k8s:dashboard的部署
·
部署成功的效果如下图所示
一 创建dashboard文件夹和yaml
创建一个文件夹
[root@rocky9-3 k8s-learn]# mkdir k8s-dashboard
[root@rocky9-3 k8s-learn]# touch k8s-dashboard.yaml
[root@rocky9-3 k8s-learn]# ll
drwxr-xr-x. 2 root root 6 2月 13 17:57 k8s-dashboard
-rw-r--r--. 1 root root 0 2月 13 17:57 k8s-dashboard.yaml
-rw-------. 1 root root 519596032 2月 11 01:48 mysql57.tar
-rw-r--r--. 1 root root 4262 2月 10 21:09 mysql-configmap.yaml
-rwxr-xr-x. 1 root root 6180 2月 10 23:35 wait-pod-recreate.sh
[root@rocky9-3 k8s-learn]# mv k8s-dashboard.yaml k8s-dashboard/k8s-dashboard.yaml
[root@rocky9-3 k8s-learn]# cd k8s-dashboard/
[root@rocky9-3 k8s-dashboard]# ll
总用量 0
-rw-r--r--. 1 root root 0 2月 13 17:57 k8s-dashboard.yaml
二 单节点运行报错
[root@rocky9-3 k8s-learn]# kubectl apply -f k8s-dashboard/k8s-dashboard.yaml
serviceaccount/k8s-dashboard created
service/k8s-dashboard created
deployment.apps/k8s-dashboard created
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user created
发现这个pod跑不起来
[root@rocky9-3 k8s-learn]# kubectl get pods -n k8s-dashboard -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
k8s-dashboard-59d546f876-fm4pc 0/1 CrashLoopBackOff 5 (6s ago) 3m6s 10.244.2.11 rocky9-3 <none> <none>
查看日志
[root@rocky9-3 k8s-learn]# kubectl logs k8s-dashboard-59d546f876-fm4pc -n k8s-dashboard
2026/02/13 10:06:01 Starting overwatch
2026/02/13 10:06:01 Using namespace: k8s-dashboard
2026/02/13 10:06:01 Using in-cluster config to connect to apiserver
2026/02/13 10:06:01 Using secret token for csrf signing
2026/02/13 10:06:01 Initializing csrf token from kubernetes-dashboard-csrf secret
panic: secrets "kubernetes-dashboard-csrf" is forbidden: User "system:serviceaccount:k8s-dashboard:k8s-dashboard" cannot get resource "secrets" in API group "" in the namespace "k8s-dashboard"
goroutine 1 [running]:
github.com/kubernetes/dashboard/src/app/backend/client/csrf.(*csrfTokenManager).init(0xc00061fae8)
/home/runner/work/dashboard/dashboard/src/app/backend/client/csrf/manager.go:41 +0x30e
github.com/kubernetes/dashboard/src/app/backend/client/csrf.NewCsrfTokenManager(...)
/home/runner/work/dashboard/dashboard/src/app/backend/client/csrf/manager.go:66
github.com/kubernetes/dashboard/src/app/backend/client.(*clientManager).initCSRFKey(0xc000088f80)
/home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:527 +0x94
github.com/kubernetes/dashboard/src/app/backend/client.(*clientManager).init(0x19aba3a?)
/home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:495 +0x32
github.com/kubernetes/dashboard/src/app/backend/client.NewClientManager(...)
/home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:594
main.main()
/home/runner/work/dashboard/dashboard/src/app/backend/dashboard.go:96 +0x1cf
[root@rocky9-3 k8s-learn]# kubectl apply -f k8s-dashboard/k8s-dashboard.yaml
Warning: resource namespaces/k8s-dashboard is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
namespace/k8s-dashboard configured
serviceaccount/k8s-dashboard unchanged
role.rbac.authorization.k8s.io/k8s-dashboard created
rolebinding.rbac.authorization.k8s.io/k8s-dashboard created
service/k8s-dashboard unchanged
deployment.apps/k8s-dashboard configured
serviceaccount/admin-user unchanged
clusterrolebinding.rbac.authorization.k8s.io/admin-user unchanged
删除旧pod，还是报错
[root@rocky9-3 k8s-learn]# kubectl delete pod -l k8s-app=k8s-dashboard -n k8s-dashboard
pod "k8s-dashboard-59d546f876-fm4pc" deleted
pod "k8s-dashboard-669cbf4cb-44mbl" deleted
root@rocky9-3 k8s-learn]# kubectl get pods -n k8s-dashboard
NAME READY STATUS RESTARTS AGE
k8s-dashboard-669cbf4cb-wmh96 0/1 Error 1 (2s ago) 4s
继续看日志
[root@rocky9-3 k8s-learn]# kubectl logs k8s-dashboard-669cbf4cb-wmh96 -n k8s-dashboard
2026/02/13 10:10:35 Starting overwatch
2026/02/13 10:10:35 Using namespace: k8s-dashboard
2026/02/13 10:10:35 Using in-cluster config to connect to apiserver
2026/02/13 10:10:35 Using secret token for csrf signing
2026/02/13 10:10:35 Initializing csrf token from kubernetes-dashboard-csrf secret
panic: secrets "kubernetes-dashboard-csrf" not found
goroutine 1 [running]:
github.com/kubernetes/dashboard/src/app/backend/client/csrf.(*csrfTokenManager).init(0xc00059fae8)
/home/runner/work/dashboard/dashboard/src/app/backend/client/csrf/manager.go:41 +0x30e
github.com/kubernetes/dashboard/src/app/backend/client/csrf.NewCsrfTokenManager(...)
