331 lines
8.9 KiB
YAML
331 lines
8.9 KiB
YAML
# ------------------- Dashboard Namespace ------------------- #
|
||
apiVersion: v1
|
||
kind: Namespace
|
||
metadata:
|
||
name: kubernetes-dashboard
|
||
|
||
---
|
||
# ------------------- Service Account ------------------- #
|
||
apiVersion: v1
|
||
kind: ServiceAccount
|
||
metadata:
|
||
labels:
|
||
k8s-app: kubernetes-dashboard
|
||
name: kubernetes-dashboard
|
||
namespace: kubernetes-dashboard
|
||
|
||
---
|
||
# ------------------- Dashboard Service (NodePort 39999) ------------------- #
|
||
kind: Service
|
||
apiVersion: v1
|
||
metadata:
|
||
labels:
|
||
k8s-app: kubernetes-dashboard
|
||
name: kubernetes-dashboard
|
||
namespace: kubernetes-dashboard
|
||
spec:
|
||
type: NodePort
|
||
ports:
|
||
- port: 443
|
||
targetPort: 8443
|
||
nodePort: 39999
|
||
selector:
|
||
k8s-app: kubernetes-dashboard
|
||
|
||
---
|
||
# ------------------- Dashboard Secrets ------------------- #
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
labels:
|
||
k8s-app: kubernetes-dashboard
|
||
name: kubernetes-dashboard-certs
|
||
namespace: kubernetes-dashboard
|
||
type: Opaque
|
||
|
||
---
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
labels:
|
||
k8s-app: kubernetes-dashboard
|
||
name: kubernetes-dashboard-csrf
|
||
namespace: kubernetes-dashboard
|
||
type: Opaque
|
||
data:
|
||
csrf: ""
|
||
|
||
---
|
||
# ------------------- Dashboard Role (FIXED) ------------------- #
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: Role
|
||
metadata:
|
||
labels:
|
||
k8s-app: kubernetes-dashboard
|
||
name: kubernetes-dashboard-minimal
|
||
namespace: kubernetes-dashboard
|
||
rules:
|
||
# [修复] 允许创建 Secrets，解决 panic 问题
|
||
- apiGroups: [""]
|
||
resources: ["secrets"]
|
||
verbs: ["create"]
|
||
# 允许对特定 Secrets 进行操作
|
||
- apiGroups: [""]
|
||
resources: ["secrets"]
|
||
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
|
||
verbs: ["get", "update", "delete"]
|
||
# ConfigMaps 权限
|
||
- apiGroups: [""]
|
||
resources: ["configmaps"]
|
||
resourceNames: ["kubernetes-dashboard-settings"]
|
||
verbs: ["get", "update"]
|
||
# Metrics 权限
|
||
- apiGroups: [""]
|
||
resources: ["services"]
|
||
resourceNames: ["heapster", "dashboard-metrics-scraper"]
|
||
verbs: ["proxy"]
|
||
- apiGroups: [""]
|
||
resources: ["services/proxy"]
|
||
resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
|
||
verbs: ["get"]
|
||
|
||
---
|
||
# ------------------- Dashboard RoleBinding ------------------- #
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: RoleBinding
|
||
metadata:
|
||
labels:
|
||
k8s-app: kubernetes-dashboard
|
||
name: kubernetes-dashboard-minimal
|
||
namespace: kubernetes-dashboard
|
||
roleRef:
|
||
apiGroup: rbac.authorization.k8s.io
|
||
kind: Role
|
||
name: kubernetes-dashboard-minimal
|
||
subjects:
|
||
- kind: ServiceAccount
|
||
name: kubernetes-dashboard
|
||
namespace: kubernetes-dashboard
|
||
|
||
---
|
||
# ------------------- Dashboard Deployment ------------------- #
|
||
kind: Deployment
|
||
apiVersion: apps/v1
