• 云原生（三十一） | Kubernetes篇之Kubernetes平台基本预装资源

    文章目录

    Kubernetes平台基本预装资源

    一、metrics-server

    二、ingress-nginx

    三、dashboard

    四、helm应用商店

    Kubernetes平台基本预装资源

    kubernetes平台安装完成后需要安装基本资源，

    本文适配 kubernetes-v1.21.1 版本

    一、metrics-server

    GitHub - kubernetes-sigs/metrics-server: Scalable and efficient source of container resource metrics for Kubernetes built-in autoscaling pipelines.icon-default.png?t=M5H6https://github.com/kubernetes-sigs/metrics-server k8s平台基本指标监控组件

    1. apiVersion: v1
    2. kind: ServiceAccount
    3. metadata:
    4.   labels:
    5.     k8s-app: metrics-server
    6.   name: metrics-server
    7.   namespace: kube-system
    8. ---
    9. apiVersion: rbac.authorization.k8s.io/v1
    10. kind: ClusterRole
    11. metadata:
    12.   labels:
    13.     k8s-app: metrics-server
    14.     rbac.authorization.k8s.io/aggregate-to-admin: "true"
    15.     rbac.authorization.k8s.io/aggregate-to-edit: "true"
    16.     rbac.authorization.k8s.io/aggregate-to-view: "true"
    17.   name: system:aggregated-metrics-reader
    18. rules:
    19. - apiGroups:
    20.   - metrics.k8s.io
    21.   resources:
    22.   - pods
    23.   - nodes
    24.   verbs:
    25.   - get
    26.   - list
    27.   - watch
    28. ---
    29. apiVersion: rbac.authorization.k8s.io/v1
    30. kind: ClusterRole
    31. metadata:
    32.   labels:
    33.     k8s-app: metrics-server
    34.   name: system:metrics-server
    35. rules:
    36. - apiGroups:
    37.   - ""
    38.   resources:
    39.   - pods
    40.   - nodes
    41.   - nodes/stats
    42.   - namespaces
    43.   - configmaps
    44.   verbs:
    45.   - get
    46.   - list
    47.   - watch
    48. ---
    49. apiVersion: rbac.authorization.k8s.io/v1
    50. kind: RoleBinding
    51. metadata:
    52.   labels:
    53.     k8s-app: metrics-server
    54.   name: metrics-server-auth-reader
    55.   namespace: kube-system
    56. roleRef:
    57.   apiGroup: rbac.authorization.k8s.io
    58.   kind: Role
    59.   name: extension-apiserver-authentication-reader
    60. subjects:
    61. - kind: ServiceAccount
    62.   name: metrics-server
    63.   namespace: kube-system
    64. ---
    65. apiVersion: rbac.authorization.k8s.io/v1
    66. kind: ClusterRoleBinding
    67. metadata:
    68.   labels:
    69.     k8s-app: metrics-server
    70.   name: metrics-server:system:auth-delegator
    71. roleRef:
    72.   apiGroup: rbac.authorization.k8s.io
    73.   kind: ClusterRole
    74.   name: system:auth-delegator
    75. subjects:
    76. - kind: ServiceAccount
    77.   name: metrics-server
    78.   namespace: kube-system
    79. ---
    80. apiVersion: rbac.authorization.k8s.io/v1
    81. kind: ClusterRoleBinding
    82. metadata:
    83.   labels:
    84.     k8s-app: metrics-server
    85.   name: system:metrics-server
    86. roleRef:
    87.   apiGroup: rbac.authorization.k8s.io
    88.   kind: ClusterRole
    89.   name: system:metrics-server
    90. subjects:
    91. - kind: ServiceAccount
    92.   name: metrics-server
    93.   namespace: kube-system
    94. ---
    95. apiVersion: v1
    96. kind: Service
    97. metadata:
    98.   labels:
    99.     k8s-app: metrics-server
    100.   name: metrics-server
    101.   namespace: kube-system
    102. spec:
    103.   ports:
    104.   - name: https
    105.     port: 443
    106.     protocol: TCP
    107.     targetPort: https
    108.   selector:
    109.     k8s-app: metrics-server
    110. ---
    111. apiVersion: apps/v1
    112. kind: Deployment
    113. metadata:
    114.   labels:
    115.     k8s-app: metrics-server
    116.   name: metrics-server
    117.   namespace: kube-system
    118. spec:
    119.   selector:
    120.     matchLabels:
    121.       k8s-app: metrics-server
    122.   strategy:
    123.     rollingUpdate:
    124.       maxUnavailable: 0
    125.   template:
    126.     metadata:
    127.       labels:
    128.         k8s-app: metrics-server
    129.     spec:
    130.       containers:
    131.       - args:
    132.         - --v=6
    133.         - --cert-dir=/tmp
    134.         - --kubelet-insecure-tls
    135.         - --secure-port=4443
    136.         - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    137.         - --kubelet-use-node-status-port
    138.         image: registry.cn-hangzhou.aliyuncs.com/lanson_k8s_images/metrics-server:v0.4.3
    139.         imagePullPolicy: IfNotPresent
    140.         livenessProbe:
    141.           failureThreshold: 3
    142.           httpGet:
    143.             path: /livez
    144.             port: https
    145.             scheme: HTTPS
    146.           periodSeconds: 10
    147.         name: metrics-server
    148.         ports:
    149.         - containerPort: 4443
    150.           name: https
    151.           protocol: TCP
    152.         readinessProbe:
    153.           failureThreshold: 3
    154.           httpGet:
    155.             path: /readyz
    156.             port: https
    157.             scheme: HTTPS
    158.           periodSeconds: 10
    159.         securityContext:
    160.           readOnlyRootFilesystem: true
    161.           runAsNonRoot: true
    162.           runAsUser: 1000
    163.         volumeMounts:
    164.         - mountPath: /tmp
    165.           name: tmp-dir
    166.       nodeSelector:
    167.         kubernetes.io/os: linux
    168.       priorityClassName: system-cluster-critical
    169.       serviceAccountName: metrics-server
    170.       volumes:
    171.       - emptyDir: {}
    172.         name: tmp-dir
    173. ---
    174. apiVersion: apiregistration.k8s.io/v1
    175. kind: APIService
    176. metadata:
    177.   labels:
    178.     k8s-app: metrics-server
    179.   name: v1beta1.metrics.k8s.io
    180. spec:
    181.   group: metrics.k8s.io
    182.   groupPriorityMinimum: 100
    183.   insecureSkipTLSVerify: true
    184.   service:
    185.     name: metrics-server
    186.     namespace: kube-system
    187.   version: v1beta1
    188.   versionPriority: 100