/home/runner/work/dashboard/dashboard/src/app/backend/client/csrf/manager.go:66
github.com/kubernetes/dashboard/src/app/backend/client.(*clientManager).initCSRFKey(0xc00013a180)
/home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:527 +0x94
github.com/kubernetes/dashboard/src/app/backend/client.(*clientManager).init(0x19aba3a?)
/home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:495 +0x32
github.com/kubernetes/dashboard/src/app/backend/client.NewClientManager(...)
/home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:594
main.main()
/home/runner/work/dashboard/dashboard/src/app/backend/dashboard.go:96 +0x1cf
运行
[root@rocky9-3 k8s-learn]# kubectl apply -f k8s-dashboard/k8s-dashboard.yaml
namespace/k8s-dashboard unchanged
serviceaccount/k8s-dashboard unchanged
role.rbac.authorization.k8s.io/k8s-dashboard unchanged
rolebinding.rbac.authorization.k8s.io/k8s-dashboard unchanged
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
service/k8s-dashboard unchanged
deployment.apps/k8s-dashboard configured
serviceaccount/admin-user unchanged
clusterrolebinding.rbac.authorization.k8s.io/admin-user unchanged
跑起来了
[root@rocky9-3 k8s-learn]# kubectl get pods -n k8s-dashboard
NAME READY STATUS RESTARTS AGE
k8s-dashboard-669cbf4cb-5qv7q 1/1 Running 0 4s
生成密钥
[root@rocky9-3 k8s-learn]# kubectl -n k8s-dashboard create token admin-user
eyJhbGciOiJSUzI1NiIsImtpZCI6IlEtSDFNVlo3WC1CQVNQTUxUaURNNG96VXA2X2ZzbTlsR2tsazZXMnNfb3MifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxNzcwOTgxNDczLCJpYXQiOjE3NzA5Nzc4NzMsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJrOHMtZGFzaGJvYXJkIiwic2VydmljZWFjY291bnQiOnsibmFtZSI6ImFkbWluLXVzZXIiLCJ1aWQiOiI5MjQ0OGQ5NS0zYzRiLTRhMmItYWQ3My01ODlhY2M0MWViZTQifX0sIm5iZiI6MTc3MDk3Nzg3Mywic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Oms4cy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.SbOjIUS0QEN9V8xl2IyJbCkse23CCblTQnioHk6DNFy3atC-vVhlOR9FZFbeHZmybyYPfmv_vxURYjlvirtxxYiSgdjJXtStr-RfovIbRT-6yPDn5J-e1mAz0UEcVsB2sJPCSlDg8F54_BJVXODdTQVJhG7Zv1RyB7X5bRNP_EmAFVpaeTLOGDK2VkMKEn4TkXPnVS02glZuxIkKIAkT1UlS9b9eAvhoGH7LxXsseayygv3_IOkB_TThd754eZYXDil-cJpbwL5dIlY-9dRG4Ns2_s24hrS6ehz8qX6cQOQwlWY7oMN_cOFX8q_t8eQsdxvLv9errAMHPdxpGCDs9Q
三 双节点运行
3.1 依然报错
root@rocky9-3 k8s-learn]# kubectl get pods -n k8s-dashboard -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
k8s-dashboard-669cbf4cb-5qv7q 1/1 Running 0 52m 10.244.2.15 rocky9-3 <none> <none>
k8s-dashboard-7dc85b74c9-fsxv9 0/1 CrashLoopBackOff 12 (3m19s ago) 39m 10.244.1.13 rocky9-2 <none> <none>
k8s-dashboard-7dc85b74c9-n8kgq 0/1 CrashLoopBackOff 12 (3m44s ago) 40m 10.244.0.7 rocky9-1 <none> <none>
3.2 换成apply方式
[root@rocky9-3 k8s-learn]# kubectl apply -f k8s-dashboard/k8s-dashboard.yaml
namespace/k8s-dashboard unchanged
serviceaccount/k8s-dashboard unchanged
role.rbac.authorization.k8s.io/k8s-dashboard unchanged
rolebinding.rbac.authorization.k8s.io/k8s-dashboard unchanged
secret/kubernetes-dashboard-csrf unchanged
secret/kubernetes-dashboard-key-holder unchanged
service/k8s-dashboard unchanged
deployment.apps/k8s-dashboard configured
serviceaccount/admin-user unchanged
clusterrolebinding.rbac.authorization.k8s.io/admin-user unchanged
查看这个pod已经运行成功了
[root@rocky9-3 k8s-learn]# kubectl -n k8s-dashboard rollout restart deploy/k8s-dashboard
deployment.apps/k8s-dashboard restarted
[root@rocky9-3 k8s-learn]# kubectl -n k8s-dashboard rollout status deploy/k8s-dashboard
