优化镜像同步，新增雄安集团监管平台项目

agent-deploy/a_dashboard/TemplateK8SDashboard.go

@@ -1,106 +1,88 @@
 package a_dashboard
 
 const CmiiK8sDashboardTemplate = `
+# ------------------- Dashboard Namespace ------------------- #
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: kube-system
+  name: kubernetes-dashboard
 
 ---
-
+# ------------------- Service Account ------------------- #
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
     k8s-app: kubernetes-dashboard
   name: kubernetes-dashboard
-  namespace: kube-system
+  namespace: kubernetes-dashboard
 
 ---
-
+# ------------------- Dashboard Service (NodePort 39999) ------------------- #
 kind: Service
 apiVersion: v1
 metadata:
   labels:
     k8s-app: kubernetes-dashboard
-    kubernetes.io/cluster-service: "true"
   name: kubernetes-dashboard
-  namespace: kube-system
+  namespace: kubernetes-dashboard
 spec:
+  type: NodePort
   ports:
     - port: 443
       targetPort: 8443
       nodePort: 39999
   selector:
     k8s-app: kubernetes-dashboard
-  type: NodePort
 
 ---
-
+# ------------------- Dashboard Secrets ------------------- #
 apiVersion: v1
 kind: Secret
 metadata:
   labels:
     k8s-app: kubernetes-dashboard
   name: kubernetes-dashboard-certs
-  namespace: kube-system
+  namespace: kubernetes-dashboard
 type: Opaque
 
 ---
-
 apiVersion: v1
 kind: Secret
 metadata:
   labels:
     k8s-app: kubernetes-dashboard
   name: kubernetes-dashboard-csrf
-  namespace: kube-system
+  namespace: kubernetes-dashboard
 type: Opaque
 data:
   csrf: ""
 
 ---
-
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-key-holder
-  namespace: kube-system
-type: Opaque
-
----
-
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-settings
-  namespace: kube-system
-
----
-
-kind: Role
+# ------------------- Dashboard Role (FIXED) ------------------- #
 apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
 metadata:
   labels:
     k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kube-system
+  name: kubernetes-dashboard-minimal
+  namespace: kubernetes-dashboard
 rules:
-  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
+  # [修复] 允许创建 Secrets，解决 panic 问题
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["create"]
+  # 允许对特定 Secrets 进行操作
   - apiGroups: [""]
     resources: ["secrets"]
     resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
     verbs: ["get", "update", "delete"]
-    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
+  # ConfigMaps 权限
   - apiGroups: [""]
     resources: ["configmaps"]
     resourceNames: ["kubernetes-dashboard-settings"]
     verbs: ["get", "update"]
-    # Allow Dashboard to get metrics.
+  # Metrics 权限
   - apiGroups: [""]
     resources: ["services"]
     resourceNames: ["heapster", "dashboard-metrics-scraper"]
@@ -111,61 +93,32 @@ rules:
     verbs: ["get"]
 
 ---
-
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-rules:
-  # Allow Metrics Scraper to get metrics from the Metrics server
-  - apiGroups: ["metrics.k8s.io"]
-    resources: ["pods", "nodes"]
-    verbs: ["get", "list", "watch"]
-
----
-
+# ------------------- Dashboard RoleBinding ------------------- #
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kube-system
+  name: kubernetes-dashboard-minimal
+  namespace: kubernetes-dashboard
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: kubernetes-dashboard
+  name: kubernetes-dashboard-minimal
 subjects:
   - kind: ServiceAccount
     name: kubernetes-dashboard
-    namespace: kube-system
+    namespace: kubernetes-dashboard
 
