K8S Dashboard 2.0 部署并使用 Ingress-Nginx 提供访问入口

# 证书
$ ls $HOME/certs

k8s-dashboard.yp14.cn.crt  k8s-dashboard.yp14.cn.key

# 创建 kubernetes-dashboard-certs secret
$ kubectl create secret generic kubernetes-dashboard-certs --from-file=$HOME/certs -n kubernetes-dashboard

$ wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml

$ vim recommended.yaml

# 把创建 kubernetes-dashboard-certs Secret 注释掉，前面已通过命令创建。

#apiVersion: v1
#kind: Secret
#metadata:
#  labels:
#    k8s-app: kubernetes-dashboard
#  name: kubernetes-dashboard-certs
#  namespace: kubernetes-dashboard
#type: Opaque

# 添加ssl证书路径，关闭自动更新证书，添加多长时间登出。
# 注意：--tls-key-file --tls-cert-file 引用名称，要与上面创建 kubernetes-dashboard-certs Secret 引用的证书文件名称一样。

          args:
            #- --auto-generate-certificates
            - --namespace=kubernetes-dashboard
            - --tls-key-file=k8s-dashboard.yp14.cn.key
            - --tls-cert-file=k8s-dashboard.yp14.cn.crt
            - --token-ttl=3600

$ kubectl  apply -f recommended.yaml

$ kubectl  get pods -n kubernetes-dashboard

NAME                                         READY   STATUS    RESTARTS   AGE
dashboard-metrics-scraper-6b4884c9d5-lx8dw   1/1     Running   0          14h
kubernetes-dashboard-b75f6b5d6-r22nq         1/1     Running   0          14h

$ vim create-admin.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

$ kubectl apply -f create-admin.yaml

$ kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')

$ cd $HOME/certs

# 创建 k8s-dashboard.yp14.cn 域名 Ingress nginx https 证书
$ kubectl create secret tls k8s-dashboard --key k8s-dashboard.yp14.cn.key --cert k8s-dashboard.yp14.cn.crt -n kubernetes-dashboard

$ vim k8s-dashboard-ingress.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: k8s-dashboard-ingress
  namespace: kubernetes-dashboard
  annotations:
    kubernetes.io/ingress.class: "nginx"
    # 开启use-regex，启用path的正则匹配
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /
    # 默认为 true，启用 TLS 时，http请求会 308 重定向到https
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # 默认为 http，开启后端服务使用 proxy_pass https://协议
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  rules:
  - host: k8s-dashboard.yp14.cn
    http:
      paths:
      - path: /
        backend:
          serviceName: kubernetes-dashboard
          servicePort: 443
  tls:
  - secretName: k8s-dashboard
    hosts:
    - k8s-dashboard.yp14.cn

# 创建
$ kubectl apply -f k8s-dashboard-ingress.yaml