$(id -g) $HOME\/.kube\/config<\/code><\/pre>\n\n\n\n
    root\u7528\u6237<\/p>\n\n\n\n
    export KUBECONFIG=\/etc\/kubernetes\/admin.conf<\/code><\/pre>\n\n\n\n
    \u52a0\u5165\u8282\u70b9<\/h3>\n\n\n\n
    \u4e0a\u8ff0\u521d\u59cb\u5316\u6587\u4ef6\u5185<\/p>\n\n\n\n
    \u4e24\u4e2a\u9644\u8282\u70b9\u8f93\u5165\uff1a<\/p>\n\n\n\n
      kubeadm join cluster-endpoint:6443 --token ckvqxx.z6dg46cxn5cjbmyg \\\n    --discovery-token-ca-cert-hash sha256:00003dda8692a4412e44a4b187969643d9db2cb72dabe3fb48686dd31798486b \\\n   <\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u67e5\u770btoken\u5217\u8868\uff0c\u53ef\u89c2\u5bdf\u5230\u6bcf\u4e2atoken\u7684\u5269\u4f59\u6709\u6548\u65f6\u95f4<\/p>\n\n\n\n
    kubeadm token list<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u9ed8\u8ba4token\u6709\u6548\u671f\u4e3a24\u5c0f\u65f6\uff0c\u8fc7\u671f\u4e4b\u540etoken\u5931\u6548\uff0c\u53ef\u91cd\u65b0\u751f\u6210token\uff1a<\/p>\n\n\n\n
    kubeadm token create --print-join-command<\/code><\/pre>\n\n\n\n
    \u4fee\u6539\u89d2\u8272\uff1a<\/p>\n\n\n\n
    \u5728master\u4e0a<\/p>\n\n\n\n
    kubectl label node node2 node-role.kubernetes.io\/worker=worker\nkubectl label node node3 node-role.kubernetes.io\/worker=worker<\/code><\/pre>\n\n\n\n
    \u67e5\u770b\u8282\u70b9<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u5b89\u88c5\u7f51\u7edc\u63d2\u4ef6<\/h3>\n\n\n\n
    \u8fdb\u5165<\/p>\n\n\n\n
    cd \/etc\/yum.repos.d<\/code><\/pre>\n\n\n\n
    \u8f93\u5165<\/p>\n\n\n\n
    curl https:\/\/docs.projectcalico.org\/v3.15\/manifests\/calico.yaml -O<\/code><\/pre>\n\n\n\n
    \u4fee\u6539\u5176\u914d\u7f6e<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u63d0\u4ea4<\/p>\n\n\n\n
    kubectl apply -f calico.yaml<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u9a8c\u8bc1\u662f\u5426\u6210\u529f<\/p>\n\n\n\n
    kubectl get pod -A | grep calico<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u67e5\u770bnode<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    k8s\u96c6\u7fa4\u6d4b\u8bd5<\/h3>\n\n\n\n
    \u521b\u5efanginx pod<\/h4>\n\n\n\n
    ##\u9ed8\u8ba4\u4f1a\u5728\u9ed8\u8ba4\u547d\u540d\u7a7a\u95f4default\u4e2d\u521b\u5efa\u4e00\u4e2a\u540d\u79f0\u4e3amynignx\u7684deployment\uff0c\u540c\u65f6\u4f1a\u521b\u5efa\u4e00\u4e2a\u540d\u79f0\u4ee5myniginx\u4e3a\u524d\u7f00\uff0c\u53ebmynginx-5b686ccd46-wshz6\u7684Pod\nkubectl create deployment mynginx --image=nginx\n\n# \u67e5\u770bpod\nkubectl get pod,svc<\/code><\/pre>\n\n\n\n
    \u5bf9\u5916\u66b4\u9732\u8bbf\u95ee<\/h4>\n\n\n\n
    \u57fa\u4e8e\u7b2c\u4e00\u6b65\u521b\u5efa\u7684deployment\u518d\u521b\u5efa\u4e00\u4e2a\u540d\u53ebmynginx\u7684Service\uff0c\u8d44\u6e90\u7c7b\u578b\u7531–type=ClusterIP\u4fee\u6539\u4e3a–type=NodePort\uff0c\u4f1a\u5728\u6bcf\u4e2aNode\u8282\u70b9\u4e0a\u76d1\u542c30161\u7aef\u53e3\uff0c\u7528\u4e8e\u63a5\u6536\u96c6\u7fa4\u5916\u90e8\u8bbf\u95ee<\/p>\n\n\n\n
    [root@node1 kubernetes]# kubectl expose deployment mynginx --port=80 --type=NodePort\nservice\/mynginx exposed\n[root@node1 kubernetes]# kubectl get pod,svc\nNAME                           READY   STATUS    RESTARTS   AGE\npod\/mynginx-5b686ccd46-vs224   1\/1     Running   0          9m26s\n\nNAME                 TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE\nservice\/kubernetes   ClusterIP   10.96.0.1        <none>        443\/TCP        17h\nservice\/mynginx      NodePort    10.101.190.255   <none>        80:31440\/TCP   17s<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u5b89\u88c5Dashboard<\/h3>\n\n\n\n
