kubernetes - 无法公开部署 Kubernetes 仪表板 (HTTPS)
问题描述
我是 kubernetes 的新手,经过很长时间的研究,似乎我的资源已经用完了,所以如果有人可以帮助我,我会非常高兴。
我目前拥有的
- 我通过 SSH 连接到的一个节点,裸机 kubernetes 设置(请注意,我没有在云中运行 k8s)
kubectl version
1.20
在客户端和服务器端产生- NGINX 入口控制器
- 使用 kubeadm 设置集群
- 以下 Pod、Services 和一个入口资源(仪表板):
豆荚:
命名空间 | 姓名 | 准备好 | 地位 | 重启 | 年龄 |
---|---|---|---|---|---|
入口-nginx | 入口-nginx-admission-create-4ml4p | 0/1 | 完全的 | 0 | 23m |
入口-nginx | 入口-nginx-admission-patch-jj9c6 | 0/1 | 完全的 | 1 | 23m |
入口-nginx | 入口-nginx-controller-67897c9494-kxwgv | 1/1 | 跑步 | 0 | 23m |
kube 系统 | coredns-74ff55c5b-2xbvq | 1/1 | 跑步 | 0 | 23m |
kube 系统 | coredns-74ff55c5b-sc667 | 1/1 | 跑步 | 0 | 23m |
kube 系统 | etcd-k8s.mydomain.de | 1/1 | 跑步 | 0 | 23m |
kube 系统 | kube-apiserver-k8s.mydomain.de | 1/1 | 跑步 | 0 | 23m |
kube 系统 | kube-controller-manager-k8s.mydomain.de | 1/1 | 跑步 | 0 | 23m |
kube 系统 | kube-flannel-ds-fhzzp | 1/1 | 跑步 | 0 | 23m |
kube 系统 | kube-proxy-lq7tt | 1/1 | 跑步 | 0 | 23m |
kube 系统 | kube-scheduler-k8s.mydomain.de | 1/1 | 跑步 | 0 | 23m |
Kubernetes-仪表板 | 仪表板-metrics-scraper-7b59f7d4df-v6qsn | 1/1 | 跑步 | 0 | 23m |
Kubernetes-仪表板 | kubernetes-dashboard-74d688b6bc-5x4nd | 1/1 | 跑步 | 0 | 23m |
服务:
命名空间 | 姓名 | 类型 | 集群IP | 外部IP | 端口 | 年龄 |
---|---|---|---|---|---|---|
默认 | Kubernetes | 集群IP | 10.96.0.1 | 没有任何 | 443/TCP | 33天 |
入口-nginx | 入口-nginx-控制器 | 节点端口 | 10.98.67.34 | 没有任何 | 80:32346/TCP、443:30710/TCP | 33天 |
入口-nginx | 入口-nginx-控制器-准入 | 集群IP | 10.110.196.58 | 没有任何 | 443/TCP | 33天 |
kube 系统 | kube-dns | 集群IP | 10.96.0.10 | 没有任何 | 53/UDP、53/TCP、9153/TCP | 33天 |
Kubernetes-仪表板 | 仪表板指标刮板 | 集群IP | 10.109.128.22 | 没有任何 | 8000/TCP | 33天 |
Kubernetes-仪表板 | Kubernetes-仪表板 | 集群IP | 10.98.158.159 | 没有任何 | 443/TCP | 33天 |
入口资源(仪表板):
命名空间 | 姓名 | 班级 | 主机 | 地址 | 端口 | 年龄 |
---|---|---|---|---|---|---|
Kubernetes-仪表板 | 仪表板入口 | 仪表盘.k8s.mydomain.de | 10.10.1.164 | 80 | 52m |
当我尝试使用https://dashboard.k8s.mydomain.de
没有任何反应到达 kubernetes 仪表板时。当我尝试使用https://dashboard.k8s.mydomain.de:30710
nginx 入口控制器的 HTTPS TCP 端口来访问它时,它就可以工作了。它是一个不安全的连接,浏览器会警告我,但它可以工作。但显然这不是期望的行为。
我想拥有什么
我想以某种方式部署 kubernetes 仪表板,以便https://dashboard.k8s.mydomain.de
通过 HTTPS 访问 kubernetes 仪表板。我不知道为什么目前情况并非如此。
这些是.yaml
我用于部署和东西的配置文件:
NGINX 入口控制器:https ://github.com/kubernetes/ingress-nginx/blob/master/deploy/static/provider/baremetal/deploy.yaml
Kubernetes 仪表板:https ://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml
仪表板入口资源:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: dashboard-ingress
namespace: kubernetes-dashboard
annotations:
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
spec:
rules:
- host: dashboard.k8s.mydomain.de
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: kubernetes-dashboard
port:
number: 443
nginx入口控制器的日志告诉我它注册了入口资源,所以我很困惑:
NGINX Ingress controller
Release: v0.44.0
Build: f802554ccfadf828f7eb6d3f9a9333686706d613
Repository: https://github.com/kubernetes/ingress-nginx
nginx version: nginx/1.19.6
I0323 09:42:57.665847 6 flags.go:208] "Watching for Ingress" class="nginx"
W0323 09:42:57.665953 6 flags.go:213] Ingresses with an empty class will also be processed by this Ingress controller
-------------------------------------------------------------------------------
W0323 09:42:57.667132 6 client_config.go:614] Neither --kubeconfig nor --master was specified. Using the inClusterConfig. This might not work.
