简体繁体 English

通过Nginx代理访问Kubernetes仪表板

[英]Visit Kubernetes dashboard through nginx proxy

原文 2018-07-29 09:39:03 7 1 nginx/ kubernetes/ kubernetes-dashboard

I wanted to visit my dashboard on a local Kubernetes installation (using docker for mac). 我想在本地Kubernetes安装上访问我的仪表板（使用docker for mac）。 I was 'blocked'. 我被“封锁”了。 I have to provide a token or my config which is normal since the RBAC updates. 自RBAC更新以来，我必须提供正常的令牌或配置。

Now I don't want to kubectl proxy or enable port forwarding every time I want to visit my dashboard so I installed an nginx proxy with a ingress (tls) which redirects me to https://kubernetes-dashboard.kube-system.svc.cluster.local:443 . 现在我不想每次都想访问仪表板时使用kubectl proxy或启用port forwarding因此我安装了带有入口（tls）的nginx代理，该入口将我重定向到https://kubernetes-dashboard.kube-system.svc.cluster.local:443 。

This works fine but now I'm a bit confused because I can see the dashboard now, without facing the RBAC issue. 这可以正常工作，但是现在我有点困惑，因为我现在可以看到仪表板，而不会遇到RBAC问题。

I read this here : 我在这里阅读：

To make Dashboard use authorization header you simply need to pass Authorization: Bearer in every request to Dashboard. 要使Dashboard使用授权标头，您只需要在向Dashboard的每个请求中传递Authorization：Bearer。 This can be achieved ie by configuring reverse proxy in front of Dashboard. 这可以通过在仪表板前面配置反向代理来实现。 Proxy will be responsible for authentication with identity provider and will pass generated token in request header to Dashboard. 代理将负责与身份提供者进行身份验证，并将在请求标头中生成的令牌传递给仪表板。 Note that Kubernetes API server needs to be configured properly to accept these tokens. 请注意，需要正确配置Kubernetes API服务器以接受这些令牌。

But it's still not very clear for me. 但是对我来说还不是很清楚。 Can someone explain we why I can see the dashboard when I create a proxy in front of it? 有人可以解释一下为什么我在仪表盘前面创建代理时可以看到仪表盘吗？

1 个解决方案

Proxy is usually needed to transfer data between different segments of the network without connecting them directly. 通常需要代理来在网络的不同部分之间传输数据而无需直接连接它们。 Each segment of the network is "talking" to proxy host without any knowledge of the existence of the other network segment. 网络的每个网段都在与代理主机“对话”，而无需知道其他网络网段的存在。

The Proxy Server is responsible for all negotiations and operations concerning requests and response packets. 代理服务器负责有关请求和响应数据包的所有协商和操作。 So, to enable authentication, authorization, SSL termination and many other things you need to configure your proxy server according to your needs. 因此，要启用身份验证，授权，SSL终止和许多其他功能，您需要根据需要配置代理服务器。

If you can see the kubernetes dashboard via proxy in front of it it just means that you did not configure any security on that proxy. 如果您可以通过代理前面看到kubernetes仪表板，则表明您未在该代理上配置任何安全性。

For example, to learn how to configure Nginx Ingress to protect a service with basic authentication in your cluster consider to read this article . 例如，要了解如何在集群中配置Nginx Ingress以使用基本身份验证来保护服务，请阅读此文章。

For more complex security setup read the article about securing Kubernetes services with Ingress, TLS and LetsEncrypt . 有关更复杂的安全设置，请阅读有关使用Ingress，TLS和LetsEncrypt保护Kubernetes服务的文章。