     

    二、ingress-nginx

    kubernetes官方使用nginx做的组件

    自建集群使用裸金属安装方式

    使用

    • 给集群中需要暴露的nginx机器节点打上标签 node-role=ingress 如：

    • kubectl label node k8s-master3 node-role=ingress
kubectl label node k8s-node1 node-role=ingress
kubectl label node k8s-node2 node-role=ingress
kubectl label node k8s-node3 node-role=ingress

    • 部署ingress的node节点会自动 开启 节点的 80和443 端口，保证这个机器端口不会被占用

    • 默认ingress-nginx在每个节点没有CPU、MEMORY最大配额限制；可以按照公司架构需求修改resoources.limits相关字段

    1. apiVersion: v1
    2. kind: Namespace
    3. metadata:
    4.   name: ingress-nginx
    5.   labels:
    6.     app.kubernetes.io/name: ingress-nginx
    7.     app.kubernetes.io/instance: ingress-nginx
    8.  
    9. ---
    10. # Source: ingress-nginx/templates/controller-serviceaccount.yaml
    11. apiVersion: v1
    12. kind: ServiceAccount
    13. metadata:
    14.   labels:
    15.     helm.sh/chart: ingress-nginx-3.30.0
    16.     app.kubernetes.io/name: ingress-nginx
    17.     app.kubernetes.io/instance: ingress-nginx
    18.     app.kubernetes.io/version: 0.46.0
    19.     app.kubernetes.io/managed-by: Helm
    20.     app.kubernetes.io/component: controller
    21.   name: ingress-nginx
    22.   namespace: ingress-nginx
    23. automountServiceAccountToken: true
    24. ---
    25. # Source: ingress-nginx/templates/controller-configmap.yaml
    26. apiVersion: v1
    27. kind: ConfigMap
    28. metadata:
    29.   labels:
    30.     helm.sh/chart: ingress-nginx-3.30.0
    31.     app.kubernetes.io/name: ingress-nginx
    32.     app.kubernetes.io/instance: ingress-nginx
    33.     app.kubernetes.io/version: 0.46.0
    34.     app.kubernetes.io/managed-by: Helm
    35.     app.kubernetes.io/component: controller
    36.   name: ingress-nginx-controller
    37.   namespace: ingress-nginx
    38. data:
    39. ---
    40. # Source: ingress-nginx/templates/clusterrole.yaml
    41. apiVersion: rbac.authorization.k8s.io/v1
    42. kind: ClusterRole
    43. metadata:
    44.   labels:
    45.     helm.sh/chart: ingress-nginx-3.30.0
    46.     app.kubernetes.io/name: ingress-nginx
    47.     app.kubernetes.io/instance: ingress-nginx
    48.     app.kubernetes.io/version: 0.46.0
    49.     app.kubernetes.io/managed-by: Helm
    50.   name: ingress-nginx
    51. rules:
    52.   - apiGroups:
    53.       - ''
    54.     resources:
    55.       - configmaps
    56.       - endpoints
    57.       - nodes
    58.       - pods
    59.       - secrets
    60.     verbs:
    61.       - list
    62.       - watch
    63.   - apiGroups:
    64.       - ''
    65.     resources:
    66.       - nodes
    67.     verbs:
    68.       - get
    69.   - apiGroups:
    70.       - ''
    71.     resources:
    72.       - services
    73.     verbs:
    74.       - get
    75.       - list
    76.       - watch
    77.   - apiGroups:
    78.       - extensions
    79.       - networking.k8s.io   # k8s 1.14+
    80.     resources:
    81.       - ingresses
    82.     verbs:
    83.       - get
    84.       - list
    85.       - watch
    86.   - apiGroups:
    87.       - ''
    88.     resources:
    89.       - events
    90.     verbs:
    91.       - create
    92.       - patch
    93.   - apiGroups:
    94.       - extensions
    95.       - networking.k8s.io   # k8s 1.14+
    96.     resources:
    97.       - ingresses/status
    98.     verbs:
    99.       - update
    100.   - apiGroups:
    101.       - networking.k8s.io   # k8s 1.14+
    102.     resources:
    103.       - ingressclasses
    104.     verbs:
    105.       - get
    106.       - list
    107.       - watch
    108. ---
    109. # Source: ingress-nginx/templates/clusterrolebinding.yaml
    110. apiVersion: rbac.authorization.k8s.io/v1
    111. kind: ClusterRoleBinding
    112. metadata:
    113.   labels:
    114.     helm.sh/chart: ingress-nginx-3.30.0
    115.     app.kubernetes.io/name: ingress-nginx
    116.     app.kubernetes.io/instance: ingress-nginx
    117.     app.kubernetes.io/version: 0.46.0
    118.     app.kubernetes.io/managed-by: Helm
    119.   name: ingress-nginx
    120. roleRef:
    121.   apiGroup: rbac.authorization.k8s.io
    122.   kind: ClusterRole
    123.   name: ingress-nginx
    124. subjects:
    125.   - kind: ServiceAccount
    126.     name: ingress-nginx
    127.     namespace: ingress-nginx
    128. ---
    129. # Source: ingress-nginx/templates/controller-role.yaml
    130. apiVersion: rbac.authorization.k8s.io/v1
    131. kind: Role
    132. metadata:
    133.   labels:
    134.     helm.sh/chart: ingress-nginx-3.30.0
    135.     app.kubernetes.io/name: ingress-nginx
    136.     app.kubernetes.io/instance: ingress-nginx
    137.     app.kubernetes.io/version: 0.46.0
    138.     app.kubernetes.io/managed-by: Helm
    139.     app.kubernetes.io/component: controller
    140.   name: ingress-nginx
    141.   namespace: ingress-nginx
    142. rules:
    143.   - apiGroups:
    144.       - ''
    145.     resources:
    146.       - namespaces
    147.     verbs:
    148.       - get
    149.   - apiGroups:
    150.       - ''
    151.     resources:
    152.       - configmaps
    153.       - pods
    154.       - secrets
    155.       - endpoints
    156.     verbs:
    157.       - get
    158.       - list
    159.       - watch
    160.   - apiGroups:
    161.       - ''
    162.     resources:
    163.       - services
    164.     verbs:
    165.       - get
    166.       - list
    167.       - watch
    168.   - apiGroups:
    169.       - extensions
    170.       - networking.k8s.io   # k8s 1.14+
    171.     resources:
    172.       - ingresses
    173.     verbs:
    174.       - get
    175.       - list
    176.       - watch
    177.   - apiGroups:
    178.       - extensions
    179.       - networking.k8s.io   # k8s 1.14+
    180.     resources:
    181.       - ingresses/status
    182.     verbs:
    183.       - update
    184.   - apiGroups:
    185.       - networking.k8s.io   # k8s 1.14+
    186.     resources:
