这就是k8s系列之八（使用ingress-nginx暴露dashboard服务）

1. 下载kubernetes-dashboard的资源描述文件
2. 修改deployment部分的容器参数， 添加使用自定义证书文件的相关参数。（具体见下面具体实施记录）
3. 注释掉创建kubernetes-dashboard-certs Secret部分的内容。
4. 创建自签名的证书， 注意主题部分的域名设置。创建好证书后，放置到$HOME/certs目录下。
5. 基于上面创建的证书创建kubernetes-dashboard-certs Secret，注意要放到kubernets-dashboard命名空间。
6. 创建ingress文件， 指定对应的hosts、tls及路由规则配置。（具体见下面具体实施记录）
7. 应用kubernetes-dashboard的资源描述文件， 创建相关service、demployment、pod等资源。
8. 创建dashboard对应的ingress, 创建ingress服务。
9. 创建服务账号及集群角色绑定资源，并应用。
10. 获取用于登录的token。
11. 通过浏览器， 使用token登录服务， 验证服务的正确性。

[root@host01 dashboard]# cd 2.0.5
[root@host01 2.0.5]# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.5/aio/deploy/recommended.yaml

spec:
      containers:
        - name: kubernetes-dashboard
          image: kubernetesui/dashboard:v2.0.5
          imagePullPolicy: Always
          ports:
            - containerPort: 8443
              protocol: TCP
          args:
            - --tls-cert-file=/tls.crt # 证书
            - --tls-key-file=/tls.key # 私钥
            - --auto-generate-certificates  # 保留备用
             --token-ttl=7200 # 设置token超时时间
            - --namespace=kubernetes-dashboard

#apiVersion: v1
#kind: Secret
#metadata:
#  labels:
#    k8s-app: kubernetes-dashboard
#  name: kubernetes-dashboard-certs
#  namespace: kubernetes-dashboard
#type: Opaque

openssl genrsa -des3 -out ca.key 2048
openssl req -new -key ca.key -out ca.csr
openssl x509 -req -days 3650 -in ca.csr -signkey ca.key -out ca.crt
[root@host01 xx]# ls
ca.crt  ca.csr  ca.key  privateKey.txt
[root@host01 xx]# cp ca.key  ca.crt ~/certs/ #复制到$HOME/certs

kubectl create secret generic kubernetes-dashboard-certs --from-file=$HOME/certs -n kubernetes-dashboard

[root@host01 2.0.5]# cat dashboard-ingress.yaml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: k8s-dashboard
  namespace: kubernetes-dashboard
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/secure-backends: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"


spec:
  tls:
   - hosts:
     - host01
     - host02
     secretName: kubernetes-dashboard-certs   
  rules:
   - host: host01 
     http:
      paths:
      - path: 
        pathType: Prefix
        backend:
          service:
            name: kubernetes-dashboard
            port: 
              number: 443
   - host: host02
     http:
      paths:
      - path: 
        pathType: Prefix
        backend:
          service:
            name: kubernetes-dashboard
            port: 
              number: 443

[root@host01 2.0.5]# kubectl apply -f recommended.yaml 
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
namespace/kubernetes-dashboard configured
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created

[root@host01 2.0.5]# kubectl apply -f dashboard-ingress.yaml 
ingress.networking.k8s.io/k8s-dashboard created

[root@host01 2.0.5]# cat <<EOF | kubectl apply -f -
> apiVersion: v1
> kind: ServiceAccount
> metadata:
>   name: admin-user
>   namespace: kubernetes-dashboard
> EOF
serviceaccount/admin-user created
[root@host01 2.0.5]# cat <<EOF | kubectl apply -f -
> apiVersion: rbac.authorization.k8s.io/v1
> kind: ClusterRoleBinding
> metadata:
>   name: admin-user
> roleRef:
>   apiGroup: rbac.authorization.k8s.io
>   kind: ClusterRole
>   name: cluster-admin
> subjects:
> - kind: ServiceAccount
>   name: admin-user
>   namespace: kubernetes-dashboard
> EOF
clusterrolebinding.rbac.authorization.k8s.io/admin-user created

[root@host01 2.0.5]# kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')

[root@host01 2.0.5]# kubectl apply -f dashboard-ingress.yaml 
Error from server (InternalError): error when creating "dashboard-ingress.yaml": Internal error occurred: failed calling webhook "validate.nginx.ingress.kubernetes.io": Post "https://ingress-nginx-controller-admission.ingress-nginx.svc:443/networking/v1beta1/ingresses?timeout=10s": x509: certificate is valid for kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, lb-apiserver.kubernetes.local, localhost, host01, host01.cluster.local, host01, host02, host02.cluster.local, host02, not ingress-nginx-controller-admission.ingress-nginx.svc

[root@host01 2.0.5]# kubectl delete -n ingress-nginx service/ingress-nginx-controller-admission
[root@host01 ~]# kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.41.2/deploy/static/provider/baremetal/deploy.yaml

# 创建的Ingress中的annotation带上cert-manager
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: k8s-dashboard
  namespace: kubernetes-dashboard
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/rewrite-target: 
    nginx.ingress.kubernetes.io/secure-backends: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    cert-manager.io/cluster-issuer: "letsencrypt-staging"

 Message:   The certificate request has failed to complete and will be retried: Failed to wait for order resource "kubernetes-dashboard-certs-2dm4v-441423537" to become ready: order is in "errored" state: Failed to create Order: 400 urn:ietf:params:acme:error:rejectedIdentifier: Error creating new order :: Cannot issue for "host01": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy (and 1 more problems. Refer to sub-problems for more information.)