[英]Kubernetes Dashboard an error on the server ("unknown") has prevented the request from succeeding
After getting my k8s cluster up and going I faithfully deployed the following WebUI dashboard using the command:在启动并运行我的 k8s 集群后,我忠实地使用以下命令部署了以下 WebUI 仪表板:
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.4/aio/deploy/recommended.yaml
When I try to access it I get the following error:当我尝试访问它时,出现以下错误:
Metric client health check failed: an error on the server ("unknown") has prevented the request from succeeding (get services dashboard-metrics-scraper)
If I get all the services I get:如果我得到我得到的所有服务:
k get services --all-namespaces
NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
default kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 8d
kube-system kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP 8d
kubernetes-dashboard dashboard-metrics-scraper ClusterIP 10.96.0.65 <none> 8000/TCP 6m10s
kubernetes-dashboard kubernetes-dashboard ClusterIP 10.96.0.173 <none> 443/TCP 6m10s
Can someone shed some light?有人可以阐明一下吗? what am I missing?我错过了什么?
More Info: In the dashboard yaml I found these roles:更多信息:在仪表板 yaml 中,我找到了这些角色:
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
rules:
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
verbs: ["get", "update", "delete"]
map.
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["kubernetes-dashboard-settings"]
verbs: ["get", "update"]
- apiGroups: [""]
resources: ["services"]
resourceNames: ["heapster", "dashboard-metrics-scraper"]
verbs: ["proxy"]
- apiGroups: [""]
resources: ["services/proxy"]
resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
verbs: ["get"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
rules:
- apiGroups: ["metrics.k8s.io"]
resources: ["pods", "nodes"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: kubernetes-dashboard
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: kubernetes-dashboard
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kubernetes-dashboard
Looks like the kube.netes-dashboard user has access to the metrics service I might be wrong看起来 kube.netes-dashboard 用户可以访问指标服务我可能错了
It looks like the kube.netes-dashboard's serviceaccount doesn't have access to all kube.netes resources (in particular, it can't access the metric server service).看起来 kube.netes-dashboard 的 serviceaccount 没有访问所有 kube.netes 资源的权限(特别是,它无法访问度量服务器服务)。
To fix this you should create a new ServiceAccount for the dashboard and give it more permissions.要解决此问题,您应该为仪表板创建一个新的 ServiceAccount 并为其授予更多权限。
Here's one that I found on another similar post ( be careful since it will give admin privileges to the dashboard, and whoever uses it will be able to destroy/create new or existing resources on your kube.netes cluster ):这是我在另一篇类似的帖子中找到的(请小心,因为它会授予仪表板管理员权限,并且使用它的任何人都能够在您的 kube.netes 集群上销毁/创建新的或现有的资源):
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: kubernetes-dashboard
labels:
k8s-app: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kube-system
If you don't have a cluster-admin ServiceAccount, create one following this template:如果您没有 cluster-admin ServiceAccount,请按照此模板创建一个:
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin
namespace: kube-system
labels:
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
Admin ClusterRole:管理员集群角色:
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
name: admin
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
nonResourceURLs: ["*"]
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.