    187.       - ingressclasses
    188.     verbs:
    189.       - get
    190.       - list
    191.       - watch
    192.   - apiGroups:
    193.       - ''
    194.     resources:
    195.       - configmaps
    196.     resourceNames:
    197.       - ingress-controller-leader-nginx
    198.     verbs:
    199.       - get
    200.       - update
    201.   - apiGroups:
    202.       - ''
    203.     resources:
    204.       - configmaps
    205.     verbs:
    206.       - create
    207.   - apiGroups:
    208.       - ''
    209.     resources:
    210.       - events
    211.     verbs:
    212.       - create
    213.       - patch
    214. ---
    215. # Source: ingress-nginx/templates/controller-rolebinding.yaml
    216. apiVersion: rbac.authorization.k8s.io/v1
    217. kind: RoleBinding
    218. metadata:
    219.   labels:
    220.     helm.sh/chart: ingress-nginx-3.30.0
    221.     app.kubernetes.io/name: ingress-nginx
    222.     app.kubernetes.io/instance: ingress-nginx
    223.     app.kubernetes.io/version: 0.46.0
    224.     app.kubernetes.io/managed-by: Helm
    225.     app.kubernetes.io/component: controller
    226.   name: ingress-nginx
    227.   namespace: ingress-nginx
    228. roleRef:
    229.   apiGroup: rbac.authorization.k8s.io
    230.   kind: Role
    231.   name: ingress-nginx
    232. subjects:
    233.   - kind: ServiceAccount
    234.     name: ingress-nginx
    235.     namespace: ingress-nginx
    236. ---
    237. # Source: ingress-nginx/templates/controller-service-webhook.yaml
    238. apiVersion: v1
    239. kind: Service
    240. metadata:
    241.   labels:
    242.     helm.sh/chart: ingress-nginx-3.30.0
    243.     app.kubernetes.io/name: ingress-nginx
    244.     app.kubernetes.io/instance: ingress-nginx
    245.     app.kubernetes.io/version: 0.46.0
    246.     app.kubernetes.io/managed-by: Helm
    247.     app.kubernetes.io/component: controller
    248.   name: ingress-nginx-controller-admission
    249.   namespace: ingress-nginx
    250. spec:
    251.   type: ClusterIP
    252.   ports:
    253.     - name: https-webhook
    254.       port: 443
    255.       targetPort: webhook
    256.   selector:
    257.     app.kubernetes.io/name: ingress-nginx
    258.     app.kubernetes.io/instance: ingress-nginx
    259.     app.kubernetes.io/component: controller
    260. ---
    261. # Source: ingress-nginx/templates/controller-service.yaml
    262. apiVersion: v1
    263. kind: Service
    264. metadata:
    265.   annotations:
    266.   labels:
    267.     helm.sh/chart: ingress-nginx-3.30.0
    268.     app.kubernetes.io/name: ingress-nginx
    269.     app.kubernetes.io/instance: ingress-nginx
    270.     app.kubernetes.io/version: 0.46.0
    271.     app.kubernetes.io/managed-by: Helm
    272.     app.kubernetes.io/component: controller
    273.   name: ingress-nginx-controller
    274.   namespace: ingress-nginx
    275. spec:
    276.   type: ClusterIP  ## 改为clusterIP
    277.   ports:
    278.     - name: http
    279.       port: 80
    280.       protocol: TCP
    281.       targetPort: http
    282.     - name: https
    283.       port: 443
    284.       protocol: TCP
    285.       targetPort: https
    286.   selector:
    287.     app.kubernetes.io/name: ingress-nginx
    288.     app.kubernetes.io/instance: ingress-nginx
    289.     app.kubernetes.io/component: controller
    290. ---
    291. # Source: ingress-nginx/templates/controller-deployment.yaml
    292. apiVersion: apps/v1
    293. kind: DaemonSet
    294. metadata:
    295.   labels:
    296.     helm.sh/chart: ingress-nginx-3.30.0
    297.     app.kubernetes.io/name: ingress-nginx
    298.     app.kubernetes.io/instance: ingress-nginx
    299.     app.kubernetes.io/version: 0.46.0
    300.     app.kubernetes.io/managed-by: Helm
    301.     app.kubernetes.io/component: controller
    302.   name: ingress-nginx-controller
    303.   namespace: ingress-nginx
    304. spec:
    305.   selector:
    306.     matchLabels:
    307.       app.kubernetes.io/name: ingress-nginx
    308.       app.kubernetes.io/instance: ingress-nginx
    309.       app.kubernetes.io/component: controller
    310.   revisionHistoryLimit: 10
    311.   minReadySeconds: 0
    312.   template:
    313.     metadata:
    314.       labels:
    315.         app.kubernetes.io/name: ingress-nginx
    316.         app.kubernetes.io/instance: ingress-nginx
    317.         app.kubernetes.io/component: controller
    318.     spec:
    319.       dnsPolicy: ClusterFirstWithHostNet   ## dns对应调整为主机网络
    320.       hostNetwork: true  ## 直接让nginx占用本机80端口和443端口，所以使用主机网络
    321.       containers:
    322.         - name: controller
    323.           image: registry.cn-hangzhou.aliyuncs.com/lanson_k8s_images/ingress-nginx-controller:v0.46.0
    324.           imagePullPolicy: IfNotPresent
    325.           lifecycle:
    326.             preStop:
    327.               exec:
    328.                 command:
    329.                   - /wait-shutdown
    330.           args:
    331.             - /nginx-ingress-controller
    332.             - --election-id=ingress-controller-leader
    333.             - --ingress-class=nginx
    334.             - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
    335.             - --validating-webhook=:8443
    336.             - --validating-webhook-certificate=/usr/local/certificates/cert
    337.             - --validating-webhook-key=/usr/local/certificates/key
    338.           securityContext:
    339.             capabilities:
    340.               drop:
    341.                 - ALL
    342.               add:
    343.                 - NET_BIND_SERVICE
    344.             runAsUser: 101
    345.             allowPrivilegeEscalation: true
    346.           env:
    347.             - name: POD_NAME
    348.               valueFrom:
    349.                 fieldRef:
    350.                   fieldPath: metadata.name
    351.             - name: POD_NAMESPACE
