身份认证

登录dashboard 的时候支持Kubeconfig 和token 两种认证方式，Kubeconfig 中也依赖token 字段，所以生成token 这一步是必不可少的。

生成token

我们创建一个admin用户并授予admin 角色绑定，使用下面的yaml文件创建admin用户并赋予他管理员权限，然后就可以通过token 登陆dashbaord，这种认证方式本质实际上是通过Service Account 的身份认证加上Bearer token请求 API server 的方式实现

1.在node节点上创建：vim admin-sa.yaml

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: admin
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: admin
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: kube-system
  labels:
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile

创建admin用户

$ kubectl create -f admin-sa.yaml
clusterrolebinding.rbac.authorization.k8s.io "admin" created
serviceaccount "admin" created

查看新创建的admin用户

$ kubectl get secret -n kube-system|grep admin
admin-token-mf8ch                                kubernetes.io/service-account-token   3         46s

获取admin用户token

$ kubectl get secret admin-token-mf8ch -o jsonpath={.data.token} -n kube-system |base64 -d
eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi10b2tlbi1tZjhjaCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJhZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImE5MmRkMWVjLTVjMzMtMTFlOS05OTkwLTc0ODVjNDExMDNmOCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTphZG1pbiJ9.jRJuLdowmVSazLFGBSW9meY4PM9SbswEc0sN98iHFGEr8Me_T8QyViENEQUx6q0C7GbYpdH9AO-XdejVPN5381DD3HRLy-j4g-2HrkB2oKR5hIJ8PMHfvcS763i4ZZKnEs70C_JlQV-yXw8fazC3w1UQo4EeBkA1i6GpM5Sf-O-TZht8Aq2_tXqjkSYjvRMrPXS5Ht5fc8helV5iVF82r4whm2Xfh-RddbvDGy9OfrR2b5m6HDKIo_HuSpYagwleZFU7YlQ-NACwmG7kyoYidqQlFL2mSRhWSYTjrqSCiwaMquHxkIzv4nnGvkXw9bn3fdTHv0AWLOcXFSQQz6igRw

然后在dashboard登录页面上直接使用上面得到的token字符串即可登录，这样就可以拥有管理员权限操作整个kubernetes集群的对象，当然你也可以为你的登录用户新建一个指定操作权限的用户。