From 9fa1873a65fe078472f580878878ca2981d35563 Mon Sep 17 00:00:00 2001 From: Matthew Mosesohn Date: Sat, 9 Sep 2017 23:38:03 +0300 Subject: [PATCH] Add kube dashboard, enabled by default (#1643) * Add kube dashboard, enabled by default Also add rbac role for kube user * Update main.yml --- docs/getting-started.md | 12 ++ inventory/group_vars/k8s-cluster.yml | 5 + .../kubernetes-apps/ansible/defaults/main.yml | 11 ++ .../ansible/tasks/dashboard.yml | 20 ++++ roles/kubernetes-apps/ansible/tasks/main.yml | 5 + .../ansible/templates/dashboard.yml.j2 | 110 ++++++++++++++++++ 6 files changed, 163 insertions(+) create mode 100644 roles/kubernetes-apps/ansible/tasks/dashboard.yml create mode 100644 roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 diff --git a/docs/getting-started.md b/docs/getting-started.md index 5494e6f0c..d96ae3ea7 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -89,3 +89,15 @@ file yourself. For more information on kubeconfig and accessing a Kubernetes cluster, refer to the Kubernetes [documentation](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). + +Accessing Kubernetes Dashboard +------------------------------ + +If the variable `dashboard_enabled` is set (default is true), then you can +access the Kubernetes Dashboard at the following URL: + + https://kube:_kube-password_@_host_:6443/ui/ + +To see the password, refer to the section above, titled *Connecting to +Kubernetes*. The host can be any kube-master or kube-node or loadbalancer +(when enabled). diff --git a/inventory/group_vars/k8s-cluster.yml b/inventory/group_vars/k8s-cluster.yml index de4642807..fbb1a34e5 100644 --- a/inventory/group_vars/k8s-cluster.yml +++ b/inventory/group_vars/k8s-cluster.yml @@ -45,6 +45,8 @@ kube_users: kube: pass: "{{kube_api_pwd}}" role: admin + groups: + - system:masters ## It is possible to activate / deactivate selected authentication methods (basic auth, static token auth) #kube_oidc_auth: false @@ -141,6 +143,9 @@ vault_deployment_type: docker # K8s image pull policy (imagePullPolicy) k8s_image_pull_policy: IfNotPresent +# Kubernetes dashboard (available at http://first_master:6443/ui by default) +dashboard_enabled: true + # Monitoring apps for k8s efk_enabled: false diff --git a/roles/kubernetes-apps/ansible/defaults/main.yml b/roles/kubernetes-apps/ansible/defaults/main.yml index 42c4a027d..3665254da 100644 --- a/roles/kubernetes-apps/ansible/defaults/main.yml +++ b/roles/kubernetes-apps/ansible/defaults/main.yml @@ -38,6 +38,17 @@ netchecker_server_memory_limit: 256M netchecker_server_cpu_requests: 50m netchecker_server_memory_requests: 64M +# Dashboard +dashboard_enabled: false +dashboard_image_repo: kubernetesdashboarddev/kubernetes-dashboard-amd64 +dashboard_image_tag: head + +# Limits for dashboard +dashboard_cpu_limit: 100m +dashboard_memory_limit: 256M +dashboard_cpu_requests: 50m +dashboard_memory_requests: 64M + # SSL etcd_cert_dir: "/etc/ssl/etcd/ssl" canal_cert_dir: "/etc/canal/certs" diff --git a/roles/kubernetes-apps/ansible/tasks/dashboard.yml b/roles/kubernetes-apps/ansible/tasks/dashboard.yml new file mode 100644 index 000000000..63ea3cf70 --- /dev/null +++ b/roles/kubernetes-apps/ansible/tasks/dashboard.yml @@ -0,0 +1,20 @@ +--- +- name: Kubernetes Apps | Lay down dashboard template + template: + src: "{{item.file}}" + dest: "{{kube_config_dir}}/{{item.file}}" + with_items: + - {file: dashboard.yml.j2, type: deploy, name: netchecker-agent} + register: manifests + when: inventory_hostname == groups['kube-master'][0] + +- name: Kubernetes Apps | Start dashboard + kube: + name: "{{item.item.name}}" + namespace: "{{system_namespace}}" + kubectl: "{{bin_dir}}/kubectl" + resource: "{{item.item.type}}" + filename: "{{kube_config_dir}}/{{item.item.file}}" + state: "latest" + with_items: "{{ manifests.results }}" + when: inventory_hostname == groups['kube-master'][0] diff --git a/roles/kubernetes-apps/ansible/tasks/main.yml b/roles/kubernetes-apps/ansible/tasks/main.yml index 3c986970c..9bea815e7 100644 --- a/roles/kubernetes-apps/ansible/tasks/main.yml +++ b/roles/kubernetes-apps/ansible/tasks/main.yml @@ -63,3 +63,8 @@ include: tasks/netchecker.yml when: deploy_netchecker tags: netchecker + +- name: Kubernetes Apps | Dashboard + include: tasks/dashboard.yml + when: dashboard_enabled + tags: dashboard diff --git a/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 b/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 new file mode 100644 index 000000000..ac32b1c7f --- /dev/null +++ b/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 @@ -0,0 +1,110 @@ +# Copyright 2015 Google Inc. All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Configuration to deploy head version of the Dashboard UI compatible with +# Kubernetes 1.6 (RBAC enabled). +# +# Example usage: kubectl create -f + +{% if rbac_enabled %} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + k8s-app: kubernetes-dashboard + name: kubernetes-dashboard + namespace: {{ system_namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: kubernetes-dashboard + labels: + k8s-app: kubernetes-dashboard +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: kubernetes-dashboard + namespace: {{ system_namespace }} +{% endif %} +--- +kind: Deployment +apiVersion: extensions/v1beta1 +metadata: + labels: + k8s-app: kubernetes-dashboard + name: kubernetes-dashboard + namespace: {{ system_namespace }} +spec: + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + k8s-app: kubernetes-dashboard + template: + metadata: + labels: + k8s-app: kubernetes-dashboard + spec: + containers: + - name: kubernetes-dashboard + image: {{ dashboard_image_repo }}:{{ dashboard_image_tag }} + # Image is tagged and updated with :head, so always pull it. + imagePullPolicy: Always + resources: + limits: + cpu: {{ dashboard_cpu_limit }} + memory: {{ dashboard_memory_limit }} + requests: + cpu: {{ dashboard_cpu_requests }} + memory: {{ dashboard_memory_requests }} + ports: + - containerPort: 9090 + protocol: TCP + args: + # Uncomment the following line to manually specify Kubernetes API server Host + # If not specified, Dashboard will attempt to auto discover the API server and connect + # to it. Uncomment only if the default does not work. + # - --apiserver-host=http://my-address:port + livenessProbe: + httpGet: + path: / + port: 9090 + initialDelaySeconds: 30 + timeoutSeconds: 30 +{% if rbac_enabled %} + serviceAccountName: kubernetes-dashboard +{% endif %} + # Comment the following tolerations if Dashboard must not be deployed on master + tolerations: + - key: node-role.kubernetes.io/master + effect: NoSchedule +--- +kind: Service +apiVersion: v1 +metadata: + labels: + k8s-app: kubernetes-dashboard + name: kubernetes-dashboard + namespace: {{ system_namespace }} +spec: + ports: + - port: 80 + targetPort: 9090 + selector: + k8s-app: kubernetes-dashboard +