Traefik 2.1 简单安装

发表于 | 更新于: | 分类于 | 本文总阅读量 次

Traefik是一个开源的kubernetes ingress controller,用于实现边缘路由，反向代理，自动发现服务。

Traefik支持多种集群技术做为它的Providers,主流使用的如Kubernetes，Docker，Docker Swarm，AWS，Mesos等等

img

Traefik是一个边缘路由器，可以作为Kuberetes服务对外暴露的入口。

traefik architecture overview

更的详细介绍参考官方网站：https://docs.traefik.io/

安装

安装步骤：

1
2
3
4
5
6
7
8
9
10
11
12
[root@kube-master-1 yaml]# ll
total 48
-rw-r--r--. 1 root root 1445 Jan 13 10:40 0.traefik-crd.yaml
-rw-r--r--. 1 root root 1126 Jan 14 00:51 1.traefik-rbac.yaml
-rw-r--r--. 1 root root  421 Jan 14 00:55 2.traefik-sa.yaml
-rw-r--r--. 1 root root 2879 Jan 16 10:03 3.traefik-deployment.yaml
-rw-r--r--. 1 root root  459 Jan 14 21:55 4.traefik-service.yaml
-rw-r--r--. 1 root root  225 Jan 14 15:17 5.traefik-dashboard.yaml
-rw-r--r--. 1 root root 7576 Jan 16 01:54 6.kubernetes-dashboard.yaml
-rw-r--r--. 1 root root  508 Jan 16 01:32 7.kubernetes-dashboard-ingress.yaml
-rw-r--r--. 1 root root  474 Jan 16 00:56 8.kubernetes-dashboard-service-account.yaml
drwxr-xr-x. 2 root root   99 Jan 16 01:39 certs

依次使用kubectl apply -f xx.yaml命令安装

1
[root@kube-master-1 yaml]# cat 0.traefik-crd.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutes.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRoute
    plural: ingressroutes
    singular: ingressroute
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: middlewares.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: Middleware
    plural: middlewares
    singular: middleware
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutetcps.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRouteTCP
    plural: ingressroutetcps
    singular: ingressroutetcp
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: tlsoptions.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: TLSOption
    plural: tlsoptions
    singular: tlsoption
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: traefikservices.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: TraefikService
    plural: traefikservices
    singular: traefikservice
  scope: Namespaced
1
[root@kube-master-1 yaml]# cat 1.traefik-rbac.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller

rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.containo.us
    resources:
      - middlewares
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - ingressroutes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - ingressroutetcps
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - tlsoptions
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - traefikservices
    verbs:
      - get
      - list
      - watch
1
[root@kube-master-1 yaml]# cat 2.traefik-sa.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: default
  name: traefik-ingress-controller

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: default
1
[root@kube-master-1 yaml]# cat 3.traefik-deployment.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: dockerhub.azk8s.cn/library/traefik:latest
          args:
            - --api=true
            - --api.insecure=true
            - --api.dashboard=true
            - --accesslog=true
            # entryPoints
            - --entryPoints.web.address=:80
            # - --entryPoints.websecure.address=:443
            - --ping=true
            - --providers.kubernetesingress
            - --providers.kubernetescrd
            #- --entryPoints.ping.address=:8082
            #- --ping.entryPoint=ping
            - --serversTransport.insecureSkipVerify=true
            - --log.level=INFO
            - --accesslog
          ports:
          - name: web
            containerPort: 80
            hostPort: 80
          - name: admin
            containerPort: 8080
          - name: websecure
						containerPort: 443
          resources:
            requests:
              cpu: "50m"
              memory: "50Mi"
            limits:
              cpu: "200m"
              memory: "100Mi"
          securityContext:
            allowPrivilegeEscalation: true
            capabilities:
              drop:
              - ALL
              add:
              - NET_BIND_SERVICE
          readinessProbe:
            httpGet:
              path: /ping
              port: 8080
            failureThreshold: 1
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          livenessProbe:
            httpGet:
              path: /ping
              port: 8080
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
1
[root@kube-master-1 yaml]# cat 4.traefik-service.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  type: NodePort
  ports:
    - protocol: TCP
      name: web
      port: 80
      targetPort: 80
    - protocol: TCP
      name: websecure
      port: 443
      targetPort: 443
  selector:
    app: traefik
1
[root@kube-master-1 yaml]# cat 5.traefik-dashboard.yaml
1
2
3
4
5
6
7
8
9
10
11
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard
spec:
  routes:
  - match: Host(`traefik.t.io`)
    kind: Rule
    services:
    - name: api@internal
      kind: TraefikService
1
[root@kube-master-1 yaml]# cat 6.kubernetes-dashboard.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
# Copyright 2017 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Namespace
metadata:
  name: kubernetes-dashboard