|
||
metadata:
|
||
labels:
|
||
k8s-app: kubernetes-dashboard
|
||
name: kubernetes-dashboard
|
||
namespace: kubernetes-dashboard
|
||
spec:
|
||
replicas: 1
|
||
revisionHistoryLimit: 10
|
||
selector:
|
||
matchLabels:
|
||
k8s-app: kubernetes-dashboard
|
||
template:
|
||
metadata:
|
||
labels:
|
||
k8s-app: kubernetes-dashboard
|
||
spec:
|
||
containers:
|
||
- name: kubernetes-dashboard
|
||
image: kubernetesui/dashboard:v2.7.0
|
||
imagePullPolicy: Always
|
||
ports:
|
||
- containerPort: 8443
|
||
protocol: TCP
|
||
args:
|
||
- --auto-generate-certificates
|
||
- --namespace=kubernetes-dashboard
|
||
volumeMounts:
|
||
- name: kubernetes-dashboard-certs
|
||
mountPath: /certs
|
||
- mountPath: /tmp
|
||
name: tmp-volume
|
||
livenessProbe:
|
||
httpGet:
|
||
scheme: HTTPS
|
||
path: /
|
||
port: 8443
|
||
initialDelaySeconds: 30
|
||
timeoutSeconds: 30
|
||
securityContext:
|
||
allowPrivilegeEscalation: false
|
||
readOnlyRootFilesystem: true
|
||
runAsUser: 1001
|
||
runAsGroup: 2001
|
||
volumes:
|
||
- name: kubernetes-dashboard-certs
|
||
secret:
|
||
secretName: kubernetes-dashboard-certs
|
||
- name: tmp-volume
|
||
emptyDir: {}
|
||
serviceAccountName: kubernetes-dashboard
|
||
nodeSelector:
|
||
"kubernetes.io/os": linux
|
||
tolerations:
|
||
- key: node-role.kubernetes.io/master
|
||
effect: NoSchedule
|
||
- key: node-role.kubernetes.io/control-plane
|
||
effect: NoSchedule
|
||
|
||
---
|
||
# ------------------- Metrics Scraper Service ------------------- #
|
||
kind: Service
|
||
apiVersion: v1
|
||
metadata:
|
||
labels:
|
||
k8s-app: dashboard-metrics-scraper
|
||
name: dashboard-metrics-scraper
|
||
namespace: kubernetes-dashboard
|
||
spec:
|
||
ports:
|
||
- port: 8000
|
||
targetPort: 8000
|
||
selector:
|
||
k8s-app: dashboard-metrics-scraper
|
||
|
||
---
|
||
# ------------------- Metrics Scraper Deployment ------------------- #
|
||
kind: Deployment
|
||
apiVersion: apps/v1
|
||
metadata:
|
||
labels:
|
||
k8s-app: dashboard-metrics-scraper
|
||
name: dashboard-metrics-scraper
|
||
namespace: kubernetes-dashboard
|
||
spec:
|
||
replicas: 1
|
||
revisionHistoryLimit: 10
|
||
selector:
|
||
matchLabels:
|
||
k8s-app: dashboard-metrics-scraper
|
||
template:
|
||
metadata:
|
||
labels:
|
||
k8s-app: dashboard-metrics-scraper
|
||
annotations:
|
||
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
|
||
spec:
|
||
containers:
|
||
- name: dashboard-metrics-scraper
|
||
image: kubernetesui/metrics-scraper:v1.0.8
|
||
ports:
|
||
- containerPort: 8000
|
||
protocol: TCP
|
||
livenessProbe:
|
||
httpGet:
|
||
scheme: HTTP
|
||
path: /
|
||
port: 8000
|
||
initialDelaySeconds: 30
|
||
timeoutSeconds: 30
|
||
volumeMounts:
|
||
- mountPath: /tmp
|
||
name: tmp-volume
|
||
securityContext:
|
||
allowPrivilegeEscalation: false
|
||
readOnlyRootFilesystem: true
|
||
runAsUser: 1001
|
||
runAsGroup: 2001
|
||
serviceAccountName: kubernetes-dashboard
|
||
nodeSelector:
|
||
"kubernetes.io/os": linux
|
||
volumes:
|
||
- name: tmp-volume
|
||
emptyDir: {}
|
||
tolerations:
|
||