I0323 09:42:57.667958 6 main.go:241] "Creating API client" host="https://10.96.0.1:443"
I0323 09:42:57.682847 6 main.go:285] "Running in Kubernetes cluster" major="1" minor="20" git="v1.20.3" state="clean" commit="01849e73f3c86211f05533c2e807736e776fcf29" platform="linux/amd64"
I0323 09:42:57.997597 6 main.go:105] "SSL fake certificate created" file="/etc/ingress-controller/ssl/default-fake-certificate.pem"
I0323 09:42:58.003204 6 main.go:115] "Enabling new Ingress features available since Kubernetes v1.18"
W0323 09:42:58.008105 6 main.go:127] No IngressClass resource with name nginx found. Only annotation will be used.
I0323 09:42:58.033445 6 ssl.go:532] "loading tls certificate" path="/usr/local/certificates/cert" key="/usr/local/certificates/key"
I0323 09:42:58.070414 6 nginx.go:254] "Starting NGINX Ingress controller"
I0323 09:42:58.077773 6 event.go:282] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"ingress-nginx", Name:"ingress-nginx-controller", UID:"a76c1e40-f5aa-4353-aeea-35bccbbb57a7", APIVersion:"v1", ResourceVersion:"3497961", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap ingress-nginx/ingress-nginx-controller
I0323 09:42:59.183747 6 event.go:282] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"kubernetes-dashboard", Name:"dashboard-ingress", UID:"6f02c931-bfad-44a1-a219-4e2b2970365e", APIVersion:"networking.k8s.io/v1beta1", ResourceVersion:"3497191", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
I0323 09:42:59.271684 6 nginx.go:296] "Starting NGINX process"
I0323 09:42:59.271826 6 leaderelection.go:243] attempting to acquire leader lease ingress-nginx/ingress-controller-leader-nginx...
I0323 09:42:59.272447 6 nginx.go:316] "Starting validation webhook" address=":8443" certPath="/usr/local/certificates/cert" keyPath="/usr/local/certificates/key"
I0323 09:42:59.272851 6 controller.go:146] "Configuration changes detected, backend reload required"
I0323 09:42:59.288414 6 leaderelection.go:253] successfully acquired lease ingress-nginx/ingress-controller-leader-nginx
I0323 09:42:59.288501 6 status.go:84] "New leader elected" identity="ingress-nginx-controller-67897c9494-kxwgv"
I0323 09:42:59.302119 6 status.go:201] "POD is not ready" pod="ingress-nginx/ingress-nginx-controller-67897c9494-kxwgv" node="k8s.mydomain.de"
I0323 09:42:59.307191 6 status.go:281] "updating Ingress status" namespace="kubernetes-dashboard" ingress="dashboard-ingress" currentValue=[{IP:10.10.1.164 Hostname: Ports:[]}] newValue=[]
I0323 09:42:59.315053 6 event.go:282] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"kubernetes-dashboard", Name:"dashboard-ingress", UID:"6f02c931-bfad-44a1-a219-4e2b2970365e", APIVersion:"networking.k8s.io/v1beta1", ResourceVersion:"3498054", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
I0323 09:42:59.381846 6 controller.go:163] "Backend successfully reloaded"
I0323 09:42:59.382014 6 controller.go:174] "Initial sync, sleeping for 1 second"
I0323 09:42:59.382266 6 event.go:282] Event(v1.ObjectReference{Kind:"Pod", Namespace:"ingress-nginx", Name:"ingress-nginx-controller-67897c9494-kxwgv", UID:"2ba6f14e-36a8-401b-a1d8-00921cbe9604", APIVersion:"v1", ResourceVersion:"3497997", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
I0323 09:43:59.323910 6 status.go:281] "updating Ingress status" namespace="kubernetes-dashboard" ingress="dashboard-ingress" currentValue=[] newValue=[{IP:10.10.1.164 Hostname: Ports:[]}]
I0323 09:43:59.333091 6 event.go:282] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"kubernetes-dashboard", Name:"dashboard-ingress", UID:"6f02c931-bfad-44a1-a219-4e2b2970365e", APIVersion:"networking.k8s.io/v1beta1", ResourceVersion:"3498144", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
当我使用 microk8s 而不是 kubeadm 设置集群时,它可以工作。请指定我必须做什么才能完成这项工作。
提前致谢
解决方案
请在 hostNetwork 模式下运行 nginx 入口控制器https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
template:
spec:
hostNetwork: true
并将其作为 DaemonSet 运行。
并将 dnsPolicy 设置为 ClusterFirstWithHostNet
另外,请阅读https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network中的安全警告
如果您使用的是https://kubernetes.github.io/ingress-nginx/deploy/#using-helm然后将下面添加到值文件
controller:
dnsPolicy: ClusterFirstWithHostNet
hostNetwork: true
kind: DaemonSet
推荐阅读
- python - How to create a new column in pandas and set its values according to whether a second column includes a string from various lists of strings
- python - 如何在python中递归地将OSM键细分为字典树(XML到JSON)
- php - 使用 PHP 定义常量和 PHP $_GLOBALS 有什么区别?
- javascript - 用于 setState 的 React Hooks
- arrays - 世博会地点中的城市位置反应原生
- ios - swift ui 无法保持正常大小写,强制转换为大写
- android - Android导航组件中的重复FragmentContainerView
- pandas - 除了某些行之外,熊猫数据框的差异?
- python - 为熊猫数据框记录断言附加参数
- jquery - Webpack x Symfony 5 - 未定义 JQuery