kubernetes(k8s) 인증서 있는 대시보드 생성

쿠버네티스를 관리하기 위한 관리도구 중 대시보드로 쉽고 편리하게 관리할 수 있다.

쿠버네티스 관리도구 중 대시보드는 모든 데이터에 접근하기 위한
admin 권한을 가지고 있기에 보안이 중요하다.

대시보드 방법들은 크게 3가지가 있다.

• webUI를 제공하는 k8s 관리도구
• 방법들
  • kubectl proxy → GKE + dashboard
  • APIserver(6443) → kubectl cluster-info
    • api server를 이용한 접근방식
    • 권장
  • NodePort service type
• https://github.com/kubernetes/dashboard/releases

이 중에서 2번째  방법을 사용하려고 한다.

kubernetes-dashboard 생성

student@k8s-master:~$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created

student@k8s-master:~$ kubectl get pod --all-namespaces

위에 로그를 보면 rbac(role based access control)로 role 생성하고 clusterrole과 rolebinding 하는 것을 볼 수 있다.

이것을 통해 dashboard에 clusterrole 권한을 부여해준다.

아래로 service account를 조회할 수 있다.

student@k8s-master:~$ kubectl -n kubernetes-dashboard get sa
NAME                   SECRETS   AGE
default                0         7m59s
kubernetes-dashboard   0         7m59s

 

Service account 생성

student@k8s-master:~$ kubectl -n kubernetes-dashboard create serviceaccount admin-user
serviceaccount/admin-user created

student@k8s-master:~$ kubectl -n kubernetes-dashboard get sa
NAME                   SECRETS   AGE
admin-user             0         9s
default                0         9m12s
kubernetes-dashboard   0         9m12s

Rolebinding

student@k8s-master:~$ mkdir dashboard
student@k8s-master:~$ cd dashboard/
student@k8s-master:~/dashboard$ vi ClusterRoleBinding-admin-user.yaml

아래 코드를 추가한다.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

k8s에 적용한다.

student@k8s-master:~/dashboard$ kubectl apply -f ClusterRoleBinding-admin-user.yaml
clusterrolebinding.rbac.authorization.k8s.io/admin-user created
student@k8s-master:~/dashboard$ kubectl get pod --all-namespaces
NAMESPACE              NAME                                         READY   STATUS    RESTARTS                                                AGE
kube-system            calico-kube-controllers-658d97c59c-8c47r     1/1     Running   0                                                       73m
kube-system            calico-node-fq95s                            1/1     Running   0                                                       73m
kube-system            calico-node-pmwc5                            1/1     Running   0                                                       73m
kube-system            calico-node-qs95f                            1/1     Running   0                                                       73m
kube-system            coredns-76f75df574-g5q5m                     1/1     Running   0                                                       41h
kube-system            coredns-76f75df574-q7gl7                     1/1     Running   0                                                       41h
kube-system            etcd-k8s-master                              1/1     Running   8 (90m a                                         go)    41h
kube-system            kube-apiserver-k8s-master                    1/1     Running   12 (90m                                          ago)   41h
kube-system            kube-controller-manager-k8s-master           1/1     Running   11 (90m                                          ago)   41h
kube-system            kube-proxy-b2sn7                             1/1     Running   11 (90m                                          ago)   41h
kube-system            kube-proxy-mslks                             1/1     Running   13 (90m                                          ago)   41h
kube-system            kube-proxy-sbvhc                             1/1     Running   13 (90m                                          ago)   41h
kube-system            kube-scheduler-k8s-master                    1/1     Running   13 (90m                                          ago)   41h
kubernetes-dashboard   dashboard-metrics-scraper-5657497c4c-gzbsf   1/1     Running   0                                                       13m
kubernetes-dashboard   kubernetes-dashboard-78f87ddfc-82r6s         1/1     Running   0                                                       13m