---

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard

---

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard

---

#apiVersion: v1
#kind: Secret
#metadata:
#  labels:
#    k8s-app: kubernetes-dashboard
#  name: kubernetes-dashboard-certs
#  namespace: kubernetes-dashboard
#type: Opaque
#
#---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-csrf
  namespace: kubernetes-dashboard
type: Opaque
data:
  csrf: ""

---

apiVersion: v1
kind: Secret
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-key-holder
  namespace: kubernetes-dashboard
type: Opaque

---

kind: ConfigMap
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-settings
  namespace: kubernetes-dashboard

---

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
rules:
  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
    verbs: ["get", "update", "delete"]
    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["kubernetes-dashboard-settings"]
    verbs: ["get", "update"]
    # Allow Dashboard to get metrics.
  - apiGroups: [""]
    resources: ["services"]
    resourceNames: ["heapster", "dashboard-metrics-scraper"]
    verbs: ["proxy"]
  - apiGroups: [""]
    resources: ["services/proxy"]
    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
    verbs: ["get"]

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
rules:
  # Allow Metrics Scraper to get metrics from the Metrics server
  - apiGroups: ["metrics.k8s.io"]
    resources: ["pods", "nodes"]
    verbs: ["get", "list", "watch"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubernetes-dashboard
subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: kubernetes-dashboard

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubernetes-dashboard
subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: kubernetes-dashboard

---

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
    spec:
      containers:
        - name: kubernetes-dashboard
          image: kubernetesui/dashboard:v2.0.0-rc1
          imagePullPolicy: Always
          ports:
            - containerPort: 8443
              protocol: TCP
          args:
            - --auto-generate-certificates
            - --namespace=kubernetes-dashboard
            # Uncomment the following line to manually specify Kubernetes API server Host
            # If not specified, Dashboard will attempt to auto discover the API server and connect
            # to it. Uncomment only if the default does not work.
            # - --apiserver-host=http://my-address:port
          volumeMounts:
            - name: kubernetes-dashboard-certs
              mountPath: /certs
              # Create on-disk volume to store exec logs
            - mountPath: /tmp
              name: tmp-volume
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /
              port: 8443
            initialDelaySeconds: 30
            timeoutSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      volumes:
        - name: kubernetes-dashboard-certs
          secret:
            secretName: kubernetes-dashboard-certs
        - name: tmp-volume
          emptyDir: {}
      serviceAccountName: kubernetes-dashboard
      nodeSelector:
        "beta.kubernetes.io/os": linux
      # Comment the following tolerations if Dashboard must not be deployed on master
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule

---

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: dashboard-metrics-scraper
  name: dashboard-metrics-scraper
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 8000
      targetPort: 8000
  selector:
    k8s-app: dashboard-metrics-scraper