 ---
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kubernetes-dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kubernetes-dashboard
-subjects:
-  - kind: ServiceAccount
-    name: kubernetes-dashboard
-    namespace: kube-system
-
----
-
+# ------------------- Dashboard Deployment ------------------- #
 kind: Deployment
 apiVersion: apps/v1
 metadata:
   labels:
     k8s-app: kubernetes-dashboard
   name: kubernetes-dashboard
-  namespace: kube-system
+  namespace: kubernetes-dashboard
 spec:
   replicas: 1
   revisionHistoryLimit: 10
@@ -177,29 +130,23 @@ spec:
       labels:
         k8s-app: kubernetes-dashboard
     spec:
-      imagePullSecrets:
-        - name: harborsecret
       containers:
         - name: kubernetes-dashboard
-          {{- if .HarborPort }}
-          image: {{ .HarborIPOrCustomImagePrefix }}:{{ .HarborPort }}/cmii/dashboard:v2.0.1
-          {{- else }}
-          image: {{ .HarborIPOrCustomImagePrefix }}dashboard:v2.0.1
-          {{- end }}
+        {{- if .HarborPort }}
+          image: {{ .HarborIPOrCustomImagePrefix }}:{{ .HarborPort }}/cmii/dashboard:v2.7.0
+        {{- else }}
+          image: {{ .HarborIPOrCustomImagePrefix }}dashboard:v2.7.0
+        {{- end }}
+          imagePullPolicy: Always
           ports:
             - containerPort: 8443
               protocol: TCP
           args:
             - --auto-generate-certificates
-            - --namespace=kube-system
-            # Uncomment the following line to manually specify Kubernetes API server Host
-            # If not specified, Dashboard will attempt to auto discover the API server and connect
-            # to it. Uncomment only if the default does not work.
-            # - --apiserver-host=http://my-address:port
+            - --namespace=kubernetes-dashboard
           volumeMounts:
             - name: kubernetes-dashboard-certs
               mountPath: /certs
-              # Create on-disk volume to store exec logs
             - mountPath: /tmp
               name: tmp-volume
           livenessProbe:
@@ -221,20 +168,23 @@ spec:
         - name: tmp-volume
           emptyDir: {}
       serviceAccountName: kubernetes-dashboard
-      # Comment the following tolerations if Dashboard must not be deployed on master
+      nodeSelector:
+        "kubernetes.io/os": linux
       tolerations:
         - key: node-role.kubernetes.io/master
           effect: NoSchedule
+        - key: node-role.kubernetes.io/control-plane
+          effect: NoSchedule
 
 ---
-
+# ------------------- Metrics Scraper Service ------------------- #
 kind: Service
 apiVersion: v1
 metadata:
   labels:
     k8s-app: dashboard-metrics-scraper
   name: dashboard-metrics-scraper
-  namespace: kube-system
+  namespace: kubernetes-dashboard
 spec:
   ports:
     - port: 8000
@@ -243,14 +193,14 @@ spec:
     k8s-app: dashboard-metrics-scraper
 
 ---
-
+# ------------------- Metrics Scraper Deployment ------------------- #
 kind: Deployment
 apiVersion: apps/v1
 metadata:
   labels:
     k8s-app: dashboard-metrics-scraper
   name: dashboard-metrics-scraper
-  namespace: kube-system
+  namespace: kubernetes-dashboard
 spec:
   replicas: 1
   revisionHistoryLimit: 10
@@ -266,11 +216,11 @@ spec:
     spec:
       containers:
         - name: dashboard-metrics-scraper
-          {{- if .HarborPort }}
-          image: {{ .HarborIPOrCustomImagePrefix }}:{{ .HarborPort }}/cmii/metrics-scraper:v1.0.4
-          {{- else }}
-          image: {{ .HarborIPOrCustomImagePrefix }}metrics-scraper:v1.0.4
-          {{- end }}
+        {{- if .HarborPort }}
+          image: {{ .HarborIPOrCustomImagePrefix }}:{{ .HarborPort }}/cmii/metrics-scraper:v1.0.8
+        {{- else }}
+          image: {{ .HarborIPOrCustomImagePrefix }}metrics-scraper:v1.0.8
+        {{- end }}
           ports:
             - containerPort: 8000
               protocol: TCP
@@ -290,20 +240,28 @@ spec:
             runAsUser: 1001
             runAsGroup: 2001
       serviceAccountName: kubernetes-dashboard
-      # Comment the following tolerations if Dashboard must not be deployed on master
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
+      nodeSelector:
+        "kubernetes.io/os": linux
       volumes:
         - name: tmp-volume
           emptyDir: {}
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+        - key: node-role.kubernetes.io/control-plane
+          effect: NoSchedule
+
 ---
+# ==================================================================
+#                自定义用户配置部分 (ADMIN & READ-ONLY)
+# ==================================================================
+
+# ------------------- 1. Admin User (全部权限) ------------------- #
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: admin-user
-  namespace: kube-system
-
+  namespace: kubernetes-dashboard
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -316,5 +274,53 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: admin-user
-    namespace: kube-system
+    namespace: kubernetes-dashboard
+
+---
+# ------------------- 2. Read-Only User (只读+看日志) ------------------- #
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: read-only-user
+  namespace: kubernetes-dashboard
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: dashboard-view-with-logs
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps", "endpoints", "persistentvolumeclaims", "pods", "replicationcontrollers", "replicationcontrollers/scale", "serviceaccounts", "services", "nodes", "persistentvolumeclaims", "persistentvolumes", "namespaces"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["cronjobs", "jobs"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses", "networkpolicies"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["events.k8s.io"]
+    resources: ["events"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: read-only-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: dashboard-view-with-logs
+subjects:
+  - kind: ServiceAccount
+    name: read-only-user
+    namespace: kubernetes-dashboard
 `