    352.               valueFrom:
    353.                 fieldRef:
    354.                   fieldPath: metadata.namespace
    355.             - name: LD_PRELOAD
    356.               value: /usr/local/lib/libmimalloc.so
    357.           livenessProbe:
    358.             httpGet:
    359.               path: /healthz
    360.               port: 10254
    361.               scheme: HTTP
    362.             initialDelaySeconds: 10
    363.             periodSeconds: 10
    364.             timeoutSeconds: 1
    365.             successThreshold: 1
    366.             failureThreshold: 5
    367.           readinessProbe:
    368.             httpGet:
    369.               path: /healthz
    370.               port: 10254
    371.               scheme: HTTP
    372.             initialDelaySeconds: 10
    373.             periodSeconds: 10
    374.             timeoutSeconds: 1
    375.             successThreshold: 1
    376.             failureThreshold: 3
    377.           ports:
    378.             - name: http
    379.               containerPort: 80
    380.               protocol: TCP
    381.             - name: https
    382.               containerPort: 443
    383.               protocol: TCP
    384.             - name: webhook
    385.               containerPort: 8443
    386.               protocol: TCP
    387.           volumeMounts:
    388.             - name: webhook-cert
    389.               mountPath: /usr/local/certificates/
    390.               readOnly: true
    391.           resources:
    392.             requests:
    393.               cpu: 100m
    394.               memory: 90Mi
    395.             limits:
    396.               cpu: 1000m
    397.               memory: 800Mi
    398.       nodeSelector:
    399.         node-role: ingress 
    400.       serviceAccountName: ingress-nginx
    401.       terminationGracePeriodSeconds: 300
    402.       volumes:
    403.         - name: webhook-cert
    404.           secret:
    405.             secretName: ingress-nginx-admission
    406. ---
    407. # Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
    408. # before changing this value, check the required kubernetes version
    409. # https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites
    410. apiVersion: admissionregistration.k8s.io/v1
    411. kind: ValidatingWebhookConfiguration
    412. metadata:
    413.   labels:
    414.     helm.sh/chart: ingress-nginx-3.30.0
    415.     app.kubernetes.io/name: ingress-nginx
    416.     app.kubernetes.io/instance: ingress-nginx
    417.     app.kubernetes.io/version: 0.46.0
    418.     app.kubernetes.io/managed-by: Helm
    419.     app.kubernetes.io/component: admission-webhook
    420.   name: ingress-nginx-admission
    421. webhooks:
    422.   - name: validate.nginx.ingress.kubernetes.io
    423.     matchPolicy: Equivalent
    424.     rules:
    425.       - apiGroups:
    426.           - networking.k8s.io
    427.         apiVersions:
    428.           - v1beta1
    429.         operations:
    430.           - CREATE
    431.           - UPDATE
    432.         resources:
    433.           - ingresses
    434.     failurePolicy: Fail
    435.     sideEffects: None
    436.     admissionReviewVersions:
    437.       - v1
    438.       - v1beta1
    439.     clientConfig:
    440.       service:
    441.         namespace: ingress-nginx
    442.         name: ingress-nginx-controller-admission
    443.         path: /networking/v1beta1/ingresses
    444. ---
    445. # Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
    446. apiVersion: v1
    447. kind: ServiceAccount
    448. metadata:
    449.   name: ingress-nginx-admission
    450.   annotations:
    451.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
    452.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    453.   labels:
    454.     helm.sh/chart: ingress-nginx-3.30.0
    455.     app.kubernetes.io/name: ingress-nginx
    456.     app.kubernetes.io/instance: ingress-nginx
    457.     app.kubernetes.io/version: 0.46.0
    458.     app.kubernetes.io/managed-by: Helm
    459.     app.kubernetes.io/component: admission-webhook
    460.   namespace: ingress-nginx
    461. ---
    462. # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
    463. apiVersion: rbac.authorization.k8s.io/v1
    464. kind: ClusterRole
    465. metadata:
    466.   name: ingress-nginx-admission
    467.   annotations:
    468.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
    469.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    470.   labels:
    471.     helm.sh/chart: ingress-nginx-3.30.0
    472.     app.kubernetes.io/name: ingress-nginx
    473.     app.kubernetes.io/instance: ingress-nginx
    474.     app.kubernetes.io/version: 0.46.0
    475.     app.kubernetes.io/managed-by: Helm
    476.     app.kubernetes.io/component: admission-webhook
    477. rules:
    478.   - apiGroups:
    479.       - admissionregistration.k8s.io
    480.     resources:
    481.       - validatingwebhookconfigurations
    482.     verbs:
    483.       - get
    484.       - update
    485. ---
    486. # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
    487. apiVersion: rbac.authorization.k8s.io/v1
    488. kind: ClusterRoleBinding
    489. metadata:
    490.   name: ingress-nginx-admission
    491.   annotations:
    492.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
    493.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    494.   labels:
    495.     helm.sh/chart: ingress-nginx-3.30.0
    496.     app.kubernetes.io/name: ingress-nginx
    497.     app.kubernetes.io/instance: ingress-nginx
    498.     app.kubernetes.io/version: 0.46.0
    499.     app.kubernetes.io/managed-by: Helm
    500.     app.kubernetes.io/component: admission-webhook
    501. roleRef:
    502.   apiGroup: rbac.authorization.k8s.io
    503.   kind: ClusterRole
    504.   name: ingress-nginx-admission
    505. subjects:
    506.   - kind: ServiceAccount