---

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: dashboard-metrics-scraper
  name: dashboard-metrics-scraper
  namespace: kubernetes-dashboard
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: dashboard-metrics-scraper
  template:
    metadata:
      labels:
        k8s-app: dashboard-metrics-scraper
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
    spec:
      containers:
        - name: dashboard-metrics-scraper
          image: kubernetesui/metrics-scraper:v1.0.1
          ports:
            - containerPort: 8000
              protocol: TCP
          livenessProbe:
            httpGet:
              scheme: HTTP
              path: /
              port: 8000
            initialDelaySeconds: 30
            timeoutSeconds: 30
          volumeMounts:
          - mountPath: /tmp
            name: tmp-volume
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 2001
      serviceAccountName: kubernetes-dashboard
      nodeSelector:
        "beta.kubernetes.io/os": linux
      # Comment the following tolerations if Dashboard must not be deployed on master
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
      volumes:
        - name: tmp-volume
          emptyDir: {}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# 7.kubernetes-dashboard-ingress.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: kubernetes-dashboard-ingressroute
  namespace: kubernetes-dashboard
spec:
  entryPoints:
    - websecure
  tls:
    secretName: kubernetes-dashboard-certs
    namespace: kubernetes-dashboard
  routes:
    - kind: Rule
      # match: Host(`k8s.t.io`) && PathPrefix(`/`)
      match: Host(`k8s.t.io`)
      services:
      - kind: Service
        name: kubernetes-dashboard
        port: 443
        namespace: kubernetes-dashboard
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# 8.kubernetes-dashboard-service-account.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kuberetes-dashboard-admin-user
  namespace: kubernetes-dashboard

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kuberetes-dashboard-admin-user
  namespace: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: kuberetes-dashboard-admin-user
    namespace: kubernetes-dashboard

完成后效果

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
[root@kube-master-1 yaml]# kubectl get ingressroute
NAME                                   AGE
kubernetes-dashboard-ingressroute-ui   68m
traefik-dashboard                      99m
[root@kube-master-1 yaml]# kubectl get svc
NAME         TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
kubernetes   ClusterIP   10.233.0.1     <none>        443/TCP        79m
traefik      NodePort    10.233.29.85   <none>        80:31216/TCP   59m
[root@kube-master-1 yaml]# kubectl get deployments
NAME      READY   UP-TO-DATE   AVAILABLE   AGE
traefik   1/1     1            1           165m
[root@kube-master-1 yaml]# kubectl get pods
NAME                       READY   STATUS    RESTARTS   AGE
traefik-6485b9b8b4-bczwx   1/1     Running   0          49m
[root@kube-master-1 yaml]# kubectl logs -f traefik-6485b9b8b4-bczwx


time="2020-01-14T08:09:17Z" level=info msg="Configuration loaded from flags."
time="2020-01-14T08:09:17Z" level=info msg="Traefik version 2.1.2 built on 2020-01-07T18:23:57Z"
time="2020-01-14T08:09:17Z" level=info msg="\nStats collection is disabled.\nHelp us improve Traefik by turning this feature on :)\nMore details on: https://docs.traefik.io/v2.0/contributing/data-collection/\n"
time="2020-01-14T08:09:17Z" level=info msg="Starting provider aggregator.ProviderAggregator {}"
time="2020-01-14T08:09:17Z" level=info msg="Starting provider *traefik.Provider {}"
time="2020-01-14T08:09:17Z" level=info msg="Starting provider *ingress.Provider {}"
time="2020-01-14T08:09:17Z" level=info msg="ingress label selector is: \"\"" providerName=kubernetes
time="2020-01-14T08:09:17Z" level=info msg="Creating in-cluster Provider client" providerName=kubernetes
time="2020-01-14T08:09:17Z" level=info msg="Starting provider *crd.Provider {}"
time="2020-01-14T08:09:17Z" level=info msg="label selector is: \"\"" providerName=kubernetescrd
time="2020-01-14T08:09:17Z" level=info msg="Creating in-cluster Provider client" providerName=kubernetescrd
10.0.2.15 - - [14/Jan/2020:08:09:28 +0000] "GET /ping HTTP/1.1" 200 2 "-" "-" 1 "ping@internal" - 16ms
10.0.2.15 - - [14/Jan/2020:08:09:32 +0000] "GET /ping HTTP/1.1" 200 2 "-" "-" 2 "ping@internal" - 0ms