token 생성

student@k8s-master:~/dashboard$ kubectl -n kubernetes-dashboard create token admin-user
eyJhbGciOiJSUzI1NiIsImtpZCI6IkhESEl1YVVnMHlVZzNFMmRYRVJsVXZRX0pmZ2E0RXJaTFZDWlpiTW84WTQifQ.eyJ                                         hdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxNzEyODAyODMzL                                         CJpYXQiOjE3MTI3OTkyMzMsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiw                                         ia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsInNlcnZpY2VhY2NvdW50Ijp7I                                         m5hbWUiOiJhZG1pbi11c2VyIiwidWlkIjoiMDY5NzRmYjUtZDUyZC00MTI4LWJjZjctYmQzNjY4ZDQzNGUwIn19LCJuYmY                                         iOjE3MTI3OTkyMzMsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDphZG1pbi11c                                         2VyIn0.PpPA7obSuapUrUgTmXWje38N0lzFv0vpdvMadynpi2w_-XiZcPo4-HmtAMDpao1UNEvtkbNsWRyFAe767cT9517                                         rcqRJ7_-Muynh5U5_adN1oXIcYavZPmgHVCdApX6y1JecgWlVJDmNiS83JmR7aT0BVD8FFpPjnefMl6UVl9s0o-ulZYbLq                                         PsQKe08WlYueOyzg8wNW8aWiFNLAKBHzszAFgMeoRs_oKCh5hJsz8v7P445uhMk_6zr-vCLdwzK_X7_iZNStt1OG9QFo0-                                         S08I6bOR0HzVdk-s24ER_3k9rRlbFqdfHi97UkHIqa5h38131fg56YbFG8_pWJXa2eg
student@k8s-master:~/dashboard$ echo 'alias dtoken="kubectl -n kubernetes-dashboard create tok                                         en admin-user"' >> ~/.bashrc
student@k8s-master:~/dashboard$ source ~/.bashrc
student@k8s-master:~/dashboard$ dtoken
eyJhbGciOi

cert 생성

student@k8s-master:~/dashboard$ grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt
student@k8s-master:~/dashboard$ grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key
student@k8s-master:~/dashboard$ ls
ClusterRoleBinding-admin-user.yaml  kubecfg.crt  kubecfg.key

student@k8s-master:~/dashboard$ openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name "kubernetes-admin"
Warning: -clcerts option ignored with -export
Enter Export Password:
Verifying - Enter Export Password:

student@k8s-master:~/dashboard$ sudo cp /etc/kubernetes/pki/ca.crt ./
[sudo] password for student:

student@k8s-master:~/dashboard$ ls
ca.crt                              kubecfg.crt  kubecfg.p12
ClusterRoleBinding-admin-user.yaml  kubecfg.key

윈도우로 가져오기

winscp 등 ftp 툴로 윈도우로 dashboard 디렉토리를 가져온다.

powershell 관리자모드로 실행한다.

인증서를 등록해준다.

PS C:\Users\user\Desktop\k8s> cd .\dashboard\
PS C:\Users\user\Desktop\k8s\dashboard> dir


    디렉터리: C:\Users\user\Desktop\k8s\dashboard


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----      2024-04-11  오전 10:52           1107 ca.crt
-a----      2024-04-11  오전 10:30            270 ClusterRoleBinding-admin-user.yaml
-a----      2024-04-11  오전 10:49           1155 kubecfg.crt
-a----      2024-04-11  오전 10:50           1679 kubecfg.key
-a----      2024-04-11  오전 10:51           2660 kubecfg.p12


PS C:\Users\user\Desktop\k8s\dashboard> certutil.exe -addstore "Root" ca.crt
Root "신뢰할 수 있는 루트 인증 기관"
서명이 공개 키와 일치합니다.
"kubernetes" 인증서가 저장소에 추가되었습니다.
CertUtil: -addstore 명령이 성공적으로 완료되었습니다.
PS C:\Users\user\Desktop\k8s\dashboard> certutil.exe -p k8spass# -user -importPFX kubecfg.p12
"kubernetes-admin" 인증서가 저장소에 추가되었습니다.

CertUtil: -importPFX 명령이 성공적으로 완료되었습니다.

크롬에서 시크릿 모드로 아래 url을 접속한다.

192.168.56.100서버에서 실행해서 아래와 같이 적었으며 ip가 다르면 ip를 고쳐주면 된다.

https://192.168.56.100:6443/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/#/login

확인을 누르고 넘어간다.

그다음 나오는 UI에서 토큰 선택하고 dtoken 치면 나오는 위에서 생성한 토큰값 입력한다.

 

이렇게 하면 끝나게 된다!!