    507.     name: ingress-nginx-admission
    508.     namespace: ingress-nginx
    509. ---
    510. # Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
    511. apiVersion: rbac.authorization.k8s.io/v1
    512. kind: Role
    513. metadata:
    514.   name: ingress-nginx-admission
    515.   annotations:
    516.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
    517.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    518.   labels:
    519.     helm.sh/chart: ingress-nginx-3.30.0
    520.     app.kubernetes.io/name: ingress-nginx
    521.     app.kubernetes.io/instance: ingress-nginx
    522.     app.kubernetes.io/version: 0.46.0
    523.     app.kubernetes.io/managed-by: Helm
    524.     app.kubernetes.io/component: admission-webhook
    525.   namespace: ingress-nginx
    526. rules:
    527.   - apiGroups:
    528.       - ''
    529.     resources:
    530.       - secrets
    531.     verbs:
    532.       - get
    533.       - create
    534. ---
    535. # Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
    536. apiVersion: rbac.authorization.k8s.io/v1
    537. kind: RoleBinding
    538. metadata:
    539.   name: ingress-nginx-admission
    540.   annotations:
    541.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
    542.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    543.   labels:
    544.     helm.sh/chart: ingress-nginx-3.30.0
    545.     app.kubernetes.io/name: ingress-nginx
    546.     app.kubernetes.io/instance: ingress-nginx
    547.     app.kubernetes.io/version: 0.46.0
    548.     app.kubernetes.io/managed-by: Helm
    549.     app.kubernetes.io/component: admission-webhook
    550.   namespace: ingress-nginx
    551. roleRef:
    552.   apiGroup: rbac.authorization.k8s.io
    553.   kind: Role
    554.   name: ingress-nginx-admission
    555. subjects:
    556.   - kind: ServiceAccount
    557.     name: ingress-nginx-admission
    558.     namespace: ingress-nginx
    559. ---
    560. # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
    561. apiVersion: batch/v1
    562. kind: Job
    563. metadata:
    564.   name: ingress-nginx-admission-create
    565.   annotations:
    566.     helm.sh/hook: pre-install,pre-upgrade
    567.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    568.   labels:
    569.     helm.sh/chart: ingress-nginx-3.30.0
    570.     app.kubernetes.io/name: ingress-nginx
    571.     app.kubernetes.io/instance: ingress-nginx
    572.     app.kubernetes.io/version: 0.46.0
    573.     app.kubernetes.io/managed-by: Helm
    574.     app.kubernetes.io/component: admission-webhook
    575.   namespace: ingress-nginx
    576. spec:
    577.   template:
    578.     metadata:
    579.       name: ingress-nginx-admission-create
    580.       labels:
    581.         helm.sh/chart: ingress-nginx-3.30.0
    582.         app.kubernetes.io/name: ingress-nginx
    583.         app.kubernetes.io/instance: ingress-nginx
    584.         app.kubernetes.io/version: 0.46.0
    585.         app.kubernetes.io/managed-by: Helm
    586.         app.kubernetes.io/component: admission-webhook
    587.     spec:
    588.       containers:
    589.         - name: create
    590.           image: docker.io/jettech/kube-webhook-certgen:v1.5.1
    591.           imagePullPolicy: IfNotPresent
    592.           args:
    593.             - create
    594.             - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
    595.             - --namespace=$(POD_NAMESPACE)
    596.             - --secret-name=ingress-nginx-admission
    597.           env:
    598.             - name: POD_NAMESPACE
    599.               valueFrom:
    600.                 fieldRef:
    601.                   fieldPath: metadata.namespace
    602.       restartPolicy: OnFailure
    603.       serviceAccountName: ingress-nginx-admission
    604.       securityContext:
    605.         runAsNonRoot: true
    606.         runAsUser: 2000
    607. ---
    608. # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
    609. apiVersion: batch/v1
    610. kind: Job
    611. metadata:
    612.   name: ingress-nginx-admission-patch
    613.   annotations:
    614.     helm.sh/hook: post-install,post-upgrade
    615.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    616.   labels:
    617.     helm.sh/chart: ingress-nginx-3.30.0
    618.     app.kubernetes.io/name: ingress-nginx
    619.     app.kubernetes.io/instance: ingress-nginx
    620.     app.kubernetes.io/version: 0.46.0
    621.     app.kubernetes.io/managed-by: Helm
    622.     app.kubernetes.io/component: admission-webhook
    623.   namespace: ingress-nginx
    624. spec:
    625.   template:
    626.     metadata:
    627.       name: ingress-nginx-admission-patch
    628.       labels:
    629.         helm.sh/chart: ingress-nginx-3.30.0
    630.         app.kubernetes.io/name: ingress-nginx
    631.         app.kubernetes.io/instance: ingress-nginx
    632.         app.kubernetes.io/version: 0.46.0
    633.         app.kubernetes.io/managed-by: Helm
    634.         app.kubernetes.io/component: admission-webhook
    635.     spec:
    636.       containers:
    637.         - name: patch
    638.           image: docker.io/jettech/kube-webhook-certgen:v1.5.1
    639.           imagePullPolicy: IfNotPresent
    640.           args:
    641.             - patch
    642.             - --webhook-name=ingress-nginx-admission
    643.             - --namespace=$(POD_NAMESPACE)
    644.             - --patch-mutating=false
    645.             - --secret-name=ingress-nginx-admission
    646.             - --patch-failure-policy=Fail
    647.           env:
    648.             - name: POD_NAMESPACE
    649.               valueFrom:
    650.                 fieldRef:
    651.                   fieldPath: metadata.namespace
    652.       restartPolicy: OnFailure
    653.       serviceAccountName: ingress-nginx-admission
    654.       securityContext:
    655.         runAsNonRoot: true
    656.         runAsUser: 2000