- key: node-role.kubernetes.io/master
|
||
effect: NoSchedule
|
||
- key: node-role.kubernetes.io/control-plane
|
||
effect: NoSchedule
|
||
|
||
---
|
||
# ==================================================================
|
||
# 自定义用户配置部分 (ADMIN & READ-ONLY)
|
||
# ==================================================================
|
||
|
||
# ------------------- 1. Admin User (全部权限) ------------------- #
|
||
apiVersion: v1
|
||
kind: ServiceAccount
|
||
metadata:
|
||
name: admin-user
|
||
namespace: kubernetes-dashboard
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: ClusterRoleBinding
|
||
metadata:
|
||
name: admin-user
|
||
roleRef:
|
||
apiGroup: rbac.authorization.k8s.io
|
||
kind: ClusterRole
|
||
name: cluster-admin
|
||
subjects:
|
||
- kind: ServiceAccount
|
||
name: admin-user
|
||
namespace: kubernetes-dashboard
|
||
|
||
---
|
||
# ------------------- 2. Read-Only User (只读+看日志) ------------------- #
|
||
apiVersion: v1
|
||
kind: ServiceAccount
|
||
metadata:
|
||
name: read-only-user
|
||
namespace: kubernetes-dashboard
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: ClusterRole
|
||
metadata:
|
||
name: dashboard-view-with-logs
|
||
rules:
|
||
- apiGroups: [""]
|
||
resources: ["configmaps", "endpoints", "persistentvolumeclaims", "pods", "replicationcontrollers", "replicationcontrollers/scale", "serviceaccounts", "services", "nodes", "persistentvolumeclaims", "persistentvolumes", "namespaces"]
|
||
verbs: ["get", "list", "watch"]
|
||
- apiGroups: [""]
|
||
resources: ["pods/log"]
|
||
verbs: ["get", "list", "watch"]
|
||
- apiGroups: ["apps"]
|
||
resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
|
||
verbs: ["get", "list", "watch"]
|
||
- apiGroups: ["batch"]
|
||
resources: ["cronjobs", "jobs"]
|
||
verbs: ["get", "list", "watch"]
|
||
- apiGroups: ["networking.k8s.io"]
|
||
resources: ["ingresses", "networkpolicies"]
|
||
verbs: ["get", "list", "watch"]
|
||
- apiGroups: ["storage.k8s.io"]
|
||
resources: ["storageclasses"]
|
||
verbs: ["get", "list", "watch"]
|
||
- apiGroups: ["events.k8s.io"]
|
||
resources: ["events"]
|
||
verbs: ["get", "list", "watch"]
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: ClusterRoleBinding
|
||
metadata:
|
||
name: read-only-user
|
||
roleRef:
|
||
apiGroup: rbac.authorization.k8s.io
|
||
kind: ClusterRole
|
||
name: dashboard-view-with-logs
|
||
subjects:
|
||
- kind: ServiceAccount
|
||
name: read-only-user
|
||
namespace: kubernetes-dashboard
|
||
|
||
# kubectl create token admin-user -n kubernetes-dashboard --duration=26280h
|
||
# kubectl create token read-only-user -n kubernetes-dashboard --duration=26280h
|
||
|
||
## 1 token的管控
|
||
# # 删除旧的绑定（为了保险起见，避免残留）
|
||
# kubectl delete clusterrolebinding admin-user
|
||
#
|
||
## 2 重新创建绑定
|
||
# kubectl create clusterrolebinding admin-user \
|
||
# --clusterrole=cluster-admin \
|
||
# --serviceaccount=kubernetes-dashboard:admin-user
|
||
|
||
## 3 重新生成token
|
||
# kubectl create token admin-user -n kubernetes-dashboard --duration=26280h
|
||
|
||
## 你无法查看已经生成的 Token 列表。 |