    cd \/etc\/yum.repos.d\/\nvi dashboard.yaml\n\n\u8f93\u5165\u4ee5\u4e0b\u5185\u5bb9\n# Copyright 2017 The Kubernetes Authors.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n#     http:\/\/www.apache.org\/licenses\/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n \napiVersion: v1\nkind: Namespace\nmetadata:\n  name: kubernetes-dashboard\n \n---\n \napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\n  namespace: kubernetes-dashboard\n \n---\n \nkind: Service\napiVersion: v1\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\n  namespace: kubernetes-dashboard\nspec:\n  ports:\n    - port: 443\n      targetPort: 8443\n  selector:\n    k8s-app: kubernetes-dashboard\n \n---\n \napiVersion: v1\nkind: Secret\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard-certs\n  namespace: kubernetes-dashboard\ntype: Opaque\n \n---\n \napiVersion: v1\nkind: Secret\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard-csrf\n  namespace: kubernetes-dashboard\ntype: Opaque\ndata:\n  csrf: \"\"\n \n---\n \napiVersion: v1\nkind: Secret\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard-key-holder\n  namespace: kubernetes-dashboard\ntype: Opaque\n \n---\n \nkind: ConfigMap\napiVersion: v1\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard-settings\n  namespace: kubernetes-dashboard\n \n---\n \nkind: Role\napiVersion: rbac.authorization.k8s.io\/v1\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\n  namespace: kubernetes-dashboard\nrules:\n  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.\n  - apiGroups: [\"\"]\n    resources: [\"secrets\"]\n    resourceNames: [\"kubernetes-dashboard-key-holder\", \"kubernetes-dashboard-certs\", \"kubernetes-dashboard-csrf\"]\n    verbs: [\"get\", \"update\", \"delete\"]\n    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.\n  - apiGroups: [\"\"]\n    resources: [\"configmaps\"]\n    resourceNames: [\"kubernetes-dashboard-settings\"]\n    verbs: [\"get\", \"update\"]\n    # Allow Dashboard to get metrics.\n  - apiGroups: [\"\"]\n    resources: [\"services\"]\n    resourceNames: [\"heapster\", \"dashboard-metrics-scraper\"]\n    verbs: [\"proxy\"]\n  - apiGroups: [\"\"]\n    resources: [\"services\/proxy\"]\n    resourceNames: [\"heapster\", \"http:heapster:\", \"https:heapster:\", \"dashboard-metrics-scraper\", \"http:dashboard-metrics-scraper\"]\n    verbs: [\"get\"]\n \n---\n \nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io\/v1\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\nrules:\n  # Allow Metrics Scraper to get metrics from the Metrics server\n  - apiGroups: [\"metrics.k8s.io\"]\n    resources: [\"pods\", \"nodes\"]\n    verbs: [\"get\", \"list\", \"watch\"]\n \n---\n \napiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\n  namespace: kubernetes-dashboard\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: Role\n  name: kubernetes-dashboard\nsubjects:\n  - kind: ServiceAccount\n    name: kubernetes-dashboard\n    namespace: kubernetes-dashboard\n \n---\n \napiVersion: rbac.authorization.k8s.io\/v1\nkind: ClusterRoleBinding\nmetadata:\n  name: kubernetes-dashboard\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: kubernetes-dashboard\nsubjects:\n  - kind: ServiceAccount\n    name: kubernetes-dashboard\n    namespace: kubernetes-dashboard\n \n---\n \nkind: Deployment\napiVersion: apps\/v1\nmetadata:\n  labels:\n    k8s-app: kubernetes-dashboard\n  name: kubernetes-dashboard\n  namespace: kubernetes-dashboard\nspec:\n  replicas: 1\n  revisionHistoryLimit: 10\n  selector:\n    matchLabels:\n      k8s-app: kubernetes-dashboard\n  template:\n    metadata:\n      labels:\n        k8s-app: kubernetes-dashboard\n    spec:\n      containers:\n        - name: kubernetes-dashboard\n          image: kubernetesui\/dashboard:v2.4.0\n          imagePullPolicy: Always\n          ports:\n            - containerPort: 8443\n              protocol: TCP\n          args:\n            - --auto-generate-certificates\n            - --namespace=kubernetes-dashboard\n            # Uncomment the following line to manually specify Kubernetes API server Host\n            # If not specified, Dashboard will attempt to auto discover the API server and connect\n            # to it. Uncomment only if the default does not work.\n            # - --apiserver-host=http:\/\/my-address:port\n          volumeMounts:\n            - name: kubernetes-dashboard-certs\n              mountPath: \/certs\n              # Create on-disk volume to store exec logs\n            - mountPath: \/tmp\n              name: tmp-volume\n          livenessProbe:\n            httpGet:\n              scheme: HTTPS\n              path: \/\n              port: 8443\n            initialDelaySeconds: 30\n            timeoutSeconds: 30\n          securityContext:\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            runAsUser: 1001\n            runAsGroup: 2001\n      volumes:\n        - name: kubernetes-dashboard-certs\n          secret:\n            secretName: kubernetes-dashboard-certs\n        - name: tmp-volume\n          emptyDir: {}\n      serviceAccountName: kubernetes-dashboard\n      nodeSelector:\n        \"kubernetes.io\/os\": linux\n      # Comment the following tolerations if Dashboard must not be deployed on master\n      tolerations:\n        - key: node-role.kubernetes.io\/master\n          effect: NoSchedule\n \n---\n \nkind: Service\napiVersion: v1\nmetadata:\n  labels:\n    k8s-app: dashboard-metrics-scraper\n  name: dashboard-metrics-scraper\n  namespace: kubernetes-dashboard\nspec:\n  ports:\n    - port: 8000\n      targetPort: 8000\n  selector:\n    k8s-app: dashboard-metrics-scraper\n \n---\n \nkind: Deployment\napiVersion: apps\/v1\nmetadata:\n  labels:\n    k8s-app: dashboard-metrics-scraper\n  name: dashboard-metrics-scraper\n  namespace: kubernetes-dashboard\nspec:\n  replicas: 1\n  revisionHistoryLimit: 10\n  selector:\n    matchLabels:\n      k8s-app: dashboard-metrics-scraper\n  template:\n    metadata:\n      labels:\n        k8s-app: dashboard-metrics-scraper\n    spec:\n      securityContext:\n        seccompProfile:\n          type: RuntimeDefault\n      containers:\n        - name: dashboard-metrics-scraper\n          image: kubernetesui\/metrics-scraper:v1.0.7\n          ports:\n            - containerPort: 8000\n              protocol: TCP\n          livenessProbe:\n            httpGet:\n              scheme: HTTP\n              path: \/\n              port: 8000\n            initialDelaySeconds: 30\n            timeoutSeconds: 30\n          volumeMounts:\n          - mountPath: \/tmp\n            name: tmp-volume\n          securityContext:\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            runAsUser: 1001\n            runAsGroup: 2001\n      serviceAccountName: kubernetes-dashboard\n      nodeSelector:\n        \"kubernetes.io\/os\": linux\n      # Comment the following tolerations if Dashboard must not be deployed on master\n      tolerations:\n        - key: node-role.kubernetes.io\/master\n          effect: NoSchedule\n      volumes:\n        - name: tmp-volume\n          emptyDir: {}<\/code><\/pre>\n\n\n\n