     

    三、dashboard

    可以安装k8s的默认可视化平台

    GitHub - kubernetes/dashboard: General-purpose web UI for Kubernetes clusters

    注意：官方下载来的默认没有指定授权，使用下面创建过授权的配置

    1. # 获取dashboard访问令牌
    2. kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')
    1. apiVersion: v1
    2. kind: Namespace
    3. metadata:
    4.   name: kubernetes-dashboard
    5.  
    6. ---
    7.  
    8. apiVersion: v1
    9. kind: ServiceAccount
    10. metadata:
    11.   labels:
    12.     k8s-app: kubernetes-dashboard
    13.   name: kubernetes-dashboard
    14.   namespace: kubernetes-dashboard
    15.  
    16. ---
    17.  
    18. kind: Service
    19. apiVersion: v1
    20. metadata:
    21.   labels:
    22.     k8s-app: kubernetes-dashboard
    23.   name: kubernetes-dashboard
    24.   namespace: kubernetes-dashboard
    25. spec:
    26.   ports:
    27.     - port: 443
    28.       targetPort: 8443
    29.   selector:
    30.     k8s-app: kubernetes-dashboard
    31.  
    32. ---
    33.  
    34. apiVersion: v1
    35. kind: Secret
    36. metadata:
    37.   labels:
    38.     k8s-app: kubernetes-dashboard
    39.   name: kubernetes-dashboard-certs
    40.   namespace: kubernetes-dashboard
    41. type: Opaque
    42.  
    43. ---
    44.  
    45. apiVersion: v1
    46. kind: Secret
    47. metadata:
    48.   labels:
    49.     k8s-app: kubernetes-dashboard
    50.   name: kubernetes-dashboard-csrf
    51.   namespace: kubernetes-dashboard
    52. type: Opaque
    53. data:
    54.   csrf: ""
    55.  
    56. ---
    57.  
    58. apiVersion: v1
    59. kind: Secret
    60. metadata:
    61.   labels:
    62.     k8s-app: kubernetes-dashboard
    63.   name: kubernetes-dashboard-key-holder
    64.   namespace: kubernetes-dashboard
    65. type: Opaque
    66.  
    67. ---
    68.  
    69. kind: ConfigMap
    70. apiVersion: v1
    71. metadata:
    72.   labels:
    73.     k8s-app: kubernetes-dashboard
    74.   name: kubernetes-dashboard-settings
    75.   namespace: kubernetes-dashboard
    76.  
    77. ---
    78.  
    79. kind: Role
    80. apiVersion: rbac.authorization.k8s.io/v1
    81. metadata:
    82.   labels:
    83.     k8s-app: kubernetes-dashboard
    84.   name: kubernetes-dashboard
    85.   namespace: kubernetes-dashboard
    86. rules:
    87.   # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
    88.   - apiGroups: [""]
    89.     resources: ["secrets"]
    90.     resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
    91.     verbs: ["get", "update", "delete"]
    92.     # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
    93.   - apiGroups: [""]
    94.     resources: ["configmaps"]
    95.     resourceNames: ["kubernetes-dashboard-settings"]
    96.     verbs: ["get", "update"]
    97.     # Allow Dashboard to get metrics.
    98.   - apiGroups: [""]
    99.     resources: ["services"]
    100.     resourceNames: ["heapster", "dashboard-metrics-scraper"]
    101.     verbs: ["proxy"]
    102.   - apiGroups: [""]
    103.     resources: ["services/proxy"]
    104.     resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
    105.     verbs: ["get"]
    106.  
    107. ---
    108.  
    109. kind: ClusterRole
    110. apiVersion: rbac.authorization.k8s.io/v1
    111. metadata:
    112.   labels:
    113.     k8s-app: kubernetes-dashboard
    114.   name: kubernetes-dashboard
    115. rules:
    116.   # Allow Metrics Scraper to get metrics from the Metrics server
    117.   - apiGroups: ["metrics.k8s.io"]
    118.     resources: ["pods", "nodes"]
    119.     verbs: ["get", "list", "watch"]
    120.  
    121. ---
    122.  
    123. apiVersion: rbac.authorization.k8s.io/v1
    124. kind: RoleBinding
    125. metadata:
    126.   labels:
    127.     k8s-app: kubernetes-dashboard
    128.   name: kubernetes-dashboard
    129.   namespace: kubernetes-dashboard
    130. roleRef:
    131.   apiGroup: rbac.authorization.k8s.io
    132.   kind: Role
    133.   name: kubernetes-dashboard
    134. subjects:
    135.   - kind: ServiceAccount
    136.     name: kubernetes-dashboard
    137.     namespace: kubernetes-dashboard
    138.  
    139.  
    140.  
    141. ---
    142.  
    143. kind: Deployment
    144. apiVersion: apps/v1
    145. metadata:
    146.   labels:
    147.     k8s-app: kubernetes-dashboard
    148.   name: kubernetes-dashboard
    149.   namespace: kubernetes-dashboard
    150. spec:
    151.   replicas: 1
    152.   revisionHistoryLimit: 10
    153.   selector:
    154.     matchLabels:
    155.       k8s-app: kubernetes-dashboard
    156.   template:
    157.     metadata:
    158.       labels:
    159.         k8s-app: kubernetes-dashboard
    160.     spec:
    161.       containers:
    162.         - name: kubernetes-dashboard