我们在外面绑定traefik.t.io与 k8s.t.io hosts

1
2
3
[Tue Jan 14 talen@tp ~]$ cat /etc/hosts
192.168.56.102  traefik.t.io
192.168.56.102  k8s.t.io

image-20200116104116358

创建dashboard访问service acount

生成证书

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
[root@kube-master-1 yaml]# mkdir certs
[root@kube-master-1 yaml]# openssl req -nodes -newkey rsa:2048 -keyout certs/dashboard.key -out certs/dashboard.csr -subj "/C=/ST=/L=/O=/OU=/CN=kubernetes-dashboard"
Generating a 2048 bit RSA private key
.................................................................................................+++
.........................................................................+++
writing new private key to 'certs/dashboard.key'
-----
No value provided for Subject Attribute C, skipped
No value provided for Subject Attribute ST, skipped
No value provided for Subject Attribute L, skipped
No value provided for Subject Attribute O, skipped
No value provided for Subject Attribute OU, skipped
[root@kube-master-1 yaml]# openssl x509 -req -sha256 -days 10000 -in certs/dashboard.csr -signkey certs/dashboard.key -out certs/dashboard.crt
Signature ok
subject=/CN=kubernetes-dashboard
Getting Private key
[root@kube-master-1 yaml]# kubectl create secret generic kubernetes-dashboard-certs --from-file=certs -n kubernetes-dashboard
Error from server (AlreadyExists): secrets "kubernetes-dashboard-certs" already exists
[root@kube-master-1 yaml]# kubectl delete secret kubernetes-dashboard-certs -n kubernetes-dashboard
secret "kubernetes-dashboard-certs" deleted
[root@kube-master-1 yaml]# kubectl create secret generic kubernetes-dashboard-certs --from-file=certs -n kubernetes-dashboard
secret/kubernetes-dashboard-certs created
1
2
3
4
5
6
7
8
9
10
11
12
13
14
[root@kube-master-1 yaml]# kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep kuberetes-dashboard-admin-user | awk '{print $1}')
Name:         kuberetes-dashboard-admin-user-token-vrkvz
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: kuberetes-dashboard-admin-user
kubernetes.io/service-account.uid: b7ed67a3-08b3-456e-b543-75802dc247d6

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6InhROXFDVHVTbXpNaTJ4a09DSG5PS0x2T05WS2pnLV8tQ2pYOEtvNGU5Qk0ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcmV0ZXMtZGFzaGJvYXJkLWFkbWluLXVzZXItdG9rZW4tdnJrdnoiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoia3ViZXJldGVzLWRhc2hib2FyZC1hZG1pbi11c2VyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiYjdlZDY3YTMtMDhiMy00NTZlLWI1NDMtNzU4MDJkYzI0N2Q2Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmVybmV0ZXMtZGFzaGJvYXJkOmt1YmVyZXRlcy1kYXNoYm9hcmQtYWRtaW4tdXNlciJ9.Dx8gB-7-srSAE7d7rgwyx5YyJLIkOGOc3LSVqzsrdadIm0zaeaSvqylFEsXaXuxW3APpruv1lIDCF8QpM9xFadCo2XQ1FEHnDaj1eCSZjpEqSkQI9zha43fGXjMNkuTEytp-QmSunILCKzTX6p516OB_vC2JQjx2nXsC_hAWJEld5aas1gDET90E-VwTwBIcsW98ovK88TJ-vwg9pB4Ng081kl_EHligEvN52eBdqB6grlSCjSG9vhA9mzykNNwB7KAQ-hrzWKP_yvmtHTlHvUibXY9nGjlL9nFQVbdQQrgPWT0jux93dzFGMFMvjkk5GZuFxRellj55G_ZDpmvszQ

使用token访问kuberetes-dashboard

image-20200116104148178

image-20200116104214415

坚持原创技术分享，您的支持将鼓励我继续创作！