    \u6267\u884c\uff1a<\/p>\n\n\n\n
    kubectl apply -f dashboard.yaml<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u67e5\u770b\u670d\u52a1\u662f\u5426\u542f\u52a8<\/p>\n\n\n\n
    kubectl get pod -n kubernetes-dashboard<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u914d\u7f6e\u8bbf\u95ee\u7684token<\/p>\n\n\n\n
    \u521b\u5efa\u76f8\u5173\u7684sa\uff0c\u590d\u5236\u4e0b\u9762\u7684\u5185\u5bb9\uff0c\u5230rbac.yaml<\/em><\/p>\n\n\n\n
    vim rbac.yaml\n\n\u8f93\u5165\uff1a\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: dashboard-admin\n  namespace: kube-system\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io\/v1      \nmetadata:\n  name: dashboard-admin\nsubjects:\n  - kind: ServiceAccount\n    name: dashboard-admin\n    namespace: kube-system\nroleRef:\n  kind: ClusterRole\n  name: cluster-admin\n  apiGroup: rbac.authorization.k8s.io<\/code><\/pre>\n\n\n\n
    \u8f93\u5165\uff1a<\/p>\n\n\n\n
    kubectl apply -f rbac.yaml<\/code><\/pre>\n\n\n\n
    \u83b7\u53d6token<\/p>\n\n\n\n
    kubectl get secret -n kubernetes-dashboard\n\u9009\u62e9\u7b2c\u4e00\u4e2aadmin\u7684\n<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u8f93\u5165\uff1a<\/p>\n\n\n\n
    kubectl describe secret admin\u7684\u5bc6\u94a5 -n kubernetes-dashboard<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u5bf9\u5916\u7aef\u53e3\u66b4\u9732<\/p>\n\n\n\n
    \u7531–type=ClusterIP\u4fee\u6539\u4e3a–type=NodePort<\/p>\n\n\n\n
    kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u83b7\u53d6\u5bf9\u5916\u7aef\u53e3<\/p>\n\n\n\n
    kubectl get svc -A|grep dashboard<\/em>
    <\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u8f93\u5165https:\/\/master\u7684ip+\u7aef\u53e3\u53f7<\/p>\n\n\n\n
    \u4e00\u822c\u8fdb\u53bb\u662f\u6b64\u9875\u9762<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u70b9\u51fb\u9ad8\u7ea7\u7136\u540e\u952e\u76d8\u4f9d\u6b21\u8f93\u5165\uff1a<\/p>\n\n\n\n
    thisisunsafe<\/code><\/pre>\n\n\n\n
    \u8f93\u5165\u5bc6\u94a5<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6700\u540e\u6210\u529f<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"
    \u865a\u62df\u673a\u51c6\u5907 \u64cd\u4f5c\u7cfb\u7edf \u865a\u62df\u673a centos 7.9.2009 x86_64 Docker v24.0.6 k8 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,9,10,14],"tags":[20,27],"class_list":["post-2895","post","type-post","status-publish","format-standard","hentry","category-5","category-9","category-10","category-14","tag-docker","tag-k8s"],"_links":{"self":[{"href":"https:\/\/www.chencuo.top\/index.php?rest_route=\/wp\/v2\/posts\/2895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.chencuo.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.chencuo.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.chencuo.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.chencuo.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2895"}],"version-history":[{"count":0,"href":"https:\/\/www.chencuo.top\/index.php?rest_route=\/wp\/v2\/posts\/2895\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.chencuo.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.chencuo.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2895"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.chencuo.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}