    163.           image: kubernetesui/dashboard:v2.2.0
    164.           imagePullPolicy: Always
    165.           ports:
    166.             - containerPort: 8443
    167.               protocol: TCP
    168.           args:
    169.             - --auto-generate-certificates
    170.             - --namespace=kubernetes-dashboard
    171.             # Uncomment the following line to manually specify Kubernetes API server Host
    172.             # If not specified, Dashboard will attempt to auto discover the API server and connect
    173.             # to it. Uncomment only if the default does not work.
    174.             # - --apiserver-host=http://my-address:port
    175.           volumeMounts:
    176.             - name: kubernetes-dashboard-certs
    177.               mountPath: /certs
    178.               # Create on-disk volume to store exec logs
    179.             - mountPath: /tmp
    180.               name: tmp-volume
    181.           livenessProbe:
    182.             httpGet:
    183.               scheme: HTTPS
    184.               path: /
    185.               port: 8443
    186.             initialDelaySeconds: 30
    187.             timeoutSeconds: 30
    188.           securityContext:
    189.             allowPrivilegeEscalation: false
    190.             readOnlyRootFilesystem: true
    191.             runAsUser: 1001
    192.             runAsGroup: 2001
    193.       volumes:
    194.         - name: kubernetes-dashboard-certs
    195.           secret:
    196.             secretName: kubernetes-dashboard-certs
    197.         - name: tmp-volume
    198.           emptyDir: {}
    199.       serviceAccountName: kubernetes-dashboard
    200.       nodeSelector:
    201.         "kubernetes.io/os": linux
    202.       # Comment the following tolerations if Dashboard must not be deployed on master
    203.       tolerations:
    204.         - key: node-role.kubernetes.io/master
    205.           effect: NoSchedule
    206.  
    207. ---
    208.  
    209. kind: Service
    210. apiVersion: v1
    211. metadata:
    212.   labels:
    213.     k8s-app: dashboard-metrics-scraper
    214.   name: dashboard-metrics-scraper
    215.   namespace: kubernetes-dashboard
    216. spec:
    217.   ports:
    218.     - port: 8000
    219.       targetPort: 8000
    220.   selector:
    221.     k8s-app: dashboard-metrics-scraper
    222.  
    223. ---
    224.  
    225. kind: Deployment
    226. apiVersion: apps/v1
    227. metadata:
    228.   labels:
    229.     k8s-app: dashboard-metrics-scraper
    230.   name: dashboard-metrics-scraper
    231.   namespace: kubernetes-dashboard
    232. spec:
    233.   replicas: 1
    234.   revisionHistoryLimit: 10
    235.   selector:
    236.     matchLabels:
    237.       k8s-app: dashboard-metrics-scraper
    238.   template:
    239.     metadata:
    240.       labels:
    241.         k8s-app: dashboard-metrics-scraper
    242.       annotations:
    243.         seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
    244.     spec:
    245.       containers:
    246.         - name: dashboard-metrics-scraper
    247.           image: kubernetesui/metrics-scraper:v1.0.6
    248.           ports:
    249.             - containerPort: 8000
    250.               protocol: TCP
    251.           livenessProbe:
    252.             httpGet:
    253.               scheme: HTTP
    254.               path: /
    255.               port: 8000
    256.             initialDelaySeconds: 30
    257.             timeoutSeconds: 30
    258.           volumeMounts:
    259.           - mountPath: /tmp
    260.             name: tmp-volume
    261.           securityContext:
    262.             allowPrivilegeEscalation: false
    263.             readOnlyRootFilesystem: true
    264.             runAsUser: 1001
    265.             runAsGroup: 2001
    266.       serviceAccountName: kubernetes-dashboard
    267.       nodeSelector:
    268.         "kubernetes.io/os": linux
    269.       # Comment the following tolerations if Dashboard must not be deployed on master
    270.       tolerations:
    271.         - key: node-role.kubernetes.io/master
    272.           effect: NoSchedule
    273.       volumes:
    274.         - name: tmp-volume
    275.           emptyDir: {}
    276. ---
    277. apiVersion: rbac.authorization.k8s.io/v1
    278. kind: ClusterRoleBinding
    279. metadata:
    280.   name: kubernetes-dashboard
    281.   namespace: kubernetes-dashboard
    282. roleRef:
    283.   apiGroup: rbac.authorization.k8s.io
    284.   kind: ClusterRole
    285.   name: cluster-admin
    286. subjects:
    287.   - kind: ServiceAccount
    288.     name: kubernetes-dashboard
    289.     namespace: kubernetes-dashboard