deployment "k8s-dashboard" successfully rolled out
[root@rocky9-3 k8s-learn]# kubectl -n k8s-dashboard get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
k8s-dashboard-5fc98c7c69-kjqrb 1/1 Running 0 20s 10.244.1.15 rocky9-2 <none> <none>
k8s-dashboard-5fc98c7c69-tjmv9 1/1 Running 0 22s 10.244.2.16 rocky9-3 <none> <none>
[root@rocky9-3 k8s-learn]# kubectl -n k8s-dashboard create token admin-user --duration=24h
eyJhbGciOiJSUzI1NiIsImtpZCI6IlEtSDFNVlo3WC1CQVNQTUxUaURNNG96VXA2X2ZzbTlsR2tsazZXMnNfb3MifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxNzcxMDY4MTUzLCJpYXQiOjE3NzA5ODE3NTMsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJrOHMtZGFzaGJvYXJkIiwic2VydmljZWFjY291bnQiOnsibmFtZSI6ImFkbWluLXVzZXIiLCJ1aWQiOiI5MjQ0OGQ5NS0zYzRiLTRhMmItYWQ3My01ODlhY2M0MWViZTQifX0sIm5iZiI6MTc3MDk4MTc1Mywic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Oms4cy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.liCj3yvMLYim9lSfOTRyYF8gxJy2xYyeu59WwYkJPK2eQESlXBwxnqgXW-QLKywC1_d_T6Up1EFgIgoKGtG7kF9cgmPc1eyhCC3wWL3ccWTf9ssEHplQC20fZZOlXscGi2W7IzFelSirKKtrOZ2TOw4a8l2KFfx0yHiOccetlgBra6NvGiP2WdwUB3-YoCNgcn7QhA_mxPw0_TOH_EBeTknDcwiyGMMtGidPzKUYWUA7ve27swSEleUsTHq7ABl3k462IXHN4J9qbudyxlgVRjJM_-vjohcZtxZge8WNwC-bs0ehm-1nkV67sqP3QVSDRjIuZ2aPXXH8B9LEH0HYfg
3.3 yaml解析
关键还是这个yaml
apiVersion: v1
kind: Namespace
metadata:
name: k8s-dashboard
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: k8s-dashboard
namespace: k8s-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: k8s-dashboard
namespace: k8s-dashboard
rules:
- apiGroups: [""]
resources: ["secrets", "configmaps", "services"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: k8s-dashboard
namespace: k8s-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: k8s-dashboard
subjects:
- kind: ServiceAccount
name: k8s-dashboard
namespace: k8s-dashboard
---
apiVersion: v1
kind: Secret
metadata:
name: kubernetes-dashboard-csrf
namespace: k8s-dashboard
type: Opaque
data:
csrf: ""
---
apiVersion: v1
kind: Secret
metadata:
name: kubernetes-dashboard-key-holder
namespace: k8s-dashboard
type: Opaque
---
apiVersion: v1
kind: Service
metadata:
name: k8s-dashboard
namespace: k8s-dashboard
spec:
type: NodePort
selector:
k8s-app: k8s-dashboard
ports:
- port: 443
targetPort: 8443
nodePort: 30443
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: k8s-dashboard
namespace: k8s-dashboard
labels:
k8s-app: k8s-dashboard
spec:
replicas: 2
selector:
matchLabels:
k8s-app: k8s-dashboard
template:
metadata:
labels:
k8s-app: k8s-dashboard
spec:
serviceAccountName: k8s-dashboard
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
k8s-app: k8s-dashboard
topologyKey: kubernetes.io/hostname
containers:
- name: k8s-dashboard
image: kubernetesui/dashboard:v2.7.0
imagePullPolicy: IfNotPresent
args:
- --auto-generate-certificates
- --namespace=k8s-dashboard
ports:
- containerPort: 8443
volumeMounts:
- name: tmp-volume
mountPath: /tmp
- name: cert-volume
mountPath: /certs
livenessProbe:
httpGet:
scheme: HTTPS
path: /
port: 8443
initialDelaySeconds: 30
periodSeconds: 10
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsUser: 1001
runAsGroup: 2001
volumes:
- name: tmp-volume
emptyDir: {}
- name: cert-volume
emptyDir: {}
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: k8s-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: k8s-dashboard
汇聚全球AI编程工具，助力开发者即刻编程。
更多推荐
1
0- 0
已为社区贡献8条内容
所有评论(0)