如何在没有 Ingress 的情况下远程访问 kube.netes microk8s 仪表板？

Question

我是 Kube.netes 的新手，我正在尝试在 4 个树莓派上部署一个 MicroKube.netes 集群。 自从（不是开玩笑）总共大约 30 个小时以来，我一直在努力设置仪表板，并且开始感到非常沮丧。 我只是无法远程访问仪表板。

未解决的解决方案：

一号入口：

我设法启用了入口，但将它连接到仪表板似乎非常复杂，因为我必须手动解析 pod 和主机内的 DNS 属性。 我最终放弃了。 也没有任何可用的文档说明如何在没有指向入口节点的有效购买域的情况下设置入口。

如果你能指导我完成这个，我愿意。

No.2 将仪表板的服务类型更改为 LoadBalancer 或 NodePort：

使用这种方法我实际上可以公开仪表板......但它只能通过 https 访问......由于 dashbaord 似乎使用自签名证书或其他一些机制我无法通过浏览器访问仪表板。 浏览器（chrome firefox）总是拒绝连接到仪表板...当我尝试通过 http 访问时，浏览器说我需要使用 https。

No.3 kube-proxy：

这只允许本地主机连接。 您可以将 arguments 传递给 kube 代理以允许其他主机访问仪表板...但是我们又遇到了 https/http 问题

在这一点上，让我感到惊讶的是，仅仅访问这个简单的仪表板是多么困难……任何人都可以就如何访问它提供任何建议吗？

a@k8s-node-1:~/kubernetes$ kctl describe service kubernetes-dashboard -n kube-system
Name:                     kubernetes-dashboard
Namespace:                kube-system
Labels:                   k8s-app=kubernetes-dashboard
Annotations:              <none>
Selector:                 k8s-app=kubernetes-dashboard
Type:                     NodePort
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       10.152.183.249
IPs:                      10.152.183.249
Port:                     <unset>  443/TCP
TargetPort:               8443/TCP
NodePort:                 <unset>  32228/TCP
Endpoints:                10.1.140.67:8443
Session Affinity:         None
External Traffic Policy:  Cluster

$ kubectl edit svc -n kube-system kubernetes-dashboard

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
kind: Service
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"k8s-app":"kubernetes-dashboard"},"name":"kubernetes-dashboard","namespace":"kube-system"},"spec":{"ports":[{"port":443,"targetPort":8443}],"selector":{"k8s>
  creationTimestamp: "2022-03-21T14:30:10Z"
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kube-system
  resourceVersion: "43060"
  selfLink: /api/v1/namespaces/kube-system/services/kubernetes-dashboard
  uid: fcb45ccc-070b-4a4d-b987-41f5b7777559
spec:
  clusterIP: 10.152.183.249
  clusterIPs:
  - 10.152.183.249
  externalTrafficPolicy: Cluster
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - nodePort: 32228
    port: 443
    protocol: TCP
    targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard
  sessionAffinity: None
  type: NodePort
status:
  loadBalancer: {}

a@k8s-node-1:~/kubernetes$ kctl get services -n kube-system
NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                  AGE
metrics-server              ClusterIP   10.152.183.233   <none>        443/TCP                  165m
kube-dns                    ClusterIP   10.152.183.10    <none>        53/UDP,53/TCP,9153/TCP   142m
dashboard-metrics-scraper   ClusterIP   10.152.183.202   <none>        8000/TCP                 32m
kubernetes-dashboard        NodePort    10.152.183.249   <none>        443:32228/TCP            32m

a@k8s-node-1:~/kubernetes$ cat dashboard-ingress.yaml 
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
  name: dashboard
  namespace: kube-system
spec:
  rules:
    - host: nonexistent.net
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: kubernetes-dashboard
                port:
                  number: 8080

a@k8s-node-1:~/kubernetes$ kctl get pods --all-namespaces -o wide
NAMESPACE     NAME                                         READY   STATUS    RESTARTS        AGE     IP               NODE         NOMINATED NODE   READINESS GATES
kube-system   calico-node-c4shb                            1/1     Running   0               3h23m   192.168.180.47   k8s-node-2   <none>           <none>
ingress       nginx-ingress-microk8s-controller-nvcvx      1/1     Running   0               3h12m   10.1.140.66      k8s-node-2   <none>           <none>
kube-system   calico-node-ptwmk                            1/1     Running   0               3h23m   192.168.180.48   k8s-node-3   <none>           <none>
ingress       nginx-ingress-microk8s-controller-hksg7      1/1     Running   0               3h12m   10.1.55.131      k8s-node-4   <none>           <none>
ingress       nginx-ingress-microk8s-controller-tk9dj      1/1     Running   0               3h12m   10.1.76.129      k8s-node-3   <none>           <none>
ingress       nginx-ingress-microk8s-controller-c8t54      1/1     Running   0               3h12m   10.1.109.66      k8s-node-1   <none>           <none>
kube-system   calico-node-k65fz                            1/1     Running   0               3h22m   192.168.180.52   k8s-node-4   <none>           <none>
kube-system   coredns-64c6478b6c-584s8                     1/1     Running   0               177m    10.1.109.67      k8s-node-1   <none>           <none>
kube-system   calico-kube-controllers-6966456d6b-vvnm6     1/1     Running   0               3h24m   10.1.109.65      k8s-node-1   <none>           <none>
kube-system   calico-node-7jhz9                            1/1     Running   0               3h33m   192.168.180.46   k8s-node-1   <none>           <none>
kube-system   metrics-server-647bdc584d-ldf8q              1/1     Running   1 (3h19m ago)   3h20m   10.1.55.129      k8s-node-4   <none>           <none>
kube-system   kubernetes-dashboard-585bdb5648-8s9xt        1/1     Running   0               67m     10.1.140.67      k8s-node-2   <none>           <none>
kube-system   dashboard-metrics-scraper-69d9497b54-x7vt9   1/1     Running   0               67m     10.1.55.132      k8s-node-4   <none>           <none>

Answer 1

使用入口确实是首选方式，但由于您的环境似乎有问题，您确实可以使用 LoadBalancer 服务。

为避免自动生成的证书出现问题，请向仪表板提供您的证书和私钥，例如作为秘密，并使用标志--tls-key-file和--tls-cert-file指向证书. 更多详情： https://github.com/kube.netes/dashboard/blob/master/docs/user/certificate-management.md