    四、helm应用商店

    curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash

    # helm国内源,但是版本很久没更新
    http://mirror.azure.cn/kubernetes/charts/ 

    详细的安装介绍可以参数我上一篇文章

    有兴趣的同学可以点下面链接：

    云原生（三十） | Kubernetes篇之应用商店-Helm_Lansonli的博客-CSDN博客

     

    • 📢博客主页：https://lansonli.blog.csdn.net
    • 📢欢迎点赞 👍 收藏 ⭐留言 📝 如有错误敬请指正！
    • 📢本文由 Lansonli 原创，首发于 CSDN博客🙉
    • 📢停下休息的时候不要忘了别人还在奔跑，希望大家抓紧时间学习，全力奔赴更美好的生活✨ 
  • 相关阅读:
    JUC并发编程——读写锁（基于狂神说的学习笔记）
    ubuntu中的系统消息中显卡显示llvmpipe (LLVM 10.0.0, 256 bits)
    【MySQL】Spring Boot项目基于Sharding-JDBC和MySQL主从复制实现读写分离(8千字详细教程)
    Flink写入kafka的自定义Key值
    vue2.x 和 vue3.x的区别
    测试方法学习
    ARP欺骗
    ClickHouse Senior Course Ⅴ
    10 分钟讲完 QUIC 协议。
    MyBatis: 向oracle表中插入null字段的处理
  • 原文地址：https://blog.csdn.net/xiaoweite1/article/details/125514433